dsh-tower 2.6.0 → 2.7.0

package/host/preset-survey.js

@@ -0,0 +1,18 @@
+// Tower survey preset declaration (#148 D7): the read-only survey preset's own
+// Plugins-page label. This is the survey twin of `host/preset-worker.js`: the row
+// config stays in `cordis.patch.yml` and this module forwards it to the injected
+// `agentPresets` service, which owns mount/unmount. A Tower-owned specifier gives
+// the row a distinct locale (`dsh-tower/preset-survey/locale/<lang>.json`).
+export const name = 'dsh-tower/preset-survey'
+
+export const inject = ['agentPresets']
+
+/**
+ * Register the survey preset with the profile's preset registry.
+ * @param {{ agentPresets: { register: (config: any) => Promise<() => Promise<void> | void> } }} ctx
+ * @param {any} config the `cordis.patch.yml` row config (id/name/description/order/plugins)
+ * @returns {Promise<() => Promise<void> | void>} the registry's unregister disposer
+ */
+export async function apply(ctx, config) {
+  return ctx.agentPresets.register(config)
+}

package/host/presets.js

@@ -20,13 +20,18 @@
 // contradiction is refused up front instead.
 import { TowerToolError } from '../domain/errors.js'
 import { reviewRequired } from '../domain/integration/review.js'
+import { ROLES, rolePresetConfig } from '../domain/roles.js'
 import { componentEnabled, disabledReason } from './capability-registry.js'
 
 export function presetIds(config = {}) {
-  return {
-    worker: String(config.spawn?.workerPreset ?? 'tower-worker'),
-    reviewer: String(config.spawn?.reviewerPreset ?? 'tower-reviewer'),
+  const ids = {}
+  const spawn = config.spawn ?? {}
+  for (const role of ROLES) {
+    const spec = rolePresetConfig(role)
+    if (!spec) continue
+    ids[role] = String(spawn[spec.slot] ?? spec.fallback)
   }
+  return ids
 }
 
 function rowId(preset) {

package/host/tool-registry.js

@@ -54,7 +54,7 @@ import { registerFindingsTool } from '../tools/findings.js'
 import { readDiscoveryConfig, normalizeDiscovery, runDiscovery } from '../adapters/tests.js'
 import { summarize as summarizeBatch } from '../domain/batch.js'
 import { assertPorts } from '../ports/index.js'
-import { COMPONENT_TOOLS, componentEnabled, componentReport, holdComponent, disabledReason } from './capability-registry.js'
+import { COMPONENT_TOOLS, componentEnabled, componentReport, holdComponent, disabledReason, presetAvailable, PRESET_ROW_COMPONENTS } from './capability-registry.js'
 import path from 'node:path'
 import { fsp } from '../adapters/store-fs.js'
 import { createDefaultDeps } from '../adapters/default.js'
@@ -511,16 +511,9 @@ async function runMissionDiscovery(tower, mission) {
     diagnosticsDir: path.join(tower.paths.dir, 'test-runs', `${mission.id}-${Date.now()}`),
   })
   const stored = await tower.recordTestRun({ missionId: mission.id, receipt })
-  const commands = Array.isArray(stored.commands) ? stored.commands : []
-  const check = {
-    name: 'tests',
-    command: commands.map((command) => `${command.id}: ${command.command}`).join('; ') || 'tower.testDiscovery',
-    exitCode: commands.every((command) => command.exitCode === 0) ? 0 : (commands.find((command) => command.exitCode !== 0)?.exitCode ?? 1),
-    evidence: stored.ok
-      ? `${stored.tests?.length ?? 0} test(s) passed at ${String(stored.treeTip ?? '').slice(0, 12)}; receipt ${stored.receiptPath ?? stored.diagnosticsPath}`
-      : `test discovery failed: ${String(stored.error ?? 'unknown').slice(0, 300)}`,
-  }
-  return { configured: true, receipt: stored, check }
+  // #149 W4: the recorded receipt is the only evidence shape. Consumers read it
+  // through domain/evidence.js; there is no separate `check` projection.
+  return { configured: true, receipt: stored }
 }
 
 async function observeActivity(ctx, tower) {
@@ -580,6 +573,15 @@ export function registerCoreTowerTools(ctx, options = {}) {
     components: {
       enabled: (id) => componentEnabled(id),
       reason: (id) => disabledReason(id),
+      // Preset rows are declarative and invisible to the code registry, so the
+      // synchronous `enabled` probe cannot answer for them. Callers that gate a
+      // shape read this async probe, which returns null when `agentPresets` is
+      // absent (unknown, not disabled).
+      available: async (id) => {
+        const presetId = PRESET_ROW_COMPONENTS[id]
+        if (presetId) return presetAvailable(ctx, presetId)
+        return componentEnabled(id)
+      },
     },
     events: {
       emit(name, payload) {
@@ -639,7 +641,7 @@ export function registerCoreTowerTools(ctx, options = {}) {
 
   registerInterruptTool(ctx, { openTower, define, actorFor, requireTowerActor, interruptRosterAgent })
 
-  registerDiffTool(ctx, { openTower, define })
+  registerDiffTool(ctx, { openTower, define, actorFor })
 
   registerAdoptTool(ctx, { openTower, define, actorFor, requireTowerActor })
 

package/locale/en.json

@@ -1,7 +1,7 @@
 {
   "meta": {
     "title": "Tower",
-    "description": "Plan and track missions, isolate each one in its own worktree, hand the work to worker and reviewer agents, and merge after review when review before merging is required. Off equals uninstalling Tower: no tools, presets or skills remain."
+    "description": "Plan and track missions, isolate each one in its own worktree, hand the work to worker and reviewer agents, and merge after review when review before merging is required. Off equals uninstalling Tower: no tools, presets or skills remain. Turning off the survey capability removes both survey presets: surveys cannot be planned (planning one is refused with an actionable code) and no survey agent can be dispatched. Build missions and every other capability keep working."
   },
   "components": {
     "tower": {
@@ -59,6 +59,21 @@
       "summary": "The independent Tower Reviewer preset: a read-only reviewer agent that reads the mission diff, checks scope and acceptance, and returns a verdict. Usable while review before merging is optional; a precondition for merging once review before merging is required.",
       "disables": "The reviewer cannot be started. That is supported while review before merging is optional; once review before merging is required, planning and entering Tower mode are refused with an explanation."
     },
+    "tower-survey": {
+      "title": "Tower Survey",
+      "summary": "Inspect one recorded commit either read-only in the shared checkout or in a disposable detached sandbox that may write and run commands inside it. A survey has no branch, no commit of its own, and never merges; the sandbox is removed when the survey completes.",
+      "disables": "Turning off the survey capability removes both survey presets: surveys cannot be planned (planning one is refused with an actionable code) and no survey agent can be dispatched. Build missions and every other capability keep working."
+    },
+    "preset-tower-survey": {
+      "title": "Tower Survey preset",
+      "summary": "The shared-checkout survey dependency: read, glob, grep, skill, and the Tower mission/status/finding/inbox/complete tools, with no write, edit, or shell tool.",
+      "disables": "A shared survey cannot be dispatched; build missions and every other capability keep working."
+    },
+    "preset-tower-survey-sandbox": {
+      "title": "Tower Survey Sandbox preset",
+      "summary": "The detached-survey dependency: a disposable sandbox that may write and run commands inside its checkout while reading one recorded commit, with no branch and no commit of its own.",
+      "disables": "A detached survey cannot be dispatched; shared surveys and build missions keep working."
+    },
     "tower-ui": {
       "title": "Tower UI",
       "summary": "Adds Tower cards for tool results, a compact status summary above the message box, and a short status strip, in the web client.",

package/locale/preset-survey/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Tower Survey preset",
+    "description": "The shared-checkout survey dependency: read, glob, grep, skill, and the Tower mission/status/finding/inbox/complete tools, with no write, edit, or shell tool. Mandatory dependency, not a switch: A shared survey cannot be dispatched; build missions and every other capability keep working."
+  }
+}

package/locale/preset-survey/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Tower Survey 预设",
+    "description": "共享检出勘察的依赖项：read、glob、grep、skill，以及 Tower 的任务线、状态、发现、收件箱与完成工具，不包含写入、编辑或命令行工具。强制依赖，不是开关：无法派发共享检出勘察；普通构建任务线与其他能力继续工作。"
+  }
+}

package/locale/preset-survey-sandbox/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Tower Survey Sandbox preset",
+    "description": "The detached-survey dependency: a disposable sandbox that may write and run commands inside its checkout while reading one recorded commit, with no branch and no commit of its own. Mandatory dependency, not a switch: A detached survey cannot be dispatched; shared surveys and build missions keep working."
+  }
+}

package/locale/preset-survey-sandbox/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Tower Survey Sandbox 预设",
+    "description": "分离勘察的依赖项：一个一次性沙箱，可在读取一个已记录提交时于检出中写入并运行命令，没有分支，也没有自己的提交。强制依赖，不是开关：无法派发分离勘察；共享检出勘察与普通构建任务线继续工作。"
+  }
+}

package/locale/zh.json

@@ -1,7 +1,7 @@
 {
   "meta": {
     "title": "Tower",
-    "description": "规划并跟踪任务线，让每条任务线在独立工作树中完成，交给执行代理与审查代理，并且在把合并前审查设为必须时，审查通过后再合并。关闭这一项等同于卸载 Tower：不再保留任何工具、预设或技能。"
+    "description": "规划并跟踪任务线，让每条任务线在独立工作树中完成，交给执行代理与审查代理，并且在把合并前审查设为必须时，审查通过后再合并。关闭这一项等同于卸载 Tower：不再保留任何工具、预设或技能。关闭勘察能力会移除两个勘察预设：无法规划勘察任务（规划勘察会被可操作的错误码拒绝），也无法派发勘察代理。普通构建任务线与其他能力继续工作。"
   },
   "components": {
     "tower": {
@@ -59,6 +59,21 @@
       "summary": "独立的 Tower Reviewer 审查代理预设：一个只读代理，阅读任务线差异、核对范围与验收，并给出结论。在合并前审查仍为可选时可以使用；一旦把合并前审查设为必须，它就是合并的前置条件。",
       "disables": "无法启动审查代理。在合并前审查仍为可选时，允许关闭这一项；一旦要求合并前必须审查，规划或进入 Tower 模式会被拒绝并给出解释。"
     },
+    "tower-survey": {
+      "title": "Tower 勘察",
+      "summary": "勘察一个已记录的提交：可在共享检出中只读查看，也可在一次性分离沙箱中写入并运行命令。勘察没有分支、没有自己的提交，也从不合并；勘察完成时沙箱会被移除。",
+      "disables": "关闭勘察能力会移除两个勘察预设：无法规划勘察任务（规划勘察会被可操作的错误码拒绝），也无法派发勘察代理。普通构建任务线与其他能力继续工作。"
+    },
+    "preset-tower-survey": {
+      "title": "Tower Survey 预设",
+      "summary": "共享检出勘察的依赖项：read、glob、grep、skill，以及 Tower 的任务线、状态、发现、收件箱与完成工具，不包含写入、编辑或命令行工具。",
+      "disables": "无法派发共享检出勘察；普通构建任务线与其他能力继续工作。"
+    },
+    "preset-tower-survey-sandbox": {
+      "title": "Tower Survey Sandbox 预设",
+      "summary": "分离勘察的依赖项：一个一次性沙箱，可在读取一个已记录提交时于检出中写入并运行命令，没有分支，也没有自己的提交。",
+      "disables": "无法派发分离勘察；共享检出勘察与普通构建任务线继续工作。"
+    },
     "tower-ui": {
       "title": "Tower 界面",
       "summary": "在 Web 客户端中显示 Tower 工具结果卡片、输入框上方的简要状态摘要，以及简短的状态提示条。",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-tower",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "type": "module",
   "description": "DSH-native Tower: mission planning, worktree isolation, review-gated merges, and a human-owned Tower mode.",
   "license": "MIT",
@@ -31,6 +31,8 @@
     "./client": "./client.js",
     "./worker": "./worker.js",
     "./reviewer": "./reviewer.js",
+    "./survey": "./survey.js",
+    "./survey-sandbox": "./survey-sandbox.js",
     "./skills": "./skills.js",
     "./batch": "./host/capability-batch.js",
     "./import": "./host/capability-import.js",
@@ -41,6 +43,8 @@
     "./hmr": "./host/capability-hmr.js",
     "./preset-worker": "./host/preset-worker.js",
     "./preset-reviewer": "./host/preset-reviewer.js",
+    "./preset-survey": "./host/preset-survey.js",
+    "./preset-survey-sandbox": "./host/preset-survey-sandbox.js",
     "./skills/locale/*.json": "./locale/skills/*.json",
     "./batch/locale/*.json": "./locale/batch/*.json",
     "./import/locale/*.json": "./locale/import/*.json",
@@ -51,6 +55,8 @@
     "./hmr/locale/*.json": "./locale/hmr/*.json",
     "./preset-worker/locale/*.json": "./locale/preset-worker/*.json",
     "./preset-reviewer/locale/*.json": "./locale/preset-reviewer/*.json",
+    "./preset-survey/locale/*.json": "./locale/preset-survey/*.json",
+    "./preset-survey-sandbox/locale/*.json": "./locale/preset-survey-sandbox/*.json",
     "./locale/*.json": "./locale/*.json",
     "./icon": "./icon.svg",
     "./package.json": "./package.json"
@@ -60,6 +66,8 @@
     "index.js",
     "worker.js",
     "reviewer.js",
+    "survey.js",
+    "survey-sandbox.js",
     "skills.js",
     "skills/",
     "host/*.js",
@@ -125,6 +133,9 @@
     "docs:check:generated:components": "node scripts/generate-component-surface.mjs --check",
     "docs:generate:locale": "node scripts/generate-capability-locale.mjs",
     "docs:check:generated:locale": "node scripts/generate-capability-locale.mjs --check",
+    "docs:generate:shapes": "node scripts/generate-shapes-reference.mjs",
+    "docs:check:generated:shapes": "node scripts/generate-shapes-reference.mjs --check",
+    "shape:audit": "node scripts/shape-audit.mjs",
     "docs:check:components": "node scripts/check-components.mjs",
     "pack:check": "node scripts/check-pack.mjs",
     "architecture:check": "node scripts/architecture.mjs",
@@ -132,7 +143,7 @@
     "types:coverage": "node scripts/types-coverage.mjs",
     "types:strict:check": "node scripts/types-strict.mjs",
     "types:strict:write": "node scripts/types-strict.mjs --write",
-    "check": "npm test && npm run test:property && npm run docs:check && npm run docs:check:philosophy && npm run docs:check:generated && npm run docs:check:generated:tools && npm run docs:check:generated:config && npm run docs:check:generated:events && npm run docs:check:generated:types && npm run docs:check:generated:components && npm run docs:check:generated:locale && npm run docs:check:components && npm run surface:check && npm run pack:check && npm run architecture:check && npm run types:coverage && npm run types:strict:check && npm run types:check && npm run domain:check",
+    "check": "npm test && npm run test:property && npm run docs:check && npm run docs:check:philosophy && npm run docs:check:generated && npm run docs:check:generated:tools && npm run docs:check:generated:config && npm run docs:check:generated:events && npm run docs:check:generated:types && npm run docs:check:generated:components && npm run docs:check:generated:locale && npm run docs:check:generated:shapes && npm run shape:audit && npm run docs:check:components && npm run surface:check && npm run pack:check && npm run architecture:check && npm run types:coverage && npm run types:strict:check && npm run types:check && npm run domain:check",
     "domain:metrics": "node scripts/domain-metrics.mjs",
     "domain:check": "node scripts/domain-metrics.mjs --check"
   },

package/ports/state.js

@@ -5,7 +5,14 @@ import { assertPort, definePort } from './contract.js'
 
 /**
  * @typedef {object} StatePort
- * @property {(input: { store: unknown, paths: unknown, now?: number, persist?: boolean, migrations?: readonly unknown[] }) => Promise<any>} loadStateFile
+ * @property {(input: {
+ *   store: unknown,
+ *   paths: unknown,
+ *   now?: number,
+ *   persist?: boolean,
+ *   migrations?: readonly unknown[],
+ *   resolveLegacySurvey?: (rawState: Record<string, any>) => Promise<{ readCommit: string, readDirty: string[] } | null>,
+ * }) => Promise<any>} loadStateFile
  */
 
 export const STATE_PORT = definePort('StatePort', ['loadStateFile'])

package/scripts/architecture-waivers.json

@@ -1,7 +1,6 @@
 {
   "$comment": "Justified architecture-gate exemptions (#80). Every entry needs rule, path, reason, and owner or ref. Scripts/architecture.mjs fails with waiver-contract when an entry is not justified. domain-pure, host-scope and no-lib-from-core cannot be waived at all, and domain/** accepts no waiver. Since #70 the retired lib/ layer has no waivers: host/** owns ambient state by rule, and only the two I/O adapters below are exempt.",
-  "waivers": [
-    {
+  "waivers": [    {
       "rule": "child-process-surface",
       "path": "adapters/vcs-git.js",
       "reason": "The git adapter is the single process-spawning boundary; no other module implements VcsPort with a child process.",
@@ -15,5 +14,6 @@
       "owner": "louifinn",
       "ref": "#50"
     }
-  ]
+  ],
+  "shapeWaivers": []
 }

package/scripts/check-docs.mjs

@@ -34,10 +34,10 @@ for (const code of [
   'blockers-present',
   'branch-missing',
   'stale-base',
-  'read-only-survey',
   'out-of-scope',
   'base-dirty',
   'deps-unmerged',
+  'survey-stale',
   'no-review',
   'review-mission-mismatch',
   'not-clean',

package/scripts/check-pack.mjs

@@ -28,6 +28,8 @@ const REQUIRED_FILES = [
   ...presetLocalePaths(),
   'host/preset-worker.js',
   'host/preset-reviewer.js',
+  'host/preset-survey.js',
+  'survey.js',
   'ui-bundle/index.js',
   'ui-bundle/package.json',
   'ui-bundle/cordis.patch.yml',

package/scripts/component-surface.json

@@ -90,6 +90,24 @@
       "kind": "row",
       "fallback": "Declared by dsh-tower/preset-reviewer: the reviewer cannot be dispatched. Supported while review.mode is off or optional (merge is unaffected; off does not use the preset at all); with review.mode required, planning/mode entry is locked with an explanatory error."
     },
+    {
+      "id": "tower-survey",
+      "scope": "visible",
+      "kind": "group",
+      "fallback": "Declared by the tower-survey group: surveys cannot be planned (planning one is refused with an actionable code) and no survey agent is dispatched, because both the read-only and the sandbox preset are nested dependencies of this row. Build missions and every existing capability are unaffected. survey.sandbox stays tuning: it chooses shared vs detached placement, never whether surveys exist."
+    },
+    {
+      "id": "preset-tower-survey",
+      "scope": "internal",
+      "kind": "row",
+      "fallback": "Declared by dsh-tower/preset-survey: the shared-checkout survey preset is a dependency of the tower-survey group, never its own switch. With the group off, a shared survey cannot be dispatched."
+    },
+    {
+      "id": "preset-tower-survey-sandbox",
+      "scope": "internal",
+      "kind": "row",
+      "fallback": "Declared by dsh-tower/preset-survey-sandbox: the detached-sandbox survey preset is a dependency of the tower-survey group, never its own switch. It is selected only when survey.sandbox is detached; with the group off, a detached survey cannot be dispatched."
+    },
     {
       "id": "tower-ui",
       "scope": "visible",
@@ -287,6 +305,16 @@
       "class": "optional-config",
       "note": "Optional independent model route for reviewers."
     },
+    {
+      "name": "spawn.surveyModel",
+      "class": "optional-config",
+      "note": "Optional model route for survey workers."
+    },
+    {
+      "name": "survey.sandbox",
+      "class": "optional-config",
+      "note": "Tuning, not a capability: shared (read-only in the shared checkout) or detached (a disposable detached sandbox that may write and run commands). The tower-survey row is still the switch."
+    },
     {
       "name": "spawn.maxLiveWorkers",
       "class": "core",
@@ -350,17 +378,6 @@
       "class": "optional-config",
       "note": "Captured discovery output cap."
     },
-    {
-      "name": "tests.autoChecks",
-      "class": "optional-config",
-      "note": "Attaches a tests check to completion when discovery runs.",
-      "exemption": {
-        "date": "2026-11-03",
-        "ref": "docs/adr/0005-component-surface.md",
-        "issue": "#138",
-        "reason": "Tuning the default receipt policy inside the optional tower-tests row, which still owns whether any test tooling exists."
-      }
-    },
     {
       "name": "tests.allowPackageDiscovery",
       "class": "core",
@@ -381,6 +398,11 @@
       "class": "forbidden-to-disable",
       "note": "The review-exemption path is part of the review and merge contract."
     },
+    {
+      "name": "gates.requireFreshSurvey",
+      "class": "forbidden-to-disable",
+      "note": "Promotes the survey-stale dependency warning to a merge blocker; the gate itself is part of the merge contract and defaults to advisory."
+    },
     {
       "name": "gates.maxReportBytes",
       "class": "forbidden-to-disable",
@@ -423,21 +445,31 @@
       "capability": "the Tower host",
       "reason": "Without the host the plugin registers nothing; there is no off state that leaves the rest working, and no config boolean may remove it. The visible `tower` anchor is the all-off boundary, and the host section nested under it may never become its own switch.",
       "tools": [],
-      "rowIds": ["tower-host"]
+      "rowIds": [
+        "tower-host"
+      ]
     },
     {
       "id": "health",
       "capability": "tower_doctor (read-only health contract)",
       "reason": "Diagnosis must always exist so a failure message can point at it. #122 removed exposeDoctor and the exposeOperational master switch; the tool is registered for every configuration.",
-      "tools": ["tower_doctor"],
-      "rowIds": ["tower-doctor"]
+      "tools": [
+        "tower_doctor"
+      ],
+      "rowIds": [
+        "tower-doctor"
+      ]
     },
     {
       "id": "recovery",
       "capability": "tower_recover (stale state-lock escape)",
       "reason": "The escape hatch must exist whenever the lock it repairs can be left behind. #122 removed exposeRecovery and the exposeOperational master switch; the tool is registered for every configuration.",
-      "tools": ["tower_recover"],
-      "rowIds": ["tower-recover"]
+      "tools": [
+        "tower_recover"
+      ],
+      "rowIds": [
+        "tower-recover"
+      ]
     },
     {
       "id": "review",
@@ -445,15 +477,31 @@
       "reason": "The policy is one tri-state configuration control on the plugin-page form, not a component row: review.mode is off, optional (default) or required, and off is a documented mode that removes tower_review and makes the merge gate ignore review. What no group, row or boolean key may switch off is the gate once the mode is required: a completed mission still needs a clean review bound to the branch tip, and the exemption path stays explicit. review.requireReview is a deprecated one-release alias, not a switch. The reviewer preset row remains a capability the policy may leave unused, never a way to weaken required mode.",
       "tools": [],
       "rowIds": [],
-      "gatedBy": ["review.mode", "review.maxRoundsPerReviewer", "gates.allowReviewExemption"]
+      "gatedBy": [
+        "review.mode",
+        "review.maxRoundsPerReviewer",
+        "gates.allowReviewExemption"
+      ]
     },
     {
       "id": "merge-gates",
       "capability": "the merge gates",
       "reason": "gates.* decides delivery; a component may not bypass it.",
-      "tools": ["tower_complete", "tower_merge"],
-      "rowIds": ["tower-gates", "tower-merge-gates"],
-      "gatedBy": ["gates.requireChecks", "gates.requireTests", "gates.allowReviewExemption", "gates.maxReportBytes"]
+      "tools": [
+        "tower_complete",
+        "tower_merge"
+      ],
+      "rowIds": [
+        "tower-gates",
+        "tower-merge-gates"
+      ],
+      "gatedBy": [
+        "gates.requireChecks",
+        "gates.requireTests",
+        "gates.allowReviewExemption",
+        "gates.requireFreshSurvey",
+        "gates.maxReportBytes"
+      ]
     }
   ]
 }

package/scripts/generate-capability-locale.mjs

@@ -63,6 +63,11 @@ export const CAPABILITY_LOCALES = [
 export const PRESET_LOCALES = [
   { specifier: 'preset-worker', component: 'preset-tower-worker', mandatory: true },
   { specifier: 'preset-reviewer', component: 'preset-tower-reviewer', mandatory: false },
+  // #148 W2: the survey capability row is a group; its two preset children are
+  // internal dependencies (never individual switches), so both are labelled with
+  // the mandatory-dependency marker.
+  { specifier: 'preset-survey', component: 'preset-tower-survey', mandatory: true },
+  { specifier: 'preset-survey-sandbox', component: 'preset-tower-survey-sandbox', mandatory: true },
 ]
 
 /** Every row that ships a generated subpath locale resource. */