dsh-tower 2.1.0 → 2.3.0

package/tools/recover.js

@@ -1,31 +1,39 @@
 // tower_recover: explicit stale state-lock diagnostics/repair.
-import { Tower } from '../app/tower.js'
-import { readStateLock } from '../lib/store.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { TowerToolError } from '../domain/errors.js'
-import { fsp } from '../adapters/store-fs.js'
 import { RecoverInput } from '../domain/contracts/tool-inputs/index.js'
 import { RECOVERY_ACTION, RECOVERY_CONFIRM, ROLE } from '../domain/vocabulary.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireTowerActor: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireTowerActor: any, readStateLock: any, lockTiming: any }} deps
  */
 export function registerRecoverTool(ctx, deps) {
-  const { define, actorFor, requireTowerActor } = deps
+  const { define, actorFor, requireTowerActor, readStateLock, lockTiming } = deps
   define(ctx, {
     name: 'tower_recover',
     description:
-      'Read-only recovery diagnostics and an explicit stale-state-lock repair. status reports the state lock owner; clear-stale-lock requires confirm:"CLEAR_STALE_LOCK" and only moves a lock whose PID is provably dead to a backup file. It never resets Tower state or worktrees.',
+      'Read-only recovery diagnostics and an explicit stale-state-lock repair. status reports the state lock owner with its age, heartbeat age and staleness; clear-stale-lock requires confirm:"CLEAR_STALE_LOCK" and only moves a lock whose PID is provably dead to a backup file. force:true additionally clears a live-but-silent PID (a recycled PID) and still renames the record to a .recovered-<ts> backup. It never resets Tower state or worktrees.',
     parameters: RecoverInput,
     output: output(SCHEMAS.recover),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       requireTowerActor(actor, 'recover Tower state')
-      const lock = await readStateLock(tower.paths)
+      const now = Date.now()
+      const lock = await readStateLock(tower.paths, { now })
+      const timing = lockTiming(lock.record, { now })
       const publicLock = lock.record
-        ? { pid: lock.record.pid ?? null, startedAt: lock.record.startedAt ?? null, at: lock.record.at ?? null, alive: lock.alive }
+        ? {
+            pid: lock.record.pid ?? null,
+            startedAt: lock.record.startedAt ?? null,
+            at: lock.record.at ?? null,
+            alive: lock.alive,
+            ageMs: timing.ageMs,
+            heartbeatAgeMs: timing.heartbeatAgeMs,
+            staleAfterMs: timing.staleAfterMs,
+            stale: timing.stale,
+          }
         : null
       if (args.action === RECOVERY_ACTION.status) {
         return { ok: true, action: RECOVERY_ACTION.status, stateLock: publicLock, cleared: false }
@@ -34,12 +42,29 @@ export function registerRecoverTool(ctx, deps) {
         throw new TowerToolError('invalid-argument', 'clear-stale-lock requires confirm:"CLEAR_STALE_LOCK"')
       }
       if (!lock.record) return { ok: true, action: RECOVERY_ACTION.clearStaleLock, stateLock: null, cleared: false }
-      if (lock.alive !== false) {
-        throw new TowerToolError('state-locked', `state lock pid ${lock.record.pid ?? ROLE.unknown} is still alive; refusing to clear it`)
+      const forced = args.force === true
+      if (lock.alive !== false && !forced) {
+        // A live PID is not proof of a live writer (#92): report the heartbeat
+        // and require the explicit force opt-in before moving the record.
+        throw new TowerToolError(
+          'state-locked',
+          `state lock pid ${lock.record.pid ?? ROLE.unknown} is still alive (last heartbeat ${timing.heartbeatAgeMs ?? 'unknown'}ms ago, stale after ${timing.staleAfterMs}ms); pass force:true with confirm:"CLEAR_STALE_LOCK" to move it to a backup after confirming no writer is active`,
+        )
       }
+      // Always rename, never unlink: the recovered bytes stay auditable. Use the
+      // plain port primitive, not `renameWithRetry`: the retrying helper has
+      // temp-file semantics and unlinks its source when the rename finally
+      // fails, which would destroy the record we are trying to preserve.
       const backup = `${tower.paths.lock}.recovered-${Date.now()}`
-      await fsp.rename(tower.paths.lock, backup)
-      return { ok: true, action: RECOVERY_ACTION.clearStaleLock, stateLock: publicLock, cleared: true, backup }
+      await tower.deps.store.rename(tower.paths.lock, backup)
+      return {
+        ok: true,
+        action: RECOVERY_ACTION.clearStaleLock,
+        stateLock: publicLock,
+        cleared: true,
+        backup,
+        forced,
+      }
     },
   })
 }

package/tools/reload.js

@@ -1,17 +1,14 @@
 // tower_reload: dev-only HMR reload request.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { TowerToolError } from '../domain/errors.js'
-import { runtimeConfig } from '../lib/config.js'
-import { createHmrBridge } from '../lib/hmr.js'
 import { ReloadInput } from '../domain/contracts/tool-inputs/index.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireTowerActor: any, sharedHmrBridge: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireTowerActor: any, sharedHmrBridge: any, runtimeConfig: any, createHmrBridge: any }} deps
  */
 export function registerReloadTool(ctx, deps) {
-  const { define, actorFor, requireTowerActor, sharedHmrBridge } = deps
+  const { define, actorFor, requireTowerActor, sharedHmrBridge, runtimeConfig, createHmrBridge } = deps
   // Dev-only hot reload. The tool is registered whenever dev.hotReload is on;
   // it reports reload-unavailable when the profile has no HMR service. When the
   // Host passed a shared bridge, its status() reflects the command's reloads too.
@@ -32,7 +29,7 @@ export function registerReloadTool(ctx, deps) {
       output: output(SCHEMAS.reload),
       async execute(args, exec) {
         if (typeof args.repoRoot === 'string') {
-          const tower = await Tower.open(args.repoRoot)
+          const tower = await deps.openTower(args.repoRoot)
           const actor = await actorFor(tower, exec)
           requireTowerActor(actor, 'reload the Tower plugin')
         }

package/tools/resource.js

@@ -1,17 +1,15 @@
 // tower_resource: advisory resource leases.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { TowerToolError } from '../domain/errors.js'
-import { acquireLease, releaseLease, inspectLeases } from '../lib/leases.js'
 import { ResourceInput } from '../domain/contracts/tool-inputs/index.js'
 import { LEASE_ACTION } from '../domain/vocabulary.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireTowerActor: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireTowerActor: any, acquireLease: any, releaseLease: any, inspectLeases: any }} deps
  */
 export function registerResourceTool(ctx, deps) {
-  const { define, actorFor, requireTowerActor } = deps
+  const { define, actorFor, requireTowerActor, acquireLease, releaseLease, inspectLeases } = deps
   define(ctx, {
     name: 'tower_resource',
     description:
@@ -19,7 +17,7 @@ export function registerResourceTool(ctx, deps) {
     parameters: ResourceInput,
     output: output(SCHEMAS.resource),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       const redact = (leases) => leases.map(({ token, ...lease }) => lease)
       if (args.action === LEASE_ACTION.status) {

package/tools/review.js

@@ -1,5 +1,4 @@
 // tower_review: independent review verdict.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { TowerToolError } from '../domain/errors.js'
 import { ReviewInput } from '../domain/contracts/tool-inputs/index.js'
@@ -7,21 +6,21 @@ import { isReviewerRole, isTowerRole } from '../domain/vocabulary.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any }} deps
  */
 export function registerReviewTool(ctx, deps) {
   const { define, actorFor } = deps
   define(ctx, {
     name: 'tower_review',
     description:
-      'Submit an independent review verdict for a completed mission, bound to the current branch tip. status is "clean", "p1-Nitems", or "p2-Nitems"; merge is "merge", "fix-then-merge", or "hold" (only clean + merge is later approval). Non-clean returns the mission to active. Reviewers are capped at 5 rounds per branch; a tower-submitted review is break-glass and requires breakGlassReason.',
+      'Submit an independent review verdict bound to the current branch tip: a completed mission starts a review round, and while the mission is active a later route may still record a verdict for that same reviewed tip, appending to the same round without changing the status (a moved tip is rejected with an explanation). status is "clean", "p1-Nitems", or "p2-Nitems"; merge is "merge", "fix-then-merge", or "hold" (only clean + merge is later approval). Non-clean returns the mission to active. Reviewers are capped at 5 rounds per branch; a tower-submitted review is break-glass and requires breakGlassReason.',
     parameters: ReviewInput,
     aliases: {"missionId":["id"]},
     requiresMissionId: true,
     board: true,
     output: output(SCHEMAS.review),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       if (!isReviewerRole(actor.role) && !isTowerRole(actor.role)) {
         throw new TowerToolError('not-authorized', `only an assigned reviewer or the tower may review; ${actor.name} is ${actor.role}`)

package/tools/roster.js

@@ -1,5 +1,4 @@
 // tower_roster: authoritative roster activity.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { TowerToolError } from '../domain/errors.js'
 import { RosterInput } from '../domain/contracts/tool-inputs/index.js'
@@ -7,7 +6,7 @@ import { PARENT_STATUS_OK, ROSTER_ACTIVITY, ROSTER_GONE_STATES } from '../domain
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any }} deps
  */
 export function registerRosterTool(ctx, deps) {
   const { define } = deps
@@ -18,7 +17,7 @@ export function registerRosterTool(ctx, deps) {
     parameters: RosterInput,
     output: output(SCHEMAS.roster),
     async execute(args) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const view = await tower.rosterView()
       const subagents = ctx.get('subagents')
       if (!subagents) throw new TowerToolError('spawn-unavailable', 'subagents service is unavailable; cannot observe roster')

package/tools/send.js

@@ -1,5 +1,4 @@
 // tower_send: durable inbox message delivery.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { TowerToolError } from '../domain/errors.js'
 import { SendInput } from '../domain/contracts/tool-inputs/index.js'
@@ -17,6 +16,7 @@ import {
  * @param {any} ctx
  * @param {{
  *   define: import('../types/index.js').DefineTool,
+ *   openTower: any,
  *   actorFor: any,
  *   checkSendRate: any,
  * }} deps
@@ -31,7 +31,7 @@ export function registerSendTool(ctx, deps) {
     aliases: { consentRef: ['consent_ref'] },
     output: output(SCHEMAS.send),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       checkSendRate(tower.config, args.repoRoot)
       const actor = await actorFor(tower, exec)
       const view = await tower.rosterView()

package/tools/spawn.js

@@ -1,5 +1,4 @@
 // tower_spawn: provision and start a worker/reviewer.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { TowerToolError, classifyError } from '../domain/errors.js'
 import { SpawnInput } from '../domain/contracts/tool-inputs/index.js'
@@ -9,13 +8,14 @@ import {
   precheckSpawnServices,
   precheckWorkerOwnership,
   resolveRosterName,
-} from '../lib/spawn-prechecks.js'
-import { buildAgentOptions, buildSpawnBriefing, waitForSpawnResult } from '../lib/spawn-support.js'
+} from '../app/spawn-prechecks.js'
+import { buildAgentOptions, buildSpawnBriefing, waitForSpawnResult } from '../app/spawn-support.js'
 
 /**
  * @param {any} ctx
  * @param {{
  *   define: import('../types/index.js').DefineTool,
+ *   openTower: any,
  *   actorFor: any,
  *   requireTowerActor: any,
  *   enqueueSpawn: any,
@@ -25,6 +25,7 @@ import { buildAgentOptions, buildSpawnBriefing, waitForSpawnResult } from '../li
  *   recordSpawnSuccess: any,
  *   runMissionDiscovery: any,
  *   textOf: any,
+ *   inspectLeases: any,
  * }} deps
  */
 export function registerSpawnTool(ctx, deps) {
@@ -43,7 +44,7 @@ export function registerSpawnTool(ctx, deps) {
     board: true,
     output: output(SCHEMAS.spawn),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       requireTowerActor(actor, 'spawn tower agents')
       const role = args.role ?? DEFAULT_ROLE
@@ -68,7 +69,9 @@ export function registerSpawnTool(ctx, deps) {
           role, tower, ctx, view, missionId: args.missionId, takeover: args.takeover,
           maxLiveWorkers: config.spawn.maxLiveWorkers, budget: backoff.budget, observeActivity,
         })
-        const { subagents, provider } = await precheckSpawnServices({ tower, ctx, config, preset, actor, exec })
+        const { subagents, provider } = await precheckSpawnServices({
+          tower, ctx, config, preset, actor, exec, inspectLeases: deps.inspectLeases,
+        })
 
         const provisioned = await tower.provision({
           missionId: args.missionId,

package/tools/status.js

@@ -1,5 +1,4 @@
 // tower_status: dashboard and mission detail.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { classifyError } from '../domain/errors.js'
 import { StatusInput } from '../domain/contracts/tool-inputs/index.js'
@@ -10,6 +9,7 @@ import { archiveView } from '../app/archive.js'
  * @param {any} ctx
  * @param {{
  *   define: import('../types/index.js').DefineTool,
+ *   openTower: any,
  *   workspaceHook: any,
  *   spawnBackoffView: any,
  *   observeActivity: any,
@@ -20,12 +20,12 @@ export function registerStatusTool(ctx, deps) {
   define(ctx, {
     name: 'tower_status',
     description:
-      'Read the Tower dashboard for a repository: state path, base branch, revision, mission status counts, paged mission summaries (scope/deps/tasks/worktree/owner), roster size, findings, archive count, config path and the activity tail. Pass missionId for one full mission (tasks, notes, reviews, findings, completion report; archived missions are loaded from their year file); offset/limit page the mission list (default 20, max 100); includeGate adds preflight gate digests for the page; includeArchived appends compact archived summaries after the active page; format:"markdown" returns the human-readable mission board (active missions plus an archived count). Read-only.',
+      'Read the Tower dashboard for a repository: state path, base branch, revision, mission status counts, paged mission summaries (scope/deps/tasks/worktree/owner), roster size, findings, archive count, config path and the activity tail. Also reports the repo-scoped git lock holder (`gitLock: {held,pid,phase,heldMs}`) so a merge holding the mutex is visible. Pass missionId for one full mission (tasks, notes, reviews, findings, completion report; archived missions are loaded from their year file); offset/limit page the mission list (default 20, max 100); includeGate adds preflight gate digests for the page; includeArchived appends compact archived summaries after the active page; format:"markdown" returns the human-readable mission board (active missions plus an archived count). Read-only.',
     parameters: StatusInput,
     aliases: { mission_id: ['missionId'], include_gate: ['includeGate'], include_archived: ['includeArchived'] },
     output: output(SCHEMAS.status),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const boardPath = tower.boardFile()
       const mode = workspaceHook?.modeInfo?.(exec) ?? null
       const statusState = await tower.load()

package/tools/teardown.js

@@ -8,13 +8,12 @@
 // Pure eligibility decisions live in domain/integration.
 // See docs/reference/tools.generated.md for the public shape.
 // tower_teardown: remove eligible mission worktrees.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { TeardownInput } from '../domain/contracts/tool-inputs/index.js'
 
 /**
  * @param {any} ctx
- * @param {{ define: import('../types/index.js').DefineTool, actorFor: any, requireTowerActor: any, observeActivity: any }} deps
+ * @param {{ define: import('../types/index.js').DefineTool, openTower: any, actorFor: any, requireTowerActor: any, observeActivity: any }} deps
  */
 export function registerTeardownTool(ctx, deps) {
   const { define, actorFor, requireTowerActor, observeActivity } = deps
@@ -27,7 +26,7 @@ export function registerTeardownTool(ctx, deps) {
     board: true,
     output: output(SCHEMAS.teardown),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       requireTowerActor(actor, 'tear down worktrees')
       const { activity } = await observeActivity(ctx, tower)

package/tools/test.js

@@ -1,5 +1,4 @@
 // tower_test: run declared worktree test discovery.
-import { Tower } from '../app/tower.js'
 import { SCHEMAS, output } from '../domain/contracts/outputs.js'
 import { TowerToolError } from '../domain/errors.js'
 import { TestInput } from '../domain/contracts/tool-inputs/index.js'
@@ -9,6 +8,7 @@ import { isReviewerRole, isWorkerRole } from '../domain/vocabulary.js'
  * @param {any} ctx
  * @param {{
  *   define: import('../types/index.js').DefineTool,
+ *   openTower: any,
  *   actorFor: any,
  *   requireKnownActor: any,
  *   runMissionDiscovery: any,
@@ -25,7 +25,7 @@ export function registerTestTool(ctx, deps) {
     requiresMissionId: true,
     output: output(SCHEMAS.test),
     async execute(args, exec) {
-      const tower = await Tower.open(args.repoRoot)
+      const tower = await deps.openTower(args.repoRoot)
       const actor = await actorFor(tower, exec)
       requireKnownActor(actor, 'tower_test')
       const context = await tower.missionContext(args.missionId)

package/types/index.d.ts

@@ -106,7 +106,7 @@ export interface CompletionReport {
   checks?: CompletionCheck[]
 }
 
-/** One recorded test-discovery receipt (lib/tests.js). */
+/** One recorded test-discovery receipt (adapters/tests.js). */
 export interface TestRun {
   version?: number
   ok?: boolean

package/ui-bundle/README.md

@@ -1,6 +1,6 @@
 # Tower UI (optional Client bundle)
 
-An **optional** Web Client bundle for the Host `dsh-tower` plugin. It never touches Tower state directly: everything it renders is derived from the conversation the user is already looking at, or from the tool results already in that conversation. There is no Host → Client remote channel, no `host.call`, no DOM manipulation, no iframe, and no import of Harness Client packages (the only module it requires is `react` from the browser module table).
+An **optional** Web Client bundle for the Host `dsh-tower` plugin. It never touches Tower state directly: everything it renders is derived from the conversation the user is already looking at, or from the tool results already in that conversation. There is no Host → Client remote channel, no `host.call`, no DOM manipulation, no iframe, and no import of Harness Client packages (the only browser module-table word it requires is `react`).
 
 Version: **0.2.2** (private, not published). The Host plugin version is unchanged.
 
@@ -20,6 +20,39 @@ The cards are deliberately compact: mission status/counts, task checklist progre
 
 The overlay strip is `pointer-events: none` end-to-end and uses `role="status"` / `aria-live="polite"`; it never blocks the composer or the page.
 
+## Source layout (#71)
+
+The bundle is split along the surfaces above. `client.js` is the entry: it owns
+the diagnostics seam and the registrations, and loads the package-local chunks
+through the DSH client module system's `require.async("./client.<surface>.js")`
+(bundles execute as classic scripts, so the entry cannot require a sibling
+synchronously). Every chunk registers through the same `window.__ModuleLoader__`
+surface as `{ id: 'dsh-tower-ui', chunk: 'client.<surface>.js', factory }` and
+receives the shared helpers/styles/locales through the `env` the entry composes;
+no chunk reaches the Host or another chunk.
+
+| File | Surface |
+|---|---|
+| `client.js` | entry: diagnostics, `apply`, the five registrations |
+| `client.toolview.js` | toolview card: lifecycle + `TowerToolCard` |
+| `client.cards.js` | the per-tool card models behind the card |
+| `client.dock.js` | composer dock: mode chip, unknown state, latest summary |
+| `client.mode.js` | history-derived mode model + observable |
+| `client.denied.js` | mode-aware `Tower mode · disabled` rows |
+| `client.overlay.js` | transient `shell.overlay` status strip + notice store |
+| `client.locales.js` | `en`/`zh` dictionaries and the `t`-seat helpers |
+| `client.styles.js` | the `--dsw-alias-*` inline style table |
+| `client.helpers.js` | tool vocabulary + defensive payload helpers |
+| `index.js` | Host half (empty `apply`) |
+
+The client tier is gated by `scripts/architecture.mjs` like any other source
+root: `client-no-node` (no `node:*` imports; DOM globals are fine),
+`client-size` (800-line ceiling per file) and `client-ambient` (no module-level
+`let`; state lives in the `create*` closure), each with a seeded fixture in
+`tests/architecture.test.mjs`. Every client source file stays under 400 lines
+and the split preserves the pre-split line total within 10%
+(`tests/ui-bundle.test.mjs`).
+
 ## Persistent Tower-mode indicator (#11)
 
 Tower mode is a Host-side session stance and there is no Client RPC for it. The dock derives it from the durable session history that the Chat projection exposes in `useChat(snapshot.legacy)`:
@@ -38,7 +71,7 @@ The Host guard returns a plain tool error like `tower mode: <tool> is disabled w
 
 While the displayed session is in Tower mode the bundle dynamically registers `tool.call.toolview` entries for:
 
-- `tower_mode.deniedWhileActive` when the latest `tower_mode` output lists it, otherwise `lib/config.js` `DEFAULT_DENY_TOOLS` (`create_goal`, `todo_write`, `team_task_create`, `team_task_update`, `team_task_reopen`, `team_task_list`, `spawn_teammate`, `wait_agent`, `workflow`, `ralph`, `subagent`, `subagent_fork`);
+- `tower_mode.deniedWhileActive` when the latest `tower_mode` output lists it, otherwise `host/config.js` `DEFAULT_DENY_TOOLS` (`create_goal`, `todo_write`, `team_task_create`, `team_task_update`, `team_task_reopen`, `team_task_list`, `spawn_teammate`, `wait_agent`, `workflow`, `ralph`, `subagent`, `subagent_fork`);
 - `update_goal` unconditionally, because the guard special-cases its `action: "resume"`.
 
 Those entries register with `priority: -10`. The slot core renders the lowest priority for a key, so this shadows the native keyed views without replacing them; disposing the entries (mode off) restores the native views exactly. A denial result renders as a distinct **`Tower mode · disabled`** row (warn marker, label, the preserved denial message, and the `/tower off` hint) — not the generic error text styling. `update_goal` resume denials get the same row. A non-denial result that lands in one of those slots while the mode is on renders a defensive generic row (there is no native view to delegate to while the registration shadows it); ordinary tool errors are not misclassified as Tower-mode denials.
@@ -56,7 +89,7 @@ Verified **statically** against the installed DSH **0.2.1-rc.2** sources:
 - Locale: `ctx.locale.register(ns, { en, zh })`, dictionaries are flat `key → template` maps with `{param}` interpolation; a slot declaration's `locale` option supplies the bound `t` seat.
 - The bundle's `dsh.client.inject` orders activation after `ui-conversation` and `ui-tool`, the two packages that declare the slots it targets. `ctx.slots.inject` only installs a registration while its owner declaration exists; each injection is guarded and reported in diagnostics instead of crashing the whole Client half.
 
-Automated offline coverage: `tests/ui-bundle.test.mjs` loads `client.js` through a fake `window.__ModuleLoader__`, asserts the 12 keys / dock id / overlay id, en–zh dictionary parity, theme-token discipline, and renders every card plus the dock/overlay components with fake hooks. It also drives fake chat history through the dock to assert the off hint, the on chip (including refresh re-derivation), `tower_mode`/`tower_control`/command updates, dynamic registration for default and configured deny lists, disposal on mode off, `update_goal`, denial-row treatment, generic fallbacks, and locale parity — no browser required.
+Automated offline coverage: `tests/ui-bundle.test.mjs` loads `client.js` through a fake `window.__ModuleLoader__` (and each split chunk through the same loader when the entry calls `require.async`), asserts the 12 keys / dock id / overlay id, en–zh dictionary parity, theme-token discipline, every file's loader format and the split-size budget, and renders every card plus the dock/overlay components with fake hooks. It also drives fake chat history through the dock to assert the off hint, the on chip (including refresh re-derivation), `tower_mode`/`tower_control`/command updates, dynamic registration for default and configured deny lists, disposal on mode off, `update_goal`, denial-row treatment, generic fallbacks, and locale parity — no browser required.
 
 Live/browser verification is **opt-in** (`tests/live/ui-slots.cjs`) because it needs an isolated profile with the bundle installed. From a teammate/subagent session the Client `Slots` inspect query times out by design (the page answers only the agent whose session it displays), so this phase did not run a live inspection; the source-level contract above is the evidence. When the script runs against an installed profile it binds a session with a bare `/tower` command and asserts, through the read-only `window.__TOWER_UI_DIAG__` report, that apply() ran without errors, that all 12 toolview keys and the dock/overlay entries registered, that the dock outlet is visible, and — since the bind command turns the Host mode on — that the history-derived `Tower · on` chip rendered (#11). The chip can be inspected visually in the same run (`data-tower-ui="dock-mode"`).
 
@@ -65,6 +98,7 @@ Live/browser verification is **opt-in** (`tests/live/ui-slots.cjs`) because it n
 ```powershell
 # offline, no browser
 node --check ui-bundle/client.js
+Get-ChildItem ui-bundle -Filter 'client*.js' | ForEach-Object { node --check $_.FullName }
 node --test tests/ui-bundle.test.mjs
 
 # opt-in live check (isolated profile only)