@modusensus/dsh-mneme 0.7.20 → 0.7.22

package/README.en.md

@@ -166,6 +166,8 @@ Every **background LLM call** (autoDream consolidation + summary, autoSummarize
 
 | Version | Highlights |
 |------|------|
+| **v0.7.22** | Restored the v0.6.9 skipInvalid tolerant-validation path (issue #89 regression, lost in the v0.7.11 rewrite): `dreamSkipInvalid` (default true) skips individual invalid decisions, applies the valid subset, and marks the run degraded; `allowCrossTypeMerge` (default false) explicitly relaxes cross-type merging — weak models (e.g. qwen3.8-flash) with jittery schema compliance no longer fail the whole batch and burn LLM calls. Strict mode and the sleep path behave unchanged; global caps/coverage floors still reject the whole run (running over cap = broken model, not minor schema drift). New `dreamMinIntervalMinutes` (0–10080, default 0 = unlimited) minimum autoDream trigger interval — failed/degraded runs also consume the interval (throttling exists to stop back-to-back failing calls); feature_flags whitelist now 34 keys; 696 tests green |
+| **v0.7.21** | Fixed autoDream/sleep effort fallback being dead code on the stream path (the catch-based retry from v0.7.16 never fired): dsh-llm rc.1 turns adapter-stage failures (incl. `UNSUPPORTED_REASONING_EFFORT`) into a terminal error finish chunk instead of a throw; `streamText` now captures the finish-chunk failure cause (`describeStreamFailure` normalizes `{code,message}`) + `withEffortFallback` gains a `getStreamError` accessor (retries without effort when rejected) + `runAuditedLlm` supports `spec.streamError` (audit `error_message` carries the real cause; `run.error` stays a stable `"llm failed"`); 688 tests green |
 | **v0.7.20** | Heat model restored (issue #87): v0.7.0 self-evolving memory back (`src/heat.js` power-law decay `H=1/(1+λΔt)^α` + per-type half-lives), sleep demotion dual protection (cold time-window + heat<0.05 + importance<5), touchRecalled gating back on `heatEnabled`, entity heat projection (ego node heat → size/opacity), recall_runs recording on by default; **default OFF** (matches v0.7.12 behavior out of the box) + feature_flags whitelist rollback switch + lightMode linkage + sleep demotion audit counts exposed (workbench can show "N demoted") + phase-two frontend (/list heat projection, HeatBadge three-tier badge, self-gated status heat-distribution card, order=heat page-local sort, all self-gated); better-sidebar fix (issue #88: soft integration moved to an inner dynamic sub-plugin, no more startup failure without bs); 685 tests green |
 | **v0.7.18** | Ecosystem step one + query convergence: better-sidebar soft integration (inject declaration + optional peer `dsh-better-sidebar` + registerTab reusing the four views, safe skip when absent; narrow-container `@container` adaptation) + `/list?deposited=only` view (receipt_chain ∪ source=dream) + deposited/archived filter chips in the library + status-page dashboard (server totals + view-all jumps) + drawer restore for archived memories; 667 tests green |
 | **v0.7.17** | Panel polish: sidebar entry continuously aligned with the host (MutationObserver syncs the New-Session class + `width:100%` + native centering restored, resilient to async skin rewrites) + importance rendered as Lucide star glyphs (`ImportanceStars` filled/hollow component replacing text ★) + toolbar dropdown stacking fix (z-index moved to the container; export/import menu no longer painted under the sticky month header); 664 tests green |
@@ -212,7 +214,13 @@ Every **background LLM call** (autoDream consolidation + summary, autoSummarize
 | v0.7.1–0.7.8 | ✅ Done | Issue fixes + graph backfill | tags↔entity_attrs bridge, inline-confirm delete, sidebar trigger toggle, brace escaping, user/fact layered types + stats endpoint (later removed), prefix-id resolution (later removed), sleep batch entity extraction, snapshotEvents() DSH compat; 764→812 tests green |
 | v0.7.9 | ✅ Done | lib-sync gate | Issue #65: src-only shim silently killed the shipped lib — synced lib + pre-publish src↔lib consistency check + lib smoke tests; 815 tests green |
 | v0.7.10–0.7.12 | ✅ Done | Panel redesign + near-rewrite | UX upgrades (color dots, pan/zoom, pagination, global search), then near-rewrite: inlined panel → pure HTTP API + standalone CLI + lightMode; TYPES narrowed 8→6 |
-| v0.7.13–0.7.20 | ✅ Done | Distillation, security, desktop, dream fix, panel polish, ecosystem, heat restore | codingRetrospect + 429 governor; private reasoning blocks dropped (CWE-200); desktop panel redesign + feature flags; autoDream thinking-model empty-body fix + backfilled tests; sidebar entry alignment + star glyphs + menu stacking polish; better-sidebar soft integration (inner dynamic sub-plugin fix, issue #88) + deposited/archived library views; heat model restored (issue #87) with phase-two frontend + archival audit (issue #87); 685 tests green |
+| v0.7.13–0.7.15 | ✅ Done | Distillation, security, desktop | codingRetrospect + 429 governor; private reasoning blocks dropped (CWE-200); desktop panel redesign + feature flags + status dashboard + import/export |
+| v0.7.16 | ✅ Done | autoDream thinking-model fix | config-first routing restored (Issue #25) + reasoningEffort auto-retry + honest audit on parse failure; backfilled API-route & lib smoke tests; 662 tests green |
+| v0.7.17 | ✅ Done | Panel polish | Sidebar entry continuously aligned with the host (MutationObserver syncs the New-Session class + `width:100%` + native centering, resilient to async skin rewrites) + Lucide star glyphs (`ImportanceStars`) + toolbar dropdown stacking fix; 664 tests green |
+| v0.7.18 | ✅ Done | Ecosystem step one + query convergence | better-sidebar soft integration (inject declaration + optional peer + registerTab reusing the four views, safe skip when absent; narrow-container `@container`) + `/list?deposited=only` view + deposited/archived filter chips + status-page dashboard + drawer restore; 667 tests green |
+| v0.7.20 | ✅ Done | Heat restore + phase-two frontend + better-sidebar fix | Heat model fully restored (issue #87, backported from v0.7.10: power-law decay + TYPE_DECAY + sleep heat-combined dual protection + entity heat projection) + acceptance checklist landed (heatEnabled default OFF / feature_flags 31 keys / lightMode linkage / sleep demotion audit / updated_at⊥last_accessed_at contract) + phase-two frontend (/list heat projection, HeatBadge three-tier, order=heat page-local sort) + better-sidebar fix (issue #88: inner dynamic sub-plugin); 685 tests green |
+| v0.7.21 | ✅ Done | effort-fallback stream fix | Catch-based effort fallback was dead code on the stream path (dsh-llm rc.1 turns adapter failures into a terminal error finish chunk instead of a throw) → `streamText` captures the finish-chunk cause (`describeStreamFailure`) + `withEffortFallback` gains a `getStreamError` accessor (retries without effort when rejected) + `runAuditedLlm` supports `spec.streamError` (real cause in audit); 688 tests green |
+| v0.7.22 | ✅ Done | skipInvalid tolerant-validation restore (issue #89) + autoDream throttle | Restored v0.6.9 skipInvalid dual-track structure (lost in the v0.7.11 rewrite): `dreamSkipInvalid` skips individual invalid decisions + applies the valid subset + marks the run degraded; `allowCrossTypeMerge` explicitly relaxes cross-type merging; weak models (qwen3.8-flash) with jittery schema compliance no longer fail the whole batch. New `dreamMinIntervalMinutes` (0–10080, default 0) minimum trigger interval — failed/degraded runs also consume it. Strict mode / sleep path unchanged; feature_flags whitelist 34 keys; 696 tests green |
 | **v0.8.0** | 🚧 Planned (late Sep) | Graph enhancement | Interest-drift visualization + scope isolation (issue #17) + cross-workspace sharing |
 
 > All new capabilities ship as **toggleable features** (enabled/disabled via configuration), conservatively on by default and never breaking existing behavior. The `failure_memories` table and the autoDream decision engine have already paved the way for future reflective growth.

package/README.md

@@ -207,6 +207,8 @@ v0.3.0 起新增**记忆基因**层：从记忆里抽取**命名实体**、**带
 
 | 版本 | 亮点 |
 |------|------|
+| **v0.7.22** | 恢复 v0.6.9 的 skipInvalid 宽容校验路径（issue #89 回归，v0.7.11 重写丢失）：`dreamSkipInvalid`（默认 true）单条非法决策跳过 + 合法子集应用 + run 记 degraded，`allowCrossTypeMerge`（默认 false）显式放宽跨类型合并——弱模型（如 qwen3.8-flash）决策合规抖动不再整单拒绝白烧 LLM 调用；严格模式/sleep 路径行为不变，全局上限/覆盖率下限仍整单拒绝（刷爆上限=模型坏了，非轻微 schema 漂移）；新增 `dreamMinIntervalMinutes`（0-10080，默认 0=不限）autoDream 最小触发间隔，失败/degraded run 也占用间隔（节流防失败调用连发）；feature_flags 白名单 34 键；696 测试全绿 |
+| **v0.7.21** | 修复 autoDream/sleep 的 effort 回退在流式路径失效（v0.7.16 的 catch 式回退是死代码）：dsh-llm rc.1 把 adapter 阶段异常（含 `UNSUPPORTED_REASONING_EFFORT`）转成终态 error finish chunk 不再抛出；`streamText` 现捕获 finish-chunk 失败原因（新增 `describeStreamFailure` 归一化 `{code,message}`）+ `withEffortFallback` 增加 `getStreamError` 访问器（effort 被拒时去掉重试一次）+ `runAuditedLlm` 支持 `spec.streamError`（audit 行 `error_message` 携带真实原因，`run.error` 稳定 `"llm failed"` 不变）；688 测试全绿 |
 | **v0.7.20** | heat 热度模型回归（issue #87）：找回 v0.7.0 自进化记忆（`src/heat.js` 幂律衰减 `H=1/(1+λΔt)^α` + per-type 差异化半衰期）、sleep 降级热联合双保护（时间窗冷 + heat<0.05 + importance<5）、touchRecalled 门控改回 `heatEnabled`、实体热投影（ego 节点 heat → 前端大小/明暗）、recall_runs 默认记录；**默认关**（默认=与 v0.7.12 行为一致）+ feature_flags 白名单回滚开关 + lightMode 联动 + sleep 降级审计计数暴露（工作动态可展示"降级 N 条"）+ 阶段二前端（/list heat 投影、HeatBadge 三档徽章、状态页热度分布卡、order=heat 页内排序，全部自门控）；better-sidebar 修复（issue #88：软集成改内层动态子插件，无 bs 环境不再启动失败）；685 测试全绿 |
 | **v0.7.18** | 生态第一步 + 查询收敛：better-sidebar 软集成（inject 声明 + optional peer `dsh-better-sidebar` + registerTab 复用四视图，未装安全跳过；窄容器 `@container` 适配）+ `/list?deposited=only` 沉淀视图（receipt_chain ∪ source=dream）+ 记忆库沉淀/已归档筛选 chip + 状态页仪表盘化（统计 + 查看全部跳转预置筛选）+ 抽屉归档记忆「恢复」；667 测试全绿 |
 | **v0.7.17** | 面板体验细化：侧边栏入口持续对齐宿主（MutationObserver 同步「新会话」类名 + `width:100%` + 交还原生居中，皮肤异步改写不再失配）+ 重要性星级换 Lucide 星形（`ImportanceStars` 实心/空心组件，替换文本 ★）+ 工具栏下拉层级修复（z-index 提到容器，导出/导入菜单不再被吸顶月份头遮挡）；664 测试全绿 |
@@ -286,6 +288,11 @@ v0.3.0 起新增**记忆基因**层：从记忆里抽取**命名实体**、**带
 | **v0.7.14** | ✅ 完成 | 安全修复（CWE-200） | 蒸馏不再采集私有推理块：`collectMessages` 只采公开 text，防止记忆库沉淀模型私有思考链；617 测试全绿 |
 | **v0.7.15** | ✅ 完成 | 桌面端适配 | 记忆库面板重设计 + 功能开关 30 键 UI（features API）+ 状态页工作台 + 导入导出（镜像同构 md 黄金闭环）+ Token 面板默认遮蔽；645 测试全绿 |
 | **v0.7.16** | ✅ 完成 | autoDream thinking 模型空体修复 + 补测 | 恢复 config-first 路由（设置面板「巩固模型」生效，Issue #25）+ reasoningEffort 被拒自动去掉重试 + 解析失败如实记 llm_audit error；补测 API 路由空白（/delete、/entities、/external-api）+ lib 运行时冒烟；662 测试全绿 |
+| **v0.7.17** | ✅ 完成 | 面板体验细化 | 侧边栏入口持续对齐宿主（MutationObserver 同步「新会话」类名 + `width:100%` + 交还原生居中，皮肤异步改写不再失配）+ 重要性星级换 Lucide 星形（`ImportanceStars` 实心/空心组件，替换文本 ★）+ 工具栏下拉层级修复（z-index 提到容器，导出/导入菜单不再被吸顶月份头遮挡）；664 测试全绿 |
+| **v0.7.18** | ✅ 完成 | 生态第一步 + 查询收敛 | better-sidebar 软集成（inject 声明 + optional peer `dsh-better-sidebar` + registerTab 复用四视图，未装安全跳过；窄容器 `@container` 适配）+ `/list?deposited=only` 沉淀视图（receipt_chain ∪ source=dream）+ 记忆库沉淀/已归档筛选 chip + 状态页仪表盘化（统计 + 查看全部跳转预置筛选）+ 抽屉归档记忆「恢复」；667 测试全绿 |
+| **v0.7.20** | ✅ 完成 | heat 回归 + 阶段二前端 + better-sidebar 修复 | heat 热度模型完整找回（issue #87，v0.7.10 移植：幂律衰减 + TYPE_DECAY + sleep 热联合双保护 + 实体热投影）+ 验收清单落地（heatEnabled 默认关 / feature_flags 31 键 / lightMode 联动 / sleep 降级审计暴露 / updated_at⊥last_accessed_at 契约）+ 阶段二前端（/list heat 投影、HeatBadge 三档、order=heat 页内排序）+ better-sidebar 修复（issue #88：内层动态子插件）；685 测试全绿 |
+| **v0.7.21** | ✅ 完成 | effort 回退流式修复 | autoDream/sleep 的 catch 式 effort 回退在流式路径是死代码（dsh-llm rc.1 把 adapter 异常转成终态 error finish chunk 不再抛出）→ `streamText` 捕获 finish-chunk 失败原因（`describeStreamFailure` 归一化）+ `withEffortFallback` 增加 `getStreamError` 访问器（effort 被拒去重试）+ `runAuditedLlm` 支持 `spec.streamError`（audit 记真实原因）；688 测试全绿 |
+| **v0.7.22** | ✅ 完成 | skipInvalid 宽容校验回归（issue #89）+ autoDream 节流 | 恢复 v0.6.9 的 skipInvalid 双轨结构（v0.7.11 重写丢失）：`dreamSkipInvalid` 单条非法决策跳过 + 合法子集应用 + run 记 degraded，`allowCrossTypeMerge` 显式放宽跨类型合并；弱模型（qwen3.8-flash）决策合规抖动不再整单拒绝；新增 `dreamMinIntervalMinutes`（0-10080，默认 0=不限）最小触发间隔，失败/degraded run 也占用间隔；严格模式/sleep 路径行为不变；feature_flags 白名单 34 键；696 测试全绿 |
 | **v0.8.0** | 🚧 计划中（9 月末） | 图谱增强 | 兴趣漂移可视化 + scope 隔离（issue #17）+ 跨 workspace 记忆共享 |
 
 > 新能力一律做成**可开关的功能**（配置启用/关闭），默认保守开启、不破坏现有行为。`failure_memories` 表与 autoDream 决策引擎已为后续反思性成长铺好路。

package/lib/config.js

@@ -47,6 +47,11 @@ export const Config = z.object({
   dreamThresholdCount: z.natural().min(1).max(1000).default(10),
   dreamThresholdChars: z.natural().min(100).max(100000).default(5000),
   dreamDelayMs: z.natural().min(0).max(60000).default(2000),
+  // autoDream 触发最小间隔（分钟，0 = 不限制，Issue #89 请求 2）：高频写入
+  // 场景下防止巩固调用（含失败重试）连发刷爆配额。间隔从每次实际开跑时刻
+  // 起算，失败/degraded 的 run 也占用间隔；间隔内的触发请求静默跳过，下一次
+  // 写入事件会重新评估。
+  dreamMinIntervalMinutes: z.natural().min(0).max(10080).default(0),
   dreamProvider: z.string(),
   dreamModel: z.string(),
   dreamMaxTokens: z.natural().min(256).max(131072).default(8192),
@@ -74,6 +79,13 @@ export const Config = z.object({
   // → 整单拒绝，防止残缺输出被隐式 keep 洗白成 ok 后再被真实 apply。0-1，
   // 默认 0.5（至少显式覆盖一半 snapshot）。
   dreamMinExplicitCoverage: z.number().min(0).max(1).default(0.5),
+  // Issue #89：v0.6.9（Issue #26）的宽容路径回归。默认跳过单条非法决策
+  // （未知 id / 跨类型合并等）、应用合法子集、run 记 degraded；设 false 恢复
+  // 整单拒绝的严格模式。全局上限与覆盖率下限不受此开关影响、始终整单拒绝。
+  dreamSkipInvalid: z.boolean().default(true),
+  // 显式开启后放宽跨类型合并检查（类型边界由用户自行承担）；配合
+  // dreamSkipInvalid 理解：关闭 skipInvalid 时跨类型 merge 直接整单拒绝。
+  allowCrossTypeMerge: z.boolean().default(false),
   // Rule version for dream adjudication: when this bumps, older dream_runs
   // degrade to historical evidence (their receipts no longer drive live
   // decisions). Default 0 = no versioning in use yet.

package/lib/dream/decisions.js

@@ -7,12 +7,22 @@ const EPISTEMIC_PRIORITY = { observation: 3, inferred: 2, subjective: 1 };
 
 /**
  * Validate a dream decision list against a snapshot of eligible memories.
- * @param decisions - LLM-produced decision list.
+ * @param decisions - LLM-produced decision list. In skipInvalid mode, invalid
+ *   entries are spliced out of this array in place (the caller reuses the same
+ *   reference downstream for apply/audit); implicit keeps are appended here too.
  * @param snapshot - Map<id, memory> of eligible (non-archived, non-summary) entries.
- * @returns {{ok: boolean, errors: string[]}}
+ * @returns {{ok: boolean, errors: string[], skipped?: Array<{index, action, ids, error}>}}
  */
 export function validateDecisions(decisions, snapshot, options = {}) {
   const errors = [];
+  // Issue #89 回归修复（v0.6.9 / Issue #26 的 skipInvalid 路径原样移植，该路径
+  // 在 v0.7.11 重写中丢失）：skipInvalid 开启时，单条非法决策只跳过该条（记录
+  // 到 skipped、不 claim 任何 id），合法子集照常应用，调用方据此把 run 记为
+  // degraded。全局信号（update/create 上限、显式覆盖率下限）依旧整单拒绝——
+  // 刷爆上限或覆盖率不达标的输出是模型坏了，不是轻微 schema 漂移。
+  const skipped = [];
+  const survivors = [];
+  const skipInvalid = options.skipInvalid === true;
   const maxUpdatePerRun = options.maxUpdatePerRun ?? 2;
   const minAgeHours = options.minAgeHours ?? 24;
   if (!Array.isArray(decisions) || decisions.length === 0) {
@@ -21,106 +31,122 @@ export function validateDecisions(decisions, snapshot, options = {}) {
   const claimed = new Set();
   for (const [index, d] of decisions.entries()) {
     const at = `decision[${index}]`;
+    // 单条校验错误先进 local：skipInvalid 模式下整条跳过，严格模式下才并入
+    // 全局 errors（沿用 v0.6.9 的双轨结构）。
+    const local = [];
+    const ids = d && d.action === "conflict" ? [d.winner, d.loser] : (d?.ids ?? []);
     if (!d || typeof d !== "object" || !ACTIONS.has(d.action)) {
-      errors.push(`${at}: invalid action ${JSON.stringify(d?.action)}`);
-      continue;
-    }
-    const ids = d.action === "conflict" ? [d.winner, d.loser] : (d.ids ?? []);
-    if (d.action === "conflict") {
+      local.push(`${at}: invalid action ${JSON.stringify(d?.action)}`);
+    } else if (d.action === "conflict") {
       if (!d.winner || !d.loser || d.winner === d.loser) {
-        errors.push(`${at}: conflict needs distinct winner and loser`);
-        continue;
+        local.push(`${at}: conflict needs distinct winner and loser`);
       }
     } else if (d.action === "create") {
       // Mint a fresh memory (sleep pattern discovery). Claims no existing id,
       // so it skips the claiming loop below; evidence is optional provenance
       // (already filtered to real ids by the caller) and is stored in content.
       if (typeof d.title !== "string" || !d.title.trim()) {
-        errors.push(`${at}: create needs non-empty title`);
-        continue;
+        local.push(`${at}: create needs non-empty title`);
       }
       if (typeof d.content !== "string" || !d.content.trim()) {
-        errors.push(`${at}: create needs non-empty content`);
-        continue;
+        local.push(`${at}: create needs non-empty content`);
       }
       if (d.importance !== undefined && (!Number.isInteger(d.importance) || d.importance < 1 || d.importance > 5)) {
-        errors.push(`${at}: create importance must be an integer 1-5 when provided`);
+        local.push(`${at}: create importance must be an integer 1-5 when provided`);
       }
       if (typeof d.type !== "string" || !d.type.trim()) {
-        errors.push(`${at}: create needs non-empty type`);
+        local.push(`${at}: create needs non-empty type`);
       }
-      continue;
     } else if (!Array.isArray(d.ids) || d.ids.length === 0) {
-      errors.push(`${at}: ${d.action} needs non-empty ids`);
-      continue;
+      local.push(`${at}: ${d.action} needs non-empty ids`);
     }
     // update-specific field validation runs BEFORE claiming ids, so a failing
     // update never pollutes the claimed set (which drives the "every id must
     // appear in a decision" check below).
-    if (d.action === "update") {
+    if (local.length === 0 && d?.action === "update") {
       // 只能更新单条
       if (!Array.isArray(d.ids) || d.ids.length !== 1) {
-        errors.push(`${at}: update must target exactly one id`);
-        continue;
-      }
-      // 必须产生实际变化
-      const mem = snapshot.get(d.ids[0]);
-      const hasChange = (d.title !== undefined && d.title !== mem?.title)
-        || (d.content !== undefined && d.content !== mem?.content)
-        || (d.importance !== undefined && d.importance !== mem?.importance);
-      if (!hasChange) {
-        errors.push(`${at}: update must change at least one field`);
-        continue;
-      }
-      // 不能更新 summary
-      if (mem?.type === "summary") {
-        errors.push(`${at}: cannot update summary via update action`);
-        continue;
-      }
-      // 保护期：新建记忆不可立即被 update（可配置）
-      const ageHours = (Date.now() - new Date(mem?.created_at).getTime()) / 3600000;
-      if (ageHours < minAgeHours) {
-        errors.push(`${at}: memory too young (< ${minAgeHours}h)`);
-        continue;
+        local.push(`${at}: update must target exactly one id`);
+      } else {
+        // 必须产生实际变化
+        const mem = snapshot.get(d.ids[0]);
+        const hasChange = (d.title !== undefined && d.title !== mem?.title)
+          || (d.content !== undefined && d.content !== mem?.content)
+          || (d.importance !== undefined && d.importance !== mem?.importance);
+        if (!hasChange) {
+          local.push(`${at}: update must change at least one field`);
+        } else if (mem?.type === "summary") {
+          // 不能更新 summary
+          local.push(`${at}: cannot update summary via update action`);
+        } else {
+          // 保护期：新建记忆不可立即被 update（可配置）
+          const ageHours = (Date.now() - new Date(mem?.created_at).getTime()) / 3600000;
+          if (ageHours < minAgeHours) {
+            local.push(`${at}: memory too young (< ${minAgeHours}h)`);
+          }
+        }
       }
     }
-    for (const id of ids) {
-      const mem = snapshot.get(id);
-      if (!mem) {
-        errors.push(`${at}: unknown id ${JSON.stringify(id)}`);
-      } else if (mem.archived || mem.type === "summary") {
-        errors.push(`${at}: id ${JSON.stringify(id)} is archived or summary (not eligible)`);
+    if (local.length === 0 && d && d.action !== "create") {
+      // seen 捕获同一条决策内的重复 id；claimed 只含先前存活决策的 id
+      // （被跳过的决策不 claim，其目标留给其它合法决策/隐式 keep）。
+      const seen = new Set();
+      for (const id of ids) {
+        const mem = snapshot.get(id);
+        if (!mem) {
+          local.push(`${at}: unknown id ${JSON.stringify(id)}`);
+        } else if (mem.archived || mem.type === "summary") {
+          local.push(`${at}: id ${JSON.stringify(id)} is archived or summary (not eligible)`);
+        }
+        if (claimed.has(id) || seen.has(id)) {
+          local.push(`${at}: id ${JSON.stringify(id)} claimed by multiple decisions`);
+        }
+        seen.add(id);
       }
-      if (claimed.has(id)) {
-        errors.push(`${at}: id ${JSON.stringify(id)} claimed by multiple decisions`);
+      if (local.length === 0 && d.action === "merge") {
+        if (!d.keepSource || !d.ids.includes(d.keepSource)) {
+          local.push(`${at}: merge keepSource must be one of ids`);
+        }
+        if (typeof d.title !== "string" || !d.title.trim() || typeof d.content !== "string" || !d.content.trim()) {
+          local.push(`${at}: merge needs non-empty title and content`);
+        }
+        if (d.importance !== undefined && (!Number.isInteger(d.importance) || d.importance < 1 || d.importance > 5)) {
+          local.push(`${at}: merge importance must be an integer 1-5 when provided`);
+        }
+        // Merging across types would blur preference/project/decision boundaries
+        // in the injected context; the snapshot carries each entry's type.
+        // Issue #26 (P1)：默认禁止跨类型合并。用户显式开启 allowCrossTypeMerge
+        // 后放宽该检查，类型边界由用户自行承担。
+        const mergeTypes = new Set(d.ids.map((id) => snapshot.get(id)?.type));
+        if (mergeTypes.size > 1 && options.allowCrossTypeMerge !== true) {
+          local.push(`${at}: merge ids span multiple types (${[...mergeTypes].join(", ")})`);
+        }
       }
-      claimed.add(id);
     }
-    if (d.action === "merge") {
-      if (!d.keepSource || !d.ids.includes(d.keepSource)) {
-        errors.push(`${at}: merge keepSource must be one of ids`);
-      }
-      if (typeof d.title !== "string" || !d.title.trim() || typeof d.content !== "string" || !d.content.trim()) {
-        errors.push(`${at}: merge needs non-empty title and content`);
-      }
-      if (d.importance !== undefined && (!Number.isInteger(d.importance) || d.importance < 1 || d.importance > 5)) {
-        errors.push(`${at}: merge importance must be an integer 1-5 when provided`);
-      }
-      // Merging across types would blur preference/project/decision boundaries
-      // in the injected context; the snapshot carries each entry's type.
-      const mergeTypes = new Set(d.ids.map((id) => snapshot.get(id)?.type));
-      if (mergeTypes.size > 1) {
-        errors.push(`${at}: merge ids span multiple types (${[...mergeTypes].join(", ")})`);
+    if (local.length > 0) {
+      if (skipInvalid) {
+        // 单条非法 → 跳过该决策，不 claim id（其目标记忆留给其它合法决策/隐式
+        // keep），并记录到 skipped 供调用方日志/审计。信息性跳过绝不写入全局
+        // errors，否则会误触发下方的整单拒绝。
+        skipped.push({ index, action: d?.action, ids, error: local.join("; ") });
+      } else {
+        errors.push(...local);
       }
+      continue;
+    }
+    if (d.action !== "create") {
+      for (const id of ids) claimed.add(id);
     }
+    survivors.push(d);
   }
-  // Cap update churn: too many edits in one cycle signals a runaway model
-  const updateCount = decisions.filter((d) => d.action === "update").length;
+  // Cap update churn: too many edits in one cycle signals a runaway model.
+  // 全局信号——skipInvalid 模式下依旧整单拒绝（见函数头注释）。
+  const updateCount = survivors.filter((d) => d.action === "update").length;
   if (updateCount > maxUpdatePerRun) {
     errors.push(`too many update decisions: ${updateCount} > ${maxUpdatePerRun}`);
   }
   // Cap pattern minting per run (sleepMaxPatternPerRun passes through here).
-  const createCount = decisions.filter((d) => d.action === "create").length;
+  const createCount = survivors.filter((d) => d.action === "create").length;
   const maxCreatePerRun = options.maxCreatePerRun ?? 5;
   if (createCount > maxCreatePerRun) {
     errors.push(`too many create decisions: ${createCount} > ${maxCreatePerRun}`);
@@ -137,25 +163,31 @@ export function validateDecisions(decisions, snapshot, options = {}) {
   // snapshot（claimed.size / snapshot.size < dreamMinExplicitCoverage）时整单拒绝，
   // 而不是用 keep 把绝大部分 snapshot 全部"通过"。
   if (errors.length > 0) {
-    return { ok: false, errors };
+    return { ok: false, errors, skipped };
   }
   const minCoverage = options.dreamMinExplicitCoverage ?? 0.5;
   if (options.dreamImplicitKeep !== false) {
     const coverage = snapshot.size > 0 ? claimed.size / snapshot.size : 1;
     if (coverage < minCoverage) {
       errors.push(`explicit decision coverage ${Math.round(coverage * 100)}% < minimum ${Math.round(minCoverage * 100)}%`);
-      return { ok: false, errors };
+      return { ok: false, errors, skipped };
     }
     for (const id of snapshot.keys()) {
-      if (!claimed.has(id)) decisions.push({ action: "keep", ids: [id] });
+      if (!claimed.has(id)) survivors.push({ action: "keep", ids: [id] });
     }
   } else {
     for (const id of snapshot.keys()) {
       if (!claimed.has(id)) errors.push(`memory ${JSON.stringify(id)} missing from decisions`);
     }
-    if (errors.length > 0) return { ok: false, errors };
+    if (errors.length > 0) return { ok: false, errors, skipped };
+  }
+  // 调用方下游（apply/audit）复用同一 decisions 引用：就地同步为 survivors——
+  // 在 skipInvalid 模式下去掉被跳过的非法决策；在隐式 keep 下追加补齐的 keep。
+  // 内容一致时（无跳过、无补齐）为 no-op。
+  if (survivors.length !== decisions.length) {
+    decisions.splice(0, decisions.length, ...survivors);
   }
-  return { ok: true, errors };
+  return { ok: true, errors, skipped };
 }
 
 /** Marker thrown when a decision target changed since the run snapshot. */

package/lib/dream/sleep.js

@@ -17,7 +17,7 @@
 import { randomUUID, createHash } from "node:crypto";
 import { validateDecisions, applyDecisions } from "./decisions.js";
 import { findPotentialConflicts } from "./clustering.js";
-import { buildReceipt, withEffortFallback } from "../dream.js";
+import { buildReceipt, describeStreamFailure, withEffortFallback } from "../dream.js";
 import { computeHeat } from "../heat.js";
 
 const SUMMARY_MAX = 120;
@@ -61,12 +61,17 @@ function parseJsonArray(text) {
 }
 
 /** Same stream consumption contract as dream.js. */
-async function streamText(ctx, options) {
+async function streamText(ctx, options, onStreamError) {
   if (!ctx?.llm?.stream) return undefined;
   let text = "";
   for await (const chunk of ctx.llm.stream(options)) {
     if (chunk.type === "text-delta" && typeof chunk.text === "string") text += chunk.text;
     if (chunk.type === "finish" && (chunk.reason?.kind === "error" || chunk.reason?.kind === "aborted")) {
+      // Same rc.1 error-as-finish-chunk behavior as dream.js — surface the
+      // cause instead of discarding it.
+      if (typeof onStreamError === "function") {
+        try { onStreamError(chunk.reason); } catch { /* diagnostics only */ }
+      }
       return undefined;
     }
   }
@@ -186,7 +191,10 @@ async function phaseConflicts(ctx, service, config, logger, runId, semantic = nu
     `候选冲突：\nid=${p.a.id} | type=${p.a.type} | title=${p.a.title}\n${p.a.content}\n---\nid=${p.b.id} | type=${p.b.type} | title=${p.b.title}\n${p.b.content}\n（相似度 ${p.similarity.toFixed(2)}）`
   ).join("\n\n");
   const sleepEffort = config.sleepReasoningEffort && config.sleepReasoningEffort !== "none" ? config.sleepReasoningEffort : null;
-  const runConflict = (withEffort) => streamText(ctx, {
+  let conflictStreamFailure = "";
+  const runConflict = (withEffort) => {
+    conflictStreamFailure = "";
+    return streamText(ctx, {
     provider: route.provider,
     model: route.model,
     purpose: "sleep-conflict",
@@ -196,9 +204,13 @@ async function phaseConflicts(ctx, service, config, logger, runId, semantic = nu
       { role: "system", content: [{ type: "text", text: CONFLICT_PROMPT }] },
       { role: "user", content: [{ type: "text", text: listText }] }
     ]
-  });
-  const text = await withEffortFallback(ctx, sleepEffort, () => runConflict(true), () => runConflict(false));
-  if (text === undefined) return { status: "failed", error: "llm failed" };
+  }, (reason) => { conflictStreamFailure = describeStreamFailure(reason); });
+  };
+  const text = await withEffortFallback(ctx, sleepEffort, () => runConflict(true), () => runConflict(false), () => conflictStreamFailure);
+  if (text === undefined) {
+    if (conflictStreamFailure) ctx.logger?.warn?.(`dsh-mneme sleep: conflict stream aborted or errored (${conflictStreamFailure})`);
+    return { status: "failed", error: "llm failed" };
+  }
   const decisions = parseJsonArray(text);
   if (!decisions) return { status: "failed", error: "invalid decisions json" };
   // validateDecisions 要求每个 snapshot id 恰好被 claim 一次。v0.4.4 起它本身
@@ -298,7 +310,10 @@ async function phasePatterns(ctx, service, config, logger, runId, signal = null)
     .join("\n");
   const maxPatterns = config.sleepMaxPatternPerRun ?? 3;
   const sleepEffort = config.sleepReasoningEffort && config.sleepReasoningEffort !== "none" ? config.sleepReasoningEffort : null;
-  const runPattern = (withEffort) => streamText(ctx, {
+  let patternStreamFailure = "";
+  const runPattern = (withEffort) => {
+    patternStreamFailure = "";
+    return streamText(ctx, {
     provider: route.provider,
     model: route.model,
     purpose: "sleep-pattern",
@@ -308,9 +323,13 @@ async function phasePatterns(ctx, service, config, logger, runId, signal = null)
       { role: "system", content: [{ type: "text", text: PATTERN_PROMPT.replace("N", String(maxPatterns)) }] },
       { role: "user", content: [{ type: "text", text: listText }] }
     ]
-  });
-  const text = await withEffortFallback(ctx, sleepEffort, () => runPattern(true), () => runPattern(false));
-  if (text === undefined) return { status: "failed", error: "llm failed" };
+  }, (reason) => { patternStreamFailure = describeStreamFailure(reason); });
+  };
+  const text = await withEffortFallback(ctx, sleepEffort, () => runPattern(true), () => runPattern(false), () => patternStreamFailure);
+  if (text === undefined) {
+    if (patternStreamFailure) ctx.logger?.warn?.(`dsh-mneme sleep: pattern stream aborted or errored (${patternStreamFailure})`);
+    return { status: "failed", error: "llm failed" };
+  }
   const decisions = parseJsonArray(text);
   if (!decisions || decisions.length === 0) return { status: "skipped", reason: "no patterns found" };
   // Evidence ids are provenance refs; an LLM-fabricated id would mint a dead