@modusensus/dsh-mneme 0.14.0-beta.1 → 0.14.0-beta.2

package/lib/dream/sleep.js

@@ -1,2027 +1,2027 @@
-import { STR, langOf } from "../lang.js";
-// System-level sleep (v0.4.0): an idle-triggered, LLM-assisted deep pass over
-// the memory store. Four independent, fail-safe phases:
-//   1. conflict resolution — high-similarity same-type pairs are either parked
-//      for review (freeze mode) or adjudicated by the LLM (winner kept / loser
-//      archived), reusing the dream conflict machinery. Strictness-graded.
-//      v0.8.1 (issue #170): cross-scope pairs are ALWAYS parked for human
-//      ownership review with a dedicated reason — never auto-adjudicated.
-//   2. archival demotion — memories unreferenced past sleepArchiveDays shrink
-//      to a one-line summary with the full body moved to _full_content; past
-//      sleepCompressDays they are archived outright.
-//   3. pattern discovery — the LLM scans the most recent memories and mints
-//      type=pattern entries carrying evidence id references.
-//   4. relation completion — orphan entities (zero relations) get implied
-//      relations completed from memory co-occurrence.
-//   5. affective attribution (v0.13.0, #619) — opt-in. Occasion-bound emotions
-//      become affective_context relations; only emotions recurring across
-//      enough independent sessions are minted as type=pattern traits.
-// Each phase is wrapped so one failure never aborts the others, and a missing
-// LLM route / semantic embedder only skips the phases that need it. A run is
-// abortable via an AbortController signal (user activity) — phases check the
-// signal between batches so a running cycle yields promptly.
-import { randomUUID, createHash } from "node:crypto";
-import { validateDecisions, applyDecisions, ACTIONS } from "./decisions.js";
-import { findPotentialConflicts, cosineSimilarity } from "./clustering.js";
-import { triagePair, recordLedgerTriage } from "./triage.js";
-import { supersedeInfoFirstPair } from "./decisions.js";
-import { scopeKeyOf } from "../scope.js";
-import { buildReceipt, describeStreamFailure, resolveDreamEffort, withEffortFallback, withMaxTokensFallback, maintainIndexAfterDream, fenceListBody, parseFailureMeta } from "../dream.js";
-import { computeHeat } from "../heat.js";
-// 四个相位读的都是行池，而动行的写手不经汇流口：phaseDemotion 直接 setArchived /
-// demoteToSummary，phasePatterns 还会 mint 出新行，所以这条契约要在每处各挡一遍
-// （清单与静态锁见 test/share-imported-guard.test.js）。
-import { isImportedRow } from "../memory-source.js";
-// Issue #533：查账本时要拿两侧当前的正文哈希，与 applyDifferentiate 记账时的口径同源。
-import { contentHashOf } from "../content-hash.js";
-
-// Issue #126 review（Copilot）：默认档（sleepActionSet="conflict"）允许的动作 = 全局
-// ACTIONS 去掉 #126 新增的两个。从 ACTIONS 派生而非硬编码，将来再扩动作集时自动跟随。
-// 只换 prompt 挡不住模型自发输出新动作，必须由校验器按档位收口。
-const LEGACY_ACTIONS = [...ACTIONS].filter((a) => a !== "supersede" && a !== "differentiate");
-
-const SUMMARY_MAX = 120;
-// Conflict similarity threshold per strictness level (v0.4.0):
-//   gentle     only high-confidence pairs (0.92) — first-time users
-//   normal     standard dream-level (0.85) — default
-//   aggressive low-confidence pairs too (0.75) — bloated stores
-const CONFLICT_THRESHOLDS = { gentle: 0.92, normal: 0.85, aggressive: 0.75 };
-
-// Issue #529（C 项的替代实现）：连续失败时最小间隔的封顶。基数默认 8 小时，
-// 2^3 就到 64 小时——不封顶的话模型持续失败会让 sleep 事实上停摆好几天，而
-// 用户完全看不出来。24 小时 = 「最多一天试一次」，与 #292 给 autoDream 的
-// 30 分钟封顶同一意图（封顶值不同是因为两个调度的基数差一个数量级）。
-//
-// 实际封顶取 max(基数, 24h)，不是硬 24h：`sleepMinIntervalHours` 允许 1–168，
-// 用户配 48 小时就是明说"两天跑一次"，退避不该把它压回 24 小时（封顶只能放宽
-// 间隔、不能收紧用户自己设的）。
-const FAILURE_BACKOFF_CAP_MS = 24 * 3600000;
-
-// Issue #529（续排）：一轮内部最多连追多少轮。449 对的池子按每轮 60 对只需 8 轮，
-// 24 留足余量；超过就退回正常最小间隔。防的是"池子在长、每轮都 clean 但永远追不完"
-// ——用户持续写入时池子进得比追得快，光看 clean 会变成永不落地的每五分钟一轮，
-// 而审计上每轮都"有产出"，肉眼很难发现。
-const CATCHUP_STREAK_CAP = 24;
-
-function parseJsonArray(text) {
-  if (typeof text !== "string") return undefined;
-  const start = text.indexOf("[");
-  const end = text.lastIndexOf("]");
-  if (start === -1 || end <= start) return undefined;
-  try {
-    const parsed = JSON.parse(text.slice(start, end + 1));
-    return Array.isArray(parsed) ? parsed : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-/**
- * Same stream consumption contract as dream.js.
- *
- * `onUsage`（optional, issue #250）receives any usage chunk for token accounting.
- * dream.js 那份一直有它；sleep 这份副本没有，导致 conflict / pattern 两条链路的
- * token 从未进 llm_audit_logs（面板因此只看到 autoDream 与 autoSummarize）。
- */
-async function streamText(ctx, options, onUsage, onStreamError) {
-  if (!ctx?.llm?.stream) return undefined;
-  let text = "";
-  for await (const chunk of ctx.llm.stream(options)) {
-    if (chunk.type === "text-delta" && typeof chunk.text === "string") text += chunk.text;
-    // DSH 的 StreamChunk 契约把用量嵌在 chunk.usage（TokenUsage：inputTokens /
-    // outputTokens / totalTokens）；兼容直接平铺在 chunk 上的旧形态。归一放在
-    // 这里，调用侧的 reporter 只需认平铺形状——与 dream.js:239 同一处理。
-    if (chunk.type === "usage" && typeof onUsage === "function") onUsage(chunk.usage ?? chunk);
-    if (chunk.type === "finish" && (chunk.reason?.kind === "error" || chunk.reason?.kind === "aborted")) {
-      // Same rc.1 error-as-finish-chunk behavior as dream.js — surface the
-      // cause instead of discarding it.
-      if (typeof onStreamError === "function") {
-        try { onStreamError(chunk.reason); } catch { /* diagnostics only */ }
-      }
-      return undefined;
-    }
-  }
-  return text;
-}
-
-/**
- * Issue #250：给 sleep 的一条 LLM 调用记一笔 llm_audit_logs（token / 时长 / 状态 /
- * 触发源）。与 dream.js 的 runAuditedLlm 同口径但各自独立一份——dream 那两个
- * checker 的调用形状绑定着它自己的排程细节，硬抽共享抽象只会收敛回 dream 的形态。
- *
- * 记账是 best-effort：写审计行失败只 warn，绝不反噬 sleep 本体（CONTRIBUTING 的
- * fail-safe 硬约定）。`body(reportUsage)` 负责真实消费流，usage chunk 经
- * reportUsage 上报。
- *
- * 审计诚实性：流被中止/报错时 body 返回 undefined，记 status='error'；流式成功但
- * 输出不可用时 `spec.auditError` 给出原因，同样记 error——否则同一轮调用会在
- * 「phase 报 failed」与「audit 报 success」之间自相矛盾（CONTRIBUTING 的审计诚实性
- * 硬约定）。`auditError` 必须是**纯判据函数**：调用方的控制流不能依赖它的副作用，
- * 因为审计关闭时这里整段早退、钩子根本不会被调用（dream 正是那样踩的，见 PR 正文）。
- */
-async function auditedSleepLlm(ctx, service, config, logger, spec, body) {
-  if (config?.llmAudit?.enabled === false || typeof service?.saveLlmAudit !== "function") {
-    return body(() => {});
-  }
-  const startedAt = Date.now();
-  const timestamp = new Date(startedAt).toISOString();
-  let inputTokens = 0;
-  let outputTokens = 0;
-  let status = "success";
-  let errorMessage = null;
-  // 提到 try 之外：finally 里的 metadataFrom 要读这一轮的原始输出（dream.js 的
-  // runAuditedLlm 就是这么声明的）。留在 try 里，finally 看不见它，读数会静默变空。
-  let result;
-  try {
-    result = await body((usage) => {
-      if (!usage) return;
-      const i = usage.input_tokens ?? usage.inputTokens ?? usage.prompt_tokens ?? usage.promptTokens;
-      const o = usage.output_tokens ?? usage.outputTokens ?? usage.completion_tokens ?? usage.completionTokens;
-      if (Number.isFinite(i)) inputTokens = i;
-      if (Number.isFinite(o)) outputTokens = o;
-    });
-    if (result === undefined) {
-      status = "error";
-      const streamErr = typeof spec.streamError === "function" ? String(spec.streamError() ?? "") : "";
-      errorMessage = streamErr ? `llm stream aborted or errored (${streamErr})` : "llm stream aborted or errored";
-    } else if (typeof spec.auditError === "function") {
-      // 流式成功但输出不可用，仍然是一次失败的调用——记 error，不与调用方的
-      // failed 返回值打架。
-      const message = spec.auditError(result);
-      if (message) {
-        status = "error";
-        errorMessage = message;
-      }
-    }
-    return result;
-  } catch (error) {
-    status = "error";
-    errorMessage = String(error?.message ?? error);
-    throw error;
-  } finally {
-    // spec.metadataFrom(result)：与 dream.js 的 runAuditedLlm 同一形状（这里是一份并行
-    // 实现，不是同一个函数——两份审计写法的字段必须一致，否则面板按 operation_type
-    // 筛出来的读数会时有时没有）。判据函数只读 result，不读闭包，理由同 dream.js。
-    let metadata;
-    if (result !== undefined && typeof spec.metadataFrom === "function") {
-      try {
-        metadata = spec.metadataFrom(result) ?? undefined;
-      } catch {
-        metadata = undefined;
-      }
-    }
-    try {
-      service.saveLlmAudit({
-        timestamp,
-        trigger_source: spec.triggerSource,
-        operation_type: spec.operationType,
-        model_id: spec.modelId,
-        input_tokens: inputTokens,
-        output_tokens: outputTokens,
-        total_tokens: inputTokens + outputTokens,
-        cost_usd: 0,
-        duration_ms: Date.now() - startedAt,
-        status,
-        error_message: errorMessage,
-        related_memory_ids: spec.relatedMemoryIds ?? [],
-        ...(metadata ? { metadata } : {})
-      });
-    } catch (auditError) {
-      logger?.warn?.(`dsh-mneme sleep: llm audit write failed: ${String(auditError)}`);
-    }
-  }
-}
-
-/** LLM route (Issue #25): explicit sleepProvider/Model wins, then the dream
- *  route as a shared explicit fallback, then the agent default model. Sleep
- *  can pin a cheaper model for its bulk passes without disturbing the dream
- *  route. Explicit config first — otherwise the config routes are dead code
- *  whenever agentDefaultModel resolves (see resolveRoute in dream.js). */
-function resolveSleepRoute(ctx, config, logger) {
-  if (config.sleepProvider && config.sleepModel) return { provider: config.sleepProvider, model: config.sleepModel };
-  if (config.dreamProvider && config.dreamModel) return { provider: config.dreamProvider, model: config.dreamModel };
-  try {
-    const sel = ctx?.agentDefaultModel?.currentSelection?.();
-    if (sel?.provider && sel?.model) return { provider: sel.provider, model: sel.model };
-  } catch { /* fall through to warn */ }
-  logger?.warn?.("dsh-mneme sleep: no llm route available");
-  return undefined;
-}
-
-function makeSummary(m) {
-  const text = (m.content ?? "").trim();
-  if (!text) return (m.title ?? "").trim();
-  return text.length <= SUMMARY_MAX ? text : `${text.slice(0, SUMMARY_MAX)}…`;
-}
-
-// issue #471 政策轴：被按下的作用域也不参与睡眠整理。与 dream.js 的 withoutPaused
-// 同源（那里记着「判定只许有一份实现」的理由），但这里是**单独一处**而不是复用：
-// 两个模块各被独立装配（runSleep / runDream 各自接 service），任何一个被换进只
-// 实现了一半 service 的夹具时都该各自降级，而不是因为对方模块没装而双双失效。
-//
-// 睡眠侧比日间加固侧更要紧：这几个相位不只读——phaseDemotion 会 setArchived 与
-// demoteToSummary（真改归档面），phasePatterns 会 mint 出 type=pattern 的新行
-// （凭空给被按下的作用域生出衍生记忆）。只挡日间那几处读入口的话，闸门开着而每
-// 6 小时一次的睡眠照样动手，那等于「按下」只是让它在白天看不见。
-//
-// service 上取不到 filterPaused 时（老装配、测试夹具）原样返回，与改动前一致。
-function withoutPaused(service, rows) {
-  if (typeof service?.filterPaused !== "function") return rows;
-  return service.filterPaused(rows);
-}
-
-// ---------------------------------------------------------------- phases
-
-/**
- * Phase 1 — conflict resolution. Needs a semantic embedder + vector index.
- * In freeze mode (conflictFreezeEnabled) conflicting pairs are parked in
- * conflict_pending for human review (no LLM). Otherwise the LLM adjudicates:
- * each pair → winner kept / loser archived. Returns a per-run summary.
- */
-async function phaseConflicts(ctx, service, config, logger, runId, semantic = null, signal = null) {
-  const language = langOf(config);
-  const embedder = semantic?.embedder;
-  const vectorIndex = semantic?.vectorIndex;
-  if (!embedder || !vectorIndex || typeof embedder.embed !== "function") {
-    return { status: "skipped", reason: "no semantic embedder" };
-  }
-  const strictness = config.sleepConflictStrictness ?? "normal";
-  const threshold = CONFLICT_THRESHOLDS[strictness] ?? CONFLICT_THRESHOLDS.normal;
-  const memories = withoutPaused(service, service.all().filter((m) => !isImportedRow(m) && !m.archived && !m.forgotten && m.type !== "summary" && m.type !== "document"));
-  if (memories.length < 2) return { status: "skipped", reason: "too few memories" };
-  if (signal?.aborted) return { status: "aborted", reason: "user activity" };
-
-  // Backfill + collect vectors for every eligible memory (best effort).
-  const vectors = new Array(memories.length);
-  const missing = [];
-  for (let i = 0; i < memories.length; i++) {
-    const cached = vectorIndex.getEmbedding?.(memories[i].id);
-    if (cached) vectors[i] = cached;
-    else missing.push(i);
-  }
-  if (missing.length) {
-    try {
-      const texts = missing.map((i) => [memories[i].title, memories[i].content].filter(Boolean).join("\n"));
-      const rows = await embedder.embed(texts);
-      missing.forEach((mi, j) => {
-        if (rows[j]?.length) {
-          vectors[mi] = rows[j];
-          vectorIndex.saveEmbedding?.(memories[mi].id, rows[j]);
-        }
-      });
-    } catch (error) {
-      logger?.warn?.(`dsh-mneme sleep: conflict vector backfill failed: ${String(error)}`);
-    }
-  }
-  const usable = [];
-  for (let i = 0; i < memories.length; i++) {
-    if (vectors[i]?.length) usable.push(i);
-  }
-  if (usable.length < 2) return { status: "skipped", reason: "no usable vectors" };
-  const usableMemories = usable.map((i) => memories[i]);
-  const usableVectors = usable.map((i) => vectors[i]);
-
-  // Issue #126：动作集档位既要决定 prompt，也要决定**校验器允许的动作集合**（见下方
-  // allowedActions），并且在候选构造阶段就要知道——full 档需要补跨类型对。因此在这里
-  // 解析，而不是等到拼 prompt 时。
-  const actionSet = config.sleepActionSet ?? "conflict";
-  const pairs = findPotentialConflicts(usableMemories, usableVectors, threshold);
-  if (actionSet === "full") {
-    // Issue #126 review（Copilot）：findPotentialConflicts 只看同类型，而 full 档的
-    // prompt 明确宣传 differentiate 用于互补型——互补本来就常跨类型（同一事实的项目侧
-    // 与偏好侧）。不补这一遍，那条路径永远选不到。merge 的类型守卫不受影响：它拦在
-    // validateDecisions 里（allowCrossTypeMerge），不在候选生成。
-    for (let i = 0; i < usableMemories.length; i++) {
-      for (let j = i + 1; j < usableMemories.length; j++) {
-        if (usableMemories[i].type === usableMemories[j].type) continue;
-        const sim = cosineSimilarity(usableVectors[i], usableVectors[j]);
-        if (sim > threshold) pairs.push({ a: usableMemories[i], b: usableMemories[j], similarity: sim });
-      }
-    }
-  }
-  if (pairs.length === 0) return { status: "skipped", reason: "no conflicts found" };
-
-  // Dedupe: each memory participates in at most one pair, highest similarity
-  // first — overlapping pairs would violate validateDecisions' "one claim".
-  pairs.sort((a, b) => b.similarity - a.similarity);
-
-  // Issue #533：已经裁决过「互补、两条都留」的对不再重判。
-  //
-  // 过滤必须发生在 used 去重**之前**：若先占位再丢弃，一条已裁决的记忆会把
-  // 名额占住，而它真正的对手又是自己人，这一轮就白跑——抑制一对不该顺带压掉
-  // 另一对候选。判据与 applyDifferentiate 的幂等同源：账本里有这对、且两侧正文
-  // 的 content_hash 与记账时一致（任一侧改过 = 结论可能不再成立，重判）。
-  // 存量兼容走同一格：旧版本把注记写进正文却没账本行，两侧都还带着注记块也算
-  // 已裁决，免得升级后第一轮把所有老对重判一遍。
-  const alreadyDifferentiated = (p) => {
-    const a = service.getById(p.a.id);
-    const b = service.getById(p.b.id);
-    if (!a || !b) return false;
-    if (typeof service.findDifferentiatedPair === "function") {
-      const record = service.findDifferentiatedPair(a.id, b.id);
-      if (record) {
-        const [ha, hb] = a.id <= b.id
-          ? [contentHashOf(a), contentHashOf(b)]
-          : [contentHashOf(b), contentHashOf(a)];
-        // 账本行没记 hash（存量/异常写入）时不下结论，宁可多判一次。
-        return record.hash_a != null && record.hash_b != null
-          && record.hash_a === ha && record.hash_b === hb;
-      }
-    }
-    return STR.differentiatedNoteRe.test(String(a.content ?? ""))
-      && STR.differentiatedNoteRe.test(String(b.content ?? ""));
-  };
-  const fresh = [];
-  let suppressed = 0;
-  for (const p of pairs) {
-    if (alreadyDifferentiated(p)) {
-      suppressed += 1;
-      continue;
-    }
-    fresh.push(p);
-  }
-  if (fresh.length === 0) {
-    // 与 "no conflicts found" 分开报：一对都没检测到 vs 检测到但全都裁决过，
-    // 是完全不同的两件事，混成一句会让「sleep 是不是没在干活」读不出来。
-    return { status: "noop", reason: "all candidate pairs already differentiated", suppressed };
-  }
-
-  // Issue #529：输入侧预算。此前 samePairs 是**全部**同 scope 相似对，一次拼成一个
-  // prompt——实测单请求 163,054 输入 token（服务端 --ctx-size 163,840），撞墙后按冷却
-  // 重排，下一轮送进去的还是同一份输入，于是 23 轮连续失败。
-  //
-  // 预筛掉「已经判过且两侧都没动过」的对：判 keep 曾经是彻底的 no-op，既不留痕也不
-  // 影响下一轮的候选池，同一对每个冷却周期都被重新送审一遍。台账（conflict_reviewed）
-  // 记的是"这段输入被看过"，两侧任一 updated_at 晚于 judged_at 就重新入池——与
-  // conflict_pending 复核项 4 同一条宽松代理：任何字段更新都算值得再看一眼。
-  //
-  // Issue #536 review（CodeRabbit ①）：预筛必须发生在下面的 used 去重**之前**，理由与
-  // #533 那条一模一样——先占位再去掉，一条已审的记忆会把自己的配对名额占住，而它真正
-  // 的对手（另一条没审过的记忆）因此进不了这一轮。三条边界：
-  //   · 只筛同 scope 对：跨 scope 对本来就要停车进人工队列，不能被台账吞掉；
-  //   · freeze 模式不筛：那一档只停车不送 LLM，台账与它无关（ledgerSkipped 记 0）；
-  //   · ledgerSkipped 在这里一次数清，后面 candidates 直接取 samePairs，不再二次过滤。
-  // ⚠️ Issue #616：这个判据把「未标注」当成「同 scope」。scopeKeyOf 把 NULL/空串
-  // 归一成 null，于是两条都没标注时 null !== null 为 false，配对算同 scope、可以进
-  // 自动池。但「归属未知」和「归属相同」不是一回事：按 v0.8.1 #170，前者本该是不可
-  // 自动的范围。live 库活跃 8259 行里 2710 行（32.8%）两个 scope 全 NULL，受影响的
-  // 面不小。修法是把「任一未标注」显式判为不可自动，而不是继续让 null 自我相等。
-  const isCrossScopePair = (p) =>
-    scopeKeyOf(p.a.agent_scope) !== scopeKeyOf(p.b.agent_scope)
-    || scopeKeyOf(p.a.workspace_scope) !== scopeKeyOf(p.b.workspace_scope);
-  const ledger = typeof service.loadConflictReviewed === "function"
-    ? (service.loadConflictReviewed() ?? new Map())
-    : new Map();
-  const pairKey = (p) => (p.a.id < p.b.id ? `${p.a.id}\u0000${p.b.id}` : `${p.b.id}\u0000${p.a.id}`);
-  const alreadyJudged = (p) => {
-    const rec = ledger.get(pairKey(p));
-    if (!rec?.judged_at) return false;
-    return (p.a.updated_at ?? "") <= rec.judged_at && (p.b.updated_at ?? "") <= rec.judged_at;
-  };
-  // Issue #641（beta 第二阶段）：分诊账本的档位。#616 点名的父子绑定不继承——
-  // enforce 与 freeze 同开时 freeze 让位（本相位降级 shadow + warn）：freeze 照常
-  // 停车（shadow 语义 = 只记账零处置），绝不出现两套处置语义同时生效。宁可少处置，
-  // 不在打架的配置下跑。
-  let ledgerMode = config.conflictLedgerMode ?? "off";
-  if (ledgerMode === "enforce" && config.conflictFreezeEnabled === true) {
-    logger?.warn?.("dsh-mneme sleep: conflictLedgerMode=enforce coexists with conflictFreezeEnabled — degrading to shadow; disable one of them");
-    ledgerMode = "shadow";
-  }
-  // alreadyJudged 预筛只为省 LLM：freeze 与 enforce 都不走 LLM，筛不筛不影响成本，
-  // 不筛还能让 T2/T3/T4 的每轮观察持续刷新账本（tier 可能随内容更新而变）。
-  const selectionPairs = config.conflictFreezeEnabled === true || ledgerMode === "enforce"
-    ? fresh
-    : fresh.filter((p) => isCrossScopePair(p) || !alreadyJudged(p));
-  const ledgerSkipped = fresh.length - selectionPairs.length;
-
-  const used = new Set();
-  const selected = [];
-  for (const p of selectionPairs) {
-    if (used.has(p.a.id) || used.has(p.b.id)) continue;
-    used.add(p.a.id);
-    used.add(p.b.id);
-    selected.push(p);
-  }
-
-  // Issue #641（beta 第一阶段，shadow 档）：分诊账本。对 selected 全量做确定性
-  // 分诊（dup / cross-scope-dup / evolution / conflict，判据唯一实现见 triage.js）
-  // 并落 conflict_ledger。shadow = 只记账零处置：下面 freeze/LLM 路径一个字节都
-  // 不变——shadow 的存在意义就是让「分诊分布是否复现真实库 46/20/5/27」在真实
-  // 运行里可测，作为切 enforce 前的预注册证据。记账失败只 warn 计数，绝不反噬
-  // 相位（与 conflict_reviewed 同一条 best-effort 纪律）。
-  // 记账时点在 used 去重之后：被去重压掉的那半边对（同一条记忆配给了更高相似的
-  // 对手）本来就不是这一轮的候选，观察它们只会让分母虚高。
-  const ledgerTriage = ledgerMode !== "off"
-    ? await recordLedgerTriage(service, runId, selected, {
-        dupMinSimilarity: config.conflictLedgerDupMinSimilarity,
-        logger,
-        // 分块记账的取消检查：用户活动打断时停止记账，余下的对下一轮重见
-        signal
-      })
-    : null;
-
-  // Issue #641（beta 第二阶段，enforce 档）：确定性处置接线。T1（dup）走
-  // supersedeInfoFirstPair（与冻结分支自动档同一条契约，decisions.js 共享实现）；
-  // T1 走信息量优先 supersede、T3 走取代链（superseded_by 指向，不归档）、
-  // T2/T4 记账即处置——不停车、不送 LLM。人审队列与 LLM 裁决在本档下都不再
-  // 消费冲突候选，conflict_pending 恒空。每轮上限沿用
-  // sleepConflictMaxPairsPerRun：处置虽不走 LLM，归档/落链仍是写动作，写预算
-  // 与 freeze/auto 两档同口径。T4 的检索时消解（fuseRecall 矛盾感知 + 注入
-  // 标注）是后续 PR，本档先把人审摘出去。
-  if (ledgerMode === "enforce") {
-    const perRunCap = config.sleepConflictMaxPairsPerRun ?? 60;
-    const pool = perRunCap > 0 ? selected.slice(0, perRunCap) : selected;
-    let t1Resolved = 0;
-    let t1Failed = 0;
-    let t3Chained = 0;
-    const t1VectorFixups = [];
-    for (const p of pool) {
-      const verdict = triagePair(p.a, p.b, p.similarity, { dupMinSimilarity: config.conflictLedgerDupMinSimilarity });
-      if (verdict.tier === "evolution") {
-        // T3 取代链（beta 第三阶段）：旧行 superseded_by → 新行，检索降权，
-        // **不归档**——演进不是输赢，旧值仍是「曾经为真」的可追溯历史（与
-        // supersede 动作的归档语义不同）。新者胜对演进成立：间隔 ≥7 天的
-        // 同主题对，新记载才反映现状（服务器时钟，内容声称的时间不做键）。
-        const newer = (p.a.created_at ?? "") >= (p.b.created_at ?? "") ? p.a : p.b;
-        const older = newer === p.a ? p.b : p.a;
-        try {
-          if (service.supersedeChain(older.id, newer.id)) {
-            t3Chained += 1;
-            // 先落观察行再推进状态（#650 评审）：enforce 档下 recordLedgerTriage 只会
-            // 把这一对写成 open，UPDATE 于此才有行可命中；顺序反了就是静默落空。
-            service.saveConflictLedgerEntry({ run_id: runId, memory_a: p.a.id, memory_b: p.b.id, tier: verdict.tier, similarity: p.similarity, signals: verdict.signals });
-            service.setConflictLedgerStatus(p.a.id, p.b.id, "superseded");
-          }
-        } catch (error) {
-          logger?.warn?.(`dsh-mneme sleep: ledger T3 chain failed for ${p.a.id}/${p.b.id}: ${String(error)}`);
-        }
-        continue;
-      }
-      if (verdict.tier !== "dup") continue;
-      let res = null;
-      try {
-        res = supersedeInfoFirstPair(p, service, logger, config);
-      } catch (error) {
-        logger?.warn?.(`dsh-mneme sleep: ledger T1 supersede failed for ${p.a.id}/${p.b.id}: ${String(error)}`);
-      }
-      if (res?.applied) {
-        t1Resolved += 1;
-        // winner/loser 用 helper 判定的真实方向（信息量优先可能翻转 p.a/p.b）
-        t1VectorFixups.push({ action: "supersede", winner: res.winnerId, loser: res.loserId });
-        try {
-          // 账本状态推进 + 机器台账照记（与自动档同款 outcome 口径）——自动处置
-          // 也要能事后回答「这一对什么时候、被谁判的」。先落观察行（#650 评审）：
-          // 这一对未必已在账本里，直接 UPDATE 会命中 0 行而静默失记。
-          service.saveConflictLedgerEntry({ run_id: runId, memory_a: p.a.id, memory_b: p.b.id, tier: verdict.tier, similarity: p.similarity, signals: verdict.signals });
-          service.setConflictLedgerStatus(p.a.id, p.b.id, "superseded");
-          service.saveConflictReviewed?.({ run_id: runId, memory_a: p.a.id, memory_b: p.b.id, outcome: "supersede", judged_at: new Date().toISOString() });
-        } catch (error) {
-          logger?.warn?.(`dsh-mneme sleep: ledger bookkeeping after T1 supersede failed for ${p.a.id}/${p.b.id}: ${String(error)}`);
-        }
-      } else {
-        t1Failed += 1;
-      }
-    }
-    // 败者向量清理：T1 的 supersede 不在下面 LLM 通路的 maintainIndexAfterDream
-    // 清单里（enforce 已早退），必须在早退前自己清——已归档行留向量等于检索
-    // 层「看得见摸不着」。
-    if (t1VectorFixups.length > 0 && semantic?.embedder && semantic?.vectorIndex) {
-      try {
-        await maintainIndexAfterDream(t1VectorFixups, service, semantic);
-      } catch (error) {
-        logger?.warn?.(`dsh-mneme sleep: ledger T1 index maintenance failed: ${String(error)}`);
-      }
-    }
-    if (selected.length > pool.length) {
-      logger?.warn?.(`dsh-mneme sleep: conflict ledger enforce capped at ${pool.length}/${selected.length} pairs this run`);
-    }
-    return {
-      status: t1Failed > 0 ? "degraded" : t1Resolved > 0 || t3Chained > 0 ? "ok" : "noop",
-      clean: t1Failed === 0,
-      frozen: 0,
-      scopeCandidates: 0,
-      pairs: selected.length,
-      batches: 0,
-      ledgerSkipped,
-      // applied 是整轮回执的唯一写库口径（runSleep 的 totalApplied 只认这个键）。
-      // 缺了它，本档真实发生的 T1 归档与 T3 落链在 receipt / dream_runs.applied
-      // 里全是 0 ——「本相位说改了、整轮说没改」（#650 评审，#619 同族）。
-      applied: t1Resolved + t3Chained,
-      enforced: { t1Resolved, t1Failed, t3Chained },
-      ...(ledgerTriage ? { ledgerTriage } : {})
-    };
-  }
-
-  // v0.8.1（issue #170 第 2 步）：跨 scope 相似对分流。同一内容落在两个归属下
-  // （任一维标注键不等即算，NULL=未标注=全局也参与比较——「全局副本 + 专属副本
-  // 并存」正是收窄/提升裁决的典型候选）不能自动裁决：归档败者可能销毁该内容在
-  // 某个归属下的唯一副本，LLM 也无从替用户决定归属。一律停车到冲突待确认队列
-  // （专属 reason），同 scope 对维持既有路径（freeze 停车 / LLM 裁决）。
-  const crossPairs = selected.filter(isCrossScopePair);
-  const samePairs = selected.filter((p) => !isCrossScopePair(p));
-  // 四态：fresh（真的新插了一行）/ existing（这一对已在队列里）/ suppressed
-  // （已人工裁决且两侧未变，复核项 4）/ failed（写库抛错）。旧代码把
-  // 「返回非 null」一律当停车成功，existing 因此每轮虚报一遍 frozen（#603）。
-  const parkPair = (p, reason) => {
-    try {
-      const parked = service.saveConflictPending({ run_id: runId, memory_a: p.a.id, memory_b: p.b.id, reason, similarity: p.similarity });
-      if (parked == null) return "suppressed";
-      return parked.fresh === true ? "fresh" : "existing";
-    } catch (error) {
-      logger?.warn?.(`dsh-mneme sleep: failed to park conflict ${p.a.id}/${p.b.id}: ${String(error)}`);
-      return "failed";
-    }
-  };
-  const scopeReason = (p) => STR.scopeCandidateReason[language](p.similarity.toFixed(2));
-  const simReason = (p) => STR.similarityReason[language](p.similarity.toFixed(2));
-
-  // 待审对的键集合（与 pairKey 同形）。只用于 freeze 分支的「先滤已入队」，
-  // 分页拉全量：队列规模不受 50 条默认页长限制。
-  const loadPendingPairKeys = () => {
-    const keys = new Set();
-    if (typeof service.listConflictPending !== "function") return keys;
-    const pageSize = 500;
-    for (let offset = 0; ; offset += pageSize) {
-      const page = service.listConflictPending({ limit: pageSize, offset, includeResolved: false }) ?? [];
-      for (const row of page) keys.add(`${row.memory_a}\u0000${row.memory_b}`);
-      if (page.length < pageSize) break;
-    }
-    return keys;
-  };
-
-  // Freeze mode: park pairs for manual review, no LLM required. Cross-scope
-  // pairs carry the dedicated scope-candidate reason so the queue reads them
-  // as ownership decisions rather than plain duplicates.
-  //
-  // Issue #603 第 1 层：这条分支此前绕过全部三个上限、直接裸跑 selected。
-  //   · 先滤已入队再截断——裸 slice 会饥饿：上限恒小于候选数时，前 N 个名额
-  //     每轮都被同一批已在队列里的对占住，后面的对永远轮不上；
-  //   · 接预算：conflictFreezeMaxPending 决定队列还能装多少，
-  //     sleepConflictMaxPairsPerRun 决定一轮最多处理多少，取两者较小值；
-  //   · 只把 fresh 计入 frozen，已入队的对不再虚报。
-  //
-  // ⚠️ Issue #616：下面这段 freeze 分支同时也是「自动裁决档」的唯一宿主——
-  // conflictAutoResolveEnabled 的全部逻辑（autoEnabled / autoPool / autoResolved）
-  // 都在这对花括号里面。两个配置键在面板上看是平行的，实际是父子：把 freeze
-  // 关掉，自动档会跟着静默消失，没有任何提示。拆开之前别把它们当独立开关用。
-  if (config.conflictFreezeEnabled === true) {
-    const maxPending = Number.isInteger(config.conflictFreezeMaxPending) ? config.conflictFreezeMaxPending : 100;
-    const pendingNow = typeof service.countConflictPending === "function" ? (service.countConflictPending() ?? 0) : 0;
-    const room = Math.max(0, maxPending - pendingNow);
-    const pendingKeys = loadPendingPairKeys();
-    const unparked = selected.filter((p) => !pendingKeys.has(pairKey(p)));
-    const withinRoom = room > 0 ? unparked.slice(0, room) : [];
-    const pendingSkipped = unparked.length - withinRoom.length;
-    const perRunCap = config.sleepConflictMaxPairsPerRun ?? 60;
-    const pool = perRunCap > 0 ? withinRoom.slice(0, perRunCap) : withinRoom;
-    // 只报「有位置但被每轮上限截住」的那部分：队列满时再追一轮也没用，
-    // 报成 backlog 会让调度器空转（catchup 上限 24 轮）。
-    const perRunSkipped = withinRoom.length - pool.length;
-    // Issue #603 第 4 层（自动裁决档，默认关）：相似度极高的**同 scope** 对不再
-    // 进人工队列，直接保留信息量更大的那条、归档另一条。人只看模糊地带。
-    //
-    // 为什么阈值留在配置里而不是写死 0.95：这一档减的是峰值，
-    // 不是把队列清零——把阈值当常量会让人以为「开了就没事了」。
-    //
-    // 为什么跨 scope 永不自动：归属是用户的决定（v0.8.1 #170），归档败者可能
-    // 销毁某归属下的唯一副本。这条约束比减负重要。
-    //
-    // ⚠️ Issue #616：这条守卫有一个洞。isCrossScopePair 走 scopeKeyOf，NULL 归一
-    // 成 null，null !== null 判为 false —— 「未标注」因此被当成「同 scope」混进
-    // autoPool。live 库活跃 8259 行里 2710 行（32.8%）两个 scope 全 NULL。改判据
-    // 之前，别把这一档当成「归属安全」。
-    //
-    // 为什么用 supersede 而不是 conflict：conflict 会把「（已否决旧信息：…）」
-    // 追加到**赢家**正文，而赢家正是留下来的那条；近重复对再叠一段互相引用的
-    // 注记，等于用冗余污染幸存记忆。supersede 把可追溯性留在被归档的一侧，
-    // 赢家正文一字不动（#126 的原设计）。
-    const autoEnabled = config.conflictAutoResolveEnabled === true;
-    const autoMin = typeof config.conflictAutoResolveMinSimilarity === "number"
-      ? config.conflictAutoResolveMinSimilarity
-      : 0.95;
-    const autoPool = [];
-    const parkPool = [];
-    for (const p of pool) {
-      const eligible = autoEnabled
-        && !isCrossScopePair(p)
-        && typeof p.similarity === "number"
-        && p.similarity >= autoMin;
-      (eligible ? autoPool : parkPool).push(p);
-    }
-    let autoResolved = 0;
-    let autoFailed = 0;
-    // 这一档不走 LLM，没有批次时间戳可借（judgedAt 在下面那条 LLM 通路里才定义），
-    // 自己取一个：台账要能回答「什么时候判的」，不能留空。
-    const autoJudgedAt = new Date().toISOString();
-    // 保留**信息量更大**的那条，不是更新的那条。
-    //
-    // 「保留新的」看着合理，实测是错的：live 库 >=0.95 的 20 对里，11 对（55%）
-    // 新的那条比旧的短，平均短 132 字；降到 0.88 的 213 对里 122 对（57%）如此。
-    // 典型例子：「用户同时开 web profile 和 desktop profile 时出现开不了新对话/
-    // 会话异常，用户自己…」（371 字，旧）被压成「用户同时开 web profile 和
-    // desktop profile 的 dsh-mneme 时开不了新对话」（307 字，新）——蒸馏时压缩过
-    // 的一版反而更新。留新条等于把更完整的那条归档掉。
-    //
-    // 这与 mem0 的裁决规则一致：`configs/prompts.py:217` 明写「两句话说的是同一
-    // 件事时，留信息量最大的那条，不是留最新的」。cognee 反过来（「取更新的」），
-    // 那是反例——照抄会把「0:00 前必须躺下」削成残缺版。
-    //
-    // 长度相同才算「信息量相当」，此时退回更新时间，再退回 id：三级兜底保证同一
-    // 对每次判出同一个赢家（否则重放会来回翻，归档的可能是刚保住的那条）。
-    const infoFirst = (p) => {
-      const an = p.a.content?.length ?? 0;
-      const bn = p.b.content?.length ?? 0;
-      if (an !== bn) return an > bn ? [p.a, p.b] : [p.b, p.a];
-      const au = p.a.updated_at ?? "";
-      const bu = p.b.updated_at ?? "";
-      if (au !== bu) return au > bu ? [p.a, p.b] : [p.b, p.a];
-      return p.a.id > p.b.id ? [p.a, p.b] : [p.b, p.a];
-    };
-    for (const p of autoPool) {
-      const [winner, loser] = infoFirst(p);
-      const snapshot = new Map();
-      for (const m of [winner, loser]) {
-        snapshot.set(m.id, { updated_at: m.updated_at, content: m.content, title: m.title });
-      }
-      // trustEpistemicWeighting 显式关掉：它会在 applySupersede 里按 epistemic_status
-      // 交换赢家，那会让「留信息量更大的那条」这条契约随数据漂移。自动档的承诺
-      // 必须是确定的。
-      const { applied, conflicts } = applyDecisions(
-        [{ action: "supersede", winner: winner.id, loser: loser.id }],
-        service, logger, snapshot, { ...config, trustEpistemicWeighting: false }
-      );
-      if (applied > 0) {
-        autoResolved++;
-        // 记进机器侧台账：自动动作也要能事后回答「这一对什么时候、被谁判的」。
-        try {
-          service.saveConflictReviewed?.({
-            run_id: runId, memory_a: p.a.id, memory_b: p.b.id,
-            outcome: "supersede", judged_at: autoJudgedAt
-          });
-        } catch (error) {
-          logger?.warn?.(`dsh-mneme sleep: failed to record auto-resolved pair ${p.a.id}/${p.b.id}: ${String(error)}`);
-        }
-        continue;
-      }
-      // 自动档没落地 → 退回人工队列。绝不因为「本来想自动处理」就把这一对丢掉，
-      // 那才是真正的静默丢失。两种没落地的原因都要说清楚：
-      //   · CAS 冲突（applyDecisions 记在 conflicts 里）——两侧在快照之后被改过，
-      //     自动判的赢家可能已经不是该保的那条，人看一眼最稳；
-      //   · 其余异常（记在 failures 里）——写库失败之类，重试无意义就交给人。
-      autoFailed++;
-      logger?.warn?.(
-        `dsh-mneme sleep: auto-resolve skipped ${p.a.id}/${p.b.id}`
-        + (conflicts.length ? ` (concurrent edit)` : "")
-        + `, falling back to manual review`
-      );
-      parkPool.push(p);
-    }
-    let frozen = 0;
-    let parkFailed = 0;
-    for (const p of parkPool) {
-      const outcome = parkPair(p, isCrossScopePair(p) ? scopeReason(p) : simReason(p));
-      if (outcome === "fresh") frozen++;
-      else if (outcome === "failed") parkFailed++;
-    }
-    if (pendingSkipped > 0) {
-      logger?.warn?.(`dsh-mneme sleep: conflict freeze queue full (${pendingNow}/${maxPending}), skipped ${pendingSkipped} conflict(s)`);
-    }
-    return {
-      status: frozen > 0 || autoResolved > 0 ? "ok" : "noop",
-      frozen,
-      // 自动裁决掉的不进队列，但确实是这一轮干的活——分开报，别混进 frozen
-      // （frozen 的语义是「给人工队列新增了几行」，混进去面板就会虚高）。
-      // Issue #616：这两个字段目前**没有消费者**。dream.js 的两处 return 只透出
-      // frozen，面板也不读它们；conflict_reviewed 台账同样没有 API 暴露，且 schema
-      // 不记赢家（memory_a/b 是排序过的）。也就是说自动裁决干了什么，事后只能翻
-      // loser 正文的「（已被取代：…）」后缀反推。补可见性之前，别指望从报告里看出
-      // 这一档跑了几对。
-      autoResolved,
-      autoFailed,
-      // 写库抛错的对既没入队也不算落地：clean=false，别让调度器当「追完了」。
-      clean: parkFailed === 0,
-      scopeCandidates: crossPairs.length,
-      pairs: selected.length,
-      batches: 0,
-      ledgerSkipped,
-      perRunSkipped,
-      pendingSkipped,
-      // #641 shadow：分诊分布随相位结果透出（dream phases 与审计行都能看到），
-      // 面板消费在 beta 第二批接。
-      ...(ledgerTriage ? { ledgerTriage } : {})
-    };
-  }
-
-  // 非 freeze：跨 scope 对先停车（绝不进 LLM 裁决），同 scope 对照常走 LLM。
-  let scopeParked = 0;
-  for (const p of crossPairs) {
-    if (parkPair(p, scopeReason(p)) === "fresh") scopeParked++;
-  }
-  if (samePairs.length === 0) {
-    // 没有可送 LLM 的同 scope 对：可能一对都没检测到，也可能全被台账挡下了
-    // （ledgerSkipped）。两种都要如实报，否则「sleep 怎么什么都不干」读不出来。
-    return {
-      status: scopeParked > 0 ? "ok" : "noop",
-      frozen: 0,
-      scopeCandidates: scopeParked,
-      pairs: selected.length,
-      batches: 0,
-      ledgerSkipped,
-      ...(ledgerTriage ? { ledgerTriage } : {})
-    };
-  }
-
-  // LLM adjudication（仅同 scope 对）。
-  const route = resolveSleepRoute(ctx, config, logger);
-  if (!route) return { status: "skipped", reason: "no llm route", scopeCandidates: scopeParked, pairs: selected.length, batches: 0, ledgerSkipped, ...(ledgerTriage ? { ledgerTriage } : {}) };
-  // 每轮总上限：分批解决的是单请求撞墙，不是"一个 449 对的池子该在一轮里跑完"。
-  // 没进这一轮的对留在下一轮（它们既没被丢弃，也不在台账里）。
-  const perRunCap = config.sleepConflictMaxPairsPerRun ?? 60;
-  const pool = perRunCap > 0 ? samePairs.slice(0, perRunCap) : samePairs;
-  const perRunSkipped = samePairs.length - pool.length;
-  const sleepEffort = await resolveDreamEffort(ctx, route, config.sleepReasoningEffort, logger);
-  let conflictStreamFailure = "";
-  // actionSet 已在候选构造前解析（跨类型候选需要它），这里只按档位选 prompt：
-  // 默认档保持只有 conflict/keep 的窄 prompt，"full" 才开放六分支。
-  const conflictPrompt = actionSet === "full" ? STR.prompts.conflictFull[language] : STR.prompts.conflict[language];
-  // reflectionUpdateEnabled=false：两份 conflict prompt 都教了模型怎么用 update
-  // （「信息部分过时 → update」那一支），只靠校验器拒会把每轮这份输出白付掉。
-  // 后缀与 dream 主链路共用同一条文案，两个入口对用户是同一个开关、同一种说法。
-  const conflictPromptGated = config.reflectionUpdateEnabled !== false
-    ? conflictPrompt
-    : conflictPrompt + STR.prompts.noUpdateSuffix[language];
-  const runConflict = (batch, withEffort, tokens) => {
-    conflictStreamFailure = "";
-    const listText = batch.map((p) => STR.candidateConflicts[language](p)).join("\n\n");
-    return auditedSleepLlm(ctx, service, config, logger, {
-      triggerSource: "sleep",
-      operationType: "sleep_conflict",
-      modelId: `${route.provider}:${route.model}`,
-      // 候选对的双方 id：面板的活动流用 related_memory_ids 解析「沉淀条数」。
-      // 分批后必须取**这一批**的 id：整轮的 60 对一次写进每一批的审计行，面板会把
-      // 同一个「沉淀条数」重复累加五遍。
-      relatedMemoryIds: batch.flatMap((p) => [p.a.id, p.b.id]),
-      streamError: () => conflictStreamFailure,
-      // 纯判据：输出里没有 JSON 数组 ⇒ 这轮是失败的调用，审计记 error。**不要**把
-      // 解析结果存进闭包给下面的控制流用——审计关闭时 auditedSleepLlm 整段早退、
-      // 这个钩子不会被调用，控制流会跟着失效（dream 的既有坑）。代价是审计开启时
-      // 多解析一次，换来两条路径彻底解耦。
-      auditError: (text) => (parseJsonArray(text) ? null : "no json array in llm output"),
-      // 纯判据，与 auditError 同一条约定：重解析一次、不读闭包（审计关掉时那些闭包
-      // 根本不会被赋值，读它会让「审计说了什么」依赖调用方走到了哪一行）。
-      metadataFrom: (text) => (parseJsonArray(text) ? null : parseFailureMeta(text))
-    }, (reportUsage) => streamText(ctx, {
-    provider: route.provider,
-    model: route.model,
-    purpose: "sleep-conflict",
-    maxTokens: tokens,
-    ...(withEffort && sleepEffort ? { reasoningEffort: sleepEffort } : {}),
-    messages: [
-      { role: "system", content: [{ type: "text", text: conflictPromptGated }], source: { kind: "plugin:dsh-mneme", plugin: "dsh-mneme" } },
-      { role: "user", content: [{ type: "text", text: fenceListBody(language, listText) }], source: { kind: "plugin:dsh-mneme", plugin: "dsh-mneme" } }
-    ]
-  }, reportUsage, (reason) => { conflictStreamFailure = describeStreamFailure(reason); }));
-  };
-  // 单批的完整往返：送 → 解析 → 校验 → 应用 → 记账。抽成函数是为了让失败只影响
-  // 自己这一批（下面的循环），而不是把整轮判死。
-  const adjudicateBatch = async (batch, updateBudget) => {
-    // Issue #529 review（CodeRabbit ①）：留痕写入失败要能被上层看见。只打 warn 的话，
-    // 这一对既没记账、又被算成"送出去的全落地了"，于是下一轮它原样回到候选池、又被
-    // 算成可续排——每个静默窗口重问一次同一个冲突，直到连击上限才停，而审计上每轮
-    // 都是干净的成功轮。计数随返回值透出，由 phaseConflicts 折进 clean。
-    let ledgerFailed = 0;
-    // Issue #536 review（CodeRabbit ③）：judged_at 是**发送时刻**，不是落地时刻。
-    //
-    // 取 max(墙钟, 本批两侧里最新的 updated_at)：`updated_at` 用的是 store 的
-    // **单调时钟**（src/store.js 的 nowIso：同一毫秒内的连续写入逐次 +1ms），它可能
-    // 比墙钟快几毫秒；直接用墙钟会记出一个早于被测行自身版本的 `judged_at`，于是
-    // 「这一对刚判过」在下一轮的 `alreadyJudged` 里读成「判过之后又被改过」，判 keep
-    // 的死循环原样复活（CI 的 test-host-legacy 腿抓到过一次真 flake）。两列同源才可比。
-    const judgedAt = batch.reduce(
-      (acc, p) => (p.a.updated_at > acc ? p.a.updated_at : (p.b.updated_at > acc ? p.b.updated_at : acc)),
-      new Date().toISOString()
-    );
-    const text = await withMaxTokensFallback(ctx, config.sleepMaxTokens ?? 2048, (tokens) => withEffortFallback(ctx, sleepEffort, () => runConflict(batch, true, tokens), () => runConflict(batch, false, tokens), () => conflictStreamFailure), () => conflictStreamFailure);
-    if (text === undefined) {
-      if (conflictStreamFailure) ctx.logger?.warn?.(`dsh-mneme sleep: conflict stream aborted or errored (${conflictStreamFailure})`);
-      return { status: "failed", error: "llm failed", failure: conflictStreamFailure || undefined };
-    }
-    const decisions = parseJsonArray(text);
-    if (!decisions) return { status: "failed", error: "invalid decisions json" };
-    // 本批的 snapshot 只含本批的 id。validateDecisions 要求每个 snapshot id 恰好被
-    // claim 一次，拿整轮的 snapshot 校验单批输出会把其余 48 对判成"未裁决"。
-    const batchSnapshot = new Map();
-    for (const p of batch) {
-      batchSnapshot.set(p.a.id, p.a);
-      batchSnapshot.set(p.b.id, p.b);
-    }
-    // v0.4.4 起 validateDecisions 本身就会为未覆盖的 id 自动补 keep（dreamImplicitKeep
-    // 默认开启），这里保留显式预填作为防御性双保险——漏判读作"未裁决冲突"而非
-    // "冲突阶段整体失败"。
-    const covered = new Set();
-    for (const d of decisions) {
-      // Issue #126 review（Copilot）：supersede 同样用 winner/loser 定位（没有 ids），
-      // 此前只认 conflict → 它的两个目标都没进 covered → 被补成 implicit keep → 与
-      // supersede 的 claim 冲突：严格模式整单拒绝，宽容模式把合成的 keep 记成 skipped。
-      if (d?.action === "conflict" || d?.action === "supersede") {
-        if (typeof d?.winner === "string") covered.add(d.winner);
-        if (typeof d?.loser === "string") covered.add(d.loser);
-      } else if (Array.isArray(d?.ids)) {
-        for (const id of d.ids) covered.add(id);
-      }
-    }
-    for (const id of batchSnapshot.keys()) {
-      if (!covered.has(id)) decisions.push({ action: "keep", ids: [id] });
-    }
-    // Issue #126：sleep 是多对批量裁决，严格模式"一票否决"太脆（一对非法就丢掉整轮
-    // 成果）→ 与 dream 对齐透传 skipInvalid：非法的那一对只跳过自己，合法子集照常
-    // 应用，run 记 degraded。update 上限与保护期同样取 dream 的同一组配置，保证两个
-    // 模块对"什么算合法"的判据一致。
-    const { ok, errors, skipped } = validateDecisions(decisions, batchSnapshot, {
-      // Issue #536 review（CodeRabbit ②）：reflectionUpdateMaxPerRun 是**整轮**上限，
-      // 分批后不能每批都拿整份额度——那样 N 批就是 N 倍上限。这里用的是本轮的剩余额度。
-      maxUpdatePerRun: updateBudget,
-      // reflectionUpdateEnabled=false：update 单条跳过（同 dream 主链路口径）。
-      allowUpdate: config.reflectionUpdateEnabled !== false,
-      minAgeHours: config.reflectionUpdateMinAgeHours,
-      skipInvalid: config.dreamSkipInvalid !== false,
-      allowCrossTypeMerge: config.allowCrossTypeMerge === true,
-      // issue #339 / E8：guarded 类型 merge 护栏（默认开，dreamMergeGuard），
-      // 与 dream 主链路同一判据。
-      mergeGuard: config.dreamMergeGuard === true,
-      // Issue #126 review（Copilot）：默认档必须真的只放行旧动作集——只换 prompt 挡不住
-      // 模型自发输出 supersede / differentiate，那样"opt-in 零行为变化"就不成立。
-      allowedActions: actionSet === "full" ? null : LEGACY_ACTIONS
-    });
-    if (!ok) return { status: "failed", error: `invalid decisions: ${errors.join("; ")}`, skipped };
-    // 同 phasePatterns——本相位的 create 也落 source=sleep（默认档的
-    // LEGACY_ACTIONS 含 create，理论上可 mint）。
-    const { applied, failures, conflicts } = applyDecisions(
-      // runId 让 differentiate 的账本行能追到是哪一轮 sleep 判的（issue #533）。
-      decisions, service, logger, batchSnapshot, { ...config, mintSource: "sleep", runId }
-    );
-    // Issue #536 review（CodeRabbit ②）：本轮剩余的 update 额度按本批**通过校验的**
-    // update 数扣减——validateDecisions 已把非法条目从 decisions 就地 splice 掉，
-    // 所以数到的都是真的会落地的那些。落地时被 CAS 挡下的也算：额度宁可少发一次，
-    // 也不能让"多批各扣一次满额"把整轮上限架空。
-    const updateUsed = decisions.filter((d) => d?.action === "update").length;
-    // Issue #126 review（Copilot）：事务内 service.update 会跳过 scheduleEmbed（txDepth>0），
-    // 而 sleep 路径此前没有 dream 那样的 post-apply 索引维护——differentiate 的差异注记与
-    // supersede 的归档都反映不到缓存向量，"注记进 embedding 防再判重复"就是空承诺。
-    if (applied > 0 && semantic?.embedder && semantic?.vectorIndex) {
-      try {
-        await maintainIndexAfterDream(decisions, service, semantic);
-      } catch (error) {
-        logger?.warn?.(`dsh-mneme sleep: index maintenance failed: ${String(error)}`);
-      }
-    }
-    // 台账：本批**全部送审对**都记一行，不只记被判成冲突的那几对。判 keep 的那一对
-    // 正是 #529 里"下一轮原样再送"的元凶，只记有动作的对等于没记。
-    if (typeof service.saveConflictReviewed === "function") {
-      // judged_at 取的是**发送之前**的时刻（见函数开头），不是落地之后：LLM 往返
-      // 期间若一侧被外部改动，它的 updated_at 会晚于 judged_at，下一轮自然重新入池；
-      // 模型看到的本来就是旧快照，按"已审"封盘等于用陈旧结论锁死这一对。
-      const outcomeOf = new Map();
-      for (const d of decisions) {
-        const action = d?.action ?? "keep";
-        if (action === "conflict" || action === "supersede") {
-          if (typeof d?.winner === "string") outcomeOf.set(d.winner, action);
-          if (typeof d?.loser === "string") outcomeOf.set(d.loser, action);
-        } else if (Array.isArray(d?.ids)) {
-          for (const id of d.ids) outcomeOf.set(id, action);
-        }
-      }
-      // Issue #536 review（CodeRabbit ③）：未落地的对不记账。skipped（非法被跳）、
-      // failures（写入失败）、conflicts（CAS 冲突）里出现过的 id，说明那条决策没生效；
-      // 把它记成"已审"会让下一轮的 alreadyJudged 为真，这一对从此不再送审——
-      // 沉默地永久压制一个真实冲突，比多送一轮贵得多。
-      const unsettled = new Set();
-      for (const f of [...(failures ?? []), ...(conflicts ?? []), ...(skipped ?? [])]) {
-        for (const id of f?.ids ?? []) unsettled.add(id);
-      }
-      for (const p of batch) {
-        if (unsettled.has(p.a.id) || unsettled.has(p.b.id)) continue;
-        try {
-          service.saveConflictReviewed({
-            run_id: runId,
-            memory_a: p.a.id,
-            memory_b: p.b.id,
-            // 一对两端的动作可能不同（conflict 的胜/败、merge 的两端），取**非 keep
-            // 的那一侧**：keep/keep 才代表"看过、不冲突"，这正是我们要留痕的结论。
-            outcome: [outcomeOf.get(p.a.id), outcomeOf.get(p.b.id)]
-              .find((x) => x && x !== "keep") ?? "keep",
-            judged_at: judgedAt
-          });
-        } catch (error) {
-          // Issue #529 review（CodeRabbit）：留痕失败必须让这一轮**不 clean**。只 warn 的
-          // 话，这一对既没记账、又被算成"送出去的全落地了"，下一轮它原样回到候选池、
-          // 又被算成可续排——每个静默窗口重问一次同一个冲突，直到连击上限才停，而
-          // 审计上每一轮都是干净的成功轮。
-          ledgerFailed += 1;
-          logger?.warn?.(`dsh-mneme sleep: failed to record reviewed conflict ${p.a.id}/${p.b.id}: ${String(error)}`);
-        }
-      }
-    }
-    // Issue #126 review（Copilot）：有决策被跳过时不能报 ok——与 dream 的 degraded 契约
-    // 对齐（"合法子集已应用"是 degraded 而非 ok），否则消费方分不清整轮与残轮。
-    return { status: applied > 0 ? (skipped.length > 0 ? "degraded" : "ok") : failures.length ? "failed" : "noop", applied, failures, conflicts, skipped, updateUsed, ledgerFailed };
-  };
-  // 分批：每批独立往返，坏批只记 degraded 不中断。此前一次全送，任何一处理由
-  // （撞上下文、输出截断、JSON 坏掉）都是整轮 failed——而整轮 failed 又不带 pairs，
-  // 事后看不出它到底送了什么。
-  const batchSize = config.sleepConflictMaxPairs ?? 12;
-  const batches = batchSize > 0
-    ? Array.from({ length: Math.ceil(pool.length / batchSize) }, (_, i) => pool.slice(i * batchSize, (i + 1) * batchSize))
-    : [pool];
-  let applied = 0;
-  const failures = [];
-  const conflicts = [];
-  const skipped = [];
-  let failedBatches = 0;
-  // Issue #529 review（CodeRabbit ①）：台账写入失败的累计数（逐批由 adjudicateBatch 报回）。
-  let ledgerFailed = 0;
-  // 用户活动打断时**不能**落进下面那条 noop：noop 的语义是「看过，没冲突」，而被打断
-  // 的那几批根本没送出去。用与入口处（signal 一开始就是 aborted）同一个词汇，避免
-  // 同一件事两个状态名。
-  let interrupted = false;
-  // Issue #536 review（CodeRabbit ②）：reflectionUpdateMaxPerRun 是**整轮**上限。
-  // 校验器本身不跨批记忆，每批各拿一份满额就等于 N 倍上限，所以额度由这里持有：
-  // 每批只领剩余额度，校验通过后按**本批通过校验的** update 数扣减。额度用尽的
-  // 那几批若还含 update，会被校验器整单拒绝（记 failed），其余批照常继续——
-  // 与"一批坏掉不判死整轮"的既有契约一致。
-  let updateLeft = config.reflectionUpdateMaxPerRun ?? 2;
-  for (let i = 0; i < batches.length; i++) {
-    if (signal?.aborted) { interrupted = true; break; }
-    // Issue #536 review（CodeRabbit）：单批抛错不能带走整轮。`adjudicateBatch` 里不只有
-    // "把失败变成返回值"的 LLM 通路，还有 `applyDecisions` 与台账写入——它们抛出的异常
-    // 此前会直接跳出循环，后面所有批都不跑、已汇总的 applied/failures 也一起丢掉。
-    // 只放行 AbortError（取消意图绝不能被降级重试吞掉，与 dream.js 的 withEffort 守卫同款），
-    // 其余一律折成这一批的 failed 结果，循环继续。
-    let res;
-    try {
-      res = await adjudicateBatch(batches[i], updateLeft);
-    } catch (error) {
-      if (error?.name === "AbortError") { interrupted = true; break; }
-      res = { status: "failed", error: String(error?.message ?? error), failures: [], skipped: [] };
-    }
-    if (res.status === "failed") {
-      failedBatches++;
-      failures.push(...(res.failures ?? []));
-      skipped.push(...(res.skipped ?? []));
-      // 失败批的原始理由（stream 层的 abort/error 原文）要进审计：只写 "llm failed"
-      // 的话，运维分不清是上下文超限、模型拒收还是用户活动打断。
-      logger?.warn?.(`dsh-mneme sleep: conflict batch ${i + 1}/${batches.length} failed: ${res.error}${res.failure ? ` (${res.failure})` : ""}`);
-      continue;
-    }
-    applied += res.applied;
-    ledgerFailed += res.ledgerFailed ?? 0;
-    updateLeft = Math.max(0, updateLeft - (res.updateUsed ?? 0));
-    failures.push(...(res.failures ?? []));
-    conflicts.push(...(res.conflicts ?? []));
-    skipped.push(...(res.skipped ?? []));
-  }
-  const degraded = skipped.length > 0 || failedBatches > 0;
-  // 一批都没成功才算整轮失败；只要有一批落地，如实记 degraded——这跟 deriveStatus
-  // 的契约一致（degraded 也算有产出）。
-  const allFailed = failedBatches === batches.length;
-  // 有一批没走通时整轮**绝不能报 noop**：noop 的语义是「看过，没冲突」，而踩了
-  // llm failed 的那批其实没看过。这是 #529 里最误导人的一处——23 轮失败期间
-  // applied 恒为 0，若再叠上 noop，运维只会以为库里没冲突。
-  const status = interrupted
-    ? "aborted"
-    : allFailed
-    ? "failed"
-    : applied > 0
-      ? (degraded ? "degraded" : "ok")
-      : failures.length
-        ? "failed"
-        : failedBatches > 0
-          ? "degraded"
-          : "noop";
-  // Issue #529（续排）：「这一轮有没有产出」和「送出去的每一对是不是都落地了」是两件
-  // 正交的事，status 只回答前者。全判 keep 的轮次 applied 恒为 0 → status 是 noop
-  // （never ok），而它恰恰是 #529 里最该续排的场景；拿 status === "ok" 当判据会在
-  // 这里把续排堵死。所以另给一个布尔，口径与下面台账的 unsettled 完全一致：failure
-  // （写入失败）/ conflicts（CAS 冲突）/ skipped（非法被跳）任一出现过，就说明有对没
-  // 落地，它下一轮还会被重新配出来，不算 clean。
-  // Issue #529 review（CodeRabbit ①）：台账写入失败同样算"没落地"——那一对没被记成
-  // 已审，下一轮会重新入池，与上面 unsettled 是同一个道理。
-  const clean =
-    !interrupted &&
-    failedBatches === 0 &&
-    skipped.length === 0 &&
-    failures.length === 0 &&
-    conflicts.length === 0 &&
-    ledgerFailed === 0;
-  return {
-    status,
-    clean,
-    // Issue #529 D：失败轮也要带 pairs/batches——此前只有成功路径带 pairs，85 条
-    // 失败审计行全是"送了个寂寞"，连送了多少对都查不到。
-    pairs: selected.length,
-    // #533：这一轮被账本压掉、没送 LLM 的候选对数——不记的话「pairs 变小了」
-    // 分不清是没检测到还是已经裁决过。
-    suppressed,
-    batches: batches.length,
-    ledgerSkipped,
-    perRunSkipped,
-    applied,
-    // Issue #529 review（CodeRabbit ①）：留痕失败的对数——clean 为 false 时要能分清是
-    // 哪一类没落地（写入失败 / 非法被跳 / CAS 冲突 / 台账没记上）。
-    ledgerFailed,
-    failures,
-    conflicts,
-    // Issue #126：#104 同向——被跳过的逐对明细要进审计行，否则事后无法判断
-    // 是哪一对、因何被跳过（此前只进 logger.warn，splice 后就地消失）。
-    skipped,
-    // #641 shadow：分诊分布随相位结果透出（四个出口都要带——freeze/空池/无路由/
-    // LLM 全路径，缺一个出口 shadow 期就有部分轮次查不到分布）。
-    ...(ledgerTriage ? { ledgerTriage } : {})
-  };
-}
-
-/**
- * Phase 2 — archival demotion. No LLM: tiering is time-based, summaries are
- * truncations, and the full body is preserved in _full_content so nothing is
- * lost. Deterministic and cheap, so it runs even with no LLM route.
- */
-function phaseDemotion(service, config, logger, runId, signal = null) {
-  const archiveDays = config.sleepArchiveDays ?? 30;
-  const compressDays = config.sleepCompressDays ?? 90;
-  const archiveCut = Date.now() - archiveDays * 86400000;
-  const compressCut = Date.now() - compressDays * 86400000;
-  const demoted = [];
-  const archived = [];
-  // 被判定为「该降级」但 demoteToSummary 实际没动手的条数。单独报出来：
-  // 它正是「台账说降级了 N 条、实际一条没变」那个缺口，藏起来就等于没修。
-  let demoteSkipped = 0;
-  // 政策轴在这里尤其要紧：下面两行会真改归档面（setArchived / demoteToSummary）。
-  // 把过滤放在循环之外、而不是在循环体里 continue：一旦将来有人在循环体里加
-  // 副作用（现已有），漏掉那条 continue 就是静默改到被按下的行。
-  // 外来行也在循环之外挡掉，同一个理由：它不经本方蒸馏，时间分层无权动它的原文或
-  // 归档面；而下面两行动作（setArchived / demoteToSummary）不经 saveWithDedupe，
-  // 汇流口那道闸门到这里已经管不到了。
-  for (const m of withoutPaused(service, service.all().filter((m) => !isImportedRow(m)))) {
-    if (signal?.aborted) break;
-    if (m.archived || m.forgotten) continue;
-    // 已降级的行不必再进判定链：demoteToSummary 见到 _full_content 会直接返回，
-    // 但这行每轮仍会被选中、空转一次事务，再被下面无条件 push 进 demoted。
-    // 提前挡掉既省事务，也让「这一轮到底动了什么」从源头算得准（#603 台账）。
-    if (m._full_content) continue;
-    const ref = m.last_accessed_at ?? m.created_at;
-    if (!ref) continue;
-    const t = new Date(ref).getTime();
-    if (Number.isNaN(t)) continue;
-    // v0.7.0 热联合判定（仅 heatEnabled 时启用；默认关则退回纯时间分层，
-    // 与 v0.7.12 行为一致）：时间窗之外再加两道保护闸——热度低于
-    // sleepHeatThreshold 且 importance<5 才允许降级。λ=0 的免疫类型 heat 恒
-    // 1.0 天然豁免（preference/pattern/summary 永不因 sleep 降级）；importance
-    // ≥5 的紧要记忆无论多冷都保留。`冷但重要` 与 `热但低值` 均不满足条件。
-    const heatOn = config.heatEnabled !== false;
-    if (heatOn) {
-      const heat = computeHeat(m, Date.now(), config);
-      const heatProtected = heat >= (config.sleepHeatThreshold ?? 0.05);
-      const important = (m.importance ?? 0) >= 5;
-      if (heatProtected || important) continue;
-    }
-    if (t < compressCut) {
-      service.setArchived(m.id, true);
-      archived.push(m.id);
-    } else if (t < archiveCut) {
-      // minRefTimeMs re-checks freshness inside demoteToSummary's transaction:
-      // a recall touch landing after this snapshot must not demote the memory.
-      //
-      // 返回值必须看：demoteToSummary 在三种情况下返回 undefined（行不存在、
-      // 已降级、快照后被 recall 摸热），而这里原来无条件 push，于是台账把没发生
-      // 的降级记成发生了——live 库实测 12 轮里虚报 43%–99%（#603）。
-      const updated = service.demoteToSummary(m.id, makeSummary(m), { minRefTimeMs: archiveCut });
-      if (updated) demoted.push(m.id);
-      else demoteSkipped++;
-    }
-  }
-  return {
-    status: demoted.length || archived.length ? "ok" : "noop",
-    demoted,
-    archived,
-    demoteSkipped
-  };
-}
-
-/**
- * Phase 3 — pattern discovery. The LLM scans the most recent memories and
- * mints type=pattern entries (create actions) with evidence references.
- * The empty snapshot is intentional: create claims no existing id, so the
- * "every id claimed" invariant is trivially satisfied for pure-create lists.
- */
-async function phasePatterns(ctx, service, config, logger, runId, signal = null) {
-  const language = langOf(config);
-  const route = resolveSleepRoute(ctx, config, logger);
-  if (!route) return { status: "skipped", reason: "no llm route" };
-  const limit = config.sleepPatternMinMemories ?? 100;
-  // #230：document 在查询层排除（excludeTypes）而不是截断后过滤——LIMIT 200
-  // 先生效的话，指针行一多就会把普通记忆挤出扫描窗，池子饿到门槛以下。
-  // 政策轴同理必须排在 `.slice(0, limit)` **之前**，否则被按下的行照样占掉
-  // sleepPatternMinMemories 的名额，而它们既不会被扫、也不该挤掉别人（#471）。
-  //
-  // archived 这一轴不在下面出现，不是漏了：list() 默认就带 `archived = 0`
-  // （store.js list 的 includeArchived 默认 false、onlyArchived 默认 false），
-  // 旧写法那句 `!m.archived` 一直是重复过滤——查询层已经把它挡在外面。
-  // 窗口至少等于本次要扫的名额：`sleepPatternMinMemories` 的合法上限是 1000
-  // （src/config.js:612）。窗口若还是死的 200，那么把这个值配到 200 以上的人
-  // **每一轮**都会触发下面那次无界重取，跟闸门按没按下无关——那是把这条修复
-  // 从「按需」变成「常付」。
-  const poolQuery = {
-    limit: Math.max(200, limit), includeForgotten: false,
-    // 三条政策轴全部下推到查询层：留在 LIMIT 之后过滤，等于让被丢掉的行为窗口占名额
-    // （模式扫描池会因此饿到 sleepPatternMinMemories 以下而静默跳过）。同一取舍见
-    // #230 的 document 轴与本文件 #471 的暂停轴，src/service.js:2247 那条注释记着前例。
-    excludeTypes: ["document", "summary", "pattern"],
-    excludeImported: true
-  };
-  const gather = (query) => withoutPaused(service, service.list(query));
-  let pool = gather(poolQuery);
-  // #515：暂停闸门要读 scope_state 并按「这一维有标注」匹配，下推进 SQL 就等于让判定
-  // 长出第二份实现（issue 里写过为什么否掉，`*` 那一行是关键的不可下推处）。所以这里
-  // 不动判定、只放宽取数：**只有窗口过滤后不够本次要扫的名额**才不带窗口重取一次。
-  // 常态仍只付一次有界查询；多付的那一次恰好就是原本会静默跳过的那一次——
-  // 症状从「库里没东西可扫」变成「扫了」，这才是这条闸门该有的行为。
-  if (pool.length < limit) pool = gather({ ...poolQuery, limit: null });
-  const memories = pool
-    .sort((a, b) => (a.updated_at < b.updated_at ? 1 : -1))
-    .slice(0, limit);
-  if (memories.length === 0) return { status: "skipped", reason: "no memories to scan" };
-  if (signal?.aborted) return { status: "aborted", reason: "user activity" };
-  const listText = memories
-    .map((m) => `id=${m.id} | type=${m.type} | importance=${m.importance} | updated=${m.updated_at} | title=${m.title} | content=${m.content}`)
-    .join("\n");
-  const maxPatterns = config.sleepMaxPatternPerRun ?? 3;
-  const sleepEffort = await resolveDreamEffort(ctx, route, config.sleepReasoningEffort, logger);
-  let patternStreamFailure = "";
-  const runPattern = (withEffort, tokens) => {
-    patternStreamFailure = "";
-    return auditedSleepLlm(ctx, service, config, logger, {
-      triggerSource: "sleep",
-      operationType: "sleep_pattern",
-      modelId: `${route.provider}:${route.model}`,
-      // 本轮扫描的记忆 id：与 dream 的 relatedMemoryIds 同义，供面板解析沉淀条数。
-      relatedMemoryIds: memories.map((m) => m.id),
-      streamError: () => patternStreamFailure,
-      // 纯判据，同 conflict 阶段：不把解析结果存进闭包供控制流使用。
-      auditError: (text) => (parseJsonArray(text) ? null : "no json array in llm output"),
-      // 纯判据，与 auditError 同一条约定：重解析一次、不读闭包（审计关掉时那些闭包
-      // 根本不会被赋值，读它会让「审计说了什么」依赖调用方走到了哪一行）。
-      metadataFrom: (text) => (parseJsonArray(text) ? null : parseFailureMeta(text))
-    }, (reportUsage) => streamText(ctx, {
-    provider: route.provider,
-    model: route.model,
-    purpose: "sleep-pattern",
-    maxTokens: tokens,
-    ...(withEffort && sleepEffort ? { reasoningEffort: sleepEffort } : {}),
-    messages: [
-      { role: "system", content: [{ type: "text", text: STR.prompts.pattern[language].replace("N", String(maxPatterns)) }], source: { kind: "plugin:dsh-mneme", plugin: "dsh-mneme" } },
-      { role: "user", content: [{ type: "text", text: fenceListBody(language, listText) }], source: { kind: "plugin:dsh-mneme", plugin: "dsh-mneme" } }
-    ]
-  }, reportUsage, (reason) => { patternStreamFailure = describeStreamFailure(reason); }));
-  };
-  const text = await withMaxTokensFallback(ctx, config.sleepMaxTokens ?? 2048, (tokens) => withEffortFallback(ctx, sleepEffort, () => runPattern(true, tokens), () => runPattern(false, tokens), () => patternStreamFailure), () => patternStreamFailure);
-  if (text === undefined) {
-    if (patternStreamFailure) ctx.logger?.warn?.(`dsh-mneme sleep: pattern stream aborted or errored (${patternStreamFailure})`);
-    return { status: "failed", error: "llm failed" };
-  }
-  const decisions = parseJsonArray(text);
-  if (!decisions || decisions.length === 0) return { status: "skipped", reason: "no patterns found" };
-  // Evidence ids are provenance refs; an LLM-fabricated id would mint a dead
-  // ev:tag pointing nowhere. Intersect evidence with the scanned set so only
-  // real memory references survive.
-  const scannedIds = new Set(memories.map((m) => m.id));
-  for (const d of decisions) {
-    if (d?.action === "create" && Array.isArray(d.evidence)) {
-      d.evidence = d.evidence.filter((id) => typeof id === "string" && scannedIds.has(id));
-    }
-  }
-  const snapshot = new Map();
-  const { ok, errors } = validateDecisions(decisions, snapshot, {
-    maxCreatePerRun: maxPatterns
-  });
-  if (!ok) return { status: "failed", error: `invalid decisions: ${errors.join("; ")}` };
-  // 本相位的 create 落 source=sleep。来源从管道给而非从决策对象取——见
-  // applyDecisions 的 @param config。
-  // #512：runId 也必须给——这是 sleep 唯一的真实铸造路径，漏了它，铸造出来的
-  // pattern 就只能追到「sleep 这条管道」，追不到「哪一轮 sleep」（正是 #512 要补的口子）。
-  const { applied, merged, failures, conflicts } = applyDecisions(
-    decisions, service, logger, snapshot, { ...config, mintSource: "sleep", runId }
-  );
-  return {
-    // A pattern that hit an existing same-title row is refreshed in place, not
-    // minted. Counting it as `ok` with `applied: 0` claims a mint that did not
-    // happen; report the refresh separately (#619 audit round 6).
-    status: applied > 0 ? "ok" : (merged > 0 ? "refreshed" : "noop"),
-    scanned: memories.length,
-    applied,
-    merged,
-    failures,
-    conflicts
-  };
-}
-
-/**
- * Phase 5 — affective attribution (issue #619). The LLM reads recent memories and
- * names emotions, but the shape of what it may write is fixed here, not by the
- * prompt: an emotion tied to **one occasion** becomes an `affective_context`
- * relation carrying the attribution on the edge; only an emotion that recurs
- * across sleepAffectiveTraitMinSessions **independent sessions** may be minted as
- * a standing trait (a type=pattern memory, through the same
- * validateDecisions/applyDecisions channel every other mint uses).
- *
- * The whole point is the guardrail, so it lives in code and not in the prompt:
- *  - the model may *claim* trait, but the claim only survives if provenance shows
- *    enough distinct sessions. A single session is downgraded to occasion, never
- *    dropped silently — dropped claims are counted and reported.
- *  - person/target must resolve to entities that already exist; an emotion about
- *    an unknown name is not evidence, it is a hallucination.
- *  - evidence ids must be inside the scanned pool (same rule phasePatterns uses).
- * Off by default (sleepAffectiveEnabled) and a child of sleepModeEnabled: no
- * route, no entities, or the flag off all mean "skip", never "run anyway".
- */
-async function phaseAffective(ctx, service, config, logger, runId, signal = null) {
-  if (config.sleepAffectiveEnabled !== true) return { status: "skipped", reason: "disabled" };
-  const route = resolveSleepRoute(ctx, config, logger);
-  if (!route) return { status: "skipped", reason: "no llm route" };
-  const entities = service.listEntities({ limit: 1000 }) ?? [];
-  if (entities.length < 2) return { status: "skipped", reason: "too few entities" };
-  const limit = config.sleepPatternMinMemories ?? 100;
-  const poolQuery = {
-    limit: Math.max(200, limit),
-    includeForgotten: false,
-    excludeTypes: ["document", "summary", "pattern"],
-    excludeImported: true
-  };
-  const gather = (query) => withoutPaused(service, service.list(query));
-  let pool = gather(poolQuery);
-  if (pool.length < limit) pool = gather({ ...poolQuery, limit: null });
-  const memories = [...pool].sort((a, b) => String(b.updated_at).localeCompare(String(a.updated_at))).slice(0, limit);
-  if (memories.length === 0) return { status: "skipped", reason: "no memories" };
-  const scannedIds = new Set(memories.map((m) => m.id));
-  const byName = new Map();
-  for (const e of entities) byName.set(e.name.toLowerCase(), e);
-  const traitMinSessions = config.sleepAffectiveTraitMinSessions ?? 3;
-  const maxRelations = config.sleepAffectiveMaxRelationsPerRun ?? 10;
-  const maxTraits = config.sleepMaxPatternPerRun ?? 3;
-  const language = langOf(config).startsWith("zh") ? "zh" : "en";
-  const entityNames = entities.map((e) => e.name).slice(0, 200).join(", ");
-  const listText = memories.map((m) => `id=${m.id} | time=${m.updated_at ?? ""} | type=${m.type} | title=${m.title} | content=${m.content}`).join("\n");
-  let streamFailure;
-  const runAffective = (tokens) => auditedSleepLlm(
-    ctx, service, config, logger,
-    {
-      triggerSource: "sleep",
-      operationType: "sleep_affective",
-      modelId: `${route.provider}:${route.model}`,
-      relatedMemoryIds: memories.map((m) => m.id),
-      streamError: () => streamFailure,
-      auditError: (out) => (parseJsonArray(out) ? null : "no json array in llm output"),
-      metadataFrom: (out) => (parseJsonArray(out) ? null : parseFailureMeta(out))
-    },
-    (reportUsage) => streamText(ctx, {
-      provider: route.provider,
-      model: route.model,
-      purpose: "sleep-affective",
-      maxTokens: tokens,
-      messages: [
-        {
-          role: "system",
-          content: [{ type: "text", text: STR.prompts.affective[language].replaceAll("{{MIN_SESSIONS}}", String(traitMinSessions)) }],
-          source: { kind: "plugin:dsh-mneme", plugin: "dsh-mneme" }
-        },
-        { role: "user", content: [{ type: "text", text: fenceListBody(language, `${entityNames}\n---\n${listText}`) }], source: { kind: "plugin:dsh-mneme", plugin: "dsh-mneme" } }
-      ]
-    }, reportUsage, (reason) => { streamFailure = describeStreamFailure(reason); })
-  );
-  const text = await withMaxTokensFallback(ctx, config.sleepMaxTokens ?? 2048, runAffective, () => streamFailure);
-  if (text === undefined) {
-    // #619 可见化 A：失败原因不能只写成 "llm failed"。conflict 相位
-    // （src/dream/sleep.js 的 adjudicateBatch 调用处）早就把 stream 层的原文写进
-    // warn 并挂在返回值的 `failure` 上，理由写在它旁边的注释里：只写 "llm failed"
-    // 的话，运维分不清是上下文超限、模型拒收还是用户活动打断。affective 相位漏了
-    // 这一步，实测 2026-11-10T16:09 那一轮审计行只有 {"status":"failed",
-    // "error":"llm failed"}，502 原文只能去 llm_audit_logs 里捞。
-    // 相位自身不重试 5xx（withMaxTokensFallback 只处理 max_tokens 被拒、
-    // withEffortFallback 只处理 effort 被拒），所以这里记的就是一次性失败的真因。
-    if (streamFailure) logger?.warn?.(`dsh-mneme sleep: affective stream aborted or errored (${streamFailure})`);
-    return { status: "failed", error: "llm failed", failure: streamFailure || undefined };
-  }
-  const items = parseJsonArray(text) ?? [];
-  if (items.length === 0) return { status: "skipped", reason: "no attributions found" };
-  const relations = [];
-  const merges = [];
-  const traits = [];
-  const dropped = [];
-  let downgradedCount = 0;
-  const sessionCache = new Map();
-  const sessionsFor = (memoryIds) => {
-    const out = new Set();
-    for (const id of memoryIds) {
-      if (!sessionCache.has(id)) {
-        let rows = [];
-        try {
-          rows = service.provenanceFor?.(id) ?? [];
-        } catch {
-          rows = [];
-        }
-        sessionCache.set(id, rows.map((r) => r.session_id).filter((s) => typeof s === "string" && s));
-      }
-      for (const s of sessionCache.get(id)) out.add(s);
-    }
-    return out;
-  };
-  for (const item of items) {
-    if (signal?.aborted) break;
-    if (!item || typeof item !== "object") continue;
-    const person = byName.get(String(item.person ?? "").toLowerCase());
-    const target = byName.get(String(item.target ?? "").toLowerCase());
-    if (!person || !target || person.id === target.id) {
-      dropped.push({ reason: "unknown entity", person: item.person, target: item.target });
-      continue;
-    }
-    const evidence = (Array.isArray(item.evidence) ? item.evidence : []).filter((id) => scannedIds.has(id));
-    if (evidence.length === 0) {
-      dropped.push({ reason: "no real evidence", person: item.person, target: item.target });
-      continue;
-    }
-    const emotion = String(item.emotion ?? "").trim();
-    if (!emotion) {
-      dropped.push({ reason: "no emotion", person: item.person, target: item.target });
-      continue;
-    }
-    // The guardrail: a claimed trait is checked against provenance, and a claim
-    // that does not survive is demoted — not discarded. Demoted claims are the
-    // interesting number: they are exactly the mis-attributions the probe hunts.
-    const claimedTrait = String(item.attribution ?? "").toLowerCase() === "trait";
-    const sessions = sessionsFor(evidence);
-    const downgraded = claimedTrait && sessions.size < traitMinSessions;
-    const attribution = claimedTrait && !downgraded ? "trait" : "occasion";
-    const record = {
-      person: person.name,
-      target: target.name,
-      emotion,
-      attribution,
-      evidence,
-      sessionCount: sessions.size,
-      why: String(item.why ?? "").slice(0, 200),
-      ...(downgraded ? { downgradedFrom: "trait" } : {})
-    };
-    if (downgraded) downgradedCount += 1;
-    if (attribution === "trait") {
-      traits.push(record);
-      continue;
-    }
-    // #619 / Ephor: entity_relations 没有 UNIQUE 约束，saveRelation 每次
-    // randomUUID() 新插一条。同一个 (person, target, 场合) 跑第二轮就会得到
-    // 第二条一模一样的边——而探针会拿同一批段反复回放，重复边会让 sessionCount
-    // 看起来比真实场合数多，主指标直接失真。
-    //
-    // 「同一场合」不能拿 evidence 有没有交集来判。两次判据都基于证据列表，
-    // 而证据列表既不是场合本身、也不稳定：
-    //   ① 模型给 evidence 的顺序不定（parseJsonArray 也不排序），[m1,m2] 与
-    //      [m2,m1] 是同一场合的两种写法；
-    //   ② 同一会话里的两条不同记忆各说一句「他很焦虑」，证据天然不相交，可
-    //      它们是同一个场合——那时该合并成一条边，而不是各写一条把边数抬高；
-    //   ③ 反过来，第一轮看到 1 条证据、第二轮攒到 2 条（含新会话），若判成重复
-    //      就整条丢掉，边上 sessionCount 永远停在第一次那个数，将来读归因覆盖率
-    //      会一直读到 1。
-    // 所以键落在会话层：同一 (person, target, emotion) 且两边的会话集有交集，
-    // 就是同一场合。命中时把 evidence 并集写回、按并集重算 sessionCount，而不是
-    // 丢弃——被扩充的边记进 merged，让「这一轮其实补了证据」在返回值里看得见。
-    // 这一步在 cap 之前：合并既有边不新增行，不该占名额。
-    const currentSessions = sessions;
-    const priorEdges = (service.getRelations(person.id) ?? []).filter((r) =>
-      r.relation_type === "affective_context" && r.to_entity === target.id
-    );
-    let mergedInto = null;
-    for (const edge of priorEdges) {
-      const meta = edge.metadata && typeof edge.metadata === "object" ? edge.metadata : null;
-      const priorEmotion = String(meta?.emotion ?? "").trim();
-      if (priorEmotion !== emotion) continue;
-      const priorEvidence = Array.isArray(meta?.evidence)
-        ? meta.evidence
-        : (edge.memory_id ? [edge.memory_id] : []);
-      const priorSessions = sessionsFor(priorEvidence);
-      // "Same occasion" is judged on session keys first. Only when either side
-      // has no session key at all does it fall back to an evidence intersection:
-      // memory_save writes memories without provenance (1671 of 8517 active rows
-      // in the live database have none), so sessionsFor returns an empty set and
-      // a session-only test would write the same edge again on every sleep pass,
-      // inflating sessionCount past the real number of occasions.
-      const sameOccasion = [...priorSessions].some((s) => currentSessions.has(s))
-        || ((priorSessions.size === 0 || currentSessions.size === 0)
-          && priorEvidence.some((id) => evidence.includes(id)));
-      if (!sameOccasion) continue;
-      mergedInto = { edge, priorEvidence, priorSessions };
-      break;
-    }
-    if (mergedInto) {
-      const { edge, priorEvidence, priorSessions } = mergedInto;
-      const unionEvidence = [...new Set([...priorEvidence, ...evidence])];
-      const unionSessions = new Set([...priorSessions, ...currentSessions]);
-      const mergedMetadata = {
-        ...(edge.metadata && typeof edge.metadata === "object" ? edge.metadata : {}),
-        emotion,
-        // 保留首个 attribution，但降级痕迹一旦有就留着——合并不能把
-        // 「它曾被判成 trait 又被降级」这段历史抹掉。
-        attribution: (edge.metadata && edge.metadata.attribution) || attribution,
-        evidence: unionEvidence,
-        sessionCount: unionSessions.size,
-        lastMergedRunId: runId
-      };
-      if (record.downgradedFrom && !mergedMetadata.downgradedFrom) {
-        mergedMetadata.downgradedFrom = record.downgradedFrom;
-      }
-      try {
-        service.updateRelationMetadata?.(edge.id, mergedMetadata);
-        merges.push({
-          id: edge.id,
-          from: person.name,
-          to: target.name,
-          emotion,
-          evidence: unionEvidence.length,
-          sessionCount: unionSessions.size
-        });
-      } catch (error) {
-        logger?.warn?.(`dsh-mneme sleep: affective relation merge ${person.name}/${target.name} failed: ${String(error)}`);
-      }
-      continue;
-    }
-    if (relations.length >= maxRelations) {
-      dropped.push({ reason: "relation cap", person: person.name, target: target.name });
-      continue;
-    }
-    try {
-      const saved = service.saveRelation({
-        from_entity: person.id,
-        to_entity: target.id,
-        relation_type: "affective_context",
-        memory_id: evidence[0],
-        source: "llm",
-        metadata: {
-          emotion,
-          attribution,
-          why: record.why,
-          evidence,
-          sessionCount: sessions.size,
-          ...(record.downgradedFrom ? { downgradedFrom: record.downgradedFrom } : {}),
-          model: `${route.provider}:${route.model}`,
-          runId
-        }
-      });
-      relations.push({ id: saved?.id, from: person.name, to: target.name, emotion, attribution, ...(record.downgradedFrom ? { downgradedFrom: record.downgradedFrom } : {}) });
-    } catch (error) {
-      logger?.warn?.(`dsh-mneme sleep: affective relation ${person.name}/${target.name} failed: ${String(error)}`);
-    }
-  }
-  // Traits ride the standard decision channel so they inherit every existing cap
-  // and the #512 mint ledger. No new write path is introduced for them.
-  let applied = 0;
-  let refreshedTraits = 0;
-  let failures = [];
-  let conflicts = [];
-  let ok = true;
-  // Candidates beyond the cap are otherwise neither minted, demoted, nor
-  // recorded: they simply vanish, while `traits` still counts them and a reader
-  // concludes they were handled. Record them the same way `relation cap` records
-  // edges, so "everything that disappears is accounted for" holds for traits.
-  for (const t of traits.slice(maxTraits)) {
-    dropped.push({ reason: "trait cap", person: t.person, target: t.target });
-  }
-  if (traits.length > 0) {
-    const decisions = traits.slice(0, maxTraits).map((t) => ({
-      action: "create",
-      type: "pattern",
-      title: STR.affectiveTrait.title[language](t),
-      content: STR.affectiveTrait.content[language](t),
-      importance: 3,
-      evidence: t.evidence
-    }));
-    const snapshot = new Map();
-    const validated = validateDecisions(decisions, snapshot, { maxCreatePerRun: maxTraits, allowedActions: ["create"] });
-    ok = validated.ok;
-    if (ok) {
-      const result = applyDecisions(decisions, service, logger, snapshot, { ...config, mintSource: "sleep", runId });
-      applied = result.applied;
-      failures = result.failures;
-      conflicts = result.conflicts;
-      // A trait whose pattern was refreshed in place (same title, same row) is
-      // not a new conclusion. Keep it out of `applied` and report it as a
-      // refresh, otherwise two different targets would read as two minted
-      // patterns while only one row exists (#619 audit round 6).
-      refreshedTraits = result.merged ?? 0;
-      // Ocasion edges observed before a disposition was confirmed do not get
-      // rewritten — an edge records "this occasion was observed", which stays
-      // true. But the edge and the pattern would then answer "how many
-      // occasions" differently (edge.sessionCount vs pattern evidence), and a
-      // coverage query reading both would have no way to tell they describe the
-      // same thing. Mark them instead of mutating the count: the edge still
-      // means one observed occasion, and `promotedToTrait` says that occasion is
-      // now part of a confirmed disposition.
-      for (const trait of traits.slice(0, maxTraits)) {
-        const person = byName.get(String(trait.person ?? "").toLowerCase());
-        const target = byName.get(String(trait.target ?? "").toLowerCase());
-        if (!person || !target || person.id === target.id) continue;
-        for (const edge of service.getRelations(person.id) ?? []) {
-          if (edge.relation_type !== "affective_context" || edge.to_entity !== target.id) continue;
-          const meta = edge.metadata && typeof edge.metadata === "object" ? edge.metadata : null;
-          if (String(meta?.emotion ?? "").trim() !== trait.emotion) continue;
-          if (meta?.promotedToTrait === true) continue;
-          try {
-            service.updateRelationMetadata?.(edge.id, {
-              ...meta,
-              promotedToTrait: true,
-              traitSessionCount: trait.sessionCount
-            });
-          } catch (error) {
-            logger?.warn?.(`dsh-mneme sleep: marking occasion ${edge.id} as promoted failed: ${String(error)}`);
-          }
-        }
-      }
-    }
-  }
-  // Aborting mid-pass is not "did nothing" and not "all done". Even when nothing
-  // was written yet, "noop" would claim the whole pool was examined and found
-  // empty — the loop broke at an arbitrary index, so it examined an unknown
-  // prefix. Report it as aborted either way.
-  if (signal?.aborted) {
-    return {
-      status: "aborted",
-      reason: "user activity",
-      scanned: memories.length,
-      relations: relations.length,
-      edgeWrites: relations.length,
-      merged: merges.length,
-      mergedList: merges,
-      applied,
-      refreshedTraits,
-      traits: traits.length,
-      downgraded: downgradedCount,
-      dropped
-    };
-  }
-  if (!ok) {
-    return {
-      status: "failed",
-      error: "trait decisions rejected by validation",
-      scanned: memories.length,
-      relations: relations.length,
-      edgeWrites: relations.length,
-      merged: merges.length,
-      mergedList: merges,
-      applied: 0,
-      refreshedTraits,
-      traits: traits.length,
-      downgraded: downgradedCount,
-      dropped
-    };
-  }
-  return {
-    // "refreshed" is a real write that minted nothing: the trait pattern already
-    // existed under the same title and was rewritten in place. Calling that
-    // "noop" would say the phase examined the pool and found nothing to do.
-    status: relations.length + merges.length + applied > 0 ? "ok" : (refreshedTraits > 0 ? "refreshed" : "noop"),
-    scanned: memories.length,
-    relations: relations.length,
-    merged: merges.length,
-    // #619: edges are real writes but not "applied decisions", so the receipt
-    // would read `:0` for a run that did write. Count them separately instead
-    // of folding them into `applied` (that would make the two numbers mean
-    // different things depending on which phase produced them).
-    edgeWrites: relations.length,
-    mergedList: merges,
-    applied,
-    refreshedTraits,
-    failures,
-    conflicts,
-    traits: traits.length,
-    downgraded: downgradedCount,
-    dropped
-  };
-}
-
-/**
- * Phase 4 — entity relation completion. Detects orphan entities (zero
- * relations) and completes implied relations from memory co-occurrence:
- * entities named in the same memory → related_to; container kinds
- * (project/module) → part_of; tech-ish pairs → depends_on. Deterministic,
- * no LLM — cheap, so it runs even without a route. saveRelation is
- * bookkeeping (no write hook), so it never re-triggers the scheduler.
- */
-function inferRelationType(a, b) {
-  if ((a.type === "project" || a.type === "module") && a.type !== b.type) return "part_of";
-  if ((b.type === "project" || b.type === "module") && b.type !== a.type) return "part_of";
-  if (/npm|plugin|api|sdk|lib|framework|package|deps?|build/i.test(`${a.name} ${b.name}`)) return "depends_on";
-  return "related_to";
-}
-
-function phaseRelations(service, config, logger, runId, signal = null) {
-  const entities = service.listEntities({ limit: 1000 }) ?? [];
-  if (entities.length < 2) return { status: "skipped", reason: "too few entities" };
-  const orphans = entities.filter((e) => (service.getRelations(e.id) ?? []).length === 0);
-  if (orphans.length === 0) return { status: "skipped", reason: "no orphan entities" };
-  const memories = withoutPaused(service, service.all().filter((m) => !isImportedRow(m) && !m.archived && !m.forgotten));
-  const seen = new Set();
-  const related = [];
-  const MAX_RELATIONS_PER_ORPHAN = 3;
-  for (const o of orphans) {
-    if (signal?.aborted) break;
-    let made = 0;
-    for (const m of memories) {
-      if (signal?.aborted || made >= MAX_RELATIONS_PER_ORPHAN) break;
-      const text = `${m.title ?? ""} ${m.content ?? ""}`;
-      if (!text.includes(o.name)) continue;
-      for (const other of entities) {
-        if (other.id === o.id || other.name === o.name) continue;
-        const key = [o.id, other.id].sort().join("|");
-        if (seen.has(key)) continue;
-        if (!text.includes(other.name)) continue;
-        const relationType = inferRelationType(o, other);
-        try {
-          service.saveRelation({ from_entity: o.id, to_entity: other.id, relation_type: relationType, memory_id: m.id, metadata: { source: "sleep_relation_completion" } });
-          seen.add(key);
-          related.push({ from: o.id, to: other.id, type: relationType });
-          made++;
-        } catch (error) {
-          logger?.warn?.(`dsh-mneme sleep: relation ${o.id}/${other.id} failed: ${String(error)}`);
-        }
-      }
-    }
-  }
-  return {
-    status: related.length > 0 ? "ok" : "noop",
-    orphanCount: orphans.length,
-    related
-  };
-}
-
-// ---------------------------------------------------------------- run
-
-function deriveStatus(phases) {
-  const list = Object.values(phases);
-  if (list.length === 0) return "noop";
-  const anyError = list.some((p) => p.status === "failed" || p.status === "error");
-  // Issue #126 review（Copilot）：phase 自身可以是 degraded（合法子集已应用但有条目被
-  // 跳过），它同样算"有产出"——否则整轮会被误判成 noop，把真实变更报成空轮。
-  // #619：`refreshed` 也是一次真实写入（同题行原地刷新），只是没铸出新条目。把它
-  // 排除在 anyWork 之外，整轮会被记成 noop，审计行又变回「跑了、什么都没干」。
-  const anyWork = list.some((p) => p.status === "ok" || p.status === "degraded" || p.status === "refreshed");
-  const anyDegraded = list.some((p) => p.status === "degraded");
-  // Issue #529：被打断（用户恢复活动）既不是失败也不是"没活干"。相位层已经用
-  // aborted 区分了这两种，整轮层若回落到 noop，审计行就又把"没跑完"记成"跑过、
-  // 没什么事"——所以这里也给它一个自己的名字。只在没有任何产出时生效：真的落了
-  // 东西就是 ok/degraded，真的报错就是 failed，二者都比 aborted 值得优先播报。
-  const anyAborted = list.some((p) => p.status === "aborted");
-  if (anyDegraded) return "degraded";
-  if (anyWork && anyError) return "degraded";
-  if (anyError) return "failed";
-  if (anyWork) return "ok";
-  if (anyAborted) return "aborted";
-  return "noop";
-}
-
-/**
- * Run one full sleep cycle. Best-effort across all phases; writes a
- * run_type='sleep' audit row (same dream_runs table) so sleep activity is
- * observable alongside consolidation runs.
- */
-export async function runSleep(ctx, service, config, logger, semantic = null, signal = null) {
-  const runId = randomUUID();
-  // Issue #89：开跑时刻——审计行 created_at 的基准（= 冷却种子），run 耗时
-  // （LLM 各 phase）不应计入重启后的冷却窗口。
-  const sleepStartedAt = Date.now();
-  const phases = {};
-  const attempt = async (name, fn) => {
-    if (signal?.aborted) return; // user resumed activity — stop before next phase
-    try {
-      phases[name] = await fn();
-    } catch (error) {
-      phases[name] = { status: "failed", error: error?.message ?? String(error) };
-      logger?.warn?.(`dsh-mneme sleep: ${name} phase failed: ${error?.message ?? error}`);
-    }
-  };
-  await attempt("conflicts", () => phaseConflicts(ctx, service, config, logger, runId, semantic, signal));
-  await attempt("demotion", () => phaseDemotion(service, config, logger, runId, signal));
-  await attempt("patterns", () => phasePatterns(ctx, service, config, logger, runId, signal));
-  await attempt("relations", () => phaseRelations(service, config, logger, runId, signal));
-  // #619：情感归因排在 relations 之后——它要读实体与 provenance，先让孤立实体的
-  // 结构边补完，再往上挂情绪轴；两相写的是不同 relation_type，不抢同一批对。
-  await attempt("affective", () => phaseAffective(ctx, service, config, logger, runId, signal));
-
-  const status = deriveStatus(phases);
-  const route = resolveSleepRoute(ctx, config, logger);
-  // #619: a phase may write rows that are not "applied decisions" — the
-  // affective phase inserts relation edges directly — and it may also extend an
-  // existing edge instead of inserting one. Both are store writes, and the
-  // receipt has to answer "did this run change anything", so both count. A run
-  // whose only effect was extending an edge would otherwise read `:0`, i.e.
-  // "ran and did nothing", which is exactly what a probe must never see.
-  //
-  // The per-kind numbers stay apart in `phases` (`applied` / `edgeWrites` /
-  // `merged` / `refreshedTraits`); the receipt is a single write count on
-  // purpose, because buildReceipt/parseReceipt are an eight-field contract
-  // shared with organize.js and four test files. Detail lives in
-  // dream_runs.phases JSON, not in the receipt.
-  //
-  // #619 / Ephor 第七轮 ①：`refreshedTraits` 必须计入。它是「同一标题的 pattern
-  // 被原地重写」的条数——库确实变了，但没有铸新条目，所以它既不在 `applied` 里
-  // （那会把刷新谎报成铸造），也不在 `merged` 里（affective 相位的 `merged` 是
-  // **边**合并数 `merges.length`，同名不同义）。漏掉它的后果实测过：第二轮
-  // `phase.status=refreshed`、`refreshedTraits=1`，整轮 receipt 第 7 段仍是 0，
-  // 于是「相位说改了、整轮说没改」，正是上一轮刚修掉的「改了库读成 0」形态。
-  const totalApplied = Object.values(phases).reduce(
-    (n, p) =>
-      n +
-      (Number.isInteger(p?.applied) ? p.applied : 0) +
-      (Number.isInteger(p?.edgeWrites) ? p.edgeWrites : 0) +
-      (Number.isInteger(p?.merged) ? p.merged : 0) +
-      (Number.isInteger(p?.refreshedTraits) ? p.refreshedTraits : 0),
-    0
-  );
-  // Issue #126（与 #104 同向）：把各 phase 的跳过明细汇总成一行审计数据，带 phase
-  // 名（同一次 run 里 conflicts 与 patterns 都可能产出 skipped）。全空时写 NULL，
-  // 不落空数组——审计行只记真实发生过的跳过。
-  const skippedDetail = Object.entries(phases).flatMap(([phase, p]) =>
-    Array.isArray(p?.skipped) ? p.skipped.map((s) => ({ phase, ...s })) : []
-  );
-  const snapshotHash = createHash("sha256").update(JSON.stringify(phases)).digest("hex");
-  const receipt = buildReceipt({
-    runId,
-    status,
-    snapshotHash,
-    inputCount: 0,
-    applied: totalApplied,
-    summaryStored: false
-  });
-  try {
-    service.saveDreamRun({
-      id: runId,
-      // Issue #89：审计行记开跑时刻而非完成时刻——run 耗时（含 LLM 各 phase）
-      // 不该计入重启后的 sleep 冷却种子。
-      created_at: new Date(sleepStartedAt).toISOString(),
-      status,
-      provider: route?.provider,
-      model: route?.model,
-      snapshot_hash: snapshotHash,
-      input_count: 0,
-      input: null,
-      decisions: phases,
-      outcome: phases,
-      applied: totalApplied,
-      summary_stored: false,
-      receipt,
-      policy_epoch: config.policyEpoch ?? 0,
-      run_type: "sleep",
-      skipped: skippedDetail.length ? skippedDetail : undefined
-    });
-  } catch (error) {
-    logger?.warn?.(`dsh-mneme sleep: failed to record audit run: ${String(error)}`);
-  }
-  // Issue #529（续排）：给调度器的续排判据。两个条件缺一不可——
-  //   · 本轮**被预算截断**（conflict 相位报告还有没进这一轮的对）：说明池子没清空；
-  //   · 本轮**clean**：送出去的每一对都落地了，不是为了追一个永远失败的批次空转。
-  // `clean` 缺失时（该相位被 attempt 吞成 failed、或配置让它早退）按"不干净"算，
-  // 宁可少追一轮，也不要在失败状态下把间隔压到静默窗口。
-  const conflictPhase = phases.conflicts;
-  const backlog = Number(conflictPhase?.perRunSkipped ?? 0) > 0;
-  // clean 与 catchup 分开给：前者是"这一轮的活全落地了"，后者是"池子没清空 + 前者"。
-  // 合成一个字段会让"干净但没 backlog"看起来像出过问题，排查时反着读。
-  const clean = conflictPhase?.clean === true;
-  const catchup = backlog && clean;
-  return { ok: status === "ok" || status === "degraded", status, clean, catchup, backlog, runId, phases, receipt };
-}
-
-// ---------------------------------------------------------------- scheduler
-
-/**
- * Idle-triggered scheduler. DSH plugins have no resident cron, so a sleep run
- * fires when: sleep is enabled, the store has been quiet for sleepIdleMinutes,
- * and the previous run is older than sleepMinIntervalHours. noteWrite() is
- * called on every store write and (re)arms an idle timer that re-checks at the
- * exact moment the idle window elapses — no polling, no cron.
- *
- * A `now` clock can be injected for tests; it defaults to Date.now.
- */
-export function createSleepScheduler({
-  service,
-  config,
-  logger,
-  onRun = null,
-  now = () => Date.now(),
-  setTimeoutFn = setTimeout,
-  clearTimeoutFn = clearTimeout,
-  // Issue #89 同族：冷却时刻由调用方从 dream_runs 审计表恢复（run_type='sleep'）——
-  // 内存变量进程重启即归零，冷却闸对新实例放行 → 重启后立即进入 sleep 冷却盲区。
-  // 测试注入 0（默认）即保持旧行为。
-  lastRunAtSeed = 0
-}) {
-  let lastWriteAt = now();
-  let lastRunAt = lastRunAtSeed;
-  let running = false;
-  let disposed = false;
-  let idleTimer = null;
-  let sleepAbort = null;
-  // Issue #529（C 项）：同一进程内的连续失败计数。失败（run 报 status="failed"
-  // 或抛错）+1，其余一律清零（ok/degraded/noop——noop 说明 LLM 通路是好的，
-  // 只是没活干，不该被当成失败拖着退避）。纯内存变量、宿主重启归零：跨重启的
-  // 冷却本来就由 lastRunAtSeed（#89/#291）负责，两者不重叠。
-  let consecutiveFailures = 0;
-  // Issue #529（续排）：上一轮报告"还有对没进这一轮、且送出去的全落地了"——池子没清空，
-  // 该接着追而不是等满一个最小间隔。只由 maybeSchedule 按 onRun 的返回置位，跑完一轮就
-  // 重新判：池子追干净或某一轮不 clean 时自动落回 false，不需要额外的复位路径。
-  let catchupWanted = false;
-  // Issue #529（续排）：进程内续排连击数。给"池子在长、每轮都 clean 但永远追不完"这类
-  // 库留一道刹车——用户持续写入时池子进得比追得快，光看 clean 会变成永不落地的每五分钟
-  // 一轮。超过上限就退回正常间隔，等下一个静默窗口重新起算。
-  let catchupStreak = 0;
-
-  // Issue #529：有效最小间隔 = 基数 × 2^连续失败数。关闭或尚无失败时逐字节
-  // 返回基数（默认关 = 行为与现状一致）。封顶取 max(基数, 24h) 而不是硬 24h：
-  // 指数再大也不会把用户自己配的大基数（允许到 168h）压小。
-  function effectiveMinIntervalMs() {
-    // Issue #529（续排）：还有 backlog 时把冷却项按 0 处理，让表落在**静默窗口**而不是
-    // 最小间隔上。不新增配置键：本轮的账本/更新写入会重置 lastWriteAt，下一轮自然至少
-    // 等一个 sleepIdleMinutes，这本身就是节流；再开一个键要连带 settings.js 白名单与
-    // test/api.test.js 的旗标计数锁，不值得为一件事动三个文件。
-    // 与连败互斥（同 issue 的第三条）：连续失败 > 0 时根本不追——两个逻辑抢同一只闹钟
-    // 最容易出"重排的是短的、判定的是长的"这种空转，互斥最省事。
-    if (catchupWanted && consecutiveFailures <= 0) return 0;
-    const base = (config.sleepMinIntervalHours ?? 8) * 3600000;
-    if (config.sleepFailureBackoff !== true || consecutiveFailures <= 0) return base;
-    const cap = Math.max(base, FAILURE_BACKOFF_CAP_MS);
-    return Math.min(base * 2 ** consecutiveFailures, cap);
-  }
-
-  function armIdleTimer() {
-    if (disposed || idleTimer) return;
-    if (config.sleepModeEnabled !== true) return;
-    const idleMs = (config.sleepIdleMinutes ?? 5) * 60000;
-    const delay = Math.max(0, idleMs - (now() - lastWriteAt)) + 1000;
-    idleTimer = setTimeoutFn(async () => {
-      idleTimer = null;
-      // Issue #187：false = 撞上 CD（或 run 失败）——此前这里直接丢弃，"CD 到期"
-      // 成了没有监听者的时刻，要等下一次写入才救回来。改为按剩余窗口重排。
-      // Issue #529（续排）：跑成了也未必收工——池子还有没进这一轮的对时要接着追，
-      // 而此时已经没有待触发的写入了，不在这里补挂就永远等不到下一轮。
-      const ran = await maybeSchedule();
-      if (!ran || catchupWanted) armNextWindow();
-    }, delay);
-    idleTimer.unref?.();
-  }
-
-  // Issue #187：撞 CD / run 失败后的补挂表——按「剩余 CD / 剩余静默」里更晚的
-  // 到点时刻重排一次，回调里重复同样的判断所以不会空转。跑成了一轮就不重排：
-  // 安静的库没有要处理的新东西，触发权交还给下一次写入的 noteWrite。
-  function armNextWindow() {
-    if (disposed || idleTimer) return;
-    if (config.sleepModeEnabled !== true) return;
-    // lastRunAt === 0 表示从未跑过（此路径不该出现，防御性返回）。
-    if (lastRunAt <= 0) return;
-    const idleMs = (config.sleepIdleMinutes ?? 5) * 60000;
-    // Issue #529：这里必须和 shouldRun 用同一个有效间隔，否则退避期里重排的闹钟
-    // 会在基数到点就响、然后被 shouldRun 否掉再重排——空转一串没有意义的定时器。
-    const cdMs = effectiveMinIntervalMs();
-    let delay = Math.max(
-      lastRunAt + cdMs - now(),
-      lastWriteAt + idleMs - now(),
-      0
-    ) + 1000;
-    // Issue #529（续排）：冷却项按 0 处理之后，静默项可能已经是负的（这一轮跑得久、
-    // 期间没有新写入），算出来只剩那 1 秒——追 backlog 不该变成秒级连发。续排下限钉在
-    // 一个静默窗口上：追得动就每轮追一批，但每批之间仍然让库安静下来。
-    // 有写入时静默项会自己变大（账本行落库会重置 lastWriteAt），这里只是保证下限。
-    if (catchupWanted) delay = Math.max(delay, idleMs + 1000);
-    idleTimer = setTimeoutFn(async () => {
-      idleTimer = null;
-      const ran = await maybeSchedule();
-      // Issue #529（续排）：与 armIdleTimer 的回调同一条理由——追 backlog 的轮次
-      // 跑完必须自己补挂，否则续排在第二张表就断了。
-      if (!ran || catchupWanted) armNextWindow();
-    }, delay);
-    idleTimer.unref?.();
-  }
-
-  function shouldRun(at = now()) {
-    if (disposed || running) return false;
-    if (config.sleepModeEnabled !== true) return false;
-    if (at - lastWriteAt < (config.sleepIdleMinutes ?? 5) * 60000) return false;
-    // lastRunAt === 0 means never ran — the min-interval check must not block
-    // the very first cycle (a real run stamps a nonzero timestamp).
-    // Issue #529：连败退避开启时改用指数放大的有效间隔——恒定失败的模型不再按
-    // 固定节奏连发（#529 实测连续 23 轮 llm failed），只会越打越稀。
-    if (lastRunAt > 0 && at - lastRunAt < effectiveMinIntervalMs()) return false;
-    return true;
-  }
-
-  /** Called on writes: resets the idle clock and re-arms the fire timer. The
-   *  pending timer is cleared first — a stale timer armed against the old idle
-   *  window would otherwise fire early, fail shouldRun, and leave nothing armed
-   *  for the next window (a missed trigger until the next write).
-   *
-   *  While a sleep run is executing (running=true) the in-flight AbortController
-   *  is NOT aborted: the run's own writes (demoteToSummary / setArchived ride
-   *  the normal write-hook path) would otherwise self-abort the cycle. External
-   *  activity during the run still resets the idle clock here, so no new cycle
-   *  fires until the store is quiet again. */
-  function noteWrite() {
-    lastWriteAt = now();
-    if (!running && sleepAbort) {
-      sleepAbort.abort(); // user resumed activity — interrupt an idle run
-    }
-    if (idleTimer) {
-      clearTimeoutFn(idleTimer);
-      idleTimer = null;
-    }
-    armIdleTimer();
-  }
-
-  async function maybeSchedule() {
-    if (!shouldRun()) return false;
-    running = true;
-    const abort = new AbortController();
-    sleepAbort = abort;
-    try {
-      lastRunAt = now();
-      const result = await service.enqueue(() =>
-        onRun ? onRun(abort.signal) : Promise.resolve({ ok: true, skipped: true })
-      );
-      // Issue #529：连败计数只在这里加减。判据优先看 result.status——runSleep 的
-      // ok 只在 ok/degraded 时为真，noop（LLM 通路正常、只是没活干）和用户活动
-      // 打断都会给出 ok:false，把它当失败会让退避在自己工作良好的库里越退越长。
-      // 回落到 !result.ok 只是为了兼容注入的 no-op 桩（没有 status 字段）。
-      // result 为空（最小测试替身）＝完成且无失败，不动计数，与 #292 口径一致。
-      if (result) {
-        const failed = typeof result.status === "string" ? result.status === "failed" : !result.ok;
-        consecutiveFailures = failed ? consecutiveFailures + 1 : 0;
-        // Issue #529（续排）：判据只认 runSleep 给的 catchup——它是"池子还有没进这一轮
-        // 的对"且"送出去的每一对都落地了"二者的合取。**不要**在这里拿 status 反推：
-        // 全判 keep 的轮次 applied 恒为 0、status 是 noop，恰好在最该追的场景失效。
-        // 连续失败时不追（与退避互斥，见 effectiveMinIntervalMs），并把连击计数清零——
-        // 失败说明这轮的"追"没有意义，重新从正常节奏起算。
-        // 连击到顶就收手，并把连击清零——不清零的话这个进程从此再也不会追（streak 只增
-        // 不减，之后每一轮都被同一道闸挡下），"等下一个静默窗口重新起算"就成了空话。
-        // 收手必须落在 catchupWanted 这个状态上，不能只写在 effectiveMinIntervalMs 里：
-        // 那里改成"返回基数"之后，armNextWindow 仍会按 catchupWanted 把闹钟钉在静默
-        // 窗口上重排，于是每 5 分钟醒一次、每次都被 shouldRun 否掉再重排——没有 LLM
-        // 调用，但定时器链永远不断。
-        const wantCatchup = result.catchup === true && consecutiveFailures <= 0;
-        if (!wantCatchup || catchupStreak + 1 >= CATCHUP_STREAK_CAP) {
-          catchupStreak = 0;
-          catchupWanted = false;
-        } else {
-          catchupStreak += 1;
-          catchupWanted = true;
-        }
-      }
-      return !!(result && result.ok);
-    } catch (error) {
-      logger?.warn?.(`dsh-mneme sleep: run failed: ${error?.message ?? error}`);
-      consecutiveFailures += 1; // Issue #529：抛错同样计入连败
-      // Issue #529（续排）：抛错也算失败，续排意图一并清掉——否则上一轮置位的状态会跟着
-      // 逃出 try 块，让下一次排表仍按静默窗口的空转节奏走。
-      catchupWanted = false;
-      catchupStreak = 0;
-      return false;
-    } finally {
-      sleepAbort = null;
-      running = false;
-      // Issue #529 review（CodeRabbit ②）：运行期间用户写入会走 noteWrite()，它把闹钟
-      // 按**那一次写入**重算了一遍——那可能是静默窗口的尾声。若这一轮结束时报告
-      // catchup=true，那只表可能几秒后就要响，下一批紧接着开跑，于是「让库安静一个
-      // 静默窗口再追」变成「跑完立刻再跑」。这里把已挂着的表撤掉重挂，交给
-      // armNextWindow 从**此刻**算出整整一个静默窗口。
-      // 反过来（不追的轮次）保留 noteWrite 挂的那只表：它是按用户最后一次写入算的，
-      // 正是「用户写完了、安静满一个窗口再说」的意思。
-      if (catchupWanted) {
-        if (idleTimer) {
-          clearTimeoutFn(idleTimer);
-          idleTimer = null;
-        }
-        armNextWindow();
-      }
-    }
-  }
-
-  async function dispose() {
-    disposed = true;
-    if (idleTimer) {
-      clearTimeoutFn(idleTimer);
-      idleTimer = null;
-    }
-    if (sleepAbort) {
-      sleepAbort.abort();
-      sleepAbort = null;
-    }
-  }
-
-  // Issue #187（同族缺陷）：构造即挂表——重启后只要没发生过写入，此前永远没有
-  // 闹钟，安静多久都不会触发。lastWriteAt 已在构造时设为当前时刻，shouldRun 的
-  // 静默条件自然生效：重启后静默满 idleMinutes 才可能起跑。
-  armIdleTimer();
-
-  return { noteWrite, maybeSchedule, shouldRun, dispose };
-}
+import { STR, langOf } from "../lang.js";
+// System-level sleep (v0.4.0): an idle-triggered, LLM-assisted deep pass over
+// the memory store. Four independent, fail-safe phases:
+//   1. conflict resolution — high-similarity same-type pairs are either parked
+//      for review (freeze mode) or adjudicated by the LLM (winner kept / loser
+//      archived), reusing the dream conflict machinery. Strictness-graded.
+//      v0.8.1 (issue #170): cross-scope pairs are ALWAYS parked for human
+//      ownership review with a dedicated reason — never auto-adjudicated.
+//   2. archival demotion — memories unreferenced past sleepArchiveDays shrink
+//      to a one-line summary with the full body moved to _full_content; past
+//      sleepCompressDays they are archived outright.
+//   3. pattern discovery — the LLM scans the most recent memories and mints
+//      type=pattern entries carrying evidence id references.
+//   4. relation completion — orphan entities (zero relations) get implied
+//      relations completed from memory co-occurrence.
+//   5. affective attribution (v0.13.0, #619) — opt-in. Occasion-bound emotions
+//      become affective_context relations; only emotions recurring across
+//      enough independent sessions are minted as type=pattern traits.
+// Each phase is wrapped so one failure never aborts the others, and a missing
+// LLM route / semantic embedder only skips the phases that need it. A run is
+// abortable via an AbortController signal (user activity) — phases check the
+// signal between batches so a running cycle yields promptly.
+import { randomUUID, createHash } from "node:crypto";
+import { validateDecisions, applyDecisions, ACTIONS } from "./decisions.js";
+import { findPotentialConflicts, cosineSimilarity } from "./clustering.js";
+import { triagePair, recordLedgerTriage } from "./triage.js";
+import { supersedeInfoFirstPair } from "./decisions.js";
+import { scopeKeyOf } from "../scope.js";
+import { buildReceipt, describeStreamFailure, resolveDreamEffort, withEffortFallback, withMaxTokensFallback, maintainIndexAfterDream, fenceListBody, parseFailureMeta } from "../dream.js";
+import { computeHeat } from "../heat.js";
+// 四个相位读的都是行池，而动行的写手不经汇流口：phaseDemotion 直接 setArchived /
+// demoteToSummary，phasePatterns 还会 mint 出新行，所以这条契约要在每处各挡一遍
+// （清单与静态锁见 test/share-imported-guard.test.js）。
+import { isImportedRow } from "../memory-source.js";
+// Issue #533：查账本时要拿两侧当前的正文哈希，与 applyDifferentiate 记账时的口径同源。
+import { contentHashOf } from "../content-hash.js";
+
+// Issue #126 review（Copilot）：默认档（sleepActionSet="conflict"）允许的动作 = 全局
+// ACTIONS 去掉 #126 新增的两个。从 ACTIONS 派生而非硬编码，将来再扩动作集时自动跟随。
+// 只换 prompt 挡不住模型自发输出新动作，必须由校验器按档位收口。
+const LEGACY_ACTIONS = [...ACTIONS].filter((a) => a !== "supersede" && a !== "differentiate");
+
+const SUMMARY_MAX = 120;
+// Conflict similarity threshold per strictness level (v0.4.0):
+//   gentle     only high-confidence pairs (0.92) — first-time users
+//   normal     standard dream-level (0.85) — default
+//   aggressive low-confidence pairs too (0.75) — bloated stores
+const CONFLICT_THRESHOLDS = { gentle: 0.92, normal: 0.85, aggressive: 0.75 };
+
+// Issue #529（C 项的替代实现）：连续失败时最小间隔的封顶。基数默认 8 小时，
+// 2^3 就到 64 小时——不封顶的话模型持续失败会让 sleep 事实上停摆好几天，而
+// 用户完全看不出来。24 小时 = 「最多一天试一次」，与 #292 给 autoDream 的
+// 30 分钟封顶同一意图（封顶值不同是因为两个调度的基数差一个数量级）。
+//
+// 实际封顶取 max(基数, 24h)，不是硬 24h：`sleepMinIntervalHours` 允许 1–168，
+// 用户配 48 小时就是明说"两天跑一次"，退避不该把它压回 24 小时（封顶只能放宽
+// 间隔、不能收紧用户自己设的）。
+const FAILURE_BACKOFF_CAP_MS = 24 * 3600000;
+
+// Issue #529（续排）：一轮内部最多连追多少轮。449 对的池子按每轮 60 对只需 8 轮，
+// 24 留足余量；超过就退回正常最小间隔。防的是"池子在长、每轮都 clean 但永远追不完"
+// ——用户持续写入时池子进得比追得快，光看 clean 会变成永不落地的每五分钟一轮，
+// 而审计上每轮都"有产出"，肉眼很难发现。
+const CATCHUP_STREAK_CAP = 24;
+
+function parseJsonArray(text) {
+  if (typeof text !== "string") return undefined;
+  const start = text.indexOf("[");
+  const end = text.lastIndexOf("]");
+  if (start === -1 || end <= start) return undefined;
+  try {
+    const parsed = JSON.parse(text.slice(start, end + 1));
+    return Array.isArray(parsed) ? parsed : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Same stream consumption contract as dream.js.
+ *
+ * `onUsage`（optional, issue #250）receives any usage chunk for token accounting.
+ * dream.js 那份一直有它；sleep 这份副本没有，导致 conflict / pattern 两条链路的
+ * token 从未进 llm_audit_logs（面板因此只看到 autoDream 与 autoSummarize）。
+ */
+async function streamText(ctx, options, onUsage, onStreamError) {
+  if (!ctx?.llm?.stream) return undefined;
+  let text = "";
+  for await (const chunk of ctx.llm.stream(options)) {
+    if (chunk.type === "text-delta" && typeof chunk.text === "string") text += chunk.text;
+    // DSH 的 StreamChunk 契约把用量嵌在 chunk.usage（TokenUsage：inputTokens /
+    // outputTokens / totalTokens）；兼容直接平铺在 chunk 上的旧形态。归一放在
+    // 这里，调用侧的 reporter 只需认平铺形状——与 dream.js:239 同一处理。
+    if (chunk.type === "usage" && typeof onUsage === "function") onUsage(chunk.usage ?? chunk);
+    if (chunk.type === "finish" && (chunk.reason?.kind === "error" || chunk.reason?.kind === "aborted")) {
+      // Same rc.1 error-as-finish-chunk behavior as dream.js — surface the
+      // cause instead of discarding it.
+      if (typeof onStreamError === "function") {
+        try { onStreamError(chunk.reason); } catch { /* diagnostics only */ }
+      }
+      return undefined;
+    }
+  }
+  return text;
+}
+
+/**
+ * Issue #250：给 sleep 的一条 LLM 调用记一笔 llm_audit_logs（token / 时长 / 状态 /
+ * 触发源）。与 dream.js 的 runAuditedLlm 同口径但各自独立一份——dream 那两个
+ * checker 的调用形状绑定着它自己的排程细节，硬抽共享抽象只会收敛回 dream 的形态。
+ *
+ * 记账是 best-effort：写审计行失败只 warn，绝不反噬 sleep 本体（CONTRIBUTING 的
+ * fail-safe 硬约定）。`body(reportUsage)` 负责真实消费流，usage chunk 经
+ * reportUsage 上报。
+ *
+ * 审计诚实性：流被中止/报错时 body 返回 undefined，记 status='error'；流式成功但
+ * 输出不可用时 `spec.auditError` 给出原因，同样记 error——否则同一轮调用会在
+ * 「phase 报 failed」与「audit 报 success」之间自相矛盾（CONTRIBUTING 的审计诚实性
+ * 硬约定）。`auditError` 必须是**纯判据函数**：调用方的控制流不能依赖它的副作用，
+ * 因为审计关闭时这里整段早退、钩子根本不会被调用（dream 正是那样踩的，见 PR 正文）。
+ */
+async function auditedSleepLlm(ctx, service, config, logger, spec, body) {
+  if (config?.llmAudit?.enabled === false || typeof service?.saveLlmAudit !== "function") {
+    return body(() => {});
+  }
+  const startedAt = Date.now();
+  const timestamp = new Date(startedAt).toISOString();
+  let inputTokens = 0;
+  let outputTokens = 0;
+  let status = "success";
+  let errorMessage = null;
+  // 提到 try 之外：finally 里的 metadataFrom 要读这一轮的原始输出（dream.js 的
+  // runAuditedLlm 就是这么声明的）。留在 try 里，finally 看不见它，读数会静默变空。
+  let result;
+  try {
+    result = await body((usage) => {
+      if (!usage) return;
+      const i = usage.input_tokens ?? usage.inputTokens ?? usage.prompt_tokens ?? usage.promptTokens;
+      const o = usage.output_tokens ?? usage.outputTokens ?? usage.completion_tokens ?? usage.completionTokens;
+      if (Number.isFinite(i)) inputTokens = i;
+      if (Number.isFinite(o)) outputTokens = o;
+    });
+    if (result === undefined) {
+      status = "error";
+      const streamErr = typeof spec.streamError === "function" ? String(spec.streamError() ?? "") : "";
+      errorMessage = streamErr ? `llm stream aborted or errored (${streamErr})` : "llm stream aborted or errored";
+    } else if (typeof spec.auditError === "function") {
+      // 流式成功但输出不可用，仍然是一次失败的调用——记 error，不与调用方的
+      // failed 返回值打架。
+      const message = spec.auditError(result);
+      if (message) {
+        status = "error";
+        errorMessage = message;
+      }
+    }
+    return result;
+  } catch (error) {
+    status = "error";
+    errorMessage = String(error?.message ?? error);
+    throw error;
+  } finally {
+    // spec.metadataFrom(result)：与 dream.js 的 runAuditedLlm 同一形状（这里是一份并行
+    // 实现，不是同一个函数——两份审计写法的字段必须一致，否则面板按 operation_type
+    // 筛出来的读数会时有时没有）。判据函数只读 result，不读闭包，理由同 dream.js。
+    let metadata;
+    if (result !== undefined && typeof spec.metadataFrom === "function") {
+      try {
+        metadata = spec.metadataFrom(result) ?? undefined;
+      } catch {
+        metadata = undefined;
+      }
+    }
+    try {
+      service.saveLlmAudit({
+        timestamp,
+        trigger_source: spec.triggerSource,
+        operation_type: spec.operationType,
+        model_id: spec.modelId,
+        input_tokens: inputTokens,
+        output_tokens: outputTokens,
+        total_tokens: inputTokens + outputTokens,
+        cost_usd: 0,
+        duration_ms: Date.now() - startedAt,
+        status,
+        error_message: errorMessage,
+        related_memory_ids: spec.relatedMemoryIds ?? [],
+        ...(metadata ? { metadata } : {})
+      });
+    } catch (auditError) {
+      logger?.warn?.(`dsh-mneme sleep: llm audit write failed: ${String(auditError)}`);
+    }
+  }
+}
+
+/** LLM route (Issue #25): explicit sleepProvider/Model wins, then the dream
+ *  route as a shared explicit fallback, then the agent default model. Sleep
+ *  can pin a cheaper model for its bulk passes without disturbing the dream
+ *  route. Explicit config first — otherwise the config routes are dead code
+ *  whenever agentDefaultModel resolves (see resolveRoute in dream.js). */
+function resolveSleepRoute(ctx, config, logger) {
+  if (config.sleepProvider && config.sleepModel) return { provider: config.sleepProvider, model: config.sleepModel };
+  if (config.dreamProvider && config.dreamModel) return { provider: config.dreamProvider, model: config.dreamModel };
+  try {
+    const sel = ctx?.agentDefaultModel?.currentSelection?.();
+    if (sel?.provider && sel?.model) return { provider: sel.provider, model: sel.model };
+  } catch { /* fall through to warn */ }
+  logger?.warn?.("dsh-mneme sleep: no llm route available");
+  return undefined;
+}
+
+function makeSummary(m) {
+  const text = (m.content ?? "").trim();
+  if (!text) return (m.title ?? "").trim();
+  return text.length <= SUMMARY_MAX ? text : `${text.slice(0, SUMMARY_MAX)}…`;
+}
+
+// issue #471 政策轴：被按下的作用域也不参与睡眠整理。与 dream.js 的 withoutPaused
+// 同源（那里记着「判定只许有一份实现」的理由），但这里是**单独一处**而不是复用：
+// 两个模块各被独立装配（runSleep / runDream 各自接 service），任何一个被换进只
+// 实现了一半 service 的夹具时都该各自降级，而不是因为对方模块没装而双双失效。
+//
+// 睡眠侧比日间加固侧更要紧：这几个相位不只读——phaseDemotion 会 setArchived 与
+// demoteToSummary（真改归档面），phasePatterns 会 mint 出 type=pattern 的新行
+// （凭空给被按下的作用域生出衍生记忆）。只挡日间那几处读入口的话，闸门开着而每
+// 6 小时一次的睡眠照样动手，那等于「按下」只是让它在白天看不见。
+//
+// service 上取不到 filterPaused 时（老装配、测试夹具）原样返回，与改动前一致。
+function withoutPaused(service, rows) {
+  if (typeof service?.filterPaused !== "function") return rows;
+  return service.filterPaused(rows);
+}
+
+// ---------------------------------------------------------------- phases
+
+/**
+ * Phase 1 — conflict resolution. Needs a semantic embedder + vector index.
+ * In freeze mode (conflictFreezeEnabled) conflicting pairs are parked in
+ * conflict_pending for human review (no LLM). Otherwise the LLM adjudicates:
+ * each pair → winner kept / loser archived. Returns a per-run summary.
+ */
+async function phaseConflicts(ctx, service, config, logger, runId, semantic = null, signal = null) {
+  const language = langOf(config);
+  const embedder = semantic?.embedder;
+  const vectorIndex = semantic?.vectorIndex;
+  if (!embedder || !vectorIndex || typeof embedder.embed !== "function") {
+    return { status: "skipped", reason: "no semantic embedder" };
+  }
+  const strictness = config.sleepConflictStrictness ?? "normal";
+  const threshold = CONFLICT_THRESHOLDS[strictness] ?? CONFLICT_THRESHOLDS.normal;
+  const memories = withoutPaused(service, service.all().filter((m) => !isImportedRow(m) && !m.archived && !m.forgotten && m.type !== "summary" && m.type !== "document"));
+  if (memories.length < 2) return { status: "skipped", reason: "too few memories" };
+  if (signal?.aborted) return { status: "aborted", reason: "user activity" };
+
+  // Backfill + collect vectors for every eligible memory (best effort).
+  const vectors = new Array(memories.length);
+  const missing = [];
+  for (let i = 0; i < memories.length; i++) {
+    const cached = vectorIndex.getEmbedding?.(memories[i].id);
+    if (cached) vectors[i] = cached;
+    else missing.push(i);
+  }
+  if (missing.length) {
+    try {
+      const texts = missing.map((i) => [memories[i].title, memories[i].content].filter(Boolean).join("\n"));
+      const rows = await embedder.embed(texts);
+      missing.forEach((mi, j) => {
+        if (rows[j]?.length) {
+          vectors[mi] = rows[j];
+          vectorIndex.saveEmbedding?.(memories[mi].id, rows[j]);
+        }
+      });
+    } catch (error) {
+      logger?.warn?.(`dsh-mneme sleep: conflict vector backfill failed: ${String(error)}`);
+    }
+  }
+  const usable = [];
+  for (let i = 0; i < memories.length; i++) {
+    if (vectors[i]?.length) usable.push(i);
+  }
+  if (usable.length < 2) return { status: "skipped", reason: "no usable vectors" };
+  const usableMemories = usable.map((i) => memories[i]);
+  const usableVectors = usable.map((i) => vectors[i]);
+
+  // Issue #126：动作集档位既要决定 prompt，也要决定**校验器允许的动作集合**（见下方
+  // allowedActions），并且在候选构造阶段就要知道——full 档需要补跨类型对。因此在这里
+  // 解析，而不是等到拼 prompt 时。
+  const actionSet = config.sleepActionSet ?? "conflict";
+  const pairs = findPotentialConflicts(usableMemories, usableVectors, threshold);
+  if (actionSet === "full") {
+    // Issue #126 review（Copilot）：findPotentialConflicts 只看同类型，而 full 档的
+    // prompt 明确宣传 differentiate 用于互补型——互补本来就常跨类型（同一事实的项目侧
+    // 与偏好侧）。不补这一遍，那条路径永远选不到。merge 的类型守卫不受影响：它拦在
+    // validateDecisions 里（allowCrossTypeMerge），不在候选生成。
+    for (let i = 0; i < usableMemories.length; i++) {
+      for (let j = i + 1; j < usableMemories.length; j++) {
+        if (usableMemories[i].type === usableMemories[j].type) continue;
+        const sim = cosineSimilarity(usableVectors[i], usableVectors[j]);
+        if (sim > threshold) pairs.push({ a: usableMemories[i], b: usableMemories[j], similarity: sim });
+      }
+    }
+  }
+  if (pairs.length === 0) return { status: "skipped", reason: "no conflicts found" };
+
+  // Dedupe: each memory participates in at most one pair, highest similarity
+  // first — overlapping pairs would violate validateDecisions' "one claim".
+  pairs.sort((a, b) => b.similarity - a.similarity);
+
+  // Issue #533：已经裁决过「互补、两条都留」的对不再重判。
+  //
+  // 过滤必须发生在 used 去重**之前**：若先占位再丢弃，一条已裁决的记忆会把
+  // 名额占住，而它真正的对手又是自己人，这一轮就白跑——抑制一对不该顺带压掉
+  // 另一对候选。判据与 applyDifferentiate 的幂等同源：账本里有这对、且两侧正文
+  // 的 content_hash 与记账时一致（任一侧改过 = 结论可能不再成立，重判）。
+  // 存量兼容走同一格：旧版本把注记写进正文却没账本行，两侧都还带着注记块也算
+  // 已裁决，免得升级后第一轮把所有老对重判一遍。
+  const alreadyDifferentiated = (p) => {
+    const a = service.getById(p.a.id);
+    const b = service.getById(p.b.id);
+    if (!a || !b) return false;
+    if (typeof service.findDifferentiatedPair === "function") {
+      const record = service.findDifferentiatedPair(a.id, b.id);
+      if (record) {
+        const [ha, hb] = a.id <= b.id
+          ? [contentHashOf(a), contentHashOf(b)]
+          : [contentHashOf(b), contentHashOf(a)];
+        // 账本行没记 hash（存量/异常写入）时不下结论，宁可多判一次。
+        return record.hash_a != null && record.hash_b != null
+          && record.hash_a === ha && record.hash_b === hb;
+      }
+    }
+    return STR.differentiatedNoteRe.test(String(a.content ?? ""))
+      && STR.differentiatedNoteRe.test(String(b.content ?? ""));
+  };
+  const fresh = [];
+  let suppressed = 0;
+  for (const p of pairs) {
+    if (alreadyDifferentiated(p)) {
+      suppressed += 1;
+      continue;
+    }
+    fresh.push(p);
+  }
+  if (fresh.length === 0) {
+    // 与 "no conflicts found" 分开报：一对都没检测到 vs 检测到但全都裁决过，
+    // 是完全不同的两件事，混成一句会让「sleep 是不是没在干活」读不出来。
+    return { status: "noop", reason: "all candidate pairs already differentiated", suppressed };
+  }
+
+  // Issue #529：输入侧预算。此前 samePairs 是**全部**同 scope 相似对，一次拼成一个
+  // prompt——实测单请求 163,054 输入 token（服务端 --ctx-size 163,840），撞墙后按冷却
+  // 重排，下一轮送进去的还是同一份输入，于是 23 轮连续失败。
+  //
+  // 预筛掉「已经判过且两侧都没动过」的对：判 keep 曾经是彻底的 no-op，既不留痕也不
+  // 影响下一轮的候选池，同一对每个冷却周期都被重新送审一遍。台账（conflict_reviewed）
+  // 记的是"这段输入被看过"，两侧任一 updated_at 晚于 judged_at 就重新入池——与
+  // conflict_pending 复核项 4 同一条宽松代理：任何字段更新都算值得再看一眼。
+  //
+  // Issue #536 review（CodeRabbit ①）：预筛必须发生在下面的 used 去重**之前**，理由与
+  // #533 那条一模一样——先占位再去掉，一条已审的记忆会把自己的配对名额占住，而它真正
+  // 的对手（另一条没审过的记忆）因此进不了这一轮。三条边界：
+  //   · 只筛同 scope 对：跨 scope 对本来就要停车进人工队列，不能被台账吞掉；
+  //   · freeze 模式不筛：那一档只停车不送 LLM，台账与它无关（ledgerSkipped 记 0）；
+  //   · ledgerSkipped 在这里一次数清，后面 candidates 直接取 samePairs，不再二次过滤。
+  // ⚠️ Issue #616：这个判据把「未标注」当成「同 scope」。scopeKeyOf 把 NULL/空串
+  // 归一成 null，于是两条都没标注时 null !== null 为 false，配对算同 scope、可以进
+  // 自动池。但「归属未知」和「归属相同」不是一回事：按 v0.8.1 #170，前者本该是不可
+  // 自动的范围。live 库活跃 8259 行里 2710 行（32.8%）两个 scope 全 NULL，受影响的
+  // 面不小。修法是把「任一未标注」显式判为不可自动，而不是继续让 null 自我相等。
+  const isCrossScopePair = (p) =>
+    scopeKeyOf(p.a.agent_scope) !== scopeKeyOf(p.b.agent_scope)
+    || scopeKeyOf(p.a.workspace_scope) !== scopeKeyOf(p.b.workspace_scope);
+  const ledger = typeof service.loadConflictReviewed === "function"
+    ? (service.loadConflictReviewed() ?? new Map())
+    : new Map();
+  const pairKey = (p) => (p.a.id < p.b.id ? `${p.a.id}\u0000${p.b.id}` : `${p.b.id}\u0000${p.a.id}`);
+  const alreadyJudged = (p) => {
+    const rec = ledger.get(pairKey(p));
+    if (!rec?.judged_at) return false;
+    return (p.a.updated_at ?? "") <= rec.judged_at && (p.b.updated_at ?? "") <= rec.judged_at;
+  };
+  // Issue #641（beta 第二阶段）：分诊账本的档位。#616 点名的父子绑定不继承——
+  // enforce 与 freeze 同开时 freeze 让位（本相位降级 shadow + warn）：freeze 照常
+  // 停车（shadow 语义 = 只记账零处置），绝不出现两套处置语义同时生效。宁可少处置，
+  // 不在打架的配置下跑。
+  let ledgerMode = config.conflictLedgerMode ?? "off";
+  if (ledgerMode === "enforce" && config.conflictFreezeEnabled === true) {
+    logger?.warn?.("dsh-mneme sleep: conflictLedgerMode=enforce coexists with conflictFreezeEnabled — degrading to shadow; disable one of them");
+    ledgerMode = "shadow";
+  }
+  // alreadyJudged 预筛只为省 LLM：freeze 与 enforce 都不走 LLM，筛不筛不影响成本，
+  // 不筛还能让 T2/T3/T4 的每轮观察持续刷新账本（tier 可能随内容更新而变）。
+  const selectionPairs = config.conflictFreezeEnabled === true || ledgerMode === "enforce"
+    ? fresh
+    : fresh.filter((p) => isCrossScopePair(p) || !alreadyJudged(p));
+  const ledgerSkipped = fresh.length - selectionPairs.length;
+
+  const used = new Set();
+  const selected = [];
+  for (const p of selectionPairs) {
+    if (used.has(p.a.id) || used.has(p.b.id)) continue;
+    used.add(p.a.id);
+    used.add(p.b.id);
+    selected.push(p);
+  }
+
+  // Issue #641（beta 第一阶段，shadow 档）：分诊账本。对 selected 全量做确定性
+  // 分诊（dup / cross-scope-dup / evolution / conflict，判据唯一实现见 triage.js）
+  // 并落 conflict_ledger。shadow = 只记账零处置：下面 freeze/LLM 路径一个字节都
+  // 不变——shadow 的存在意义就是让「分诊分布是否复现真实库 46/20/5/27」在真实
+  // 运行里可测，作为切 enforce 前的预注册证据。记账失败只 warn 计数，绝不反噬
+  // 相位（与 conflict_reviewed 同一条 best-effort 纪律）。
+  // 记账时点在 used 去重之后：被去重压掉的那半边对（同一条记忆配给了更高相似的
+  // 对手）本来就不是这一轮的候选，观察它们只会让分母虚高。
+  const ledgerTriage = ledgerMode !== "off"
+    ? await recordLedgerTriage(service, runId, selected, {
+        dupMinSimilarity: config.conflictLedgerDupMinSimilarity,
+        logger,
+        // 分块记账的取消检查：用户活动打断时停止记账，余下的对下一轮重见
+        signal
+      })
+    : null;
+
+  // Issue #641（beta 第二阶段，enforce 档）：确定性处置接线。T1（dup）走
+  // supersedeInfoFirstPair（与冻结分支自动档同一条契约，decisions.js 共享实现）；
+  // T1 走信息量优先 supersede、T3 走取代链（superseded_by 指向，不归档）、
+  // T2/T4 记账即处置——不停车、不送 LLM。人审队列与 LLM 裁决在本档下都不再
+  // 消费冲突候选，conflict_pending 恒空。每轮上限沿用
+  // sleepConflictMaxPairsPerRun：处置虽不走 LLM，归档/落链仍是写动作，写预算
+  // 与 freeze/auto 两档同口径。T4 的检索时消解（fuseRecall 矛盾感知 + 注入
+  // 标注）是后续 PR，本档先把人审摘出去。
+  if (ledgerMode === "enforce") {
+    const perRunCap = config.sleepConflictMaxPairsPerRun ?? 60;
+    const pool = perRunCap > 0 ? selected.slice(0, perRunCap) : selected;
+    let t1Resolved = 0;
+    let t1Failed = 0;
+    let t3Chained = 0;
+    const t1VectorFixups = [];
+    for (const p of pool) {
+      const verdict = triagePair(p.a, p.b, p.similarity, { dupMinSimilarity: config.conflictLedgerDupMinSimilarity });
+      if (verdict.tier === "evolution") {
+        // T3 取代链（beta 第三阶段）：旧行 superseded_by → 新行，检索降权，
+        // **不归档**——演进不是输赢，旧值仍是「曾经为真」的可追溯历史（与
+        // supersede 动作的归档语义不同）。新者胜对演进成立：间隔 ≥7 天的
+        // 同主题对，新记载才反映现状（服务器时钟，内容声称的时间不做键）。
+        const newer = (p.a.created_at ?? "") >= (p.b.created_at ?? "") ? p.a : p.b;
+        const older = newer === p.a ? p.b : p.a;
+        try {
+          if (service.supersedeChain(older.id, newer.id)) {
+            t3Chained += 1;
+            // 先落观察行再推进状态（#650 评审）：enforce 档下 recordLedgerTriage 只会
+            // 把这一对写成 open，UPDATE 于此才有行可命中；顺序反了就是静默落空。
+            service.saveConflictLedgerEntry({ run_id: runId, memory_a: p.a.id, memory_b: p.b.id, tier: verdict.tier, similarity: p.similarity, signals: verdict.signals });
+            service.setConflictLedgerStatus(p.a.id, p.b.id, "superseded");
+          }
+        } catch (error) {
+          logger?.warn?.(`dsh-mneme sleep: ledger T3 chain failed for ${p.a.id}/${p.b.id}: ${String(error)}`);
+        }
+        continue;
+      }
+      if (verdict.tier !== "dup") continue;
+      let res = null;
+      try {
+        res = supersedeInfoFirstPair(p, service, logger, config);
+      } catch (error) {
+        logger?.warn?.(`dsh-mneme sleep: ledger T1 supersede failed for ${p.a.id}/${p.b.id}: ${String(error)}`);
+      }
+      if (res?.applied) {
+        t1Resolved += 1;
+        // winner/loser 用 helper 判定的真实方向（信息量优先可能翻转 p.a/p.b）
+        t1VectorFixups.push({ action: "supersede", winner: res.winnerId, loser: res.loserId });
+        try {
+          // 账本状态推进 + 机器台账照记（与自动档同款 outcome 口径）——自动处置
+          // 也要能事后回答「这一对什么时候、被谁判的」。先落观察行（#650 评审）：
+          // 这一对未必已在账本里，直接 UPDATE 会命中 0 行而静默失记。
+          service.saveConflictLedgerEntry({ run_id: runId, memory_a: p.a.id, memory_b: p.b.id, tier: verdict.tier, similarity: p.similarity, signals: verdict.signals });
+          service.setConflictLedgerStatus(p.a.id, p.b.id, "superseded");
+          service.saveConflictReviewed?.({ run_id: runId, memory_a: p.a.id, memory_b: p.b.id, outcome: "supersede", judged_at: new Date().toISOString() });
+        } catch (error) {
+          logger?.warn?.(`dsh-mneme sleep: ledger bookkeeping after T1 supersede failed for ${p.a.id}/${p.b.id}: ${String(error)}`);
+        }
+      } else {
+        t1Failed += 1;
+      }
+    }
+    // 败者向量清理：T1 的 supersede 不在下面 LLM 通路的 maintainIndexAfterDream
+    // 清单里（enforce 已早退），必须在早退前自己清——已归档行留向量等于检索
+    // 层「看得见摸不着」。
+    if (t1VectorFixups.length > 0 && semantic?.embedder && semantic?.vectorIndex) {
+      try {
+        await maintainIndexAfterDream(t1VectorFixups, service, semantic);
+      } catch (error) {
+        logger?.warn?.(`dsh-mneme sleep: ledger T1 index maintenance failed: ${String(error)}`);
+      }
+    }
+    if (selected.length > pool.length) {
+      logger?.warn?.(`dsh-mneme sleep: conflict ledger enforce capped at ${pool.length}/${selected.length} pairs this run`);
+    }
+    return {
+      status: t1Failed > 0 ? "degraded" : t1Resolved > 0 || t3Chained > 0 ? "ok" : "noop",
+      clean: t1Failed === 0,
+      frozen: 0,
+      scopeCandidates: 0,
+      pairs: selected.length,
+      batches: 0,
+      ledgerSkipped,
+      // applied 是整轮回执的唯一写库口径（runSleep 的 totalApplied 只认这个键）。
+      // 缺了它，本档真实发生的 T1 归档与 T3 落链在 receipt / dream_runs.applied
+      // 里全是 0 ——「本相位说改了、整轮说没改」（#650 评审，#619 同族）。
+      applied: t1Resolved + t3Chained,
+      enforced: { t1Resolved, t1Failed, t3Chained },
+      ...(ledgerTriage ? { ledgerTriage } : {})
+    };
+  }
+
+  // v0.8.1（issue #170 第 2 步）：跨 scope 相似对分流。同一内容落在两个归属下
+  // （任一维标注键不等即算，NULL=未标注=全局也参与比较——「全局副本 + 专属副本
+  // 并存」正是收窄/提升裁决的典型候选）不能自动裁决：归档败者可能销毁该内容在
+  // 某个归属下的唯一副本，LLM 也无从替用户决定归属。一律停车到冲突待确认队列
+  // （专属 reason），同 scope 对维持既有路径（freeze 停车 / LLM 裁决）。
+  const crossPairs = selected.filter(isCrossScopePair);
+  const samePairs = selected.filter((p) => !isCrossScopePair(p));
+  // 四态：fresh（真的新插了一行）/ existing（这一对已在队列里）/ suppressed
+  // （已人工裁决且两侧未变，复核项 4）/ failed（写库抛错）。旧代码把
+  // 「返回非 null」一律当停车成功，existing 因此每轮虚报一遍 frozen（#603）。
+  const parkPair = (p, reason) => {
+    try {
+      const parked = service.saveConflictPending({ run_id: runId, memory_a: p.a.id, memory_b: p.b.id, reason, similarity: p.similarity });
+      if (parked == null) return "suppressed";
+      return parked.fresh === true ? "fresh" : "existing";
+    } catch (error) {
+      logger?.warn?.(`dsh-mneme sleep: failed to park conflict ${p.a.id}/${p.b.id}: ${String(error)}`);
+      return "failed";
+    }
+  };
+  const scopeReason = (p) => STR.scopeCandidateReason[language](p.similarity.toFixed(2));
+  const simReason = (p) => STR.similarityReason[language](p.similarity.toFixed(2));
+
+  // 待审对的键集合（与 pairKey 同形）。只用于 freeze 分支的「先滤已入队」，
+  // 分页拉全量：队列规模不受 50 条默认页长限制。
+  const loadPendingPairKeys = () => {
+    const keys = new Set();
+    if (typeof service.listConflictPending !== "function") return keys;
+    const pageSize = 500;
+    for (let offset = 0; ; offset += pageSize) {
+      const page = service.listConflictPending({ limit: pageSize, offset, includeResolved: false }) ?? [];
+      for (const row of page) keys.add(`${row.memory_a}\u0000${row.memory_b}`);
+      if (page.length < pageSize) break;
+    }
+    return keys;
+  };
+
+  // Freeze mode: park pairs for manual review, no LLM required. Cross-scope
+  // pairs carry the dedicated scope-candidate reason so the queue reads them
+  // as ownership decisions rather than plain duplicates.
+  //
+  // Issue #603 第 1 层：这条分支此前绕过全部三个上限、直接裸跑 selected。
+  //   · 先滤已入队再截断——裸 slice 会饥饿：上限恒小于候选数时，前 N 个名额
+  //     每轮都被同一批已在队列里的对占住，后面的对永远轮不上；
+  //   · 接预算：conflictFreezeMaxPending 决定队列还能装多少，
+  //     sleepConflictMaxPairsPerRun 决定一轮最多处理多少，取两者较小值；
+  //   · 只把 fresh 计入 frozen，已入队的对不再虚报。
+  //
+  // ⚠️ Issue #616：下面这段 freeze 分支同时也是「自动裁决档」的唯一宿主——
+  // conflictAutoResolveEnabled 的全部逻辑（autoEnabled / autoPool / autoResolved）
+  // 都在这对花括号里面。两个配置键在面板上看是平行的，实际是父子：把 freeze
+  // 关掉，自动档会跟着静默消失，没有任何提示。拆开之前别把它们当独立开关用。
+  if (config.conflictFreezeEnabled === true) {
+    const maxPending = Number.isInteger(config.conflictFreezeMaxPending) ? config.conflictFreezeMaxPending : 100;
+    const pendingNow = typeof service.countConflictPending === "function" ? (service.countConflictPending() ?? 0) : 0;
+    const room = Math.max(0, maxPending - pendingNow);
+    const pendingKeys = loadPendingPairKeys();
+    const unparked = selected.filter((p) => !pendingKeys.has(pairKey(p)));
+    const withinRoom = room > 0 ? unparked.slice(0, room) : [];
+    const pendingSkipped = unparked.length - withinRoom.length;
+    const perRunCap = config.sleepConflictMaxPairsPerRun ?? 60;
+    const pool = perRunCap > 0 ? withinRoom.slice(0, perRunCap) : withinRoom;
+    // 只报「有位置但被每轮上限截住」的那部分：队列满时再追一轮也没用，
+    // 报成 backlog 会让调度器空转（catchup 上限 24 轮）。
+    const perRunSkipped = withinRoom.length - pool.length;
+    // Issue #603 第 4 层（自动裁决档，默认关）：相似度极高的**同 scope** 对不再
+    // 进人工队列，直接保留信息量更大的那条、归档另一条。人只看模糊地带。
+    //
+    // 为什么阈值留在配置里而不是写死 0.95：这一档减的是峰值，
+    // 不是把队列清零——把阈值当常量会让人以为「开了就没事了」。
+    //
+    // 为什么跨 scope 永不自动：归属是用户的决定（v0.8.1 #170），归档败者可能
+    // 销毁某归属下的唯一副本。这条约束比减负重要。
+    //
+    // ⚠️ Issue #616：这条守卫有一个洞。isCrossScopePair 走 scopeKeyOf，NULL 归一
+    // 成 null，null !== null 判为 false —— 「未标注」因此被当成「同 scope」混进
+    // autoPool。live 库活跃 8259 行里 2710 行（32.8%）两个 scope 全 NULL。改判据
+    // 之前，别把这一档当成「归属安全」。
+    //
+    // 为什么用 supersede 而不是 conflict：conflict 会把「（已否决旧信息：…）」
+    // 追加到**赢家**正文，而赢家正是留下来的那条；近重复对再叠一段互相引用的
+    // 注记，等于用冗余污染幸存记忆。supersede 把可追溯性留在被归档的一侧，
+    // 赢家正文一字不动（#126 的原设计）。
+    const autoEnabled = config.conflictAutoResolveEnabled === true;
+    const autoMin = typeof config.conflictAutoResolveMinSimilarity === "number"
+      ? config.conflictAutoResolveMinSimilarity
+      : 0.95;
+    const autoPool = [];
+    const parkPool = [];
+    for (const p of pool) {
+      const eligible = autoEnabled
+        && !isCrossScopePair(p)
+        && typeof p.similarity === "number"
+        && p.similarity >= autoMin;
+      (eligible ? autoPool : parkPool).push(p);
+    }
+    let autoResolved = 0;
+    let autoFailed = 0;
+    // 这一档不走 LLM，没有批次时间戳可借（judgedAt 在下面那条 LLM 通路里才定义），
+    // 自己取一个：台账要能回答「什么时候判的」，不能留空。
+    const autoJudgedAt = new Date().toISOString();
+    // 保留**信息量更大**的那条，不是更新的那条。
+    //
+    // 「保留新的」看着合理，实测是错的：live 库 >=0.95 的 20 对里，11 对（55%）
+    // 新的那条比旧的短，平均短 132 字；降到 0.88 的 213 对里 122 对（57%）如此。
+    // 典型例子：「用户同时开 web profile 和 desktop profile 时出现开不了新对话/
+    // 会话异常，用户自己…」（371 字，旧）被压成「用户同时开 web profile 和
+    // desktop profile 的 dsh-mneme 时开不了新对话」（307 字，新）——蒸馏时压缩过
+    // 的一版反而更新。留新条等于把更完整的那条归档掉。
+    //
+    // 这与 mem0 的裁决规则一致：`configs/prompts.py:217` 明写「两句话说的是同一
+    // 件事时，留信息量最大的那条，不是留最新的」。cognee 反过来（「取更新的」），
+    // 那是反例——照抄会把「0:00 前必须躺下」削成残缺版。
+    //
+    // 长度相同才算「信息量相当」，此时退回更新时间，再退回 id：三级兜底保证同一
+    // 对每次判出同一个赢家（否则重放会来回翻，归档的可能是刚保住的那条）。
+    const infoFirst = (p) => {
+      const an = p.a.content?.length ?? 0;
+      const bn = p.b.content?.length ?? 0;
+      if (an !== bn) return an > bn ? [p.a, p.b] : [p.b, p.a];
+      const au = p.a.updated_at ?? "";
+      const bu = p.b.updated_at ?? "";
+      if (au !== bu) return au > bu ? [p.a, p.b] : [p.b, p.a];
+      return p.a.id > p.b.id ? [p.a, p.b] : [p.b, p.a];
+    };
+    for (const p of autoPool) {
+      const [winner, loser] = infoFirst(p);
+      const snapshot = new Map();
+      for (const m of [winner, loser]) {
+        snapshot.set(m.id, { updated_at: m.updated_at, content: m.content, title: m.title });
+      }
+      // trustEpistemicWeighting 显式关掉：它会在 applySupersede 里按 epistemic_status
+      // 交换赢家，那会让「留信息量更大的那条」这条契约随数据漂移。自动档的承诺
+      // 必须是确定的。
+      const { applied, conflicts } = applyDecisions(
+        [{ action: "supersede", winner: winner.id, loser: loser.id }],
+        service, logger, snapshot, { ...config, trustEpistemicWeighting: false }
+      );
+      if (applied > 0) {
+        autoResolved++;
+        // 记进机器侧台账：自动动作也要能事后回答「这一对什么时候、被谁判的」。
+        try {
+          service.saveConflictReviewed?.({
+            run_id: runId, memory_a: p.a.id, memory_b: p.b.id,
+            outcome: "supersede", judged_at: autoJudgedAt
+          });
+        } catch (error) {
+          logger?.warn?.(`dsh-mneme sleep: failed to record auto-resolved pair ${p.a.id}/${p.b.id}: ${String(error)}`);
+        }
+        continue;
+      }
+      // 自动档没落地 → 退回人工队列。绝不因为「本来想自动处理」就把这一对丢掉，
+      // 那才是真正的静默丢失。两种没落地的原因都要说清楚：
+      //   · CAS 冲突（applyDecisions 记在 conflicts 里）——两侧在快照之后被改过，
+      //     自动判的赢家可能已经不是该保的那条，人看一眼最稳；
+      //   · 其余异常（记在 failures 里）——写库失败之类，重试无意义就交给人。
+      autoFailed++;
+      logger?.warn?.(
+        `dsh-mneme sleep: auto-resolve skipped ${p.a.id}/${p.b.id}`
+        + (conflicts.length ? ` (concurrent edit)` : "")
+        + `, falling back to manual review`
+      );
+      parkPool.push(p);
+    }
+    let frozen = 0;
+    let parkFailed = 0;
+    for (const p of parkPool) {
+      const outcome = parkPair(p, isCrossScopePair(p) ? scopeReason(p) : simReason(p));
+      if (outcome === "fresh") frozen++;
+      else if (outcome === "failed") parkFailed++;
+    }
+    if (pendingSkipped > 0) {
+      logger?.warn?.(`dsh-mneme sleep: conflict freeze queue full (${pendingNow}/${maxPending}), skipped ${pendingSkipped} conflict(s)`);
+    }
+    return {
+      status: frozen > 0 || autoResolved > 0 ? "ok" : "noop",
+      frozen,
+      // 自动裁决掉的不进队列，但确实是这一轮干的活——分开报，别混进 frozen
+      // （frozen 的语义是「给人工队列新增了几行」，混进去面板就会虚高）。
+      // Issue #616：这两个字段目前**没有消费者**。dream.js 的两处 return 只透出
+      // frozen，面板也不读它们；conflict_reviewed 台账同样没有 API 暴露，且 schema
+      // 不记赢家（memory_a/b 是排序过的）。也就是说自动裁决干了什么，事后只能翻
+      // loser 正文的「（已被取代：…）」后缀反推。补可见性之前，别指望从报告里看出
+      // 这一档跑了几对。
+      autoResolved,
+      autoFailed,
+      // 写库抛错的对既没入队也不算落地：clean=false，别让调度器当「追完了」。
+      clean: parkFailed === 0,
+      scopeCandidates: crossPairs.length,
+      pairs: selected.length,
+      batches: 0,
+      ledgerSkipped,
+      perRunSkipped,
+      pendingSkipped,
+      // #641 shadow：分诊分布随相位结果透出（dream phases 与审计行都能看到），
+      // 面板消费在 beta 第二批接。
+      ...(ledgerTriage ? { ledgerTriage } : {})
+    };
+  }
+
+  // 非 freeze：跨 scope 对先停车（绝不进 LLM 裁决），同 scope 对照常走 LLM。
+  let scopeParked = 0;
+  for (const p of crossPairs) {
+    if (parkPair(p, scopeReason(p)) === "fresh") scopeParked++;
+  }
+  if (samePairs.length === 0) {
+    // 没有可送 LLM 的同 scope 对：可能一对都没检测到，也可能全被台账挡下了
+    // （ledgerSkipped）。两种都要如实报，否则「sleep 怎么什么都不干」读不出来。
+    return {
+      status: scopeParked > 0 ? "ok" : "noop",
+      frozen: 0,
+      scopeCandidates: scopeParked,
+      pairs: selected.length,
+      batches: 0,
+      ledgerSkipped,
+      ...(ledgerTriage ? { ledgerTriage } : {})
+    };
+  }
+
+  // LLM adjudication（仅同 scope 对）。
+  const route = resolveSleepRoute(ctx, config, logger);
+  if (!route) return { status: "skipped", reason: "no llm route", scopeCandidates: scopeParked, pairs: selected.length, batches: 0, ledgerSkipped, ...(ledgerTriage ? { ledgerTriage } : {}) };
+  // 每轮总上限：分批解决的是单请求撞墙，不是"一个 449 对的池子该在一轮里跑完"。
+  // 没进这一轮的对留在下一轮（它们既没被丢弃，也不在台账里）。
+  const perRunCap = config.sleepConflictMaxPairsPerRun ?? 60;
+  const pool = perRunCap > 0 ? samePairs.slice(0, perRunCap) : samePairs;
+  const perRunSkipped = samePairs.length - pool.length;
+  const sleepEffort = await resolveDreamEffort(ctx, route, config.sleepReasoningEffort, logger);
+  let conflictStreamFailure = "";
+  // actionSet 已在候选构造前解析（跨类型候选需要它），这里只按档位选 prompt：
+  // 默认档保持只有 conflict/keep 的窄 prompt，"full" 才开放六分支。
+  const conflictPrompt = actionSet === "full" ? STR.prompts.conflictFull[language] : STR.prompts.conflict[language];
+  // reflectionUpdateEnabled=false：两份 conflict prompt 都教了模型怎么用 update
+  // （「信息部分过时 → update」那一支），只靠校验器拒会把每轮这份输出白付掉。
+  // 后缀与 dream 主链路共用同一条文案，两个入口对用户是同一个开关、同一种说法。
+  const conflictPromptGated = config.reflectionUpdateEnabled !== false
+    ? conflictPrompt
+    : conflictPrompt + STR.prompts.noUpdateSuffix[language];
+  const runConflict = (batch, withEffort, tokens) => {
+    conflictStreamFailure = "";
+    const listText = batch.map((p) => STR.candidateConflicts[language](p)).join("\n\n");
+    return auditedSleepLlm(ctx, service, config, logger, {
+      triggerSource: "sleep",
+      operationType: "sleep_conflict",
+      modelId: `${route.provider}:${route.model}`,
+      // 候选对的双方 id：面板的活动流用 related_memory_ids 解析「沉淀条数」。
+      // 分批后必须取**这一批**的 id：整轮的 60 对一次写进每一批的审计行，面板会把
+      // 同一个「沉淀条数」重复累加五遍。
+      relatedMemoryIds: batch.flatMap((p) => [p.a.id, p.b.id]),
+      streamError: () => conflictStreamFailure,
+      // 纯判据：输出里没有 JSON 数组 ⇒ 这轮是失败的调用，审计记 error。**不要**把
+      // 解析结果存进闭包给下面的控制流用——审计关闭时 auditedSleepLlm 整段早退、
+      // 这个钩子不会被调用，控制流会跟着失效（dream 的既有坑）。代价是审计开启时
+      // 多解析一次，换来两条路径彻底解耦。
+      auditError: (text) => (parseJsonArray(text) ? null : "no json array in llm output"),
+      // 纯判据，与 auditError 同一条约定：重解析一次、不读闭包（审计关掉时那些闭包
+      // 根本不会被赋值，读它会让「审计说了什么」依赖调用方走到了哪一行）。
+      metadataFrom: (text) => (parseJsonArray(text) ? null : parseFailureMeta(text))
+    }, (reportUsage) => streamText(ctx, {
+    provider: route.provider,
+    model: route.model,
+    purpose: "sleep-conflict",
+    maxTokens: tokens,
+    ...(withEffort && sleepEffort ? { reasoningEffort: sleepEffort } : {}),
+    messages: [
+      { role: "system", content: [{ type: "text", text: conflictPromptGated }], source: { kind: "plugin:dsh-mneme", plugin: "dsh-mneme" } },
+      { role: "user", content: [{ type: "text", text: fenceListBody(language, listText) }], source: { kind: "plugin:dsh-mneme", plugin: "dsh-mneme" } }
+    ]
+  }, reportUsage, (reason) => { conflictStreamFailure = describeStreamFailure(reason); }));
+  };
+  // 单批的完整往返：送 → 解析 → 校验 → 应用 → 记账。抽成函数是为了让失败只影响
+  // 自己这一批（下面的循环），而不是把整轮判死。
+  const adjudicateBatch = async (batch, updateBudget) => {
+    // Issue #529 review（CodeRabbit ①）：留痕写入失败要能被上层看见。只打 warn 的话，
+    // 这一对既没记账、又被算成"送出去的全落地了"，于是下一轮它原样回到候选池、又被
+    // 算成可续排——每个静默窗口重问一次同一个冲突，直到连击上限才停，而审计上每轮
+    // 都是干净的成功轮。计数随返回值透出，由 phaseConflicts 折进 clean。
+    let ledgerFailed = 0;
+    // Issue #536 review（CodeRabbit ③）：judged_at 是**发送时刻**，不是落地时刻。
+    //
+    // 取 max(墙钟, 本批两侧里最新的 updated_at)：`updated_at` 用的是 store 的
+    // **单调时钟**（src/store.js 的 nowIso：同一毫秒内的连续写入逐次 +1ms），它可能
+    // 比墙钟快几毫秒；直接用墙钟会记出一个早于被测行自身版本的 `judged_at`，于是
+    // 「这一对刚判过」在下一轮的 `alreadyJudged` 里读成「判过之后又被改过」，判 keep
+    // 的死循环原样复活（CI 的 test-host-legacy 腿抓到过一次真 flake）。两列同源才可比。
+    const judgedAt = batch.reduce(
+      (acc, p) => (p.a.updated_at > acc ? p.a.updated_at : (p.b.updated_at > acc ? p.b.updated_at : acc)),
+      new Date().toISOString()
+    );
+    const text = await withMaxTokensFallback(ctx, config.sleepMaxTokens ?? 2048, (tokens) => withEffortFallback(ctx, sleepEffort, () => runConflict(batch, true, tokens), () => runConflict(batch, false, tokens), () => conflictStreamFailure), () => conflictStreamFailure);
+    if (text === undefined) {
+      if (conflictStreamFailure) ctx.logger?.warn?.(`dsh-mneme sleep: conflict stream aborted or errored (${conflictStreamFailure})`);
+      return { status: "failed", error: "llm failed", failure: conflictStreamFailure || undefined };
+    }
+    const decisions = parseJsonArray(text);
+    if (!decisions) return { status: "failed", error: "invalid decisions json" };
+    // 本批的 snapshot 只含本批的 id。validateDecisions 要求每个 snapshot id 恰好被
+    // claim 一次，拿整轮的 snapshot 校验单批输出会把其余 48 对判成"未裁决"。
+    const batchSnapshot = new Map();
+    for (const p of batch) {
+      batchSnapshot.set(p.a.id, p.a);
+      batchSnapshot.set(p.b.id, p.b);
+    }
+    // v0.4.4 起 validateDecisions 本身就会为未覆盖的 id 自动补 keep（dreamImplicitKeep
+    // 默认开启），这里保留显式预填作为防御性双保险——漏判读作"未裁决冲突"而非
+    // "冲突阶段整体失败"。
+    const covered = new Set();
+    for (const d of decisions) {
+      // Issue #126 review（Copilot）：supersede 同样用 winner/loser 定位（没有 ids），
+      // 此前只认 conflict → 它的两个目标都没进 covered → 被补成 implicit keep → 与
+      // supersede 的 claim 冲突：严格模式整单拒绝，宽容模式把合成的 keep 记成 skipped。
+      if (d?.action === "conflict" || d?.action === "supersede") {
+        if (typeof d?.winner === "string") covered.add(d.winner);
+        if (typeof d?.loser === "string") covered.add(d.loser);
+      } else if (Array.isArray(d?.ids)) {
+        for (const id of d.ids) covered.add(id);
+      }
+    }
+    for (const id of batchSnapshot.keys()) {
+      if (!covered.has(id)) decisions.push({ action: "keep", ids: [id] });
+    }
+    // Issue #126：sleep 是多对批量裁决，严格模式"一票否决"太脆（一对非法就丢掉整轮
+    // 成果）→ 与 dream 对齐透传 skipInvalid：非法的那一对只跳过自己，合法子集照常
+    // 应用，run 记 degraded。update 上限与保护期同样取 dream 的同一组配置，保证两个
+    // 模块对"什么算合法"的判据一致。
+    const { ok, errors, skipped } = validateDecisions(decisions, batchSnapshot, {
+      // Issue #536 review（CodeRabbit ②）：reflectionUpdateMaxPerRun 是**整轮**上限，
+      // 分批后不能每批都拿整份额度——那样 N 批就是 N 倍上限。这里用的是本轮的剩余额度。
+      maxUpdatePerRun: updateBudget,
+      // reflectionUpdateEnabled=false：update 单条跳过（同 dream 主链路口径）。
+      allowUpdate: config.reflectionUpdateEnabled !== false,
+      minAgeHours: config.reflectionUpdateMinAgeHours,
+      skipInvalid: config.dreamSkipInvalid !== false,
+      allowCrossTypeMerge: config.allowCrossTypeMerge === true,
+      // issue #339 / E8：guarded 类型 merge 护栏（默认开，dreamMergeGuard），
+      // 与 dream 主链路同一判据。
+      mergeGuard: config.dreamMergeGuard === true,
+      // Issue #126 review（Copilot）：默认档必须真的只放行旧动作集——只换 prompt 挡不住
+      // 模型自发输出 supersede / differentiate，那样"opt-in 零行为变化"就不成立。
+      allowedActions: actionSet === "full" ? null : LEGACY_ACTIONS
+    });
+    if (!ok) return { status: "failed", error: `invalid decisions: ${errors.join("; ")}`, skipped };
+    // 同 phasePatterns——本相位的 create 也落 source=sleep（默认档的
+    // LEGACY_ACTIONS 含 create，理论上可 mint）。
+    const { applied, failures, conflicts } = applyDecisions(
+      // runId 让 differentiate 的账本行能追到是哪一轮 sleep 判的（issue #533）。
+      decisions, service, logger, batchSnapshot, { ...config, mintSource: "sleep", runId }
+    );
+    // Issue #536 review（CodeRabbit ②）：本轮剩余的 update 额度按本批**通过校验的**
+    // update 数扣减——validateDecisions 已把非法条目从 decisions 就地 splice 掉，
+    // 所以数到的都是真的会落地的那些。落地时被 CAS 挡下的也算：额度宁可少发一次，
+    // 也不能让"多批各扣一次满额"把整轮上限架空。
+    const updateUsed = decisions.filter((d) => d?.action === "update").length;
+    // Issue #126 review（Copilot）：事务内 service.update 会跳过 scheduleEmbed（txDepth>0），
+    // 而 sleep 路径此前没有 dream 那样的 post-apply 索引维护——differentiate 的差异注记与
+    // supersede 的归档都反映不到缓存向量，"注记进 embedding 防再判重复"就是空承诺。
+    if (applied > 0 && semantic?.embedder && semantic?.vectorIndex) {
+      try {
+        await maintainIndexAfterDream(decisions, service, semantic);
+      } catch (error) {
+        logger?.warn?.(`dsh-mneme sleep: index maintenance failed: ${String(error)}`);
+      }
+    }
+    // 台账：本批**全部送审对**都记一行，不只记被判成冲突的那几对。判 keep 的那一对
+    // 正是 #529 里"下一轮原样再送"的元凶，只记有动作的对等于没记。
+    if (typeof service.saveConflictReviewed === "function") {
+      // judged_at 取的是**发送之前**的时刻（见函数开头），不是落地之后：LLM 往返
+      // 期间若一侧被外部改动，它的 updated_at 会晚于 judged_at，下一轮自然重新入池；
+      // 模型看到的本来就是旧快照，按"已审"封盘等于用陈旧结论锁死这一对。
+      const outcomeOf = new Map();
+      for (const d of decisions) {
+        const action = d?.action ?? "keep";
+        if (action === "conflict" || action === "supersede") {
+          if (typeof d?.winner === "string") outcomeOf.set(d.winner, action);
+          if (typeof d?.loser === "string") outcomeOf.set(d.loser, action);
+        } else if (Array.isArray(d?.ids)) {
+          for (const id of d.ids) outcomeOf.set(id, action);
+        }
+      }
+      // Issue #536 review（CodeRabbit ③）：未落地的对不记账。skipped（非法被跳）、
+      // failures（写入失败）、conflicts（CAS 冲突）里出现过的 id，说明那条决策没生效；
+      // 把它记成"已审"会让下一轮的 alreadyJudged 为真，这一对从此不再送审——
+      // 沉默地永久压制一个真实冲突，比多送一轮贵得多。
+      const unsettled = new Set();
+      for (const f of [...(failures ?? []), ...(conflicts ?? []), ...(skipped ?? [])]) {
+        for (const id of f?.ids ?? []) unsettled.add(id);
+      }
+      for (const p of batch) {
+        if (unsettled.has(p.a.id) || unsettled.has(p.b.id)) continue;
+        try {
+          service.saveConflictReviewed({
+            run_id: runId,
+            memory_a: p.a.id,
+            memory_b: p.b.id,
+            // 一对两端的动作可能不同（conflict 的胜/败、merge 的两端），取**非 keep
+            // 的那一侧**：keep/keep 才代表"看过、不冲突"，这正是我们要留痕的结论。
+            outcome: [outcomeOf.get(p.a.id), outcomeOf.get(p.b.id)]
+              .find((x) => x && x !== "keep") ?? "keep",
+            judged_at: judgedAt
+          });
+        } catch (error) {
+          // Issue #529 review（CodeRabbit）：留痕失败必须让这一轮**不 clean**。只 warn 的
+          // 话，这一对既没记账、又被算成"送出去的全落地了"，下一轮它原样回到候选池、
+          // 又被算成可续排——每个静默窗口重问一次同一个冲突，直到连击上限才停，而
+          // 审计上每一轮都是干净的成功轮。
+          ledgerFailed += 1;
+          logger?.warn?.(`dsh-mneme sleep: failed to record reviewed conflict ${p.a.id}/${p.b.id}: ${String(error)}`);
+        }
+      }
+    }
+    // Issue #126 review（Copilot）：有决策被跳过时不能报 ok——与 dream 的 degraded 契约
+    // 对齐（"合法子集已应用"是 degraded 而非 ok），否则消费方分不清整轮与残轮。
+    return { status: applied > 0 ? (skipped.length > 0 ? "degraded" : "ok") : failures.length ? "failed" : "noop", applied, failures, conflicts, skipped, updateUsed, ledgerFailed };
+  };
+  // 分批：每批独立往返，坏批只记 degraded 不中断。此前一次全送，任何一处理由
+  // （撞上下文、输出截断、JSON 坏掉）都是整轮 failed——而整轮 failed 又不带 pairs，
+  // 事后看不出它到底送了什么。
+  const batchSize = config.sleepConflictMaxPairs ?? 12;
+  const batches = batchSize > 0
+    ? Array.from({ length: Math.ceil(pool.length / batchSize) }, (_, i) => pool.slice(i * batchSize, (i + 1) * batchSize))
+    : [pool];
+  let applied = 0;
+  const failures = [];
+  const conflicts = [];
+  const skipped = [];
+  let failedBatches = 0;
+  // Issue #529 review（CodeRabbit ①）：台账写入失败的累计数（逐批由 adjudicateBatch 报回）。
+  let ledgerFailed = 0;
+  // 用户活动打断时**不能**落进下面那条 noop：noop 的语义是「看过，没冲突」，而被打断
+  // 的那几批根本没送出去。用与入口处（signal 一开始就是 aborted）同一个词汇，避免
+  // 同一件事两个状态名。
+  let interrupted = false;
+  // Issue #536 review（CodeRabbit ②）：reflectionUpdateMaxPerRun 是**整轮**上限。
+  // 校验器本身不跨批记忆，每批各拿一份满额就等于 N 倍上限，所以额度由这里持有：
+  // 每批只领剩余额度，校验通过后按**本批通过校验的** update 数扣减。额度用尽的
+  // 那几批若还含 update，会被校验器整单拒绝（记 failed），其余批照常继续——
+  // 与"一批坏掉不判死整轮"的既有契约一致。
+  let updateLeft = config.reflectionUpdateMaxPerRun ?? 2;
+  for (let i = 0; i < batches.length; i++) {
+    if (signal?.aborted) { interrupted = true; break; }
+    // Issue #536 review（CodeRabbit）：单批抛错不能带走整轮。`adjudicateBatch` 里不只有
+    // "把失败变成返回值"的 LLM 通路，还有 `applyDecisions` 与台账写入——它们抛出的异常
+    // 此前会直接跳出循环，后面所有批都不跑、已汇总的 applied/failures 也一起丢掉。
+    // 只放行 AbortError（取消意图绝不能被降级重试吞掉，与 dream.js 的 withEffort 守卫同款），
+    // 其余一律折成这一批的 failed 结果，循环继续。
+    let res;
+    try {
+      res = await adjudicateBatch(batches[i], updateLeft);
+    } catch (error) {
+      if (error?.name === "AbortError") { interrupted = true; break; }
+      res = { status: "failed", error: String(error?.message ?? error), failures: [], skipped: [] };
+    }
+    if (res.status === "failed") {
+      failedBatches++;
+      failures.push(...(res.failures ?? []));
+      skipped.push(...(res.skipped ?? []));
+      // 失败批的原始理由（stream 层的 abort/error 原文）要进审计：只写 "llm failed"
+      // 的话，运维分不清是上下文超限、模型拒收还是用户活动打断。
+      logger?.warn?.(`dsh-mneme sleep: conflict batch ${i + 1}/${batches.length} failed: ${res.error}${res.failure ? ` (${res.failure})` : ""}`);
+      continue;
+    }
+    applied += res.applied;
+    ledgerFailed += res.ledgerFailed ?? 0;
+    updateLeft = Math.max(0, updateLeft - (res.updateUsed ?? 0));
+    failures.push(...(res.failures ?? []));
+    conflicts.push(...(res.conflicts ?? []));
+    skipped.push(...(res.skipped ?? []));
+  }
+  const degraded = skipped.length > 0 || failedBatches > 0;
+  // 一批都没成功才算整轮失败；只要有一批落地，如实记 degraded——这跟 deriveStatus
+  // 的契约一致（degraded 也算有产出）。
+  const allFailed = failedBatches === batches.length;
+  // 有一批没走通时整轮**绝不能报 noop**：noop 的语义是「看过，没冲突」，而踩了
+  // llm failed 的那批其实没看过。这是 #529 里最误导人的一处——23 轮失败期间
+  // applied 恒为 0，若再叠上 noop，运维只会以为库里没冲突。
+  const status = interrupted
+    ? "aborted"
+    : allFailed
+    ? "failed"
+    : applied > 0
+      ? (degraded ? "degraded" : "ok")
+      : failures.length
+        ? "failed"
+        : failedBatches > 0
+          ? "degraded"
+          : "noop";
+  // Issue #529（续排）：「这一轮有没有产出」和「送出去的每一对是不是都落地了」是两件
+  // 正交的事，status 只回答前者。全判 keep 的轮次 applied 恒为 0 → status 是 noop
+  // （never ok），而它恰恰是 #529 里最该续排的场景；拿 status === "ok" 当判据会在
+  // 这里把续排堵死。所以另给一个布尔，口径与下面台账的 unsettled 完全一致：failure
+  // （写入失败）/ conflicts（CAS 冲突）/ skipped（非法被跳）任一出现过，就说明有对没
+  // 落地，它下一轮还会被重新配出来，不算 clean。
+  // Issue #529 review（CodeRabbit ①）：台账写入失败同样算"没落地"——那一对没被记成
+  // 已审，下一轮会重新入池，与上面 unsettled 是同一个道理。
+  const clean =
+    !interrupted &&
+    failedBatches === 0 &&
+    skipped.length === 0 &&
+    failures.length === 0 &&
+    conflicts.length === 0 &&
+    ledgerFailed === 0;
+  return {
+    status,
+    clean,
+    // Issue #529 D：失败轮也要带 pairs/batches——此前只有成功路径带 pairs，85 条
+    // 失败审计行全是"送了个寂寞"，连送了多少对都查不到。
+    pairs: selected.length,
+    // #533：这一轮被账本压掉、没送 LLM 的候选对数——不记的话「pairs 变小了」
+    // 分不清是没检测到还是已经裁决过。
+    suppressed,
+    batches: batches.length,
+    ledgerSkipped,
+    perRunSkipped,
+    applied,
+    // Issue #529 review（CodeRabbit ①）：留痕失败的对数——clean 为 false 时要能分清是
+    // 哪一类没落地（写入失败 / 非法被跳 / CAS 冲突 / 台账没记上）。
+    ledgerFailed,
+    failures,
+    conflicts,
+    // Issue #126：#104 同向——被跳过的逐对明细要进审计行，否则事后无法判断
+    // 是哪一对、因何被跳过（此前只进 logger.warn，splice 后就地消失）。
+    skipped,
+    // #641 shadow：分诊分布随相位结果透出（四个出口都要带——freeze/空池/无路由/
+    // LLM 全路径，缺一个出口 shadow 期就有部分轮次查不到分布）。
+    ...(ledgerTriage ? { ledgerTriage } : {})
+  };
+}
+
+/**
+ * Phase 2 — archival demotion. No LLM: tiering is time-based, summaries are
+ * truncations, and the full body is preserved in _full_content so nothing is
+ * lost. Deterministic and cheap, so it runs even with no LLM route.
+ */
+function phaseDemotion(service, config, logger, runId, signal = null) {
+  const archiveDays = config.sleepArchiveDays ?? 30;
+  const compressDays = config.sleepCompressDays ?? 90;
+  const archiveCut = Date.now() - archiveDays * 86400000;
+  const compressCut = Date.now() - compressDays * 86400000;
+  const demoted = [];
+  const archived = [];
+  // 被判定为「该降级」但 demoteToSummary 实际没动手的条数。单独报出来：
+  // 它正是「台账说降级了 N 条、实际一条没变」那个缺口，藏起来就等于没修。
+  let demoteSkipped = 0;
+  // 政策轴在这里尤其要紧：下面两行会真改归档面（setArchived / demoteToSummary）。
+  // 把过滤放在循环之外、而不是在循环体里 continue：一旦将来有人在循环体里加
+  // 副作用（现已有），漏掉那条 continue 就是静默改到被按下的行。
+  // 外来行也在循环之外挡掉，同一个理由：它不经本方蒸馏，时间分层无权动它的原文或
+  // 归档面；而下面两行动作（setArchived / demoteToSummary）不经 saveWithDedupe，
+  // 汇流口那道闸门到这里已经管不到了。
+  for (const m of withoutPaused(service, service.all().filter((m) => !isImportedRow(m)))) {
+    if (signal?.aborted) break;
+    if (m.archived || m.forgotten) continue;
+    // 已降级的行不必再进判定链：demoteToSummary 见到 _full_content 会直接返回，
+    // 但这行每轮仍会被选中、空转一次事务，再被下面无条件 push 进 demoted。
+    // 提前挡掉既省事务，也让「这一轮到底动了什么」从源头算得准（#603 台账）。
+    if (m._full_content) continue;
+    const ref = m.last_accessed_at ?? m.created_at;
+    if (!ref) continue;
+    const t = new Date(ref).getTime();
+    if (Number.isNaN(t)) continue;
+    // v0.7.0 热联合判定（仅 heatEnabled 时启用；默认关则退回纯时间分层，
+    // 与 v0.7.12 行为一致）：时间窗之外再加两道保护闸——热度低于
+    // sleepHeatThreshold 且 importance<5 才允许降级。λ=0 的免疫类型 heat 恒
+    // 1.0 天然豁免（preference/pattern/summary 永不因 sleep 降级）；importance
+    // ≥5 的紧要记忆无论多冷都保留。`冷但重要` 与 `热但低值` 均不满足条件。
+    const heatOn = config.heatEnabled !== false;
+    if (heatOn) {
+      const heat = computeHeat(m, Date.now(), config);
+      const heatProtected = heat >= (config.sleepHeatThreshold ?? 0.05);
+      const important = (m.importance ?? 0) >= 5;
+      if (heatProtected || important) continue;
+    }
+    if (t < compressCut) {
+      service.setArchived(m.id, true);
+      archived.push(m.id);
+    } else if (t < archiveCut) {
+      // minRefTimeMs re-checks freshness inside demoteToSummary's transaction:
+      // a recall touch landing after this snapshot must not demote the memory.
+      //
+      // 返回值必须看：demoteToSummary 在三种情况下返回 undefined（行不存在、
+      // 已降级、快照后被 recall 摸热），而这里原来无条件 push，于是台账把没发生
+      // 的降级记成发生了——live 库实测 12 轮里虚报 43%–99%（#603）。
+      const updated = service.demoteToSummary(m.id, makeSummary(m), { minRefTimeMs: archiveCut });
+      if (updated) demoted.push(m.id);
+      else demoteSkipped++;
+    }
+  }
+  return {
+    status: demoted.length || archived.length ? "ok" : "noop",
+    demoted,
+    archived,
+    demoteSkipped
+  };
+}
+
+/**
+ * Phase 3 — pattern discovery. The LLM scans the most recent memories and
+ * mints type=pattern entries (create actions) with evidence references.
+ * The empty snapshot is intentional: create claims no existing id, so the
+ * "every id claimed" invariant is trivially satisfied for pure-create lists.
+ */
+async function phasePatterns(ctx, service, config, logger, runId, signal = null) {
+  const language = langOf(config);
+  const route = resolveSleepRoute(ctx, config, logger);
+  if (!route) return { status: "skipped", reason: "no llm route" };
+  const limit = config.sleepPatternMinMemories ?? 100;
+  // #230：document 在查询层排除（excludeTypes）而不是截断后过滤——LIMIT 200
+  // 先生效的话，指针行一多就会把普通记忆挤出扫描窗，池子饿到门槛以下。
+  // 政策轴同理必须排在 `.slice(0, limit)` **之前**，否则被按下的行照样占掉
+  // sleepPatternMinMemories 的名额，而它们既不会被扫、也不该挤掉别人（#471）。
+  //
+  // archived 这一轴不在下面出现，不是漏了：list() 默认就带 `archived = 0`
+  // （store.js list 的 includeArchived 默认 false、onlyArchived 默认 false），
+  // 旧写法那句 `!m.archived` 一直是重复过滤——查询层已经把它挡在外面。
+  // 窗口至少等于本次要扫的名额：`sleepPatternMinMemories` 的合法上限是 1000
+  // （src/config.js:612）。窗口若还是死的 200，那么把这个值配到 200 以上的人
+  // **每一轮**都会触发下面那次无界重取，跟闸门按没按下无关——那是把这条修复
+  // 从「按需」变成「常付」。
+  const poolQuery = {
+    limit: Math.max(200, limit), includeForgotten: false,
+    // 三条政策轴全部下推到查询层：留在 LIMIT 之后过滤，等于让被丢掉的行为窗口占名额
+    // （模式扫描池会因此饿到 sleepPatternMinMemories 以下而静默跳过）。同一取舍见
+    // #230 的 document 轴与本文件 #471 的暂停轴，src/service.js:2247 那条注释记着前例。
+    excludeTypes: ["document", "summary", "pattern"],
+    excludeImported: true
+  };
+  const gather = (query) => withoutPaused(service, service.list(query));
+  let pool = gather(poolQuery);
+  // #515：暂停闸门要读 scope_state 并按「这一维有标注」匹配，下推进 SQL 就等于让判定
+  // 长出第二份实现（issue 里写过为什么否掉，`*` 那一行是关键的不可下推处）。所以这里
+  // 不动判定、只放宽取数：**只有窗口过滤后不够本次要扫的名额**才不带窗口重取一次。
+  // 常态仍只付一次有界查询；多付的那一次恰好就是原本会静默跳过的那一次——
+  // 症状从「库里没东西可扫」变成「扫了」，这才是这条闸门该有的行为。
+  if (pool.length < limit) pool = gather({ ...poolQuery, limit: null });
+  const memories = pool
+    .sort((a, b) => (a.updated_at < b.updated_at ? 1 : -1))
+    .slice(0, limit);
+  if (memories.length === 0) return { status: "skipped", reason: "no memories to scan" };
+  if (signal?.aborted) return { status: "aborted", reason: "user activity" };
+  const listText = memories
+    .map((m) => `id=${m.id} | type=${m.type} | importance=${m.importance} | updated=${m.updated_at} | title=${m.title} | content=${m.content}`)
+    .join("\n");
+  const maxPatterns = config.sleepMaxPatternPerRun ?? 3;
+  const sleepEffort = await resolveDreamEffort(ctx, route, config.sleepReasoningEffort, logger);
+  let patternStreamFailure = "";
+  const runPattern = (withEffort, tokens) => {
+    patternStreamFailure = "";
+    return auditedSleepLlm(ctx, service, config, logger, {
+      triggerSource: "sleep",
+      operationType: "sleep_pattern",
+      modelId: `${route.provider}:${route.model}`,
+      // 本轮扫描的记忆 id：与 dream 的 relatedMemoryIds 同义，供面板解析沉淀条数。
+      relatedMemoryIds: memories.map((m) => m.id),
+      streamError: () => patternStreamFailure,
+      // 纯判据，同 conflict 阶段：不把解析结果存进闭包供控制流使用。
+      auditError: (text) => (parseJsonArray(text) ? null : "no json array in llm output"),
+      // 纯判据，与 auditError 同一条约定：重解析一次、不读闭包（审计关掉时那些闭包
+      // 根本不会被赋值，读它会让「审计说了什么」依赖调用方走到了哪一行）。
+      metadataFrom: (text) => (parseJsonArray(text) ? null : parseFailureMeta(text))
+    }, (reportUsage) => streamText(ctx, {
+    provider: route.provider,
+    model: route.model,
+    purpose: "sleep-pattern",
+    maxTokens: tokens,
+    ...(withEffort && sleepEffort ? { reasoningEffort: sleepEffort } : {}),
+    messages: [
+      { role: "system", content: [{ type: "text", text: STR.prompts.pattern[language].replace("N", String(maxPatterns)) }], source: { kind: "plugin:dsh-mneme", plugin: "dsh-mneme" } },
+      { role: "user", content: [{ type: "text", text: fenceListBody(language, listText) }], source: { kind: "plugin:dsh-mneme", plugin: "dsh-mneme" } }
+    ]
+  }, reportUsage, (reason) => { patternStreamFailure = describeStreamFailure(reason); }));
+  };
+  const text = await withMaxTokensFallback(ctx, config.sleepMaxTokens ?? 2048, (tokens) => withEffortFallback(ctx, sleepEffort, () => runPattern(true, tokens), () => runPattern(false, tokens), () => patternStreamFailure), () => patternStreamFailure);
+  if (text === undefined) {
+    if (patternStreamFailure) ctx.logger?.warn?.(`dsh-mneme sleep: pattern stream aborted or errored (${patternStreamFailure})`);
+    return { status: "failed", error: "llm failed" };
+  }
+  const decisions = parseJsonArray(text);
+  if (!decisions || decisions.length === 0) return { status: "skipped", reason: "no patterns found" };
+  // Evidence ids are provenance refs; an LLM-fabricated id would mint a dead
+  // ev:tag pointing nowhere. Intersect evidence with the scanned set so only
+  // real memory references survive.
+  const scannedIds = new Set(memories.map((m) => m.id));
+  for (const d of decisions) {
+    if (d?.action === "create" && Array.isArray(d.evidence)) {
+      d.evidence = d.evidence.filter((id) => typeof id === "string" && scannedIds.has(id));
+    }
+  }
+  const snapshot = new Map();
+  const { ok, errors } = validateDecisions(decisions, snapshot, {
+    maxCreatePerRun: maxPatterns
+  });
+  if (!ok) return { status: "failed", error: `invalid decisions: ${errors.join("; ")}` };
+  // 本相位的 create 落 source=sleep。来源从管道给而非从决策对象取——见
+  // applyDecisions 的 @param config。
+  // #512：runId 也必须给——这是 sleep 唯一的真实铸造路径，漏了它，铸造出来的
+  // pattern 就只能追到「sleep 这条管道」，追不到「哪一轮 sleep」（正是 #512 要补的口子）。
+  const { applied, merged, failures, conflicts } = applyDecisions(
+    decisions, service, logger, snapshot, { ...config, mintSource: "sleep", runId }
+  );
+  return {
+    // A pattern that hit an existing same-title row is refreshed in place, not
+    // minted. Counting it as `ok` with `applied: 0` claims a mint that did not
+    // happen; report the refresh separately (#619 audit round 6).
+    status: applied > 0 ? "ok" : (merged > 0 ? "refreshed" : "noop"),
+    scanned: memories.length,
+    applied,
+    merged,
+    failures,
+    conflicts
+  };
+}
+
+/**
+ * Phase 5 — affective attribution (issue #619). The LLM reads recent memories and
+ * names emotions, but the shape of what it may write is fixed here, not by the
+ * prompt: an emotion tied to **one occasion** becomes an `affective_context`
+ * relation carrying the attribution on the edge; only an emotion that recurs
+ * across sleepAffectiveTraitMinSessions **independent sessions** may be minted as
+ * a standing trait (a type=pattern memory, through the same
+ * validateDecisions/applyDecisions channel every other mint uses).
+ *
+ * The whole point is the guardrail, so it lives in code and not in the prompt:
+ *  - the model may *claim* trait, but the claim only survives if provenance shows
+ *    enough distinct sessions. A single session is downgraded to occasion, never
+ *    dropped silently — dropped claims are counted and reported.
+ *  - person/target must resolve to entities that already exist; an emotion about
+ *    an unknown name is not evidence, it is a hallucination.
+ *  - evidence ids must be inside the scanned pool (same rule phasePatterns uses).
+ * Off by default (sleepAffectiveEnabled) and a child of sleepModeEnabled: no
+ * route, no entities, or the flag off all mean "skip", never "run anyway".
+ */
+async function phaseAffective(ctx, service, config, logger, runId, signal = null) {
+  if (config.sleepAffectiveEnabled !== true) return { status: "skipped", reason: "disabled" };
+  const route = resolveSleepRoute(ctx, config, logger);
+  if (!route) return { status: "skipped", reason: "no llm route" };
+  const entities = service.listEntities({ limit: 1000 }) ?? [];
+  if (entities.length < 2) return { status: "skipped", reason: "too few entities" };
+  const limit = config.sleepPatternMinMemories ?? 100;
+  const poolQuery = {
+    limit: Math.max(200, limit),
+    includeForgotten: false,
+    excludeTypes: ["document", "summary", "pattern"],
+    excludeImported: true
+  };
+  const gather = (query) => withoutPaused(service, service.list(query));
+  let pool = gather(poolQuery);
+  if (pool.length < limit) pool = gather({ ...poolQuery, limit: null });
+  const memories = [...pool].sort((a, b) => String(b.updated_at).localeCompare(String(a.updated_at))).slice(0, limit);
+  if (memories.length === 0) return { status: "skipped", reason: "no memories" };
+  const scannedIds = new Set(memories.map((m) => m.id));
+  const byName = new Map();
+  for (const e of entities) byName.set(e.name.toLowerCase(), e);
+  const traitMinSessions = config.sleepAffectiveTraitMinSessions ?? 3;
+  const maxRelations = config.sleepAffectiveMaxRelationsPerRun ?? 10;
+  const maxTraits = config.sleepMaxPatternPerRun ?? 3;
+  const language = langOf(config).startsWith("zh") ? "zh" : "en";
+  const entityNames = entities.map((e) => e.name).slice(0, 200).join(", ");
+  const listText = memories.map((m) => `id=${m.id} | time=${m.updated_at ?? ""} | type=${m.type} | title=${m.title} | content=${m.content}`).join("\n");
+  let streamFailure;
+  const runAffective = (tokens) => auditedSleepLlm(
+    ctx, service, config, logger,
+    {
+      triggerSource: "sleep",
+      operationType: "sleep_affective",
+      modelId: `${route.provider}:${route.model}`,
+      relatedMemoryIds: memories.map((m) => m.id),
+      streamError: () => streamFailure,
+      auditError: (out) => (parseJsonArray(out) ? null : "no json array in llm output"),
+      metadataFrom: (out) => (parseJsonArray(out) ? null : parseFailureMeta(out))
+    },
+    (reportUsage) => streamText(ctx, {
+      provider: route.provider,
+      model: route.model,
+      purpose: "sleep-affective",
+      maxTokens: tokens,
+      messages: [
+        {
+          role: "system",
+          content: [{ type: "text", text: STR.prompts.affective[language].replaceAll("{{MIN_SESSIONS}}", String(traitMinSessions)) }],
+          source: { kind: "plugin:dsh-mneme", plugin: "dsh-mneme" }
+        },
+        { role: "user", content: [{ type: "text", text: fenceListBody(language, `${entityNames}\n---\n${listText}`) }], source: { kind: "plugin:dsh-mneme", plugin: "dsh-mneme" } }
+      ]
+    }, reportUsage, (reason) => { streamFailure = describeStreamFailure(reason); })
+  );
+  const text = await withMaxTokensFallback(ctx, config.sleepMaxTokens ?? 2048, runAffective, () => streamFailure);
+  if (text === undefined) {
+    // #619 可见化 A：失败原因不能只写成 "llm failed"。conflict 相位
+    // （src/dream/sleep.js 的 adjudicateBatch 调用处）早就把 stream 层的原文写进
+    // warn 并挂在返回值的 `failure` 上，理由写在它旁边的注释里：只写 "llm failed"
+    // 的话，运维分不清是上下文超限、模型拒收还是用户活动打断。affective 相位漏了
+    // 这一步，实测 2026-11-10T16:09 那一轮审计行只有 {"status":"failed",
+    // "error":"llm failed"}，502 原文只能去 llm_audit_logs 里捞。
+    // 相位自身不重试 5xx（withMaxTokensFallback 只处理 max_tokens 被拒、
+    // withEffortFallback 只处理 effort 被拒），所以这里记的就是一次性失败的真因。
+    if (streamFailure) logger?.warn?.(`dsh-mneme sleep: affective stream aborted or errored (${streamFailure})`);
+    return { status: "failed", error: "llm failed", failure: streamFailure || undefined };
+  }
+  const items = parseJsonArray(text) ?? [];
+  if (items.length === 0) return { status: "skipped", reason: "no attributions found" };
+  const relations = [];
+  const merges = [];
+  const traits = [];
+  const dropped = [];
+  let downgradedCount = 0;
+  const sessionCache = new Map();
+  const sessionsFor = (memoryIds) => {
+    const out = new Set();
+    for (const id of memoryIds) {
+      if (!sessionCache.has(id)) {
+        let rows = [];
+        try {
+          rows = service.provenanceFor?.(id) ?? [];
+        } catch {
+          rows = [];
+        }
+        sessionCache.set(id, rows.map((r) => r.session_id).filter((s) => typeof s === "string" && s));
+      }
+      for (const s of sessionCache.get(id)) out.add(s);
+    }
+    return out;
+  };
+  for (const item of items) {
+    if (signal?.aborted) break;
+    if (!item || typeof item !== "object") continue;
+    const person = byName.get(String(item.person ?? "").toLowerCase());
+    const target = byName.get(String(item.target ?? "").toLowerCase());
+    if (!person || !target || person.id === target.id) {
+      dropped.push({ reason: "unknown entity", person: item.person, target: item.target });
+      continue;
+    }
+    const evidence = (Array.isArray(item.evidence) ? item.evidence : []).filter((id) => scannedIds.has(id));
+    if (evidence.length === 0) {
+      dropped.push({ reason: "no real evidence", person: item.person, target: item.target });
+      continue;
+    }
+    const emotion = String(item.emotion ?? "").trim();
+    if (!emotion) {
+      dropped.push({ reason: "no emotion", person: item.person, target: item.target });
+      continue;
+    }
+    // The guardrail: a claimed trait is checked against provenance, and a claim
+    // that does not survive is demoted — not discarded. Demoted claims are the
+    // interesting number: they are exactly the mis-attributions the probe hunts.
+    const claimedTrait = String(item.attribution ?? "").toLowerCase() === "trait";
+    const sessions = sessionsFor(evidence);
+    const downgraded = claimedTrait && sessions.size < traitMinSessions;
+    const attribution = claimedTrait && !downgraded ? "trait" : "occasion";
+    const record = {
+      person: person.name,
+      target: target.name,
+      emotion,
+      attribution,
+      evidence,
+      sessionCount: sessions.size,
+      why: String(item.why ?? "").slice(0, 200),
+      ...(downgraded ? { downgradedFrom: "trait" } : {})
+    };
+    if (downgraded) downgradedCount += 1;
+    if (attribution === "trait") {
+      traits.push(record);
+      continue;
+    }
+    // #619 / Ephor: entity_relations 没有 UNIQUE 约束，saveRelation 每次
+    // randomUUID() 新插一条。同一个 (person, target, 场合) 跑第二轮就会得到
+    // 第二条一模一样的边——而探针会拿同一批段反复回放，重复边会让 sessionCount
+    // 看起来比真实场合数多，主指标直接失真。
+    //
+    // 「同一场合」不能拿 evidence 有没有交集来判。两次判据都基于证据列表，
+    // 而证据列表既不是场合本身、也不稳定：
+    //   ① 模型给 evidence 的顺序不定（parseJsonArray 也不排序），[m1,m2] 与
+    //      [m2,m1] 是同一场合的两种写法；
+    //   ② 同一会话里的两条不同记忆各说一句「他很焦虑」，证据天然不相交，可
+    //      它们是同一个场合——那时该合并成一条边，而不是各写一条把边数抬高；
+    //   ③ 反过来，第一轮看到 1 条证据、第二轮攒到 2 条（含新会话），若判成重复
+    //      就整条丢掉，边上 sessionCount 永远停在第一次那个数，将来读归因覆盖率
+    //      会一直读到 1。
+    // 所以键落在会话层：同一 (person, target, emotion) 且两边的会话集有交集，
+    // 就是同一场合。命中时把 evidence 并集写回、按并集重算 sessionCount，而不是
+    // 丢弃——被扩充的边记进 merged，让「这一轮其实补了证据」在返回值里看得见。
+    // 这一步在 cap 之前：合并既有边不新增行，不该占名额。
+    const currentSessions = sessions;
+    const priorEdges = (service.getRelations(person.id) ?? []).filter((r) =>
+      r.relation_type === "affective_context" && r.to_entity === target.id
+    );
+    let mergedInto = null;
+    for (const edge of priorEdges) {
+      const meta = edge.metadata && typeof edge.metadata === "object" ? edge.metadata : null;
+      const priorEmotion = String(meta?.emotion ?? "").trim();
+      if (priorEmotion !== emotion) continue;
+      const priorEvidence = Array.isArray(meta?.evidence)
+        ? meta.evidence
+        : (edge.memory_id ? [edge.memory_id] : []);
+      const priorSessions = sessionsFor(priorEvidence);
+      // "Same occasion" is judged on session keys first. Only when either side
+      // has no session key at all does it fall back to an evidence intersection:
+      // memory_save writes memories without provenance (1671 of 8517 active rows
+      // in the live database have none), so sessionsFor returns an empty set and
+      // a session-only test would write the same edge again on every sleep pass,
+      // inflating sessionCount past the real number of occasions.
+      const sameOccasion = [...priorSessions].some((s) => currentSessions.has(s))
+        || ((priorSessions.size === 0 || currentSessions.size === 0)
+          && priorEvidence.some((id) => evidence.includes(id)));
+      if (!sameOccasion) continue;
+      mergedInto = { edge, priorEvidence, priorSessions };
+      break;
+    }
+    if (mergedInto) {
+      const { edge, priorEvidence, priorSessions } = mergedInto;
+      const unionEvidence = [...new Set([...priorEvidence, ...evidence])];
+      const unionSessions = new Set([...priorSessions, ...currentSessions]);
+      const mergedMetadata = {
+        ...(edge.metadata && typeof edge.metadata === "object" ? edge.metadata : {}),
+        emotion,
+        // 保留首个 attribution，但降级痕迹一旦有就留着——合并不能把
+        // 「它曾被判成 trait 又被降级」这段历史抹掉。
+        attribution: (edge.metadata && edge.metadata.attribution) || attribution,
+        evidence: unionEvidence,
+        sessionCount: unionSessions.size,
+        lastMergedRunId: runId
+      };
+      if (record.downgradedFrom && !mergedMetadata.downgradedFrom) {
+        mergedMetadata.downgradedFrom = record.downgradedFrom;
+      }
+      try {
+        service.updateRelationMetadata?.(edge.id, mergedMetadata);
+        merges.push({
+          id: edge.id,
+          from: person.name,
+          to: target.name,
+          emotion,
+          evidence: unionEvidence.length,
+          sessionCount: unionSessions.size
+        });
+      } catch (error) {
+        logger?.warn?.(`dsh-mneme sleep: affective relation merge ${person.name}/${target.name} failed: ${String(error)}`);
+      }
+      continue;
+    }
+    if (relations.length >= maxRelations) {
+      dropped.push({ reason: "relation cap", person: person.name, target: target.name });
+      continue;
+    }
+    try {
+      const saved = service.saveRelation({
+        from_entity: person.id,
+        to_entity: target.id,
+        relation_type: "affective_context",
+        memory_id: evidence[0],
+        source: "llm",
+        metadata: {
+          emotion,
+          attribution,
+          why: record.why,
+          evidence,
+          sessionCount: sessions.size,
+          ...(record.downgradedFrom ? { downgradedFrom: record.downgradedFrom } : {}),
+          model: `${route.provider}:${route.model}`,
+          runId
+        }
+      });
+      relations.push({ id: saved?.id, from: person.name, to: target.name, emotion, attribution, ...(record.downgradedFrom ? { downgradedFrom: record.downgradedFrom } : {}) });
+    } catch (error) {
+      logger?.warn?.(`dsh-mneme sleep: affective relation ${person.name}/${target.name} failed: ${String(error)}`);
+    }
+  }
+  // Traits ride the standard decision channel so they inherit every existing cap
+  // and the #512 mint ledger. No new write path is introduced for them.
+  let applied = 0;
+  let refreshedTraits = 0;
+  let failures = [];
+  let conflicts = [];
+  let ok = true;
+  // Candidates beyond the cap are otherwise neither minted, demoted, nor
+  // recorded: they simply vanish, while `traits` still counts them and a reader
+  // concludes they were handled. Record them the same way `relation cap` records
+  // edges, so "everything that disappears is accounted for" holds for traits.
+  for (const t of traits.slice(maxTraits)) {
+    dropped.push({ reason: "trait cap", person: t.person, target: t.target });
+  }
+  if (traits.length > 0) {
+    const decisions = traits.slice(0, maxTraits).map((t) => ({
+      action: "create",
+      type: "pattern",
+      title: STR.affectiveTrait.title[language](t),
+      content: STR.affectiveTrait.content[language](t),
+      importance: 3,
+      evidence: t.evidence
+    }));
+    const snapshot = new Map();
+    const validated = validateDecisions(decisions, snapshot, { maxCreatePerRun: maxTraits, allowedActions: ["create"] });
+    ok = validated.ok;
+    if (ok) {
+      const result = applyDecisions(decisions, service, logger, snapshot, { ...config, mintSource: "sleep", runId });
+      applied = result.applied;
+      failures = result.failures;
+      conflicts = result.conflicts;
+      // A trait whose pattern was refreshed in place (same title, same row) is
+      // not a new conclusion. Keep it out of `applied` and report it as a
+      // refresh, otherwise two different targets would read as two minted
+      // patterns while only one row exists (#619 audit round 6).
+      refreshedTraits = result.merged ?? 0;
+      // Ocasion edges observed before a disposition was confirmed do not get
+      // rewritten — an edge records "this occasion was observed", which stays
+      // true. But the edge and the pattern would then answer "how many
+      // occasions" differently (edge.sessionCount vs pattern evidence), and a
+      // coverage query reading both would have no way to tell they describe the
+      // same thing. Mark them instead of mutating the count: the edge still
+      // means one observed occasion, and `promotedToTrait` says that occasion is
+      // now part of a confirmed disposition.
+      for (const trait of traits.slice(0, maxTraits)) {
+        const person = byName.get(String(trait.person ?? "").toLowerCase());
+        const target = byName.get(String(trait.target ?? "").toLowerCase());
+        if (!person || !target || person.id === target.id) continue;
+        for (const edge of service.getRelations(person.id) ?? []) {
+          if (edge.relation_type !== "affective_context" || edge.to_entity !== target.id) continue;
+          const meta = edge.metadata && typeof edge.metadata === "object" ? edge.metadata : null;
+          if (String(meta?.emotion ?? "").trim() !== trait.emotion) continue;
+          if (meta?.promotedToTrait === true) continue;
+          try {
+            service.updateRelationMetadata?.(edge.id, {
+              ...meta,
+              promotedToTrait: true,
+              traitSessionCount: trait.sessionCount
+            });
+          } catch (error) {
+            logger?.warn?.(`dsh-mneme sleep: marking occasion ${edge.id} as promoted failed: ${String(error)}`);
+          }
+        }
+      }
+    }
+  }
+  // Aborting mid-pass is not "did nothing" and not "all done". Even when nothing
+  // was written yet, "noop" would claim the whole pool was examined and found
+  // empty — the loop broke at an arbitrary index, so it examined an unknown
+  // prefix. Report it as aborted either way.
+  if (signal?.aborted) {
+    return {
+      status: "aborted",
+      reason: "user activity",
+      scanned: memories.length,
+      relations: relations.length,
+      edgeWrites: relations.length,
+      merged: merges.length,
+      mergedList: merges,
+      applied,
+      refreshedTraits,
+      traits: traits.length,
+      downgraded: downgradedCount,
+      dropped
+    };
+  }
+  if (!ok) {
+    return {
+      status: "failed",
+      error: "trait decisions rejected by validation",
+      scanned: memories.length,
+      relations: relations.length,
+      edgeWrites: relations.length,
+      merged: merges.length,
+      mergedList: merges,
+      applied: 0,
+      refreshedTraits,
+      traits: traits.length,
+      downgraded: downgradedCount,
+      dropped
+    };
+  }
+  return {
+    // "refreshed" is a real write that minted nothing: the trait pattern already
+    // existed under the same title and was rewritten in place. Calling that
+    // "noop" would say the phase examined the pool and found nothing to do.
+    status: relations.length + merges.length + applied > 0 ? "ok" : (refreshedTraits > 0 ? "refreshed" : "noop"),
+    scanned: memories.length,
+    relations: relations.length,
+    merged: merges.length,
+    // #619: edges are real writes but not "applied decisions", so the receipt
+    // would read `:0` for a run that did write. Count them separately instead
+    // of folding them into `applied` (that would make the two numbers mean
+    // different things depending on which phase produced them).
+    edgeWrites: relations.length,
+    mergedList: merges,
+    applied,
+    refreshedTraits,
+    failures,
+    conflicts,
+    traits: traits.length,
+    downgraded: downgradedCount,
+    dropped
+  };
+}
+
+/**
+ * Phase 4 — entity relation completion. Detects orphan entities (zero
+ * relations) and completes implied relations from memory co-occurrence:
+ * entities named in the same memory → related_to; container kinds
+ * (project/module) → part_of; tech-ish pairs → depends_on. Deterministic,
+ * no LLM — cheap, so it runs even without a route. saveRelation is
+ * bookkeeping (no write hook), so it never re-triggers the scheduler.
+ */
+function inferRelationType(a, b) {
+  if ((a.type === "project" || a.type === "module") && a.type !== b.type) return "part_of";
+  if ((b.type === "project" || b.type === "module") && b.type !== a.type) return "part_of";
+  if (/npm|plugin|api|sdk|lib|framework|package|deps?|build/i.test(`${a.name} ${b.name}`)) return "depends_on";
+  return "related_to";
+}
+
+function phaseRelations(service, config, logger, runId, signal = null) {
+  const entities = service.listEntities({ limit: 1000 }) ?? [];
+  if (entities.length < 2) return { status: "skipped", reason: "too few entities" };
+  const orphans = entities.filter((e) => (service.getRelations(e.id) ?? []).length === 0);
+  if (orphans.length === 0) return { status: "skipped", reason: "no orphan entities" };
+  const memories = withoutPaused(service, service.all().filter((m) => !isImportedRow(m) && !m.archived && !m.forgotten));
+  const seen = new Set();
+  const related = [];
+  const MAX_RELATIONS_PER_ORPHAN = 3;
+  for (const o of orphans) {
+    if (signal?.aborted) break;
+    let made = 0;
+    for (const m of memories) {
+      if (signal?.aborted || made >= MAX_RELATIONS_PER_ORPHAN) break;
+      const text = `${m.title ?? ""} ${m.content ?? ""}`;
+      if (!text.includes(o.name)) continue;
+      for (const other of entities) {
+        if (other.id === o.id || other.name === o.name) continue;
+        const key = [o.id, other.id].sort().join("|");
+        if (seen.has(key)) continue;
+        if (!text.includes(other.name)) continue;
+        const relationType = inferRelationType(o, other);
+        try {
+          service.saveRelation({ from_entity: o.id, to_entity: other.id, relation_type: relationType, memory_id: m.id, metadata: { source: "sleep_relation_completion" } });
+          seen.add(key);
+          related.push({ from: o.id, to: other.id, type: relationType });
+          made++;
+        } catch (error) {
+          logger?.warn?.(`dsh-mneme sleep: relation ${o.id}/${other.id} failed: ${String(error)}`);
+        }
+      }
+    }
+  }
+  return {
+    status: related.length > 0 ? "ok" : "noop",
+    orphanCount: orphans.length,
+    related
+  };
+}
+
+// ---------------------------------------------------------------- run
+
+function deriveStatus(phases) {
+  const list = Object.values(phases);
+  if (list.length === 0) return "noop";
+  const anyError = list.some((p) => p.status === "failed" || p.status === "error");
+  // Issue #126 review（Copilot）：phase 自身可以是 degraded（合法子集已应用但有条目被
+  // 跳过），它同样算"有产出"——否则整轮会被误判成 noop，把真实变更报成空轮。
+  // #619：`refreshed` 也是一次真实写入（同题行原地刷新），只是没铸出新条目。把它
+  // 排除在 anyWork 之外，整轮会被记成 noop，审计行又变回「跑了、什么都没干」。
+  const anyWork = list.some((p) => p.status === "ok" || p.status === "degraded" || p.status === "refreshed");
+  const anyDegraded = list.some((p) => p.status === "degraded");
+  // Issue #529：被打断（用户恢复活动）既不是失败也不是"没活干"。相位层已经用
+  // aborted 区分了这两种，整轮层若回落到 noop，审计行就又把"没跑完"记成"跑过、
+  // 没什么事"——所以这里也给它一个自己的名字。只在没有任何产出时生效：真的落了
+  // 东西就是 ok/degraded，真的报错就是 failed，二者都比 aborted 值得优先播报。
+  const anyAborted = list.some((p) => p.status === "aborted");
+  if (anyDegraded) return "degraded";
+  if (anyWork && anyError) return "degraded";
+  if (anyError) return "failed";
+  if (anyWork) return "ok";
+  if (anyAborted) return "aborted";
+  return "noop";
+}
+
+/**
+ * Run one full sleep cycle. Best-effort across all phases; writes a
+ * run_type='sleep' audit row (same dream_runs table) so sleep activity is
+ * observable alongside consolidation runs.
+ */
+export async function runSleep(ctx, service, config, logger, semantic = null, signal = null) {
+  const runId = randomUUID();
+  // Issue #89：开跑时刻——审计行 created_at 的基准（= 冷却种子），run 耗时
+  // （LLM 各 phase）不应计入重启后的冷却窗口。
+  const sleepStartedAt = Date.now();
+  const phases = {};
+  const attempt = async (name, fn) => {
+    if (signal?.aborted) return; // user resumed activity — stop before next phase
+    try {
+      phases[name] = await fn();
+    } catch (error) {
+      phases[name] = { status: "failed", error: error?.message ?? String(error) };
+      logger?.warn?.(`dsh-mneme sleep: ${name} phase failed: ${error?.message ?? error}`);
+    }
+  };
+  await attempt("conflicts", () => phaseConflicts(ctx, service, config, logger, runId, semantic, signal));
+  await attempt("demotion", () => phaseDemotion(service, config, logger, runId, signal));
+  await attempt("patterns", () => phasePatterns(ctx, service, config, logger, runId, signal));
+  await attempt("relations", () => phaseRelations(service, config, logger, runId, signal));
+  // #619：情感归因排在 relations 之后——它要读实体与 provenance，先让孤立实体的
+  // 结构边补完，再往上挂情绪轴；两相写的是不同 relation_type，不抢同一批对。
+  await attempt("affective", () => phaseAffective(ctx, service, config, logger, runId, signal));
+
+  const status = deriveStatus(phases);
+  const route = resolveSleepRoute(ctx, config, logger);
+  // #619: a phase may write rows that are not "applied decisions" — the
+  // affective phase inserts relation edges directly — and it may also extend an
+  // existing edge instead of inserting one. Both are store writes, and the
+  // receipt has to answer "did this run change anything", so both count. A run
+  // whose only effect was extending an edge would otherwise read `:0`, i.e.
+  // "ran and did nothing", which is exactly what a probe must never see.
+  //
+  // The per-kind numbers stay apart in `phases` (`applied` / `edgeWrites` /
+  // `merged` / `refreshedTraits`); the receipt is a single write count on
+  // purpose, because buildReceipt/parseReceipt are an eight-field contract
+  // shared with organize.js and four test files. Detail lives in
+  // dream_runs.phases JSON, not in the receipt.
+  //
+  // #619 / Ephor 第七轮 ①：`refreshedTraits` 必须计入。它是「同一标题的 pattern
+  // 被原地重写」的条数——库确实变了，但没有铸新条目，所以它既不在 `applied` 里
+  // （那会把刷新谎报成铸造），也不在 `merged` 里（affective 相位的 `merged` 是
+  // **边**合并数 `merges.length`，同名不同义）。漏掉它的后果实测过：第二轮
+  // `phase.status=refreshed`、`refreshedTraits=1`，整轮 receipt 第 7 段仍是 0，
+  // 于是「相位说改了、整轮说没改」，正是上一轮刚修掉的「改了库读成 0」形态。
+  const totalApplied = Object.values(phases).reduce(
+    (n, p) =>
+      n +
+      (Number.isInteger(p?.applied) ? p.applied : 0) +
+      (Number.isInteger(p?.edgeWrites) ? p.edgeWrites : 0) +
+      (Number.isInteger(p?.merged) ? p.merged : 0) +
+      (Number.isInteger(p?.refreshedTraits) ? p.refreshedTraits : 0),
+    0
+  );
+  // Issue #126（与 #104 同向）：把各 phase 的跳过明细汇总成一行审计数据，带 phase
+  // 名（同一次 run 里 conflicts 与 patterns 都可能产出 skipped）。全空时写 NULL，
+  // 不落空数组——审计行只记真实发生过的跳过。
+  const skippedDetail = Object.entries(phases).flatMap(([phase, p]) =>
+    Array.isArray(p?.skipped) ? p.skipped.map((s) => ({ phase, ...s })) : []
+  );
+  const snapshotHash = createHash("sha256").update(JSON.stringify(phases)).digest("hex");
+  const receipt = buildReceipt({
+    runId,
+    status,
+    snapshotHash,
+    inputCount: 0,
+    applied: totalApplied,
+    summaryStored: false
+  });
+  try {
+    service.saveDreamRun({
+      id: runId,
+      // Issue #89：审计行记开跑时刻而非完成时刻——run 耗时（含 LLM 各 phase）
+      // 不该计入重启后的 sleep 冷却种子。
+      created_at: new Date(sleepStartedAt).toISOString(),
+      status,
+      provider: route?.provider,
+      model: route?.model,
+      snapshot_hash: snapshotHash,
+      input_count: 0,
+      input: null,
+      decisions: phases,
+      outcome: phases,
+      applied: totalApplied,
+      summary_stored: false,
+      receipt,
+      policy_epoch: config.policyEpoch ?? 0,
+      run_type: "sleep",
+      skipped: skippedDetail.length ? skippedDetail : undefined
+    });
+  } catch (error) {
+    logger?.warn?.(`dsh-mneme sleep: failed to record audit run: ${String(error)}`);
+  }
+  // Issue #529（续排）：给调度器的续排判据。两个条件缺一不可——
+  //   · 本轮**被预算截断**（conflict 相位报告还有没进这一轮的对）：说明池子没清空；
+  //   · 本轮**clean**：送出去的每一对都落地了，不是为了追一个永远失败的批次空转。
+  // `clean` 缺失时（该相位被 attempt 吞成 failed、或配置让它早退）按"不干净"算，
+  // 宁可少追一轮，也不要在失败状态下把间隔压到静默窗口。
+  const conflictPhase = phases.conflicts;
+  const backlog = Number(conflictPhase?.perRunSkipped ?? 0) > 0;
+  // clean 与 catchup 分开给：前者是"这一轮的活全落地了"，后者是"池子没清空 + 前者"。
+  // 合成一个字段会让"干净但没 backlog"看起来像出过问题，排查时反着读。
+  const clean = conflictPhase?.clean === true;
+  const catchup = backlog && clean;
+  return { ok: status === "ok" || status === "degraded", status, clean, catchup, backlog, runId, phases, receipt };
+}
+
+// ---------------------------------------------------------------- scheduler
+
+/**
+ * Idle-triggered scheduler. DSH plugins have no resident cron, so a sleep run
+ * fires when: sleep is enabled, the store has been quiet for sleepIdleMinutes,
+ * and the previous run is older than sleepMinIntervalHours. noteWrite() is
+ * called on every store write and (re)arms an idle timer that re-checks at the
+ * exact moment the idle window elapses — no polling, no cron.
+ *
+ * A `now` clock can be injected for tests; it defaults to Date.now.
+ */
+export function createSleepScheduler({
+  service,
+  config,
+  logger,
+  onRun = null,
+  now = () => Date.now(),
+  setTimeoutFn = setTimeout,
+  clearTimeoutFn = clearTimeout,
+  // Issue #89 同族：冷却时刻由调用方从 dream_runs 审计表恢复（run_type='sleep'）——
+  // 内存变量进程重启即归零，冷却闸对新实例放行 → 重启后立即进入 sleep 冷却盲区。
+  // 测试注入 0（默认）即保持旧行为。
+  lastRunAtSeed = 0
+}) {
+  let lastWriteAt = now();
+  let lastRunAt = lastRunAtSeed;
+  let running = false;
+  let disposed = false;
+  let idleTimer = null;
+  let sleepAbort = null;
+  // Issue #529（C 项）：同一进程内的连续失败计数。失败（run 报 status="failed"
+  // 或抛错）+1，其余一律清零（ok/degraded/noop——noop 说明 LLM 通路是好的，
+  // 只是没活干，不该被当成失败拖着退避）。纯内存变量、宿主重启归零：跨重启的
+  // 冷却本来就由 lastRunAtSeed（#89/#291）负责，两者不重叠。
+  let consecutiveFailures = 0;
+  // Issue #529（续排）：上一轮报告"还有对没进这一轮、且送出去的全落地了"——池子没清空，
+  // 该接着追而不是等满一个最小间隔。只由 maybeSchedule 按 onRun 的返回置位，跑完一轮就
+  // 重新判：池子追干净或某一轮不 clean 时自动落回 false，不需要额外的复位路径。
+  let catchupWanted = false;
+  // Issue #529（续排）：进程内续排连击数。给"池子在长、每轮都 clean 但永远追不完"这类
+  // 库留一道刹车——用户持续写入时池子进得比追得快，光看 clean 会变成永不落地的每五分钟
+  // 一轮。超过上限就退回正常间隔，等下一个静默窗口重新起算。
+  let catchupStreak = 0;
+
+  // Issue #529：有效最小间隔 = 基数 × 2^连续失败数。关闭或尚无失败时逐字节
+  // 返回基数（默认关 = 行为与现状一致）。封顶取 max(基数, 24h) 而不是硬 24h：
+  // 指数再大也不会把用户自己配的大基数（允许到 168h）压小。
+  function effectiveMinIntervalMs() {
+    // Issue #529（续排）：还有 backlog 时把冷却项按 0 处理，让表落在**静默窗口**而不是
+    // 最小间隔上。不新增配置键：本轮的账本/更新写入会重置 lastWriteAt，下一轮自然至少
+    // 等一个 sleepIdleMinutes，这本身就是节流；再开一个键要连带 settings.js 白名单与
+    // test/api.test.js 的旗标计数锁，不值得为一件事动三个文件。
+    // 与连败互斥（同 issue 的第三条）：连续失败 > 0 时根本不追——两个逻辑抢同一只闹钟
+    // 最容易出"重排的是短的、判定的是长的"这种空转，互斥最省事。
+    if (catchupWanted && consecutiveFailures <= 0) return 0;
+    const base = (config.sleepMinIntervalHours ?? 8) * 3600000;
+    if (config.sleepFailureBackoff !== true || consecutiveFailures <= 0) return base;
+    const cap = Math.max(base, FAILURE_BACKOFF_CAP_MS);
+    return Math.min(base * 2 ** consecutiveFailures, cap);
+  }
+
+  function armIdleTimer() {
+    if (disposed || idleTimer) return;
+    if (config.sleepModeEnabled !== true) return;
+    const idleMs = (config.sleepIdleMinutes ?? 5) * 60000;
+    const delay = Math.max(0, idleMs - (now() - lastWriteAt)) + 1000;
+    idleTimer = setTimeoutFn(async () => {
+      idleTimer = null;
+      // Issue #187：false = 撞上 CD（或 run 失败）——此前这里直接丢弃，"CD 到期"
+      // 成了没有监听者的时刻，要等下一次写入才救回来。改为按剩余窗口重排。
+      // Issue #529（续排）：跑成了也未必收工——池子还有没进这一轮的对时要接着追，
+      // 而此时已经没有待触发的写入了，不在这里补挂就永远等不到下一轮。
+      const ran = await maybeSchedule();
+      if (!ran || catchupWanted) armNextWindow();
+    }, delay);
+    idleTimer.unref?.();
+  }
+
+  // Issue #187：撞 CD / run 失败后的补挂表——按「剩余 CD / 剩余静默」里更晚的
+  // 到点时刻重排一次，回调里重复同样的判断所以不会空转。跑成了一轮就不重排：
+  // 安静的库没有要处理的新东西，触发权交还给下一次写入的 noteWrite。
+  function armNextWindow() {
+    if (disposed || idleTimer) return;
+    if (config.sleepModeEnabled !== true) return;
+    // lastRunAt === 0 表示从未跑过（此路径不该出现，防御性返回）。
+    if (lastRunAt <= 0) return;
+    const idleMs = (config.sleepIdleMinutes ?? 5) * 60000;
+    // Issue #529：这里必须和 shouldRun 用同一个有效间隔，否则退避期里重排的闹钟
+    // 会在基数到点就响、然后被 shouldRun 否掉再重排——空转一串没有意义的定时器。
+    const cdMs = effectiveMinIntervalMs();
+    let delay = Math.max(
+      lastRunAt + cdMs - now(),
+      lastWriteAt + idleMs - now(),
+      0
+    ) + 1000;
+    // Issue #529（续排）：冷却项按 0 处理之后，静默项可能已经是负的（这一轮跑得久、
+    // 期间没有新写入），算出来只剩那 1 秒——追 backlog 不该变成秒级连发。续排下限钉在
+    // 一个静默窗口上：追得动就每轮追一批，但每批之间仍然让库安静下来。
+    // 有写入时静默项会自己变大（账本行落库会重置 lastWriteAt），这里只是保证下限。
+    if (catchupWanted) delay = Math.max(delay, idleMs + 1000);
+    idleTimer = setTimeoutFn(async () => {
+      idleTimer = null;
+      const ran = await maybeSchedule();
+      // Issue #529（续排）：与 armIdleTimer 的回调同一条理由——追 backlog 的轮次
+      // 跑完必须自己补挂，否则续排在第二张表就断了。
+      if (!ran || catchupWanted) armNextWindow();
+    }, delay);
+    idleTimer.unref?.();
+  }
+
+  function shouldRun(at = now()) {
+    if (disposed || running) return false;
+    if (config.sleepModeEnabled !== true) return false;
+    if (at - lastWriteAt < (config.sleepIdleMinutes ?? 5) * 60000) return false;
+    // lastRunAt === 0 means never ran — the min-interval check must not block
+    // the very first cycle (a real run stamps a nonzero timestamp).
+    // Issue #529：连败退避开启时改用指数放大的有效间隔——恒定失败的模型不再按
+    // 固定节奏连发（#529 实测连续 23 轮 llm failed），只会越打越稀。
+    if (lastRunAt > 0 && at - lastRunAt < effectiveMinIntervalMs()) return false;
+    return true;
+  }
+
+  /** Called on writes: resets the idle clock and re-arms the fire timer. The
+   *  pending timer is cleared first — a stale timer armed against the old idle
+   *  window would otherwise fire early, fail shouldRun, and leave nothing armed
+   *  for the next window (a missed trigger until the next write).
+   *
+   *  While a sleep run is executing (running=true) the in-flight AbortController
+   *  is NOT aborted: the run's own writes (demoteToSummary / setArchived ride
+   *  the normal write-hook path) would otherwise self-abort the cycle. External
+   *  activity during the run still resets the idle clock here, so no new cycle
+   *  fires until the store is quiet again. */
+  function noteWrite() {
+    lastWriteAt = now();
+    if (!running && sleepAbort) {
+      sleepAbort.abort(); // user resumed activity — interrupt an idle run
+    }
+    if (idleTimer) {
+      clearTimeoutFn(idleTimer);
+      idleTimer = null;
+    }
+    armIdleTimer();
+  }
+
+  async function maybeSchedule() {
+    if (!shouldRun()) return false;
+    running = true;
+    const abort = new AbortController();
+    sleepAbort = abort;
+    try {
+      lastRunAt = now();
+      const result = await service.enqueue(() =>
+        onRun ? onRun(abort.signal) : Promise.resolve({ ok: true, skipped: true })
+      );
+      // Issue #529：连败计数只在这里加减。判据优先看 result.status——runSleep 的
+      // ok 只在 ok/degraded 时为真，noop（LLM 通路正常、只是没活干）和用户活动
+      // 打断都会给出 ok:false，把它当失败会让退避在自己工作良好的库里越退越长。
+      // 回落到 !result.ok 只是为了兼容注入的 no-op 桩（没有 status 字段）。
+      // result 为空（最小测试替身）＝完成且无失败，不动计数，与 #292 口径一致。
+      if (result) {
+        const failed = typeof result.status === "string" ? result.status === "failed" : !result.ok;
+        consecutiveFailures = failed ? consecutiveFailures + 1 : 0;
+        // Issue #529（续排）：判据只认 runSleep 给的 catchup——它是"池子还有没进这一轮
+        // 的对"且"送出去的每一对都落地了"二者的合取。**不要**在这里拿 status 反推：
+        // 全判 keep 的轮次 applied 恒为 0、status 是 noop，恰好在最该追的场景失效。
+        // 连续失败时不追（与退避互斥，见 effectiveMinIntervalMs），并把连击计数清零——
+        // 失败说明这轮的"追"没有意义，重新从正常节奏起算。
+        // 连击到顶就收手，并把连击清零——不清零的话这个进程从此再也不会追（streak 只增
+        // 不减，之后每一轮都被同一道闸挡下），"等下一个静默窗口重新起算"就成了空话。
+        // 收手必须落在 catchupWanted 这个状态上，不能只写在 effectiveMinIntervalMs 里：
+        // 那里改成"返回基数"之后，armNextWindow 仍会按 catchupWanted 把闹钟钉在静默
+        // 窗口上重排，于是每 5 分钟醒一次、每次都被 shouldRun 否掉再重排——没有 LLM
+        // 调用，但定时器链永远不断。
+        const wantCatchup = result.catchup === true && consecutiveFailures <= 0;
+        if (!wantCatchup || catchupStreak + 1 >= CATCHUP_STREAK_CAP) {
+          catchupStreak = 0;
+          catchupWanted = false;
+        } else {
+          catchupStreak += 1;
+          catchupWanted = true;
+        }
+      }
+      return !!(result && result.ok);
+    } catch (error) {
+      logger?.warn?.(`dsh-mneme sleep: run failed: ${error?.message ?? error}`);
+      consecutiveFailures += 1; // Issue #529：抛错同样计入连败
+      // Issue #529（续排）：抛错也算失败，续排意图一并清掉——否则上一轮置位的状态会跟着
+      // 逃出 try 块，让下一次排表仍按静默窗口的空转节奏走。
+      catchupWanted = false;
+      catchupStreak = 0;
+      return false;
+    } finally {
+      sleepAbort = null;
+      running = false;
+      // Issue #529 review（CodeRabbit ②）：运行期间用户写入会走 noteWrite()，它把闹钟
+      // 按**那一次写入**重算了一遍——那可能是静默窗口的尾声。若这一轮结束时报告
+      // catchup=true，那只表可能几秒后就要响，下一批紧接着开跑，于是「让库安静一个
+      // 静默窗口再追」变成「跑完立刻再跑」。这里把已挂着的表撤掉重挂，交给
+      // armNextWindow 从**此刻**算出整整一个静默窗口。
+      // 反过来（不追的轮次）保留 noteWrite 挂的那只表：它是按用户最后一次写入算的，
+      // 正是「用户写完了、安静满一个窗口再说」的意思。
+      if (catchupWanted) {
+        if (idleTimer) {
+          clearTimeoutFn(idleTimer);
+          idleTimer = null;
+        }
+        armNextWindow();
+      }
+    }
+  }
+
+  async function dispose() {
+    disposed = true;
+    if (idleTimer) {
+      clearTimeoutFn(idleTimer);
+      idleTimer = null;
+    }
+    if (sleepAbort) {
+      sleepAbort.abort();
+      sleepAbort = null;
+    }
+  }
+
+  // Issue #187（同族缺陷）：构造即挂表——重启后只要没发生过写入，此前永远没有
+  // 闹钟，安静多久都不会触发。lastWriteAt 已在构造时设为当前时刻，shouldRun 的
+  // 静默条件自然生效：重启后静默满 idleMinutes 才可能起跑。
+  armIdleTimer();
+
+  return { noteWrite, maybeSchedule, shouldRun, dispose };
+}