dsh-tower 2.5.0 → 2.7.0

package/app/tower.js

@@ -8,6 +8,7 @@ import { assertPorts } from '../ports/index.js'
 import { validateCreate as validateBatchCreate, validateClose as validateBatchClose, summarize as summarizeBatch } from '../domain/batch.js'
 
 import { rebaseWaived } from '../domain/gate.js'
+import { isReviewExempt } from '../domain/integration/review.js'
 import { DEFAULT_MERGE_TIMEOUT_MS, gitLockTimeoutMs } from '../domain/lockBudget.js'
 export { ROSTER_INACTIVE_STATES } from '../domain/roster.js'
 
@@ -27,6 +28,7 @@ import { writeBoard, boardFile } from './board.js'
 import { archiveIndex, archivedMission } from './archive.js'
 import { recordSpawnOutcome, recordInterrupt, reserveRoster, recordSpawn, rosterView } from './spawn.js'
 import { recordTestRun, recordLegacySnapshot, recordLegacyMap } from './recording.js'
+import { resolveLegacySurveyRead } from './sharedCheckout.js'
 
 export const ROLES = ['worker', 'reviewer']
 const MAX_REVIEW_ROUNDS = 5
@@ -98,6 +100,7 @@ import { rebase } from './rebase.js'
 import { merge } from './merge.js'
 import { init } from './init.js'
 import { provision } from './provision.js'
+import { provisionReviewCheckout } from './reviewCheckout.js'
 import { addFinding, readFindings, findings } from './findings.js'
 import { recordMessage, recordDelivery, inbox } from './messages.js'
 import { createBatch, closeBatch, abandonBatch, batchStatus } from './batch.js'
@@ -169,6 +172,20 @@ export class Tower {
     return (await this.git(cwd, ['rev-parse', ref])).trim()
   }
 
+  /**
+   * The commit a mission branch points at, resolved from the branch ref. Never
+   * reads a live worktree checkout: a checkout is a view, the ref is the fact
+   * (#149 W3 review evidence and every tip comparison use this).
+   * @param {{ id?: string, worktree?: { branch?: string } | null }} mission
+   */
+  async branchTip(mission) {
+    const branch = mission?.worktree?.branch
+    if (typeof branch !== 'string' || branch.length === 0) {
+      fail(`mission ${mission?.id ?? ''} has no branch to resolve`.replace('  ', ' '), 'invalid-argument')
+    }
+    return this.revParse(this.root, `refs/heads/${branch}`)
+  }
+
   async isClean(cwd) {
     return (await this.git(cwd, ['status', '--porcelain'])).trim().length === 0
   }
@@ -192,6 +209,9 @@ export class Tower {
       paths: this.paths,
       now: this.deps.clock?.now ? this.deps.clock.now() : Date.now(),
       persist: options.persist,
+      // A legacy survey planned but never provisioned recorded no base; the
+      // loader resolves it once, from this checkout, before the pure migration.
+      resolveLegacySurvey: (rawState) => resolveLegacySurveyRead(this, rawState),
     })
     this.stateLoad = { ...loaded.version, migration: loaded.migration }
     return loaded.state
@@ -278,6 +298,15 @@ export class Tower {
     return provision(this, input)
   }
 
+  /**
+   * Provision the disposable detached review checkout for a reviewer (#149 W3).
+   * The commit it returns is the reviewer's evidence for every later read and
+   * the verdict stamp.
+   */
+  async provisionReviewCheckout(input = {}) {
+    return provisionReviewCheckout(this, input)
+  }
+
   async missionContext(missionId) {
     return missionContext(this, missionId)
   }
@@ -508,11 +537,10 @@ export class Tower {
     if (!mission.worktree) return null
     const branch = mission.worktree.branch
     const reviews = (state.reviews ?? []).filter((review) => review.branch === branch)
-    const exempt =
-      this.config.review?.requireReview === false ||
-      (mission.reviewPolicy === 'none' &&
-        this.config.gates?.allowReviewExemption === true &&
-        String(mission.reviewExemptionReason ?? '').trim().length > 0)
+    // #M39: reconciliation follows the same policy as the gate — only
+    // `review.mode:required` demands review evidence; `off`/`optional` reconcile
+    // a landed branch without one.
+    const exempt = isReviewExempt(mission, this.config)
     if (reviews.length === 0 && !exempt) return null
     const latest = reviews.length > 0 ? reviews.reduce((a, b) => (a.round >= b.round ? a : b)) : null
     if (latest && !exempt && (latest.status !== 'clean' || latest.mergeVerdict !== 'merge')) return null
@@ -521,7 +549,7 @@ export class Tower {
     let branchTip
     try {
       baseTip = await this.revParse(this.root, state.base)
-      branchTip = await this.revParse(mission.worktree.path, 'HEAD')
+      branchTip = await this.branchTip(mission)
     } catch {
       return null
     }

package/client.js

@@ -0,0 +1,321 @@
+// dsh-tower — core Web Client half.
+//
+// The Host half of the bundle declares the profile config schema; this module
+// adds the one editable control the Plugins page needs: a section in the
+// `plugins.bundle.config` keyed slot for the `dsh-tower` bundle. The section is
+// a single three-option radio group (off / optional / required) rendered from
+// the Host-owned settings form. There is deliberately no component row for the
+// review policy: rows are on/off capabilities, while the policy is one value
+// with three states.
+//
+// Saving goes through `ctx.configForms.get('tower-host')` (the Host entry id in
+// cordis.patch.yml). One `mutate([...])` call writes both review keys:
+// `review.mode` becomes the selected value and the deprecated scalar alias
+// `review.requireReview` is normalized to `false`, so the stored profile patch
+// can never contain a contradiction. The Host schema marks both keys volatile, so
+// the accepted values are reflected in place without reloading the plugin.
+//
+// The displayed selection is the *resolved* policy, not just `review.mode`: the
+// alias decides when `mode` is absent, exactly like `resolveReviewPolicy` in
+// domain/integration/review.js.
+//
+// No build step, no new dependency, no Host/Client package imports: React comes
+// from the browser module table and theme colors use `--dsw-alias-*` tokens.
+window.__ModuleLoader__.load({
+  id: 'dsh-tower',
+  factory(require) {
+    const React = require('react')
+    const h = React.createElement
+    const NS = 'dsh-tower'
+    const HOST_ENTRY = 'tower-host'
+    const MODES = ['off', 'optional', 'required']
+    const DEFAULT_MODE = 'optional'
+
+    const EN = {
+      'config.title': 'Review policy',
+      'config.intro': 'Choose how Tower treats review for this profile. This choice is saved immediately.',
+      'config.current': 'Current choice: {mode}',
+      'config.loading': 'Loading the saved review policy…',
+      'config.unavailable': 'The review policy cannot be changed here right now. Try again later, or open the Tower host settings.',
+      'config.readonly': 'This review policy is read-only in the current profile.',
+      'config.saving': 'Saving…',
+      'config.saved': 'Saved.',
+      'config.saveFailed': 'The new choice could not be saved; the previous policy is still in effect.',
+      'config.off.label': 'Off',
+      'config.off.description': 'Review is unavailable: no review can be recorded, and merges never wait for one.',
+      'config.optional.label': 'Optional',
+      'config.optional.description': 'Review is available, but it never blocks a merge.',
+      'config.required.label': 'Required',
+      'config.required.description': 'A clean review at the branch tip blocks merge; the reviewer preset is required.',
+      'config.restartHint':
+        'This profile started with review off, so the merge gate already uses the new choice but the review tool appears only after a restart (or a profile reload).',
+    }
+
+    const ZH = {
+      'config.title': '审查策略',
+      'config.intro': '选择 Tower 为此配置处理审查的方式，选择后会立即保存。',
+      'config.current': '当前选择：{mode}',
+      'config.loading': '正在加载已保存的审查策略…',
+      'config.unavailable': '暂时无法在此修改审查策略，请稍后再试，或打开 Tower 主机设置。',
+      'config.readonly': '当前配置下审查策略为只读。',
+      'config.saving': '正在保存…',
+      'config.saved': '已保存。',
+      'config.saveFailed': '新选择未能保存，仍使用之前的审查策略。',
+      'config.off.label': '关闭',
+      'config.off.description': '审查不可用：无法记录审查，合并也不会等待审查。',
+      'config.optional.label': '可选',
+      'config.optional.description': '审查可用，但不会阻止合并。',
+      'config.required.label': '必需',
+      'config.required.description': '分支末端的干净审查会阻止合并；需要审查代理预设。',
+      'config.restartHint':
+        '此配置启动时审查为关闭状态：合并门禁已使用新的选择，但审查工具需要重启（或重新加载配置）后才会出现。',
+    }
+
+    function fill(text, params) {
+      return String(text ?? '').replace(/\{([A-Za-z0-9_]+)\}/g, (match, key) =>
+        params && params[key] !== undefined ? String(params[key]) : match,
+      )
+    }
+
+    function makeT(props) {
+      const seat = props && typeof props.t === 'function' ? props.t : null
+      return function t(key, params) {
+        if (seat) {
+          try {
+            const value = seat(key, params)
+            if (typeof value === 'string') return value
+          } catch {
+            /* fall back to the bundled English dictionary */
+          }
+        }
+        return fill(EN[key] !== undefined ? EN[key] : key, params)
+      }
+    }
+
+    function readForm(props) {
+      return props && props.form && typeof props.form.getSnapshot === 'function' ? props.form : null
+    }
+
+    function safeSnapshot(form) {
+      if (!form) return null
+      try {
+        return form.getSnapshot() ?? null
+      } catch {
+        return null
+      }
+    }
+
+    // The resolved policy: an explicit `mode` wins; otherwise the deprecated
+    // boolean alias decides (true -> required, false -> optional), like
+    // `resolveReviewPolicy`. Only a literal `true` can raise the mode, which is
+    // also the only value the resolver accepts beside a non-required mode.
+    function currentMode(snapshot) {
+      const review = (snapshot && snapshot.value && snapshot.value.review) || {}
+      if (MODES.includes(review.mode)) return review.mode
+      return review.requireReview === true ? 'required' : DEFAULT_MODE
+    }
+
+    // Both review keys are written together: the selected mode, plus the alias
+    // normalized to `false`. An explicit `false` is required — leaving the key
+    // unset would restore the inherited default, and a stale `true` would
+    // contradict a non-required mode and make `resolveTowerConfig` throw.
+    function reviewOps(mode) {
+      return [
+        { op: 'set', path: ['review', 'mode'], value: mode },
+        { op: 'set', path: ['review', 'requireReview'], value: false },
+      ]
+    }
+
+    function ReviewPolicySection(props) {
+      const t = makeT(props)
+      const form = readForm(props)
+      const [snapshot, setSnapshot] = React.useState(function () {
+        return safeSnapshot(form)
+      })
+      const [pending, setPending] = React.useState(null)
+      const [notice, setNotice] = React.useState(null)
+      // The policy this page first saw. A session whose profile started with
+      // review off never registered the review tool, so switching to
+      // optional/required takes effect at the merge gate immediately but needs a
+      // restart (or profile reload) before the tool exists. The control states
+      // that limitation instead of pretending the tool appeared.
+      const startMode = React.useRef(null)
+
+      React.useEffect(
+        function () {
+          if (!form) return undefined
+          const update = function () {
+            const next = safeSnapshot(form)
+            if (startMode.current === null && next && next.status === 'ready') {
+              startMode.current = currentMode(next)
+            }
+            setSnapshot(next)
+          }
+          update()
+          let unsubscribe
+          try {
+            unsubscribe = form.subscribe(update)
+          } catch {
+            unsubscribe = undefined
+          }
+          return function () {
+            if (typeof unsubscribe === 'function') unsubscribe()
+          }
+        },
+        [form],
+      )
+
+      const status = snapshot && typeof snapshot.status === 'string' ? snapshot.status : 'unavailable'
+      const writable = status === 'ready' && snapshot.writable !== false
+      const selection = currentMode(snapshot)
+      const restartNeeded = notice === 'saved' && startMode.current === 'off' && selection !== 'off'
+
+      function choose(next) {
+        if (!form || !writable || pending || next === selection) return
+        setPending(next)
+        setNotice(null)
+        let result
+        try {
+          result = form.mutate(reviewOps(next), snapshot ? snapshot.revision : undefined)
+        } catch {
+          setPending(null)
+          setNotice('saveFailed')
+          return
+        }
+        Promise.resolve(result).then(
+          function (accepted) {
+            setPending(null)
+            setSnapshot(safeSnapshot(form))
+            setNotice(accepted === false ? 'saveFailed' : 'saved')
+          },
+          function () {
+            setPending(null)
+            setSnapshot(safeSnapshot(form))
+            setNotice('saveFailed')
+          },
+        )
+      }
+
+      const statusText =
+        status === 'loading'
+          ? t('config.loading')
+          : status !== 'ready'
+            ? t('config.unavailable')
+            : snapshot && snapshot.writable === false
+              ? t('config.readonly')
+              : ''
+
+      return h(
+        'section',
+        {
+          'data-dsh-tower-review-policy': '',
+          style: {
+            display: 'grid',
+            gap: '10px',
+            padding: '16px',
+            border: '1px solid var(--dsw-alias-border-l2)',
+            borderRadius: '8px',
+            background: 'var(--dsw-alias-bg-module-platform)',
+          },
+        },
+        h('div', { style: { color: 'var(--dsw-alias-label-primary)', fontWeight: 600 } }, t('config.title')),
+        h('p', { style: { margin: 0, color: 'var(--dsw-alias-label-secondary)', fontSize: '13px' } }, t('config.intro')),
+        h(
+          'div',
+          {
+            role: 'radiogroup',
+            'aria-label': t('config.title'),
+            style: { display: 'grid', gap: '8px' },
+          },
+          MODES.map(function (mode) {
+            const active = selection === mode
+            return h(
+              'label',
+              {
+                key: mode,
+                'data-mode': mode,
+                style: {
+                  display: 'grid',
+                  gridTemplateColumns: 'auto 1fr',
+                  gap: '8px',
+                  alignItems: 'start',
+                  padding: '8px',
+                  borderRadius: '6px',
+                  cursor: writable && !pending ? 'pointer' : 'default',
+                  border: active ? '1px solid var(--dsw-alias-label-primary)' : '1px solid var(--dsw-alias-border-l2)',
+                },
+              },
+              h('input', {
+                type: 'radio',
+                name: 'dsh-tower-review-policy',
+                value: mode,
+                checked: active,
+                disabled: !writable || Boolean(pending),
+                onChange: function () {
+                  choose(mode)
+                },
+              }),
+              h(
+                'span',
+                { style: { display: 'grid', gap: '2px' } },
+                h('span', { style: { color: 'var(--dsw-alias-label-primary)', fontWeight: 500 } }, t(`config.${mode}.label`)),
+                h('span', { style: { color: 'var(--dsw-alias-label-secondary)', fontSize: '13px' } }, t(`config.${mode}.description`)),
+              ),
+            )
+          }),
+        ),
+        statusText
+          ? h('p', { style: { margin: 0, color: 'var(--dsw-alias-label-secondary)', fontSize: '13px' } }, statusText)
+          : null,
+        h(
+          'p',
+          {
+            role: 'status',
+            'aria-live': 'polite',
+            style: { margin: 0, color: 'var(--dsw-alias-label-secondary)', fontSize: '13px', minHeight: '18px' },
+          },
+          pending ? t('config.saving') : notice ? t(`config.${notice}`) : t('config.current', { mode: t(`config.${selection}.label`) }),
+        ),
+        restartNeeded
+          ? h(
+              'p',
+              {
+                'data-dsh-tower-restart-hint': '',
+                style: { margin: 0, color: 'var(--dsw-alias-label-secondary)', fontSize: '13px' },
+              },
+              t('config.restartHint'),
+            )
+          : null,
+      )
+    }
+
+    return {
+      inject: ['slots', 'locale'],
+      async apply(ctx) {
+        ctx.effect(function () {
+          return ctx.locale.register(NS, { en: EN, zh: ZH })
+        }, 'dsh-tower: review policy settings')
+        ctx.slots.inject('plugins.bundle.config', function () {
+          return ctx.slots.register(
+            {
+              name: 'plugins.bundle.config',
+              key: 'dsh-tower',
+              locale: NS,
+              inject: function () {
+                let forms
+                try {
+                  forms = typeof ctx.get === 'function' ? ctx.get('configForms') : undefined
+                } catch {
+                  forms = undefined
+                }
+                const form = forms && typeof forms.get === 'function' ? forms.get(HOST_ENTRY) : undefined
+                return { form }
+              },
+            },
+            ReviewPolicySection,
+          )
+        })
+      },
+    }
+  },
+})

package/cordis.patch.yml

@@ -85,9 +85,11 @@
     - id: tower-hmr
       name: 'dsh-tower/hmr'
       disabled: true
-    # Conditional optional component: off is supported only while
-    # review.requireReview is false; with the gate on planning/mode entry refuse
-    # the combination with an explanatory error.
+    # Optional capability row, usable while the review policy (`review.mode`) is
+    # off or optional. With `review.mode:required`, planning/mode entry refuse this
+    # row being off with an explanatory error. The row is not mutually exclusive
+    # with the policy: the policy is one tri-state control on the plugin page,
+    # not a component row.
     - id: preset-tower-reviewer
       name: 'dsh-tower/preset-reviewer'
       config:
@@ -108,3 +110,53 @@
             name: '@deepseek-ai/dsh-tool-fs-search'
             config:
               sampleOverCapGlobResults: false
+    # #148 D7/W2: one visible survey capability row. The group is the switch:
+    # both the read-only preset and the detached-sandbox preset are nested
+    # dependencies of it, so the sandbox placement is tuning and adds no second
+    # visible component. Off means a survey cannot be planned (tower_plan refuses
+    # with an actionable code) and no survey agent can be dispatched; build
+    # missions are unaffected. Read-only remains structural for the shared
+    # placement (the preset allow-list has no write, edit, or shell tool); the
+    # sandbox preset exists only for `survey.sandbox: 'detached'`.
+    - id: tower-survey
+      name: cordis:group
+      group: true
+      config:
+        - id: preset-tower-survey
+          name: 'dsh-tower/preset-survey'
+          config:
+            id: tower-survey
+            name: Tower Survey
+            description: Read-only inspection of one recorded commit in the shared checkout.
+            order: 62
+            plugins:
+              - id: tower-survey-policy
+                name: 'dsh-tower/survey'
+              - id: tower-survey-fs
+                name: '@deepseek-ai/dsh-tool-fs'
+                config:
+                  write: false
+                  edit: false
+                  readImage: false
+              - id: tower-survey-fs-search
+                name: '@deepseek-ai/dsh-tool-fs-search'
+                config:
+                  sampleOverCapGlobResults: false
+        - id: preset-tower-survey-sandbox
+          name: 'dsh-tower/preset-survey-sandbox'
+          config:
+            id: tower-survey-sandbox
+            name: Tower Survey Sandbox
+            description: Disposable detached checkout for a survey that may write or run commands while reading one recorded commit.
+            order: 63
+            plugins:
+              - id: tower-survey-sandbox-policy
+                name: 'dsh-tower/survey-sandbox'
+              - id: tower-survey-sandbox-fs
+                name: '@deepseek-ai/dsh-tool-fs'
+              - id: tower-survey-sandbox-fs-search
+                name: '@deepseek-ai/dsh-tool-fs-search'
+                config:
+                  sampleOverCapGlobResults: false
+              - id: tower-survey-sandbox-pwsh
+                name: '@deepseek-ai/dsh-tool-pwsh'

package/docs/adr/0005-component-surface.md

@@ -42,14 +42,17 @@ Adopt this shape and record it as principle 11:
   a documented fallback stating what still works while it is off. A capability
   qualifies only when its off state leaves the rest of Tower intact and is not
   worse than uninstalling.
-- **The safety nets are never switches.** The health contract, the recovery
-  escape, the review contract and the merge gates are configuration or code; no
-  group, row or boolean key may gate them. Enforcement covers both routes: a
-  `cordis.patch.yml` row that defaults any key classified `forbidden-to-disable`
-  to `false` is refused, and every `tools.expose*` route in
-  `host/tool-registry.js` must match the `gateableTools` allowlist in the source
-  of truth, so a new route to a review, merge or host tool fails even when that
-  capability lists no tools of its own.
+- **The safety nets are never switches.** The health contract, the recovery escape
+  and the merge gates are configuration or code; no group, row or boolean key may
+  gate them. The review policy is configuration too — one tri-state control
+  (`off`/`optional`/`required`) on the plugin-page form, not a component row and
+  never one row per mode — while the review gate in required mode (clean,
+  tip-bound evidence and the exemption path) is contract and cannot be switched
+  off by a row. Enforcement covers both routes: a `cordis.patch.yml` row that
+  defaults any key classified `forbidden-to-disable` to `false` is refused, and
+  every `tools.expose*` route in `host/tool-registry.js` must match the
+  `gateableTools` allowlist in the source of truth, so a new route to a review,
+  merge or host tool fails even when that capability lists no tools of its own.
 - **Config keys stay on the component axis.** Every config key is classified
   `core`, `optional-component`, `optional-config` or `forbidden-to-disable` in
   `docs/reference/component-surface.md`, generated from the single source of
@@ -80,9 +83,10 @@ The one `tower-bundle` group is gone. `cordis.patch.yml` now ships the mandatory
 `tower` host anchor (the Host plugin and the worker preset are its internal
 sections) plus the individually switchable top-level rows `tower-skills`,
 `tower-batch`, `tower-import`, `tower-leases`, `tower-tests`, `tower-hmr`
-(shipped off) and `preset-tower-reviewer` (conditional on
-`review.requireReview`). The visible component count moved 1 → 8 and is recorded
-as a dated decision in `scripts/surface-baseline.json`.
+(shipped off) and `preset-tower-reviewer` (conditional on the review policy;
+today the reviewer row may be off unless `review.mode` is `required`). The
+visible component count moved 1 → 8 and is recorded as a dated decision in
+`scripts/surface-baseline.json`.
 
 The capability switches became rows: the seven `tools.expose*` keys and
 `dev.hotReload` were deleted from the schema and are now rejected as unknown
@@ -235,8 +239,9 @@ keys, 11 visible components.
 - Decisions: #137
 
 Wave 3 made the gate fail closed, but every label it admitted still passed. The
-plugin page leaked config keys (`gates.requireTests:true`, `review.requireReview`)
-and bare tool ids (`tower_batch`, `tower_resource`) into the off-state copy, the
+plugin page leaked config keys (`gates.requireTests:true`, the deprecated
+`review.requireReview` alias) and bare tool ids (`tower_batch`, `tower_resource`)
+into the off-state copy, the
 Chinese copy mixed 咨询式租约 / 重型工作 / untranslated `mission` and `preset`, and
 the Web UI used 任务线 while the plugin page left `mission` in English. The counts
 do not move: 53 config keys, 13 components, 11 visible.
@@ -294,3 +299,43 @@ do not move: 53 config keys, 13 components, 11 visible.
   `scripts/component-surface.json` and the generated
   `docs/reference/component-surface.md` is an operator reference for auditors, not
   a plugin-page label. It may name keys and tools; the locale fields may not.
+
+## Addendum (wave 5): the review policy is a tri-state control, not a component row
+
+- Date: 2026-11-01
+- Decisions: #M39, #M40, #M42
+
+Waves 1–4 listed "the review contract" among the things that are never switches.
+That wording was honest while review was a bare boolean, but it became wrong when
+#M39 made the policy a three-value mode and #M40 put one control for it on the
+plugin page. Wave 5 states the actual contract:
+
+- **`review.mode` is the policy, not a capability row.** It has exactly three
+  values — `off`, `optional` (the default) and `required` — and the plugin-pages
+  control is one tri-state radio group on the `dsh-tower` configuration form.
+  There is no review-policy component row, and there are no three mutually
+  exclusive rows. `off` is supported and documented: `tower_review` is not
+  registered, reviewer spawn is refused, and the merge gate ignores review.
+  `optional` keeps `tower_review` and never blocks a merge. `required` keeps the
+  merge gate: a completed mission needs a clean review bound to the branch tip,
+  with the existing exemption path.
+- **`review.requireReview` is a deprecated one-release alias.** It is classified
+  `core` (not `forbidden-to-disable`) because it is policy configuration and a
+  compatibility alias, not a switch a row may own. `true` resolves to `required`,
+  `false` to `optional`, and leaving it unset means `optional`. `true` next to an
+  explicit non-required mode is rejected; `false` never overrides an explicit
+  mode. The alias is removed after the 2.6 window.
+- **What stays non-disableable is the gate in `required` mode.** The merge gate's
+  review evidence and tip binding, and the exemption path, may not be removed by
+  any group, row or boolean. The reviewer preset row stays an optional
+  capability: it may be off while the policy is `off` or `optional`, and under
+  `required` planning and mode entry refuse that combination with an explanation.
+  It is not a mutually exclusive row — the policy is not a row at all.
+- **The gate enforces the shape.** A review-policy-shaped component row, a
+  component `allowedOverrides` or shipped row `config:` that names `review.mode`
+  (or the alias), a missing required-mode gate record, or a forbidden capability
+  that lists `preset-tower-reviewer` all fail
+  `npm run docs:check:components`.
+- **Counts do not move.** 54 config keys, 11 visible components; only the class of
+  one deprecated key changes. The source of truth carries the decision date
+  (`2026-11-01`) and this addendum is its written decision.