dsh-tower 2.4.2 → 2.5.0

package/CHANGELOG.md

@@ -4,6 +4,46 @@
 
 ## 未发布（Unreleased）
 
+## 2.5.0（2026-11-01）
+
+### 新增
+
+- **#133 追踪看板成为可选能力**：新增 `tower-board` 组件行，关闭后不再写 `MISSIONS.md`，
+  `tower_status`/`tower_doctor` 说明关闭原因；`docs.boardLocation` 仍是位置调节项。
+  旧的 `docs.board` 配置键被删除，写入旧键会收到带迁移说明的 `config-unknown-key`。
+- **#135 归档成为可选能力**：新增 `tower-archive` 组件行，关闭后终态任务保持热存储且不自动归档，
+  doctor 报告关闭后果；`archive.afterDays`/`archive.maxMissions` 仍是节奏调节项。
+  旧的 `archive.enabled` 配置键被删除。
+- **#134 `tower-ui` 进入组件源**：`ui-bundle/cordis.patch.yml` 的 UI 行现在被组件源、locale 覆盖与
+  基线同时看到；门禁解析所有随包发布的 `cordis.patch.yml`。
+- **#137 面向普通用户的双语标签与术语表**：新增 `GLOSSARY.md`（12 组中英术语 + 文案规则），
+  重写全部可见组件行的标题、用途与关闭后果；不再出现原始配置键、工具 id、斜杠命令或模块说明符。
+
+### 变更
+
+- **#138 组件门禁改为失败关闭**：键分类、行为开关、行覆盖、随包补丁与双向计数面全部机器校验；
+  双向面的每次计数决策必须带日期；`OPERATIONAL_TOOLS` 直接导入真实注册表，不再靠正则猜测。
+- **#136 删除 `tests.enabled` 第二开关**：`tower-tests` 组件行是唯一开关；`tower_test` 在行关闭时
+  报告 `disabled by component tower-tests` 并给出修复方式，不再误报“未配置”。
+- **#132 组行关闭后果可见**：`tower` 组行的“关闭等于卸载 Tower”现在显示在 Plugins 页面的描述里，
+  不再只是不可达的 locale 文本。
+- **#141 HMR 明确定位为开发工具**：`tower-hmr` 保持默认关闭，文案改为“开发热重载（开发工具）”。
+- 配置面 55 → 53 键；可见组件 11 个；新增 `tower-board`/`tower-archive` 行 locale 与打包清单条目。
+
+### 修复
+
+- **#131 租约组合提前拒绝**：`tower-leases` 关闭且 `spawn.requireLease` 非空时，配置/预检阶段直接
+  拒绝并说明行与两项修复方式；`lease-busy` 只指向真实注册的工具，`tower_doctor` 交叉检查该组合。
+- **#139 能力卸载不留残影**：skills provider 注册与 Tower 模式提示段都通过 `ctx.effect` 释放，
+  热卸载后 `componentReport` 与真实挂载状态一致。
+- **#140 禁用行原因一致**：`tests-missing` 合并阻塞项点名 `tower-tests` 行；机器输出的英文契约写入文档。
+- **#142 `/tower` 预检不再误伤转发输入**：运行前置条件只在进入模式/切换时重新校验，
+  转发指令与 `/tower off` 在无关行关闭时继续工作。
+- **F16 作用域重叠判定补全**：`scopesOverlap` 在保留文档化近似的同时加入精确 token-NFA 交集，
+  修掉 `a/b*` 与 `a/bc*` 被误判为不重叠的问题。
+- **F17 配置解析一遍收敛**：`resolveTowerConfig` 现在对空输入也满足严格一遍幂等。
+- **F23 术语表随包发布**：`GLOSSARY.md` 进入 `package.json` `files` 与打包清单（293 个文件）。
+
 ## 2.4.2（2026-10-24）
 
 ### 修复

package/COMPATIBILITY.md

@@ -5,6 +5,7 @@ is shipped in the npm package; doctor reads it locally and never contacts a regi
 
 | dsh version | tag / commit | verified on | what was run |
 |---|---|---|---|
+| 0.2.1-rc.2 | v2.5.0 | 2026-11-01 | mount smoke (28/28 default tools, 3 skills, 2 presets with distinct labels, 1 bundle row), `npm test` (696), `npm run test:property` (111), `npm run check` (docs + generated + component + surface + pack 293 + types + architecture + domain), `npm run release:check -- --mode tag --tag v2.5.0` |
 | 0.2.1-rc.2 | v2.4.2 | 2026-10-24 | mount smoke (28/28 default tools, 3 skills, 2 presets with distinct labels, 1 bundle row), `npm test` (631), docs + seven generated checks, types coverage 148/148, components + philosophy + surface gates |
 | 0.2.1-rc.2 | v2.4.1 | 2026-10-24 | mount smoke (28/28 default tools, 3 skills, 2 presets, 1 bundle row), `npm test` (620), `types:coverage` 146/146, docs + seven generated checks incl capability-row locales, components + philosophy + surface gates |
 | 0.2.1-rc.2 | v2.4.0 | 2026-10-24 | mount smoke (28/28 default tools, 3 skills, 2 presets, 1 bundle row), `npm test` (612), `types:coverage` 146/146, strict ratchet 10, docs + six generated checks, components + philosophy + surface gates |

package/CONTRIBUTING.md

@@ -102,7 +102,9 @@ cd dsh-tower
 npm test        # no dependencies to install; Node's built-in test runner only
 ```
 
-Requirements: Node.js 22+, Git. No package installation is needed for the offline suite.
+Requirements: Node.js 22+, Git. No package installation is needed for the offline example suite.
+
+The property-based PR tier (`npm run test:property`) does need the dev dependencies: run `npm ci` once, then `npm run test:property`. It is part of `npm run check` and runs on every CI matrix leg; the nightly long tier is `npm run test:property:long`. See [tests/README.md](tests/README.md#property-based-tests-fast-check-130).
 
 The opt-in live suite is the exception: install it once with
 `npm ci --prefix tests/live && npx --prefix tests/live playwright install chromium`, then run it with `npm run test:live`
@@ -118,13 +120,13 @@ the push gates; CI schedules it nightly.
 - `host/` — the composition root and session/process glue (`tool-registry.js`, `config.js`, `hmr.js`, `modeStore.js`, `doctor.js`); `adapters/` — the only I/O implementations (store, git, archive, leases, locks); `app/` — use cases; `domain/` — the pure core.
 - `worker.js` — the `tower-worker` preset policy (tool surface + protocol text).
 - `host/preset-worker.js` / `host/preset-reviewer.js` — the two Tower-owned preset declaration rows (`dsh-tower/preset-*`). They keep the row config in `cordis.patch.yml`, forward it to `ctx.agentPresets.register()`, and give each preset row its own Plugins-page label; do not mount the shared `@deepseek-ai/dsh-agent-preset` for these rows.
-- `tests/` — add a regression test for every behavior change. The offline suite is `tests/*.test.mjs`; live-runtime scripts are documented in `tests/README.md`.
+- `tests/` — add a regression test for every behavior change. The offline suite is `tests/*.test.mjs`; an invariant over a pure domain function belongs in `tests/property/*.prop.mjs` (fast-check) rather than a hand-rolled randomized loop, and `tests/no-random.test.mjs` enforces that. Live-runtime scripts are documented in `tests/README.md`.
 - `scripts/architecture.mjs` — the fitness rules; `scripts/architecture-waivers.json` — the only exemptions, each with a `reason` and an `owner`/`ref`. An entry without a reason fails the blocking `waiver-contract` rule, The three layering rules that keep the core pure — `domain-pure`, `host-scope`, and `no-lib-from-core` — cannot be waived at all. The `let` scan behind `host-scope` is statement-aware: every binding of every top-level declaration is recorded, and only `host/**` may hold ambient state.
 - `types/` — the published declaration surface (`package.json` `types` is `types/index.d.ts`). The vocabulary block in that file is generated from the runtime constants by `npm run types:generate` and gated by `npm run docs:check:generated:types`; never edit it by hand. `tsconfig.strict.json` turns `noImplicitAny` on for an explicit file list that may grow but never silently shrink: add a file, then record it with `npm run types:strict:write` (a removal also needs `--allow-shrink`). `npm run types:coverage` fails when a shipped runtime `.js` file is outside the `tsc` program.
 
 ## Pull request checklist
 
-1. `npm test` passes locally (631 tests today, including protocol end-to-end against a real temporary Git repository and mock spawn coverage) and `npm run docs:check` passes.
+1. `npm test` passes locally (696 tests today, including protocol end-to-end against a real temporary Git repository and mock spawn coverage), `npm run test:property` passes (111 generated property cases; also part of `npm run check`), and `npm run docs:check` passes.
 2. New behavior has a test. Bug fixes should add a test that fails before the fix.
 3. No secrets, tokens, personal paths, session logs, or generated artifacts are added. `.gitignore` covers local acceptance output; do not force-add it.
 4. Keep the public API and state-file formats compatible; if a change is breaking, call it out in `CHANGELOG.md` and bump the version.

package/GLOSSARY.md

@@ -0,0 +1,67 @@
+# GLOSSARY
+
+The canonical bilingual vocabulary for Tower's user-facing copy. Plain language
+first: a component label says what a person can do, then what changes when the
+component is off. The reader should not need to know a config key, a tool id or
+an internal module name.
+
+This file is enforced. `npm run docs:check:components` fails when a label field
+in `locale/`, the generated `locale/<specifier>/` row labels or
+`ui-bundle/locale/` uses a different Chinese term, leaves the English word
+untranslated, or drifts from the table below. The gate that enforces it is
+described in [ADR 0005](docs/adr/0005-component-surface.md) (wave-4 addendum,
+#137).
+
+## Canonical vocabulary
+
+One term per concept, in both languages. Use these in every label, summary and
+off-state sentence.
+
+| Concept | English | 中文 | Notes |
+|---|---|---|---|
+| mission | mission | 任务线 | The unit of work a Tower session plans, executes and merges. Reserve 任务 for a single task inside a mission. |
+| task | task | 任务 | One checklist item inside a mission. Not a substitute for 任务线. |
+| batch | batch | 批次 | A finite evidence batch. Do not mix 批量 into label copy; that word describes bulk actions, not the component. |
+| doctor | doctor | 体检 | The read-only health check. Do not use 诊断 as a noun for the health tool. |
+| board | board | 看板 | The human-readable mission board (`MISSIONS.md`). |
+| archive | archive | 归档 | Moving finished missions out of the live state file. |
+| preset | preset | 预设 | A shipped role definition. Never leave the English word in Chinese copy. |
+| worktree | worktree | 工作树 | The isolated checkout a worker runs in. |
+| review | review | 审查 | The review contract and the act of reviewing. Do not use 评审 in plugin-page copy. |
+| lease | lease | 租约 | Advisory resource coordination. Never 咨询式租约: the lease coordinates, it does not consult. |
+| worker | worker | 执行代理 | The role that executes a mission. "Tower Worker" is a product name and stays as-is. |
+| reviewer | reviewer | 审查代理 | The role that independently reviews a mission. "Tower Reviewer" is a product name and stays as-is. |
+
+## Product names and other surfaces
+
+Brand and product names are not translated: Tower, DSH, Tower Worker, Tower
+Reviewer, Tower UI, MISSIONS.md. On first use in a sentence, gloss an unfamiliar
+one parenthetically — for example "Tower Codex (Tower's earlier state format)".
+
+The Web client has its own string catalogue (`ui-bundle/client.locales.js`).
+When its wording disagrees with this table, this table wins and the client copy
+is migrated separately under the same glossary.
+
+## Copy rules
+
+1. One sentence for the capability, one sentence for the off consequence.
+2. No config-key syntax (`gates.requireTests:true`), no bare tool ids
+   (`tower_batch`), no slash commands (`/tower reload`) and no module specifiers
+   in a label field. Describe the capability and the effect instead.
+3. Say "Tower mode", not just "模式", and "refused with an explanation", not
+   "locked": the user needs to know they will get the reason.
+4. The off sentence must be truthful. A lease is coordination only, but a worker
+   configured to require one cannot start while the lease row is off — planning
+   and Tower-mode entry are refused with an explanation until the setting is
+   cleared or the row is re-enabled. Say that, and say that everything else keeps
+   working.
+5. English and Chinese must agree field by field. Chinese copy reads as Chinese:
+   no untranslated English common nouns, no machine-translated calques — say
+   关闭该批次, not 收口; 当前状态文件, not 在线状态文件; 某一具体工作, not
+   一项命名工作; and 卡住的锁如何恢复, not 锁状态的恢复出口.
+6. When turning a row off makes an operation impossible under the current
+   settings, name that operation (planning, entering Tower mode, merging) and how
+   the user clears the requirement. Never claim a blocked operation keeps
+   working: a reviewer preset needed for merging is a precondition, not an
+   optional extra, and test evidence that cannot be recorded keeps merges blocked
+   until the requirement is cleared.

package/README.md

@@ -125,6 +125,12 @@ tower_teardown  repoRoot=D:\work\repo
 
 图片与文件附件会随指令一起作为一条完整的 `UserMessage` 转发。
 
+运行时前置条件（preset 行、组件行与配置的冲突）只在**进入**模式的路径上重新校验：
+裸 `/tower`、`/tower on`、`/tower on <指令>`，以及模式关闭时的 `/tower <指令>`。已经开启
+模式后的 `/tower <指令>`、`/tower off`、`/tower off <指令>` 与 `/tower ack` 不再重复校验，
+因此会话中途关掉某一行之后，人仍然退得出去、指令也仍然转发得出去；`tower_spawn`、规划与
+合并/预检各自保留自己的护栏。详见 [组件行与消息语言](docs/guide/quickstart.md#component-rows-runtime-preconditions-and-message-language)。
+
 ## 组件模型
 
 本 bundle 采用 **强制 host 锚点 + 可单独启停的可选行**（#121）：`cordis.patch.yml` 插入顶层

package/app/archive.js

@@ -94,6 +94,21 @@ export function archiveView(index) {
   }
 }
 
+/**
+ * #135: archival is the `tower-archive` component row, not a config switch. The
+ * probe is supplied by the composition root. A Tower built without a component
+ * probe (unit fixtures, direct adapter use) keeps archiving: an absent probe means
+ * "not composed", not "row disabled".
+ *
+ * @param {any} tower
+ * @returns {boolean}
+ */
+function archiveEnabled(tower) {
+  const components = tower.deps?.components
+  if (!components || typeof components.enabled !== 'function') return true
+  return components.enabled('tower-archive') === true
+}
+
 /**
  * Move the eligible terminal missions out of `state` and into the archive.
  * Mutates `state` in memory (missions, linked reviews and closed findings) and
@@ -105,8 +120,8 @@ export function archiveView(index) {
  * @returns {Promise<{ archived: string[], written: boolean, files?: string[], error: string | null, year?: number }>}
  */
 export async function sweepArchive(tower, state, options = {}) {
+  if (!archiveEnabled(tower)) return { archived: [], written: false, error: null }
   const policy = tower.config.archive ?? {}
-  if (policy.enabled === false) return { archived: [], written: false, error: null }
   const now = options.now ?? Date.now()
   const activity = options.activity ?? {}
 

package/app/board.js

@@ -8,8 +8,23 @@ export function boardFile(tower) {
     : path.join(tower.paths.dir, 'MISSIONS.md')
 }
 
+/**
+ * #133: the board is the `tower-board` component row, not a config switch. The
+ * probe is supplied by the composition root. A Tower built without a component
+ * probe (unit fixtures, direct adapter use) keeps writing the board: an absent
+ * probe means "not composed", not "row disabled".
+ *
+ * @param {any} tower
+ * @returns {boolean}
+ */
+export function boardEnabled(tower) {
+  const components = tower.deps?.components
+  if (!components || typeof components.enabled !== 'function') return true
+  return components.enabled('tower-board') === true
+}
+
 export async function writeBoard(tower) {
-  if (tower.config.docs?.board === false) return null
+  if (!boardEnabled(tower)) return null
   try {
     const state = await tower.load()
     const index = await tower.archiveIndex()

package/app/gate.js

@@ -91,6 +91,19 @@ export async function evaluateGate(tower, input) {
 
     const branch = worktree ? worktree.branch : null
     const latest = latestReview(reviewsForBranch(reviews, branch))
+    // #140: `mergeGateBlockers` is pure and may not read the component registry, so
+    // the composition root publishes `deps.components` and this layer snapshots the
+    // one fact the gate needs. Absent (unit tests, custom port bags) means unknown,
+    // and the blocker keeps its generic wording.
+    const components = /** @type {{ enabled?: (id: string) => boolean, reason?: (id: string) => string } | undefined} */ (
+      tower.deps?.components
+    )
+    const testsComponent = components
+      ? {
+          enabled: typeof components.enabled === 'function' ? components.enabled('tower-tests') === true : false,
+          reason: typeof components.reason === 'function' ? components.reason('tower-tests') : 'disabled by component tower-tests',
+        }
+      : null
     for (const blocker of mergeGateBlockers({
       mission,
       roster: state.roster ?? [],
@@ -102,6 +115,7 @@ export async function evaluateGate(tower, input) {
       parentStatus: input.parentStatus,
       inactiveStates: ROSTER_INACTIVE_STATES,
       rebaseWaived: latest ? tower.rebaseWaived(mission, latest) : false,
+      testsComponent,
     })) push(blocker.code, blocker.detail)
 
     const checkoutBranch = await tower.deps.vcs.currentBranch(tower.root)

package/app/spawn-prechecks.js

@@ -132,10 +132,12 @@ export async function precheckWorkerOwnership({
 /**
  * Service/provider/preset/lease checks, run before provisioning.
  * `inspectLeases` is injected by the composition root so the app layer never
- * imports the lease adapter (#69).
- * @param {{ tower: any, ctx: any, config: any, preset: string, actor: any, exec: any, inspectLeases: any }} input
+ * imports the lease adapter (#69). `leaseComponent` is the matching probe for the
+ * `tower-leases` row (#131): when the row is off there is no `tower_resource`
+ * tool, so a missing lease cannot be fixed by following the old advice.
+ * @param {{ tower: any, ctx: any, config: any, preset: string, actor: any, exec: any, inspectLeases: any, leaseComponent?: () => { enabled: boolean, reason: string } }} input
  */
-export async function precheckSpawnServices({ tower, ctx, config, preset, actor, exec, inspectLeases }) {
+export async function precheckSpawnServices({ tower, ctx, config, preset, actor, exec, inspectLeases, leaseComponent }) {
   const subagents = ctx.get('subagents')
   if (!subagents) throw new TowerToolError('spawn-unavailable', 'subagents service is unavailable; cannot spawn')
   const providers = subagents.list()
@@ -150,6 +152,19 @@ export async function precheckSpawnServices({ tower, ctx, config, preset, actor,
   }
   if (typeof config.spawn.requireLease === 'string' && config.spawn.requireLease.trim()) {
     const requiredLease = config.spawn.requireLease.trim()
+    // #131: registration-aware. Telling a caller to "acquire it with
+    // tower_resource" is useless when the tower-leases row is off and the tool is
+    // not registered; name the component and both remedies instead.
+    const leasesRow = typeof leaseComponent === 'function' ? leaseComponent() : null
+    if (leasesRow && leasesRow.enabled !== true) {
+      // Refuse before reading the ledger: a lease left over from when the row was
+      // on must not let a spawn through, and the ledger cannot be fixed without
+      // the unregistered tool (issue #131, evidence note 4).
+      throw new TowerToolError(
+        'lease-busy',
+        `spawn.requireLease="${requiredLease}" cannot be satisfied: ${leasesRow.reason ?? 'the tower-leases component is disabled'}, so tower_resource is not registered; re-enable the tower-leases row or clear spawn.requireLease`,
+      )
+    }
     const info = await inspectLeases(tower.commonDir)
     const lease = info.leases.find((entry) => entry.name === requiredLease && entry.expired !== true)
     if (!lease) {

package/cordis.patch.yml

@@ -8,11 +8,13 @@
 #
 # Policy: principle 11 in PRINCIPLES.md + docs/adr/0005-component-surface.md.
 # The per-key answer is docs/reference/component-surface.md, generated from
-# scripts/component-surface.json. `npm run docs:check:components` refuses a new
-# switch, a missing locale label, or a moved component count without a written
-# decision. `tower_doctor` and `tower_recover` are part of the host and are never
-# switches (#122); a capability row owns exactly one optional capability, and
-# `tower_status` / `tower_doctor` name any row that is off.
+# scripts/component-surface.json. `npm run docs:check:components` reads every
+# shipped patch (this file and ui-bundle/cordis.patch.yml, which ships the
+# tower-ui row) and refuses a row with no classification, a missing locale label,
+# or a moved component count without a written decision. `tower_doctor` and
+# `tower_recover` are part of the host and are never switches (#122); a capability
+# row owns exactly one optional capability, and `tower_status` / `tower_doctor`
+# name any row that is off.
 - insert:
     # Mandatory host anchor. Not an optional capability: off == uninstall.
     - id: tower
@@ -66,7 +68,20 @@
       name: 'dsh-tower/leases'
     - id: tower-tests
       name: 'dsh-tower/tests'
-    # dev hot reload: shipped off. Enable the row for a linked dev profile.
+    # #133: the MISSIONS.md board is a capability, not the old `docs.board` key.
+    # Off writes no board and leaves an existing one to go stale; every tool and
+    # gate keeps working. `docs.boardLocation` stays genuine tuning.
+    - id: tower-board
+      name: 'dsh-tower/board'
+    # #135: archival is a capability, not the old `archive.enabled` key. Off keeps
+    # terminal missions hot in state.json, so the hot state keeps growing; merges,
+    # gates and every other capability keep working and nothing is deleted.
+    # `archive.afterDays` / `archive.maxMissions` stay genuine tuning.
+    - id: tower-archive
+      name: 'dsh-tower/archive'
+    # #141: developer tooling, not an end-user capability switch. It stays shipped
+    # off; the locale copy states that this row exists for linked-profile
+    # development only, so the plugin page does not read as a missing feature.
     - id: tower-hmr
       name: 'dsh-tower/hmr'
       disabled: true

package/docs/adr/0004-surface-budget.md

@@ -30,7 +30,9 @@ note for each niche key.
 
 - Growth is visible in a diff instead of arriving one reasonable-looking key at a
   time.
-- A reduction is cheap: the baseline can be ratcheted down with no ADR.
+- A reduction is cheap for `sections` and `tools`: the baseline can be ratcheted
+  down with no ADR. Since #138 the config-key count is two-way like the component
+  count (see [ADR 0005](0005-component-surface.md)).
 - The classification table is auditable, not decorative: the check fails when a
   live key or tool is missing from it.
 - The numbers are three lines in `tower_doctor` output, not a new dashboard.
@@ -53,8 +55,10 @@ extends the budget with a fourth — the number of user-visible component rows i
 `cordis.patch.yml` — and records it as its own `components` baseline entry with a
 two-way decision rule (a contraction needs a decision just like growth). The
 three original counts are still measured by `npm run surface:check`; the
-component count is validated by `npm run docs:check:components`. The historical
-decision above is unchanged: "three surfaces" describes the 2.3.0 rule.
+component count is validated by `npm run docs:check:components`. ADR 0005's wave
+3 (#138) also makes `configKeys` two-way, so the cheap-shrink consequence above
+now applies only to `sections` and `tools`. The historical decision above is
+unchanged: "three surfaces" describes the 2.3.0 rule.
 
 ## Rejected alternatives
 
@@ -65,6 +69,8 @@ decision above is unchanged: "three surfaces" describes the 2.3.0 rule.
 - **A per-key count in each generated reference** — two references can disagree;
   one shared baseline plus one check keeps the counts equal.
 - **Only an ADR requirement** — a pure deletion would need paperwork even though it
-  shrinks the surface; the matching-deletion path keeps reductions cheap.
+  shrinks the surface; the matching-deletion path keeps `sections`/`tools`
+  reductions cheap. The config-key surface is the exception since #138: a removed
+  switch is itself a capability decision, so it needs a dated record (ADR 0005).
 - **A GitHub issue label instead of a repo file** — the brake must run offline in
   `npm test` and in CI without a token.

package/docs/adr/0005-component-surface.md

@@ -128,3 +128,169 @@ this wave makes the shipped surface obey it instead of carrying debt.
 - **A GitHub issue label or a docs-only policy.** The brake must run offline in
   `npm test` and in CI without a token, and the policy must survive the closure
   of the issue that introduced it.
+
+## Addendum (wave 2): board, archive, UI and explicit development tooling
+
+- Date: 2026-11-02
+- Decisions: #132, #133, #134, #135, #141
+
+Four components were component-shaped but sat outside the policy: `docs.board` and
+`archive.enabled` were booleans in the config form, `tower-ui` shipped as a real
+plugin-page row that no source-of-truth entry described, and the group rows never
+stated their off consequence where a reader sees it. Wave 2 closes those gaps
+without widening the mechanism.
+
+- **`tower-board` (#133).** `docs.board` is deleted; the board is the optional
+  `tower-board` row with its own capability module. Its fallback: no `MISSIONS.md`
+  is written or refreshed, an existing board goes stale, and every state tool and
+  gate keeps working. `docs.boardLocation` stays a tuning key because it only
+  chooses a path. With the row off, the composition behaves like an all-Tower-off
+  profile for the board (nothing is written) while the rest of Tower keeps working.
+- **`tower-archive` (#135).** `archive.enabled` is deleted; archival is the
+  optional `tower-archive` row. Its fallback is deliberately honest: terminal
+  missions stay hot in `state.json`, the hot state keeps growing, and `status` /
+  `doctor` keep loading their full history; merges and gates are unaffected and
+  nothing is deleted. `archive.afterDays` / `archive.maxMissions` stay tuning.
+- **Removed keys fail loudly.** A config that still sets `docs.board` or
+  `archive.enabled` is rejected with `config-unknown-key` and an upgrade note that
+  names the replacing row and points here. There is no silent alias: a switch that
+  moved to the plugin page must not keep working from a config file.
+- **`tower-ui` is classified (#134).** The UI plugin row is now a visible
+  component with a documented fallback (the web UI plugin does not load: no tool
+  cards, composer-dock summary or status strip; host tools, missions and the board
+  are unaffected). Because it ships in `ui-bundle/`, the gate reads **every**
+  shipped `cordis.patch.yml` (root and `ui-bundle/`), classifies every visible row
+  and enforces a label source for each: either a generated `<specifier>/locale`
+  row, or the row package's own `meta` label when the labels live there. A row
+  added to any shipped patch without a source-of-truth entry fails
+  `npm run docs:check:components`.
+- **A group row states its consequence where it is read (#132).** The plugin page
+  renders the group row from the package `meta` block, so the off-equals-uninstall
+  consequence lives in the root `meta.description` in both languages, and the gate
+  pins it there instead of trusting only the `components` block. This is a label
+  fix, not a new mechanism.
+- **`tower-hmr` stays shipped off (#141).** Moving it to a separate install path
+  would hide the switch and re-open the orphan-mount hazard; the row is kept as
+  explicit development tooling instead: its locale copy and its source-of-truth
+  fallback say that it exists for a linked dev profile, that a normal profile
+  behaves exactly as before, and that it is off on purpose.
+- **Count decision.** The visible component count moved 8 → 9 → 10 → 11 across
+  #133, #135 and #134; the three dated steps are recorded in
+  `scripts/surface-baseline.json`. The config surface contracted 55 → 53, which the
+  other surfaces allow without a decision record.
+
+## Addendum (wave 3): close the gate's blind spots
+
+- Date: 2026-11-03
+- Decisions: #138
+
+Wave 2 made the gate read every shipped row, but four ways to evade it remained:
+a class was free text, the operational route table was scraped with a regex, only
+the patches named in `COMPONENT_PATCH_FILES` were read, and only booleans were
+reviewed. Wave 3 closes them without changing the shipped decisions: 53 config
+keys, 11 visible components.
+
+- **The class is checked against the key's shape (#138.1).** A boolean that
+  removes a capability cannot file as `optional-config` by assertion. Every live
+  boolean must be `core`, `optional-component` or `forbidden-to-disable`, or an
+  `optional-config` key carrying a dated `exemption` whose reason names its
+  tuning-only nature. The same rule covers the non-boolean behaviour knobs below.
+  An exemption is only legal on a reviewed boolean/knob, and its `ref` must exist.
+- **The config-key count is two-way (#138.1).** Wave 2's closing note ("the config
+  surface contracted 55 → 53, which the other surfaces allow without a decision
+  record") is retracted. Removing a switch is a capability decision, so
+  `configKeys` now joins `components` in `SURFACE_TWO_WAY_KEYS`: any later increase
+  or decrease needs a dated decision in `scripts/surface-baseline.json`. The gate
+  requires the `date` field itself (`YYYY-MM-DD`) on every decision of a two-way
+  surface, so a bare from/to record fails even when its chain reaches the value
+  (review of #138). The 64 → 53 history is recorded as one dated decision there;
+  sections and tools keep the ADR 0004 cheap-shrink rule.
+- **The route table is imported, not scraped (#138.2).** `host/tool-registry.js`
+  exports `OPERATIONAL_TOOLS`, and the gate imports that module instead of
+  regex-matching its source. A missing file, a failed import, or a missing/non-Map
+  export is `registry-unreadable` and fails the gate. An empty Map is still the
+  correct determined state (#122): "nothing is gated" is distinct from "could not
+  read".
+- **Every shipped patch is discovered (#138.3).** The gate walks the package for
+  `cordis.patch.yml` and compares the result with `COMPONENT_PATCH_FILES` in both
+  directions. An unlisted patch fails `patch-unclassified`; a listed patch that is
+  missing fails `patch-missing`. The row checks stay bidirectional: every shipped
+  row needs a source-of-truth entry, and every source-of-truth row needs a shipped
+  row.
+- **Behaviour knobs and row overrides are reviewed (#138.4).** `spawn.requireLease`
+  and `tests.admission` are recorded in `behaviorKnobs` and carry tuning-only
+  exemptions: the optional `tower-leases` / `tower-tests` row owns the capability,
+  while these keys choose the safety level or timing inside it. A row's scalar
+  `config:` overrides are now parsed and must name a live config key and be listed
+  in that component's `allowedOverrides`. A row that sets `docs.board`,
+  `archive.enabled` or `tests.enabled` therefore fails as `row-override-unknown`
+  (those capabilities are rows), a row that enables or disables a key it does not
+  own fails as `row-override-foreign`, and `allowedOverrides` may never name a
+  forbidden-to-disable key. Fixtures reproduce the #133/#135/#136 shapes and a
+  foreign override, proving they fail before the fix passes.
+
+## Addendum (wave 4): broad-audience labels and a copy gate
+
+- Date: 2026-11-04
+- Decisions: #137
+
+Wave 3 made the gate fail closed, but every label it admitted still passed. The
+plugin page leaked config keys (`gates.requireTests:true`, `review.requireReview`)
+and bare tool ids (`tower_batch`, `tower_resource`) into the off-state copy, the
+Chinese copy mixed 咨询式租约 / 重型工作 / untranslated `mission` and `preset`, and
+the Web UI used 任务线 while the plugin page left `mission` in English. The counts
+do not move: 53 config keys, 13 components, 11 visible.
+
+- **The labels are rewritten for a reader, not for an operator (#137.1).** Every
+  visible row, the group row and the UI row now say what the capability is for
+  and what stops when it is off, in plain language. Config keys, tool ids, slash
+  commands and module specifiers are gone from `title`, `summary`, `disables` and
+  the two `meta` descriptions. The off copy says "refused with an explanation",
+  not "locked", and names Tower mode. The `tower-leases` fix also removes the F19
+  claim that "nothing else depends on a lease": a lease is coordination only, but
+  a worker configured to require one cannot start while the row is off; planning
+  and Tower-mode entry are refused with an explanation until the setting is
+  cleared or the row is re-enabled, and everything else keeps working.
+- **One bilingual vocabulary, recorded (#137.2).** `GLOSSARY.md` is the single
+  table for mission/任务线, batch/批次, doctor/体检, board/看板, archive/归档,
+  preset/预设, worktree/工作树, review/审查, lease/租约, worker/执行代理 and
+  reviewer/审查代理. It also records the copy rules (two sentences, no
+  identifiers, truthful off effect, natural Chinese) and is a gate input: a label
+  that uses a term the table does not pair with its other-language field fails.
+  The Web client's own string catalogue shares this table but is migrated
+  separately; the runtime error copy in `host/presets.js` is likewise a follow-up.
+- **The copy is checked mechanically (#137.3).** `checkLocaleCopy` runs over the
+  root locale pair, the ui-bundle meta pair and every generated row-locale pair.
+  It fails on config-key syntax, `tower_*` ids, `/tower` commands, `dsh-tower/*`
+  specifiers, empty fields, zh/en path drift and glossary mismatches in both
+  directions; the Chinese side may not leave glossary words untranslated.
+  `checkMetaRowCopy` pins the hand-written ui-bundle `meta.title` / `description`
+  to the root `components['tower-ui']` entry and the same composition the
+  generator renders, so the one row that ships its own label cannot drift.
+  `checkGlossaryFile` keeps `GLOSSARY.md` present and complete. Negative
+  fixtures in `tests/locale-copy.test.mjs` prove a raw key, a bare tool id and a
+  term mismatch fail in both languages before the fixed copy passes.
+- **Review of #137 corrected three claims and hardened the guard.** The
+  `tower-tests` off copy promised that "merges … keep working", but
+  `domain/gate.js` emits the `tests-missing` merge blocker while the test
+  requirement is on and `host/presets.js` refuses planning and Tower-mode entry,
+  so the copy now says planning and entry are refused and merges stay blocked
+  until the requirement is cleared. The reviewer preset summary said "only used
+  when review before merging is required"; the row is usable while review is
+  optional and becomes a precondition for merging only when the requirement is
+  on, so the summary says that instead. The Chinese calques 锁状态的恢复出口,
+  收口, 一项命名工作, 在线状态文件 and 关闭该行 were replaced with 卡住的锁如何
+  恢复, 关闭该批次, 某一具体工作, 当前状态文件 and 关闭这一项. The guard now
+  normalizes full-width punctuation and matches case-insensitively, so
+  `Gates.requireTests`, `Tower_batch` and `gates。requireTests` fail; the worker
+  and reviewer role nouns accept an initial capital but exclude the product names
+  "Tower Worker" and "Tower Reviewer", in both the en→zh and zh→en directions.
+  `GLOSSARY.md` ships in the package (`package.json` `files`, pinned by
+  `scripts/pack-manifest.txt`) because it is a gate input, not repository-only
+  prose.
+- **Rejected: a prose style guide with no gate.** It is what let wave 1–3 pass;
+  a reviewer's attention does not survive the next rename.
+- **Rejected: translating the developer reference table.** The fallback text in
+  `scripts/component-surface.json` and the generated
+  `docs/reference/component-surface.md` is an operator reference for auditors, not
+  a plugin-page label. It may name keys and tools; the locale fields may not.

package/docs/guide/install-upgrade-migration.md

@@ -29,6 +29,27 @@ The Host plugin loads at DSH startup: **restart DSH after install or update**.
 
 ## Migration notes
 
+- **2.4.2 → 2.5.0 (#131/#133/#135/#136/#142)**: three component-shaped config
+  keys are gone — `tests.enabled`, `docs.board`, and `archive.enabled`. The
+  `tower-tests`, `tower-board`, and `tower-archive` component rows are the only
+  switches. A profile or repository config that still writes any of these keys is
+  rejected as `config-unknown-key` with an upgrade note and the host stops
+  mounting, so delete the key and enable or disable the row in the plugin page
+  instead. `docs.boardLocation` and `archive.afterDays`/`archive.maxMissions`
+  remain tuning keys. With `tower-tests` off there is no `tower_test` tool and no
+  receipt, which also means `gates.requireTests` cannot be satisfied: planning and
+  mode entry refuse that combination, and the merge gate's `tests-missing` blocker
+  names the disabled row and the fix. `tower_test` no longer reports "not
+  configured" for a component cause; it reports `disabled by component
+  tower-tests` with the remedy.
+  Two more runtime rules became explicit: a config that sets `spawn.requireLease`
+  while the `tower-leases` row is off is refused up front with `config-invalid`
+  naming the row and both remedies (previously every spawn failed at `lease-busy`
+  advising an unregistered `tower_resource`), and `/tower` re-validates the runtime
+  preconditions only when it enters the mode, so `/tower off` and a forwarded
+  `/tower <text>` keep working while an unrelated row is disabled. No state
+  migration; see [component rows and messages](quickstart.md#component-rows-runtime-preconditions-and-message-language).
+
 - **state schema v1 → v2 (unreleased)**: `state.json` migrates automatically. The first **write** after
   upgrading keeps a `state.json.v1.bak` backup, advances `revision` once, and appends
   `state.migrated {from,to}` to `activity.jsonl`; read-only tools keep reading a v1 file without