@modusensus/dsh-mneme 0.7.10 → 0.7.12

package/{dsh-mneme/lib → lib}/config.js

@@ -1,15 +1,9 @@
 import z from "@deepseek-ai/schemastery";
-import { TYPE_DECAY_DEFAULTS } from "./heat.js";
 
 export const Config = z.object({
   memoryDir: z.string().default("~/.dsh/memory"),
   autoInject: z.boolean().default(true),
   autoSummarize: z.boolean().default(true),
-  // Session lifecycle (v0.6.0): when enabled, deleting/disposing a session also
-  // archives every memory that was born in it (treating the session as a save
-  // point — entries stay recoverable via memory_archive/restoreBySession).
-  // Default OFF: legacy behavior, a disposed session leaves its memories active.
-  sessionLifecycleEnabled: z.boolean().default(false),
   // Optional model override for summarization. When both are non-empty, they
   // take priority over the session's current model. Empty = use the session's
   // active provider/model (same as before).
@@ -17,18 +11,6 @@ export const Config = z.object({
   summarizeModel: z.string().default(""),
   maxInjectedItems: z.natural().min(1).max(20).default(5),
   importanceThreshold: z.natural().min(1).max(5).default(3),
-  // 时间前缀注入（issue #34，opt-in，默认关）：开启时，新对话开始时把当前
-  // 日期时间以 [当前时间: 2026-08-26 周二 19:30] 前缀注入一次，让模型感知
-  // "现在几点/周几"。只注入一次（对话开始时），同会话后续渲染不再重复；
-  // 关闭时行为与之前完全一致。
-  injectTimePrefix: z.boolean().default(false),
-  // 花括号转义（issue #40，默认开）：DSH 核心 interpolate() 会把 `{{name}}`
-  // 当 prompt 变量做严格校验（变量名须匹配 /^[a-z][a-z0-9_]*$/），记忆正文里
-  // 合法的模板语法（如 `{{hl|}}`、`{{挖空}}`、`{{关键词}}`）会因非法变量名
-  // 直接 throw、让整轮对话崩溃。开启后注入边界把 `{{`→`\{\{`、`}}`→`\}\}`，
-  // 文本不再含 `{{`/`}}` 子串，interpolate 不再扫描到，内容保持可读且幂等
-  // （不会二次转义）。关闭后按原样透传。
-  escapePromptVariables: z.boolean().default(true),
   autoDream: z.boolean().default(true),
   dreamThresholdCount: z.natural().min(1).max(1000).default(10),
   dreamThresholdChars: z.natural().min(100).max(100000).default(5000),
@@ -37,13 +19,11 @@ export const Config = z.object({
   dreamModel: z.string(),
   dreamMaxTokens: z.natural().min(256).max(131072).default(8192),
   // Pass-through reasoning effort for dream's LLM calls. 'none' (default)
-  // omits the field so the provider's own default applies; 'off' explicitly
-  // disables thinking — REQUIRED for thinking-type models (deepseek-v4-flash
-  // etc.) that would otherwise drain the whole token budget into reasoning and
-  // return an empty body ("no json array in llm output"); low/medium/high are
-  // forwarded verbatim to cap reasoning spend.
+  // omits the field so the provider's own default applies; low/medium/high
+  // are forwarded verbatim. Useful to cap reasoning spend on thinking-type
+  // models that would otherwise drain the whole token budget and return an
+  // empty body ("no json array in llm output").
   dreamReasoningEffort: z.union([
-    z.const("off"),
     z.const("low"),
     z.const("medium"),
     z.const("high"),
@@ -62,16 +42,6 @@ export const Config = z.object({
   // → 整单拒绝，防止残缺输出被隐式 keep 洗白成 ok 后再被真实 apply。0-1，
   // 默认 0.5（至少显式覆盖一半 snapshot）。
   dreamMinExplicitCoverage: z.number().min(0).max(1).default(0.5),
-  // 跳过非法决策（Issue #26 P0，默认开）：跨类型 merge 等"单条非法"决策不再
-  // 让整批校验失败 → 跳过该决策、应用合法子集，run 记为 degraded（applied>0）。
-  // 关闭后恢复旧的"任意非法即整单拒绝"（applied=0）。防洗白语义不受影响——
-  // 显式覆盖率不足/update 超量等全局错误仍整单拒绝。
-  dreamSkipInvalid: z.boolean().default(true),
-  // 允许跨类型合并（Issue #26 P1，默认关）：类型有语义边界（preference 注入
-  // 权重更高、decision/project 注入上下文不同），跨类型合并会丢类型信息，故
-  // 默认禁止并在 skipInvalid 下被跳过；显式开启后放宽该检查，类型边界由用户
-  // 自行承担（需与 dreamSkipInvalid 配合：开启后跨类型 merge 视为合法、可应用）。
-  allowCrossTypeMerge: z.boolean().default(false),
   // Rule version for dream adjudication: when this bumps, older dream_runs
   // degrade to historical evidence (their receipts no longer drive live
   // decisions). Default 0 = no versioning in use yet.
@@ -189,43 +159,6 @@ export const Config = z.object({
   // Prefix/semantic search over entity names (used by recall).
   entitySearchEnabled: z.boolean().default(true),
 
-  // --- wiki-link: explicit cross-memory [[links]] (v0.6.1) ----------------
-  // Opt-in, off by default. When enabled, saveWithDedupe/update fire-and-forget
-  // a wiki-link resolution pass: [[target]] / [[显示|target]] markers in a
-  // memory's content become links_to relations in entity_relations (idempotent,
-  // deduped by the unique relation index). The storage layer + read APIs
-  // (getBacklinks/getForwardLinks/resolveWikiLink) are always available
-  // regardless of this flag.
-  wikiLinkEnabled: z.boolean().default(false),
-
-  // --- tag system (v0.6.2) ---------------------------------------------------
-  // Opt-in: when autoTagEnabled is true, a light LLM pass runs after each
-  // autoDream consolidation and extracts 1-3 tags per retained memory
-  // (autoTagMaxPerRun bounds how many memories are tagged per run). The tag
-  // storage layer (store.setMemoryTags/getMemoryTags + tag: search + mirror
-  // `#tag` line) is always available regardless of this flag.
-  autoTagEnabled: z.boolean().default(false),
-  autoTagMaxPerRun: z.natural().min(1).max(100).default(10),
-  // Manual tagging (service.setMemoryTags / memory tools) is on by default;
-  // set false to disable the manual write path too.
-  manualTagEnabled: z.boolean().default(true),
-
-  // --- sidebar trigger (issue #38) ---------------------------------------
-  // The memory library is reachable from two UI surfaces: a "记忆库" tab in the
-  // conversation header AND an entrance button at the sidebar footer (bottom
-  // left). Some sidebars get crowded there — dsh-cost-meter and friends also
-  // claim the footer slot — so the entrance button is now optional. Off just
-  // hides the button; the conversation tab stays, so no functionality is lost.
-  // The Web panel exposes this as a toggle (settings-over-config, see
-  // settings.getUiConfig); the value here is the plugin-config default.
-  showSidebarTrigger: z.boolean().default(true),
-
-  // --- tag-weighted re-rank (v0.6.4) -------------------------------------
-  // Opt-in: boost candidates whose tags overlap the query/session tags.
-  tagBoostEnabled: z.boolean().default(false),
-  tagBoostFactor: z.number().min(1).max(2).default(1.15),
-  sessionTagBoostFactor: z.number().min(1).max(2).default(1.08),
-
   // --- sleep mode: idle-triggered deep maintenance (v0.4.0) ---------------
   // Opt-in, off by default. Unlike autoDream (threshold-triggered, lightweight)
   // sleep fires when the store has been quiet for sleepIdleMinutes and deep-
@@ -264,25 +197,14 @@ export const Config = z.object({
   sleepProvider: z.string().default(""),
   sleepModel: z.string().default(""),
   // Pass-through reasoning effort for sleep's LLM passes, same semantics as
-  // dreamReasoningEffort: 'none' (default) omits the field; 'off' explicitly
-  // disables thinking (thinking-type models would burn the whole budget on
-  // reasoning); low/medium/high are forwarded verbatim.
+  // dreamReasoningEffort: 'none' (default) omits the field; low/medium/high
+  // are forwarded verbatim.
   sleepReasoningEffort: z.union([
-    z.const("off"),
     z.const("low"),
     z.const("medium"),
     z.const("high"),
     z.const("none")
   ]).default("none"),
-  // Batch entity extraction during sleep (issue #23). The write-path extractor
-  // only fires when entityExtractionEnabled is on (an LLM call per write);
-  // this additive phase backfills entities/attrs/relations for memories that
-  // never went through it, so stores that leave the write-path extractor off
-  // still accumulate an ego graph as long as sleep runs. On by default (it is
-  // a no-op until a sleep cycle fires), capped per run to bound token spend.
-  sleepEntityExtractionEnabled: z.boolean().default(true),
-  // Max memories entity-extracted per sleep run (oldest un-extracted first).
-  sleepEntityExtractionMaxPerRun: z.natural().min(1).max(100).default(20),
 
   // --- epistemic trust: memory source credibility (v0.4.5) -----------------
   // Distinguish memories by source: observation (measured / witnessed),
@@ -328,19 +250,52 @@ export const Config = z.object({
   // flag (production isolation is unconditional).
   evalPersistTestResults: z.boolean().default(false),
 
-  // --- heat: v0.7.0 self-evolution (heat + interest drift) ----------------
-  // 总开关，默认开但保守：不改变召回排序，只提供热度字段 / sleep 降级
-  // 联合判定保护 / 前端热度投影。关闭后跳过所有 heat 计算与热度触达。
-  heatEnabled: z.boolean().default(true),
-  // 幂律形状参数 α（heat = 1/(1+λΔt)^α），越大衰减越快。
-  heatGlobalAlpha: z.number().min(0.1).max(5).default(1.2),
-  // per-type 衰减因子 λ；λ=0 的类型免疫（热度恒 1.0，sleep 永不降级）。
-  // 未知类型走默认 0.002。z.dict 的键为 type 字符串、值为数字 λ。
-  heatTypeDecay: z.dict(z.number(), z.string()).default({ ...TYPE_DECAY_DEFAULTS }),
-  // sleep 降级联合判定的热度下限：heat < 该值 且 importance<5 才允许降级。
-  sleepHeatThreshold: z.number().min(0).max(1).default(0.05),
-  // recordRecall 默认值（recall_runs 记录默认开；显式传 false 的调用方不受影响）。
-  recallRecordDefault: z.boolean().default(true),
-  // recall_runs 滚动清理保留天数。
-  recallRetentionDays: z.natural().min(1).max(3650).default(90),
+  // --- standalone external API (v0.7.12) ------------------------------------
+  // A plain node:http server for ecosystem integrations that cannot reach the
+  // DSH-internal webServer. Disabled by default; when enabled the Bearer token
+  // is persisted in the settings kv ("external_api"), auto-generated on first
+  // boot. Bind host: keep the loopback default — moving it to a non-loopback
+  // address exposes the whole memory store to the network and is the
+  // operator's responsibility.
+  externalApiEnabled: z.boolean().default(false),
+  externalApiPort: z.natural().default(8790),
+  externalApiHost: z.string().default("127.0.0.1"),
+
+  // --- light mode preset (v0.7.12) -------------------------------------------
+  // One switch for low-resource setups: turns off every background/semantic
+  // heavy path (dream consolidation, entity extraction, vector pipeline,
+  // reranker, BM25, semantic dedup / selective inject, sleep mode) while
+  // keeping the core loop (autoInject, autoSummarize, hot memory, quality
+  // filter, keyword search). Applied by applyLightModePreset before the config
+  // reaches any service; a persisted panel_mode="light" (settings kv) counts
+  // as lightMode=true too and wins over the bundle config.
+  lightMode: z.boolean().default(false),
 });
+
+// Fields forced to false by the light-mode preset. Everything not listed here
+// (autoInject, autoSummarize, hotMemory*, memoryQualityFilter, dream
+// thresholds/delays, ...) is left untouched — those are the core loop.
+const LIGHT_MODE_OFF = [
+  "entityExtractionEnabled",
+  "autoDream",
+  "sleepModeEnabled",
+  "rerankEnabled",
+  "autoReindexOnBoot",
+  "hybridInject",
+  "searchSemanticDedup",
+  "selectiveInjectEnabled",
+  "bm25SearchEnabled"
+];
+
+/**
+ * Apply the light-mode preset to a resolved config object (pure function,
+ * exported for tests). When cfg.lightMode is not exactly true the config is
+ * returned unchanged; otherwise a shallow copy carries false for every heavy
+ * feature. Idempotent and side-effect free.
+ */
+export function applyLightModePreset(cfg) {
+  if (cfg?.lightMode !== true) return cfg;
+  const preset = { ...cfg, lightMode: true };
+  for (const key of LIGHT_MODE_OFF) preset[key] = false;
+  return preset;
+}

package/{dsh-mneme/lib → lib}/dream/decisions.js

@@ -7,163 +7,120 @@ const EPISTEMIC_PRIORITY = { observation: 3, inferred: 2, subjective: 1 };
 
 /**
  * Validate a dream decision list against a snapshot of eligible memories.
- *
- * Issue #26 (skipInvalid): 模型几乎必然为了语义相关性而产出跨类型 merge
- * （type 不同，硬性禁止），这类"单条非法"此前让整批校验 ok:false、整单拒绝
- * （applied=0、白耗一次 LLM 调用）。`options.skipInvalid` 开启后，逐条非法的
- * 决策被跳过（从 decisions 中移除、不 claim 任何 id、记录到 `skipped`），
- * 只有全局性错误（update/create 超量、显式覆盖率不足——
- * 这些是"模型失控/输出被截断"信号）仍整单拒绝，防洗白语义不变。
- * `options.allowCrossTypeMerge`（Issue #26 P1）显式放宽跨类型合并检查——
- * 默认 false 保持现有类型边界，true 时跨类型 merge 被允许（类型边界由
- * 用户自行承担）。
- *
- * @param decisions - LLM-produced decision list. In skipInvalid mode, invalid
- *   entries are spliced out in place so the caller's downstream apply/audit
- *   operates on the surviving subset only.
+ * @param decisions - LLM-produced decision list.
  * @param snapshot - Map<id, memory> of eligible (non-archived, non-summary) entries.
- * @returns {{ok: boolean, errors: string[], skipped?: Array<{index, action, ids, error}>}}
+ * @returns {{ok: boolean, errors: string[]}}
  */
 export function validateDecisions(decisions, snapshot, options = {}) {
   const errors = [];
-  const skipped = [];
   const maxUpdatePerRun = options.maxUpdatePerRun ?? 2;
   const minAgeHours = options.minAgeHours ?? 24;
-  const skipInvalid = options.skipInvalid === true;
   if (!Array.isArray(decisions) || decisions.length === 0) {
     return { ok: false, errors: ["decision list must be a non-empty array"] };
   }
   const claimed = new Set();
-  const survivors = [];
   for (const [index, d] of decisions.entries()) {
     const at = `decision[${index}]`;
-    const local = [];
-    const ids = d && d.action === "conflict" ? [d.winner, d.loser] : (d?.ids ?? []);
     if (!d || typeof d !== "object" || !ACTIONS.has(d.action)) {
-      local.push(`${at}: invalid action ${JSON.stringify(d?.action)}`);
-    } else {
-      if (d.action === "conflict") {
-        if (!d.winner || !d.loser || d.winner === d.loser) {
-          local.push(`${at}: conflict needs distinct winner and loser`);
-        }
-      } else if (d.action === "create") {
-        // Mint a fresh memory (sleep pattern discovery). Claims no existing id,
-        // so it skips the claiming loop below; evidence is optional provenance
-        // (already filtered to real ids by the caller) and is stored in content.
-        if (typeof d.title !== "string" || !d.title.trim()) {
-          local.push(`${at}: create needs non-empty title`);
-        }
-        if (typeof d.content !== "string" || !d.content.trim()) {
-          local.push(`${at}: create needs non-empty content`);
-        }
-        if (d.importance !== undefined && (!Number.isInteger(d.importance) || d.importance < 1 || d.importance > 5)) {
-          local.push(`${at}: create importance must be an integer 1-5 when provided`);
-        }
-        if (typeof d.type !== "string" || !d.type.trim()) {
-          local.push(`${at}: create needs non-empty type`);
-        }
-      } else if (!Array.isArray(d.ids) || d.ids.length === 0) {
-        local.push(`${at}: ${d.action} needs non-empty ids`);
+      errors.push(`${at}: invalid action ${JSON.stringify(d?.action)}`);
+      continue;
+    }
+    const ids = d.action === "conflict" ? [d.winner, d.loser] : (d.ids ?? []);
+    if (d.action === "conflict") {
+      if (!d.winner || !d.loser || d.winner === d.loser) {
+        errors.push(`${at}: conflict needs distinct winner and loser`);
+        continue;
       }
-      // update-specific field validation runs BEFORE claiming ids, so a failing
-      // update never pollutes the claimed set (which drives the "every id must
-      // appear in a decision" check below).
-      if (d.action === "update") {
-        // 只能更新单条
-        if (!Array.isArray(d.ids) || d.ids.length !== 1) {
-          local.push(`${at}: update must target exactly one id`);
-        } else {
-          // 必须产生实际变化
-          const mem = snapshot.get(d.ids[0]);
-          const hasChange = (d.title !== undefined && d.title !== mem?.title)
-            || (d.content !== undefined && d.content !== mem?.content)
-            || (d.importance !== undefined && d.importance !== mem?.importance);
-          if (!hasChange) {
-            local.push(`${at}: update must change at least one field`);
-          }
-          // 不能更新 summary
-          if (mem?.type === "summary") {
-            local.push(`${at}: cannot update summary via update action`);
-          }
-          // 保护期：新建记忆不可立即被 update（可配置）
-          const ageHours = (Date.now() - new Date(mem?.created_at).getTime()) / 3600000;
-          if (ageHours < minAgeHours) {
-            local.push(`${at}: memory too young (< ${minAgeHours}h)`);
-          }
-        }
+    } else if (d.action === "create") {
+      // Mint a fresh memory (sleep pattern discovery). Claims no existing id,
+      // so it skips the claiming loop below; evidence is optional provenance
+      // (already filtered to real ids by the caller) and is stored in content.
+      if (typeof d.title !== "string" || !d.title.trim()) {
+        errors.push(`${at}: create needs non-empty title`);
+        continue;
       }
-      if (d.action !== "create") {
-        const seen = new Set();
-        for (const id of ids) {
-          const mem = snapshot.get(id);
-          if (!mem) {
-            local.push(`${at}: unknown id ${JSON.stringify(id)}`);
-          } else if (mem.archived || mem.type === "summary") {
-            local.push(`${at}: id ${JSON.stringify(id)} is archived or summary (not eligible)`);
-          }
-          // 单决策内重复 id（同一决策引用同一记忆两次）→ 非法；跨决策重复由
-          // 全局 claimed 检测（只含已通过校验的幸存决策的 claim）。
-          if (seen.has(id)) {
-            local.push(`${at}: duplicate id ${JSON.stringify(id)} within one decision`);
-          }
-          if (claimed.has(id)) {
-            local.push(`${at}: id ${JSON.stringify(id)} claimed by multiple decisions`);
-          }
-          seen.add(id);
-        }
-        if (d.action === "merge") {
-          if (!d.keepSource || !d.ids.includes(d.keepSource)) {
-            local.push(`${at}: merge keepSource must be one of ids`);
-          }
-          if (typeof d.title !== "string" || !d.title.trim() || typeof d.content !== "string" || !d.content.trim()) {
-            local.push(`${at}: merge needs non-empty title and content`);
-          }
-          if (d.importance !== undefined && (!Number.isInteger(d.importance) || d.importance < 1 || d.importance > 5)) {
-            local.push(`${at}: merge importance must be an integer 1-5 when provided`);
-          }
-          // Merging across types would blur preference/project/decision boundaries
-          // in the injected context; the snapshot carries each entry's type.
-          // Issue #26 (P1): 默认禁止跨类型合并（类型有语义作用——preference 注入
-          // 权重更高、decision/project 注入上下文不同，合并会丢类型边界）。用户显式
-          // 开启 allowCrossTypeMerge 后放宽该检查，类型边界由用户自行承担。
-          const mergeTypes = new Set(d.ids.map((id) => snapshot.get(id)?.type));
-          if (mergeTypes.size > 1 && options.allowCrossTypeMerge !== true) {
-            local.push(`${at}: merge ids span multiple types (${[...mergeTypes].join(", ")})`);
-          }
-        }
+      if (typeof d.content !== "string" || !d.content.trim()) {
+        errors.push(`${at}: create needs non-empty content`);
+        continue;
       }
-    }
-    if (local.length > 0) {
-      if (skipInvalid) {
-        // 单条非法 → 跳过该决策，不 claim id（其目标记忆留给其它合法决策/
-        // 隐式 keep），并记录到 skipped 供调用方日志/审计。信息性跳过绝不
-        // 写入全局 errors，否则会误触发下方的整单拒绝。
-        skipped.push({
-          index,
-          action: d?.action,
-          ids,
-          error: local.join("; ")
-        });
-      } else {
-        errors.push(...local);
+      if (d.importance !== undefined && (!Number.isInteger(d.importance) || d.importance < 1 || d.importance > 5)) {
+        errors.push(`${at}: create importance must be an integer 1-5 when provided`);
+      }
+      if (typeof d.type !== "string" || !d.type.trim()) {
+        errors.push(`${at}: create needs non-empty type`);
       }
       continue;
+    } else if (!Array.isArray(d.ids) || d.ids.length === 0) {
+      errors.push(`${at}: ${d.action} needs non-empty ids`);
+      continue;
+    }
+    // update-specific field validation runs BEFORE claiming ids, so a failing
+    // update never pollutes the claimed set (which drives the "every id must
+    // appear in a decision" check below).
+    if (d.action === "update") {
+      // 只能更新单条
+      if (!Array.isArray(d.ids) || d.ids.length !== 1) {
+        errors.push(`${at}: update must target exactly one id`);
+        continue;
+      }
+      // 必须产生实际变化
+      const mem = snapshot.get(d.ids[0]);
+      const hasChange = (d.title !== undefined && d.title !== mem?.title)
+        || (d.content !== undefined && d.content !== mem?.content)
+        || (d.importance !== undefined && d.importance !== mem?.importance);
+      if (!hasChange) {
+        errors.push(`${at}: update must change at least one field`);
+        continue;
+      }
+      // 不能更新 summary
+      if (mem?.type === "summary") {
+        errors.push(`${at}: cannot update summary via update action`);
+        continue;
+      }
+      // 保护期：新建记忆不可立即被 update（可配置）
+      const ageHours = (Date.now() - new Date(mem?.created_at).getTime()) / 3600000;
+      if (ageHours < minAgeHours) {
+        errors.push(`${at}: memory too young (< ${minAgeHours}h)`);
+        continue;
+      }
     }
-    if (d.action !== "create") {
-      for (const id of ids) claimed.add(id);
+    for (const id of ids) {
+      const mem = snapshot.get(id);
+      if (!mem) {
+        errors.push(`${at}: unknown id ${JSON.stringify(id)}`);
+      } else if (mem.archived || mem.type === "summary") {
+        errors.push(`${at}: id ${JSON.stringify(id)} is archived or summary (not eligible)`);
+      }
+      if (claimed.has(id)) {
+        errors.push(`${at}: id ${JSON.stringify(id)} claimed by multiple decisions`);
+      }
+      claimed.add(id);
+    }
+    if (d.action === "merge") {
+      if (!d.keepSource || !d.ids.includes(d.keepSource)) {
+        errors.push(`${at}: merge keepSource must be one of ids`);
+      }
+      if (typeof d.title !== "string" || !d.title.trim() || typeof d.content !== "string" || !d.content.trim()) {
+        errors.push(`${at}: merge needs non-empty title and content`);
+      }
+      if (d.importance !== undefined && (!Number.isInteger(d.importance) || d.importance < 1 || d.importance > 5)) {
+        errors.push(`${at}: merge importance must be an integer 1-5 when provided`);
+      }
+      // Merging across types would blur preference/project/decision boundaries
+      // in the injected context; the snapshot carries each entry's type.
+      const mergeTypes = new Set(d.ids.map((id) => snapshot.get(id)?.type));
+      if (mergeTypes.size > 1) {
+        errors.push(`${at}: merge ids span multiple types (${[...mergeTypes].join(", ")})`);
+      }
     }
-    survivors.push(d);
   }
-  // Cap update churn: too many edits in one cycle signals a runaway model.
-  // These are GLOBAL signals — in skipInvalid mode they still reject the whole
-  // batch, because a model that floods updates/creates is broken, not just
-  // slightly schema-drifting.
-  const updateCount = survivors.filter((d) => d.action === "update").length;
+  // Cap update churn: too many edits in one cycle signals a runaway model
+  const updateCount = decisions.filter((d) => d.action === "update").length;
   if (updateCount > maxUpdatePerRun) {
     errors.push(`too many update decisions: ${updateCount} > ${maxUpdatePerRun}`);
   }
   // Cap pattern minting per run (sleepMaxPatternPerRun passes through here).
-  const createCount = survivors.filter((d) => d.action === "create").length;
+  const createCount = decisions.filter((d) => d.action === "create").length;
   const maxCreatePerRun = options.maxCreatePerRun ?? 5;
   if (createCount > maxCreatePerRun) {
     errors.push(`too many create decisions: ${createCount} > ${maxCreatePerRun}`);
@@ -180,31 +137,25 @@ export function validateDecisions(decisions, snapshot, options = {}) {
   // snapshot（claimed.size / snapshot.size < dreamMinExplicitCoverage）时整单拒绝，
   // 而不是用 keep 把绝大部分 snapshot 全部"通过"。
   if (errors.length > 0) {
-    return { ok: false, errors, skipped };
+    return { ok: false, errors };
   }
   const minCoverage = options.dreamMinExplicitCoverage ?? 0.5;
   if (options.dreamImplicitKeep !== false) {
     const coverage = snapshot.size > 0 ? claimed.size / snapshot.size : 1;
     if (coverage < minCoverage) {
       errors.push(`explicit decision coverage ${Math.round(coverage * 100)}% < minimum ${Math.round(minCoverage * 100)}%`);
-      return { ok: false, errors, skipped };
+      return { ok: false, errors };
     }
     for (const id of snapshot.keys()) {
-      if (!claimed.has(id)) survivors.push({ action: "keep", ids: [id] });
+      if (!claimed.has(id)) decisions.push({ action: "keep", ids: [id] });
     }
   } else {
     for (const id of snapshot.keys()) {
       if (!claimed.has(id)) errors.push(`memory ${JSON.stringify(id)} missing from decisions`);
     }
-    if (errors.length > 0) return { ok: false, errors, skipped };
-  }
-  // 调用方下游（apply/audit）复用同一 decisions 引用：就地同步为 survivors——
-  // 在 skipInvalid 模式下去掉被跳过的非法决策；在隐式 keep 下追加补齐的 keep。
-  // 内容一致时（无跳过、无补齐）为 no-op。
-  if (survivors.length !== decisions.length) {
-    decisions.splice(0, decisions.length, ...survivors);
+    if (errors.length > 0) return { ok: false, errors };
   }
-  return { ok: true, errors, skipped };
+  return { ok: true, errors };
 }
 
 /** Marker thrown when a decision target changed since the run snapshot. */