@modusensus/dsh-mneme 0.7.22 → 0.7.24

package/README.en.md

@@ -7,7 +7,7 @@ English | [简体中文](README.md)
 [![npm version](https://img.shields.io/npm/v/@modusensus/dsh-mneme?color=blue&label=npm)](https://www.npmjs.com/package/@modusensus/dsh-mneme)
 [![license](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![Awesome](https://awesome-dsh-plugin.com/badge.svg)](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin)
-[![tests](https://img.shields.io/badge/tests-685%20passed-success)](https://github.com/modusensus/dsh-mneme)
+[![tests](https://img.shields.io/badge/tests-714%20passed-success)](https://github.com/modusensus/dsh-mneme)
 
 > A cross-session memory plugin for DeepSeek Harness: it lets the Agent remember you, remember your projects, and organize memories automatically. **Mneme** (Μνήμη) — named after Mnemosyne, the Greek goddess of memory who presides over memory and dreams, just as autoDream consolidates memories in the background.
 
@@ -58,15 +58,15 @@ English | [简体中文](README.md)
 
 #### dreamMaxTokens Tuning Guide
 
-The default `8192` covers ordinary memory stores. When the **memory volume is large** (tens of thousands of characters or more), the decision list and summary may exceed the default budget; scale it up by size:
+The default `32768` reserves headroom for reasoning models, where reasoning alone may consume 8k+ tokens before any body output. For **larger memory stores** scale it up by size:
 
 | Memory store size | Recommended `dreamMaxTokens` |
 |-----------|----------------------|
-| Ordinary (<10k chars) | `8192` (default) |
+| Ordinary (<10k chars) | `32768` (default) |
 | Medium (10k–50k chars) | `65536` |
 | Large (>50k chars) | `131072` (cap) |
 
-> With **reasoning models** (e.g. DeepSeek-R1-like), the model may spend the entire budget on reasoning and return an empty body (the log shows `no json array in llm output`). In that case, setting `dreamReasoningEffort` to `low` suppresses reasoning overhead and leaves the budget for the body output; the sleep side has the corresponding `sleepReasoningEffort`. The default `none` omits the field entirely, fully honoring the model's own default — behavior identical to earlier versions.
+> With **reasoning models** (e.g. DeepSeek-R1-like), the model may spend the entire budget on reasoning and return an empty body (the log shows `no json array in llm output`). Resolution order: ① set `dreamReasoningEffort` to `low` to suppress reasoning overhead (when the provider rejects the parameter it is stripped automatically and retried once — the rejection reason lands in `llm_audit`; some models, e.g. v4-flash-ga, reject every effort tier); ② if the retry still returns an empty body under the model's default reasoning behavior, raise `dreamMaxTokens` (reasoning and body share this budget) or route `dreamProvider`/`dreamModel` to a non-reasoning model. The sleep side has the corresponding `sleepReasoningEffort`.
 
 ### Sleep Mode: System-Level Sleep 💤 (v0.4.0, opt-in)
 
@@ -166,6 +166,8 @@ Every **background LLM call** (autoDream consolidation + summary, autoSummarize
 
 | Version | Highlights |
 |------|------|
+| **v0.7.24** | Fixed DSH Desktop plugin-tree load crash (v0.7.23 regression): cordis 4's ctx is a Proxy — accessing a property not declared in `inject` throws `cannot get property "webServer" without inject` (not `undefined`), and removing webServer from inject meant cordis no longer waited for the host service, so Desktop crashed on restart; fix: restored webServer to inject (cordis applies the plugin only after the host service is ready) + apply/register guard switched to `ctx.reflect.get` (inject-free read, returns `undefined` when absent, never throws); verified with a real cordis + dsh-host-webserver plugin (API routes 200, unknown path 404, headless silently inactive); 714 tests green |
+| **v0.7.23** | Root-caused "memory consolidation keeps failing": a legal empty decision array `[]` from consolidation is no longer treated as a failure (CONSOLIDATION_PROMPT explicitly allows "no output when nothing needs changing", so a model with a healthy, non-redundant memory legitimately returns `[]` — yet `validateDecisions` hard-rejected it as `decision list must be a non-empty array`, failing the whole run and flooding the audit with failures; **model-agnostic** — ChatGPT/Claude hit the same trap; fix: empty array short-circuits to `ok:true` no-op instead of tripping the implicit-keep coverage check). Plus: empty-body fix part 2 (`dreamMaxTokens` default 8192→32768 so thinking models don't burn the whole budget on reasoning) + skipInvalid splice residue bug (length equality ≠ content equality, skipped decisions leaked into apply/audit); 712 tests green |
 | **v0.7.22** | Restored the v0.6.9 skipInvalid tolerant-validation path (issue #89 regression, lost in the v0.7.11 rewrite): `dreamSkipInvalid` (default true) skips individual invalid decisions, applies the valid subset, and marks the run degraded; `allowCrossTypeMerge` (default false) explicitly relaxes cross-type merging — weak models (e.g. qwen3.8-flash) with jittery schema compliance no longer fail the whole batch and burn LLM calls. Strict mode and the sleep path behave unchanged; global caps/coverage floors still reject the whole run (running over cap = broken model, not minor schema drift). New `dreamMinIntervalMinutes` (0–10080, default 0 = unlimited) minimum autoDream trigger interval — failed/degraded runs also consume the interval (throttling exists to stop back-to-back failing calls); feature_flags whitelist now 34 keys; 696 tests green |
 | **v0.7.21** | Fixed autoDream/sleep effort fallback being dead code on the stream path (the catch-based retry from v0.7.16 never fired): dsh-llm rc.1 turns adapter-stage failures (incl. `UNSUPPORTED_REASONING_EFFORT`) into a terminal error finish chunk instead of a throw; `streamText` now captures the finish-chunk failure cause (`describeStreamFailure` normalizes `{code,message}`) + `withEffortFallback` gains a `getStreamError` accessor (retries without effort when rejected) + `runAuditedLlm` supports `spec.streamError` (audit `error_message` carries the real cause; `run.error` stays a stable `"llm failed"`); 688 tests green |
 | **v0.7.20** | Heat model restored (issue #87): v0.7.0 self-evolving memory back (`src/heat.js` power-law decay `H=1/(1+λΔt)^α` + per-type half-lives), sleep demotion dual protection (cold time-window + heat<0.05 + importance<5), touchRecalled gating back on `heatEnabled`, entity heat projection (ego node heat → size/opacity), recall_runs recording on by default; **default OFF** (matches v0.7.12 behavior out of the box) + feature_flags whitelist rollback switch + lightMode linkage + sleep demotion audit counts exposed (workbench can show "N demoted") + phase-two frontend (/list heat projection, HeatBadge three-tier badge, self-gated status heat-distribution card, order=heat page-local sort, all self-gated); better-sidebar fix (issue #88: soft integration moved to an inner dynamic sub-plugin, no more startup failure without bs); 685 tests green |
@@ -291,7 +293,7 @@ It works out of the box with the defaults. To adjust, override in `~/.dsh/profil
 | `dreamThresholdChars` | `5000` | Total character threshold that triggers consolidation |
 | `dreamDelayMs` | `2000` | Asynchronous consolidation delay (debounce) |
 | `dreamProvider` / `dreamModel` | empty | Explicit dream LLM route — config wins over the agent's default model (config-first, v0.7.16); left empty, the agent's default model is used |
-| `dreamMaxTokens` | `8192` | Maximum tokens per dream LLM call (cap 131072; increase for large memory stores — see the tuning guide below) |
+| `dreamMaxTokens` | `32768` | Maximum tokens per dream LLM call (cap 131072; reasoning and body share this budget on reasoning models — raise it when the body comes back empty, see the tuning guide below) |
 | `dreamReasoningEffort` | `none` | Reasoning-effort passthrough for the dream LLM: `low` / `medium` / `high` / `none` (`none` = omit the field and use the model default; set `low` when a reasoning model exhausts its budget on reasoning and produces an empty body) |
 | `apiToken` | empty | Optional API auth token; once set, write operations and key endpoints require `Authorization: Bearer <apiToken>` |
 | `embedProvider` | `openai` | Semantic backend: `openai` (default, v0.1-compatible) / `local` (ONNX offline) / `ollama` |
@@ -440,7 +442,7 @@ src/
 lib/
 ├── client.js         # Web 面板（手写 ModuleLoader bundle）
 └── *.js              # src 的同步分发产物
-test/                 # 662 node:test tests (audit + three-axis stress invariants)
+test/                 # 714 node:test tests (audit + three-axis stress invariants)
 scripts/              # e2e-dsh.js 端到端演示 · stress-dsh.js 三轴线压测 · sync-lib.js 同步
 ```
 
@@ -449,7 +451,7 @@ scripts/              # e2e-dsh.js 端到端演示 · stress-dsh.js 三轴线压
 ```bash
 cd dsh-mneme
 npm install        # 安装 peer 依赖（以 devDependencies 形式，用于本地测试）
-npm test           # 运行 662 个测试
+npm test           # 运行 714 个测试
 npm run stress     # 三轴线压测：长会话检索 / 冲突仲裁 / 多 Agent 并发（离线 mock LLM）
 npm run sync       # 把 src/ 同步到 lib/（发布时由 prepack 钩子自动执行）
 ```

package/README.md

@@ -5,7 +5,7 @@
 [![npm version](https://img.shields.io/npm/v/@modusensus/dsh-mneme?color=blue&label=npm)](https://www.npmjs.com/package/@modusensus/dsh-mneme)
 [![license](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![Awesome](https://awesome-dsh-plugin.com/badge.svg)](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin)
-[![tests](https://img.shields.io/badge/tests-685%20passed-success)](https://github.com/modusensus/dsh-mneme)
+[![tests](https://img.shields.io/badge/tests-714%20passed-success)](https://github.com/modusensus/dsh-mneme)
 [![CI](https://img.shields.io/github/actions/workflow/status/modusensus/dsh-mneme/ci.yml)](https://github.com/modusensus/dsh-mneme/actions)
 [![node](https://img.shields.io/badge/node-24%2B-blue)](https://nodejs.org)
 [![npm downloads](https://img.shields.io/npm/dm/@modusensus/dsh-mneme?color=blue&label=downloads)](https://www.npmjs.com/package/@modusensus/dsh-mneme)
@@ -81,15 +81,15 @@ dsh web
 
 #### dreamMaxTokens 调优指南
 
-默认 `8192` 已覆盖常规记忆库。当**记忆量大**（数万字符以上）时，决策清单与摘要可能超过默认预算，建议按规模调大：
+默认 `32768` 已为思考型模型预留推理+正文的双重预算（部分思考型模型仅推理就可能消耗 8k+ token）。当**记忆量大**（数万字符以上）时按规模继续调大：
 
 | 记忆库规模 | 建议 `dreamMaxTokens` |
 |-----------|----------------------|
-| 常规（<1 万字） | `8192`（默认） |
+| 常规（<1 万字） | `32768`（默认） |
 | 中等（1 万-5 万字） | `65536` |
 | 大型（5 万字以上） | `131072`（上限） |
 
-> 若使用**思考型模型**（如 deepseek-v4-flash / DeepSeek-R1 类），模型可能把全部预算花在 reasoning 上导致正文为空（日志出现 `no json array in llm output`，v0.7.16 已修复）。此时把 `dreamReasoningEffort` 设为 `low` 显式压低思考（`none` 默认不传该字段，完全沿用模型自身默认，行为与旧版本一致）；即使被方舟拒绝该参数，v0.7.16 起也会自动去掉重试一次。sleep 侧对应 `sleepReasoningEffort`。
+> 若使用**思考型模型**（如 deepseek-v4-flash / DeepSeek-R1 类），模型可能把全部预算花在 reasoning 上导致正文为空（日志出现 `no json array in llm output`）。处理顺序：① 把 `dreamReasoningEffort` 设为 `low` 显式压低思考（被方舟拒绝该参数时自动去掉重试一次，拒绝原因会记入 llm_audit——部分模型如 v4-flash-ga 不支持任何 effort 档位）；② 重试走模型默认思考行为后正文仍为空的，调大 `dreamMaxTokens`（reasoning 与正文共享该预算）或配置 `dreamProvider`/`dreamModel` 指向非思考模型。sleep 侧对应 `sleepReasoningEffort`。
 
 ### Sleep Mode 系统级睡眠 💤（v0.4.0，opt-in）
 
@@ -207,6 +207,8 @@ v0.3.0 起新增**记忆基因**层：从记忆里抽取**命名实体**、**带
 
 | 版本 | 亮点 |
 |------|------|
+| **v0.7.24** | 修复 DSH Desktop 插件树加载崩溃（v0.7.23 回归）：cordis 4 的 ctx 是 Proxy，访问未在 inject 声明的 `webServer` 会抛 `cannot get property without inject`（而非返回 undefined），且去掉 inject 后 cordis 不再等待宿主服务 → 桌面端重启即崩；修复：恢复 webServer 到 inject（cordis 等宿主就绪再 apply）+ apply/register 守卫改 `ctx.reflect.get`（免 inject 读取、未提供返回 undefined 不抛错）；真实 cordis + dsh-host-webserver 插件实测；714 测试全绿 |
+| **v0.7.23** | 记忆沉淀「反复失败」根治：consolidation 合法空数组 `[]` 不再误判 failed（CONSOLIDATION_PROMPT 允许「无问题无需输出」，模型无冗余时合法返回 `[]`——此前 `validateDecisions` 硬判 non-empty → 整单 failed、审计反复失败，且与模型无关，ChatGPT/Claude 同样踩中；修复：空数组显式短路 `ok:true` no-op）+ 空体修复第二段（`dreamMaxTokens` 默认 8192→32768，思考模型推理烧光预算的根治余量，设置面板可调）+ skipInvalid splice 残留 bug（长度相等≠内容一致，被跳决策残留）；712 测试全绿 |
 | **v0.7.22** | 恢复 v0.6.9 的 skipInvalid 宽容校验路径（issue #89 回归，v0.7.11 重写丢失）：`dreamSkipInvalid`（默认 true）单条非法决策跳过 + 合法子集应用 + run 记 degraded，`allowCrossTypeMerge`（默认 false）显式放宽跨类型合并——弱模型（如 qwen3.8-flash）决策合规抖动不再整单拒绝白烧 LLM 调用；严格模式/sleep 路径行为不变，全局上限/覆盖率下限仍整单拒绝（刷爆上限=模型坏了，非轻微 schema 漂移）；新增 `dreamMinIntervalMinutes`（0-10080，默认 0=不限）autoDream 最小触发间隔，失败/degraded run 也占用间隔（节流防失败调用连发）；feature_flags 白名单 34 键；696 测试全绿 |
 | **v0.7.21** | 修复 autoDream/sleep 的 effort 回退在流式路径失效（v0.7.16 的 catch 式回退是死代码）：dsh-llm rc.1 把 adapter 阶段异常（含 `UNSUPPORTED_REASONING_EFFORT`）转成终态 error finish chunk 不再抛出；`streamText` 现捕获 finish-chunk 失败原因（新增 `describeStreamFailure` 归一化 `{code,message}`）+ `withEffortFallback` 增加 `getStreamError` 访问器（effort 被拒时去掉重试一次）+ `runAuditedLlm` 支持 `spec.streamError`（audit 行 `error_message` 携带真实原因，`run.error` 稳定 `"llm failed"` 不变）；688 测试全绿 |
 | **v0.7.20** | heat 热度模型回归（issue #87）：找回 v0.7.0 自进化记忆（`src/heat.js` 幂律衰减 `H=1/(1+λΔt)^α` + per-type 差异化半衰期）、sleep 降级热联合双保护（时间窗冷 + heat<0.05 + importance<5）、touchRecalled 门控改回 `heatEnabled`、实体热投影（ego 节点 heat → 前端大小/明暗）、recall_runs 默认记录；**默认关**（默认=与 v0.7.12 行为一致）+ feature_flags 白名单回滚开关 + lightMode 联动 + sleep 降级审计计数暴露（工作动态可展示"降级 N 条"）+ 阶段二前端（/list heat 投影、HeatBadge 三档徽章、状态页热度分布卡、order=heat 页内排序，全部自门控）；better-sidebar 修复（issue #88：软集成改内层动态子插件，无 bs 环境不再启动失败）；685 测试全绿 |
@@ -292,6 +294,8 @@ v0.3.0 起新增**记忆基因**层：从记忆里抽取**命名实体**、**带
 | **v0.7.18** | ✅ 完成 | 生态第一步 + 查询收敛 | better-sidebar 软集成（inject 声明 + optional peer `dsh-better-sidebar` + registerTab 复用四视图，未装安全跳过；窄容器 `@container` 适配）+ `/list?deposited=only` 沉淀视图（receipt_chain ∪ source=dream）+ 记忆库沉淀/已归档筛选 chip + 状态页仪表盘化（统计 + 查看全部跳转预置筛选）+ 抽屉归档记忆「恢复」；667 测试全绿 |
 | **v0.7.20** | ✅ 完成 | heat 回归 + 阶段二前端 + better-sidebar 修复 | heat 热度模型完整找回（issue #87，v0.7.10 移植：幂律衰减 + TYPE_DECAY + sleep 热联合双保护 + 实体热投影）+ 验收清单落地（heatEnabled 默认关 / feature_flags 31 键 / lightMode 联动 / sleep 降级审计暴露 / updated_at⊥last_accessed_at 契约）+ 阶段二前端（/list heat 投影、HeatBadge 三档、order=heat 页内排序）+ better-sidebar 修复（issue #88：内层动态子插件）；685 测试全绿 |
 | **v0.7.21** | ✅ 完成 | effort 回退流式修复 | autoDream/sleep 的 catch 式 effort 回退在流式路径是死代码（dsh-llm rc.1 把 adapter 异常转成终态 error finish chunk 不再抛出）→ `streamText` 捕获 finish-chunk 失败原因（`describeStreamFailure` 归一化）+ `withEffortFallback` 增加 `getStreamError` 访问器（effort 被拒去重试）+ `runAuditedLlm` 支持 `spec.streamError`（audit 记真实原因）；688 测试全绿 |
+| **v0.7.24** | ✅ 完成 | 桌面端崩溃紧急修复 | v0.7.23 把 webServer 移出 inject 致 cordis Proxy 抛 `cannot get property "webServer" without inject`（未注入属性直接访问抛错而非 undefined），桌面端重启插件树加载失败；修复：恢复 webServer 到 inject（cordis 等宿主就绪再 apply）+ apply/register 守卫改 `ctx.reflect.get`（免 inject 读取、未提供返回 undefined 不抛错，未来 headless 移出 inject 也安全）；真实 cordis + dsh-host-webserver 实测 API 路由 200 / 未知路径 404 / headless 静默不激活；714 测试全绿 |
+| **v0.7.23** | ✅ 完成 | 记忆沉淀「反复失败」根治 + 空体第二段 + skipInvalid splice 修复 | consolidation 合法空数组 `[]` no-op（CONSOLIDATION_PROMPT 允许无问题无需输出；此前 validateDecisions 硬判 non-empty → 整单 failed，模型无关、ChatGPT/Claude 同样踩中；修复：空数组显式短路 ok，不再触发隐式 keep 覆盖率误判）；`dreamMaxTokens` 默认 8192→32768（思考模型推理烧光预算根治余量）；skipInvalid splice 残留 bug（长度相等≠内容一致，被跳决策残留进 apply）；712 测试全绿 |
 | **v0.7.22** | ✅ 完成 | skipInvalid 宽容校验回归（issue #89）+ autoDream 节流 | 恢复 v0.6.9 的 skipInvalid 双轨结构（v0.7.11 重写丢失）：`dreamSkipInvalid` 单条非法决策跳过 + 合法子集应用 + run 记 degraded，`allowCrossTypeMerge` 显式放宽跨类型合并；弱模型（qwen3.8-flash）决策合规抖动不再整单拒绝；新增 `dreamMinIntervalMinutes`（0-10080，默认 0=不限）最小触发间隔，失败/degraded run 也占用间隔；严格模式/sleep 路径行为不变；feature_flags 白名单 34 键；696 测试全绿 |
 | **v0.8.0** | 🚧 计划中（9 月末） | 图谱增强 | 兴趣漂移可视化 + scope 隔离（issue #17）+ 跨 workspace 记忆共享 |
 
@@ -363,7 +367,7 @@ dsh web
 | `dreamThresholdChars` | `5000` | 触发整理的总字符阈值 |
 | `dreamDelayMs` | `2000` | 整理异步延迟（去抖） |
 | `dreamProvider` / `dreamModel` | 空 | dream 的 LLM 路由覆盖（显式配置优先于 agent 默认模型；留空则回退到 agent 默认模型） |
-| `dreamMaxTokens` | `8192` | dream LLM 调用最大 token 数（上限 131072；大记忆量建议调大，见下方调优指南） |
+| `dreamMaxTokens` | `32768` | dream LLM 调用最大 token 数（上限 131072；思考型模型的 reasoning 与正文共享该预算，正文为空时优先调大，见下方调优指南） |
 | `dreamReasoningEffort` | `none` | dream LLM 推理强度透传：`low` / `medium` / `high` / `none`（`none`=不传该字段，沿用模型默认；思考型模型（如 deepseek-v4-flash）想压低思考可设 `low`；被方舟拒绝该参数时 v0.7.16 起自动去掉重试一次） |
 | `apiToken` | 空 | 可选 API 鉴权 token；设置后写操作与密钥接口要求 `Authorization: Bearer <apiToken>` |
 | `embedProvider` | `openai` | 语义后端：`openai`（默认，兼容 v0.1）/ `local`（ONNX 离线）/ `ollama` |
@@ -527,7 +531,7 @@ src/
 ├── api.js            # HTTP 路由（Web 面板数据通道）
 └── index.js          # 插件接线
 lib/                  # src 的同步分发产物（npm run sync；发布前由 root prepack 的 check-sync.js 校验一致性；唯一手写例外 lib/client.js——Web 面板 bundle，sync 不覆盖）
-test/                 # 662 个 node:test 测试（审计与三轴线压测不变量；src↔lib 一致性由 scripts/check-sync.js 发布闸门校验）
+test/                 # 714 个 node:test 测试（审计与三轴线压测不变量；src↔lib 一致性由 scripts/check-sync.js 发布闸门校验）
 scripts/              # e2e-dsh.js 端到端演示 · stress-dsh.js 三轴线压测 · sync-lib.js 同步 · check-sync.js 发布闸门 · benchmark-recall.js 召回基准
 ```
 
@@ -536,7 +540,7 @@ scripts/              # e2e-dsh.js 端到端演示 · stress-dsh.js 三轴线压
 ```bash
 cd dsh-mneme
 npm install        # 安装 peer 依赖（以 devDependencies 形式，用于本地测试）
-npm test           # 运行 662 个测试
+npm test           # 运行 714 个测试
 npm run stress     # 三轴线压测：长会话检索 / 冲突仲裁 / 多 Agent 并发（离线 mock LLM）
 npm run sync       # 把 src/ 同步到 lib/（发布时由 prepack 钩子自动执行）
 ```

package/lib/api.js

@@ -98,6 +98,14 @@ function parseBody(text) {
 export function createApi(ctx, service, settings, commands, embedder, semantic = null, apiToken = "", config = null) {
   const disposers = [];
 
+  // webServer 在 index.js 的 inject 声明中（cordis 等宿主服务就绪后 apply），
+  // 这里做防御性读取：cordis ctx 的 Proxy 不允许直接访问未 inject 的属性
+  // （会抛 "cannot get property without inject"），用 ctx.reflect.get 免
+  // inject 读取（未提供返回 undefined）；对象字面量 mock ctx（测试）没有
+  // reflect，退回直接属性访问。createApi 只在有 webServer 时被调用（index.js
+  // 守卫 + 测试 mock），故下方 register 用之非空。
+  const webServer = typeof ctx.reflect?.get === "function" ? ctx.reflect.get("webServer") : ctx.webServer;
+
   // feature flags 快照（GET/PUT 共用）：overrides 是持久化的用户显式覆盖；
   // effective 是启动配置在白名单键上被 overrides 覆盖后的最终值。config 缺席
   // （旧调用方直连、未传 cfg）时只报被覆盖的键，不把不存在的默认值编造给前端。
@@ -140,7 +148,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   }
 
   const register = (route) => {
-    disposers.push(ctx.webServer.register(route));
+    disposers.push(webServer.register(route));
   };
 
   // /api/dsh-mneme prefix fallback → 404 JSON for unknown sub-paths

package/lib/config.js

@@ -54,7 +54,7 @@ export const Config = z.object({
   dreamMinIntervalMinutes: z.natural().min(0).max(10080).default(0),
   dreamProvider: z.string(),
   dreamModel: z.string(),
-  dreamMaxTokens: z.natural().min(256).max(131072).default(8192),
+  dreamMaxTokens: z.natural().min(256).max(131072).default(32768),
   // Pass-through reasoning effort for dream's LLM calls. 'none' (default)
   // omits the field so the provider's own default applies; low/medium/high
   // are forwarded verbatim. Useful to cap reasoning spend on thinking-type

package/lib/dream/decisions.js

@@ -25,8 +25,15 @@ export function validateDecisions(decisions, snapshot, options = {}) {
   const skipInvalid = options.skipInvalid === true;
   const maxUpdatePerRun = options.maxUpdatePerRun ?? 2;
   const minAgeHours = options.minAgeHours ?? 24;
-  if (!Array.isArray(decisions) || decisions.length === 0) {
-    return { ok: false, errors: ["decision list must be a non-empty array"] };
+  if (!Array.isArray(decisions)) {
+    return { ok: false, errors: ["decision list must be an array"] };
+  }
+  // 空决策 = 模型完整评估后确认无需操作（CONSOLIDATION_PROMPT 明确允许"无问题的
+  // 条目无需输出"）。合法 JSON [] 不是空体（那是无输出/截断），也不是"残缺输出"
+  // ——显式短路直接 ok，避免隐式 keep 的覆盖率检查把 0% 误判为模型坏了。与
+  // sleep 的空模式（skipped no-op）语义对齐：下游 applied=0、audit 记 ok。
+  if (decisions.length === 0) {
+    return { ok: true, errors: [], skipped: [] };
   }
   const claimed = new Set();
   for (const [index, d] of decisions.entries()) {
@@ -183,10 +190,10 @@ export function validateDecisions(decisions, snapshot, options = {}) {
   }
   // 调用方下游（apply/audit）复用同一 decisions 引用：就地同步为 survivors——
   // 在 skipInvalid 模式下去掉被跳过的非法决策；在隐式 keep 下追加补齐的 keep。
-  // 内容一致时（无跳过、无补齐）为 no-op。
-  if (survivors.length !== decisions.length) {
-    decisions.splice(0, decisions.length, ...survivors);
-  }
+  // 不能以 survivors.length !== decisions.length 作为是否 splice 的判据：
+  // 当"被跳过的非法决策数 == 隐式补齐的 keep 数"时长度回到相等但内容已变，
+  // 被跳过的决策会残留进 apply/audit。一律无条件 splice 最安全。
+  decisions.splice(0, decisions.length, ...survivors);
   return { ok: true, errors, skipped };
 }
 

package/lib/index.js

@@ -21,7 +21,13 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 
 export const name = "dsh-mneme";
-export const inject = ["tools", "systemPrompt", "webServer", "llm", "agentDefaultModel", "commands"];
+// webServer 在 inject 声明中：cordis 会等宿主 webServer 服务激活后才 apply 本
+// 插件，保证 apply 时路由注册不落时序（v0.7.23 曾移出 inject 想支持 headless，
+// 结果 cordis 不再等待，apply 时宿主 webServer 未就绪 → 桌面端 "cannot get
+// property without inject" 崩溃）。守卫用 ctx.reflect.get（免 inject 读取，
+// 未提供返回 undefined）而非 if (ctx.webServer)：直接访问未注入属性在 cordis
+// Proxy 下会抛错而非返回 undefined。
+export const inject = ["tools", "systemPrompt", "llm", "agentDefaultModel", "commands", "webServer"];
 export { Config };
 
 // Arrow (not function declaration): cordis 4 treats any apply with a
@@ -359,7 +365,14 @@ export const apply = (ctx, config) => {
   const summarizer = createSummarizer(ctx, service, cfg);
   disposers.push(summarizer.dispose);
 
-  if (ctx.webServer) {
+  // webServer 可选依赖：cordis 4 的 ctx 是 Proxy，直接访问未在 inject 声明的
+  // 属性会抛 "cannot get property without inject"（不会返回 undefined），所以
+  // 不能用 if (ctx.webServer) 守卫。ctx.reflect.get 是 cordis 提供的免 inject
+  // 读取（未提供时返回 undefined）；对象字面量 mock ctx（测试）没有 reflect，
+  // 退回直接属性访问。headless/无 UI 宿主无 webServer 时跳过 API 注册，其余
+  // 功能（工具/注入/dream）照常。
+  const webServer = typeof ctx.reflect?.get === "function" ? ctx.reflect.get("webServer") : ctx.webServer;
+  if (webServer) {
     const api = createApi(ctx, service, settings, commands ?? {
       add: () => { throw new Error("commands unavailable"); },
       remove: () => false,

package/lib/settings.js

@@ -74,7 +74,8 @@ const FEATURE_FLAG_INT_RANGES = {
   distillRateLimitBaseDelayMs: [100, 60000],
   distillMaxChars: [1000, 200000],
   codingBoostFactor: [1, 5],
-  dreamMinIntervalMinutes: [0, 10080]
+  dreamMinIntervalMinutes: [0, 10080],
+  dreamMaxTokens: [256, 131072]
 };
 // 自由字符串开关（与 config.js 的 z.string() 同名同型）：trim 后 ≤200 字符，
 // 空串合法（= 跟随主对话模型/默认路径，面板显示 placeholder）。

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@modusensus/dsh-mneme",
   "description": "Cross-session memory plugin for DeepSeek Harness with autoDream consolidation: SQLite store, Markdown mirrors, 7 model tools, automatic injection, session summarization, user profile/rules, custom slash commands, vector (semantic) search, and a Web GUI panel",
-  "version": "0.7.22",
+  "version": "0.7.24",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/api.js

@@ -98,6 +98,14 @@ function parseBody(text) {
 export function createApi(ctx, service, settings, commands, embedder, semantic = null, apiToken = "", config = null) {
   const disposers = [];
 
+  // webServer 在 index.js 的 inject 声明中（cordis 等宿主服务就绪后 apply），
+  // 这里做防御性读取：cordis ctx 的 Proxy 不允许直接访问未 inject 的属性
+  // （会抛 "cannot get property without inject"），用 ctx.reflect.get 免
+  // inject 读取（未提供返回 undefined）；对象字面量 mock ctx（测试）没有
+  // reflect，退回直接属性访问。createApi 只在有 webServer 时被调用（index.js
+  // 守卫 + 测试 mock），故下方 register 用之非空。
+  const webServer = typeof ctx.reflect?.get === "function" ? ctx.reflect.get("webServer") : ctx.webServer;
+
   // feature flags 快照（GET/PUT 共用）：overrides 是持久化的用户显式覆盖；
   // effective 是启动配置在白名单键上被 overrides 覆盖后的最终值。config 缺席
   // （旧调用方直连、未传 cfg）时只报被覆盖的键，不把不存在的默认值编造给前端。
@@ -140,7 +148,7 @@ export function createApi(ctx, service, settings, commands, embedder, semantic =
   }
 
   const register = (route) => {
-    disposers.push(ctx.webServer.register(route));
+    disposers.push(webServer.register(route));
   };
 
   // /api/dsh-mneme prefix fallback → 404 JSON for unknown sub-paths

package/src/config.js

@@ -54,7 +54,7 @@ export const Config = z.object({
   dreamMinIntervalMinutes: z.natural().min(0).max(10080).default(0),
   dreamProvider: z.string(),
   dreamModel: z.string(),
-  dreamMaxTokens: z.natural().min(256).max(131072).default(8192),
+  dreamMaxTokens: z.natural().min(256).max(131072).default(32768),
   // Pass-through reasoning effort for dream's LLM calls. 'none' (default)
   // omits the field so the provider's own default applies; low/medium/high
   // are forwarded verbatim. Useful to cap reasoning spend on thinking-type

package/src/dream/decisions.js

@@ -25,8 +25,15 @@ export function validateDecisions(decisions, snapshot, options = {}) {
   const skipInvalid = options.skipInvalid === true;
   const maxUpdatePerRun = options.maxUpdatePerRun ?? 2;
   const minAgeHours = options.minAgeHours ?? 24;
-  if (!Array.isArray(decisions) || decisions.length === 0) {
-    return { ok: false, errors: ["decision list must be a non-empty array"] };
+  if (!Array.isArray(decisions)) {
+    return { ok: false, errors: ["decision list must be an array"] };
+  }
+  // 空决策 = 模型完整评估后确认无需操作（CONSOLIDATION_PROMPT 明确允许"无问题的
+  // 条目无需输出"）。合法 JSON [] 不是空体（那是无输出/截断），也不是"残缺输出"
+  // ——显式短路直接 ok，避免隐式 keep 的覆盖率检查把 0% 误判为模型坏了。与
+  // sleep 的空模式（skipped no-op）语义对齐：下游 applied=0、audit 记 ok。
+  if (decisions.length === 0) {
+    return { ok: true, errors: [], skipped: [] };
   }
   const claimed = new Set();
   for (const [index, d] of decisions.entries()) {
@@ -183,10 +190,10 @@ export function validateDecisions(decisions, snapshot, options = {}) {
   }
   // 调用方下游（apply/audit）复用同一 decisions 引用：就地同步为 survivors——
   // 在 skipInvalid 模式下去掉被跳过的非法决策；在隐式 keep 下追加补齐的 keep。
-  // 内容一致时（无跳过、无补齐）为 no-op。
-  if (survivors.length !== decisions.length) {
-    decisions.splice(0, decisions.length, ...survivors);
-  }
+  // 不能以 survivors.length !== decisions.length 作为是否 splice 的判据：
+  // 当"被跳过的非法决策数 == 隐式补齐的 keep 数"时长度回到相等但内容已变，
+  // 被跳过的决策会残留进 apply/audit。一律无条件 splice 最安全。
+  decisions.splice(0, decisions.length, ...survivors);
   return { ok: true, errors, skipped };
 }
 

package/src/index.js

@@ -21,7 +21,13 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 
 export const name = "dsh-mneme";
-export const inject = ["tools", "systemPrompt", "webServer", "llm", "agentDefaultModel", "commands"];
+// webServer 在 inject 声明中：cordis 会等宿主 webServer 服务激活后才 apply 本
+// 插件，保证 apply 时路由注册不落时序（v0.7.23 曾移出 inject 想支持 headless，
+// 结果 cordis 不再等待，apply 时宿主 webServer 未就绪 → 桌面端 "cannot get
+// property without inject" 崩溃）。守卫用 ctx.reflect.get（免 inject 读取，
+// 未提供返回 undefined）而非 if (ctx.webServer)：直接访问未注入属性在 cordis
+// Proxy 下会抛错而非返回 undefined。
+export const inject = ["tools", "systemPrompt", "llm", "agentDefaultModel", "commands", "webServer"];
 export { Config };
 
 // Arrow (not function declaration): cordis 4 treats any apply with a
@@ -359,7 +365,14 @@ export const apply = (ctx, config) => {
   const summarizer = createSummarizer(ctx, service, cfg);
   disposers.push(summarizer.dispose);
 
-  if (ctx.webServer) {
+  // webServer 可选依赖：cordis 4 的 ctx 是 Proxy，直接访问未在 inject 声明的
+  // 属性会抛 "cannot get property without inject"（不会返回 undefined），所以
+  // 不能用 if (ctx.webServer) 守卫。ctx.reflect.get 是 cordis 提供的免 inject
+  // 读取（未提供时返回 undefined）；对象字面量 mock ctx（测试）没有 reflect，
+  // 退回直接属性访问。headless/无 UI 宿主无 webServer 时跳过 API 注册，其余
+  // 功能（工具/注入/dream）照常。
+  const webServer = typeof ctx.reflect?.get === "function" ? ctx.reflect.get("webServer") : ctx.webServer;
+  if (webServer) {
     const api = createApi(ctx, service, settings, commands ?? {
       add: () => { throw new Error("commands unavailable"); },
       remove: () => false,

package/src/settings.js

@@ -74,7 +74,8 @@ const FEATURE_FLAG_INT_RANGES = {
   distillRateLimitBaseDelayMs: [100, 60000],
   distillMaxChars: [1000, 200000],
   codingBoostFactor: [1, 5],
-  dreamMinIntervalMinutes: [0, 10080]
+  dreamMinIntervalMinutes: [0, 10080],
+  dreamMaxTokens: [256, 131072]
 };
 // 自由字符串开关（与 config.js 的 z.string() 同名同型）：trim 后 ≤200 字符，
 // 空串合法（= 跟随主对话模型/默认路径，面板显示 placeholder）。

package/test/api.test.js

@@ -527,14 +527,16 @@ test("GET /api/dsh-mneme/features returns empty overrides and effective config d
   assert.equal(res.statusCode, 200);
   const data = JSON.parse(res.body);
   assert.deepEqual(data.overrides, {});
-  // effective 覆盖全部 34 个白名单键（含 v0.7.20 heatEnabled 与 Issue #89 回归
-  // 修复新增的 dreamSkipInvalid/allowCrossTypeMerge/dreamMinIntervalMinutes），
-  // 未覆盖时取 bundle 配置的解析默认值；dreamProvider/dreamModel 无 schema
-  // 默认值（Config({}) 解析为 undefined），不编造给前端 → 34 - 2 = 32
-  assert.equal(Object.keys(data.effective).length, 32);
+  // effective 覆盖全部 35 个白名单键（含 v0.7.20 heatEnabled、Issue #89 新增
+  // dreamSkipInvalid/allowCrossTypeMerge/dreamMinIntervalMinutes 与本轮补入面板
+  // 的 dreamMaxTokens），未覆盖时取 bundle 配置的解析默认值；
+  // dreamProvider/dreamModel 无 schema 默认值（Config({}) 解析为 undefined），
+  // 不编造给前端 → 35 - 2 = 33
+  assert.equal(Object.keys(data.effective).length, 33);
   assert.equal(data.effective.dreamSkipInvalid, true);
   assert.equal(data.effective.allowCrossTypeMerge, false);
   assert.equal(data.effective.dreamMinIntervalMinutes, 0);
+  assert.equal(data.effective.dreamMaxTokens, 32768);
   assert.equal(data.effective.autoInject, true);
   assert.equal(data.effective.codingRetrospect, false);
   assert.equal(data.effective.distillMaxChars, 24000);

package/test/dream.test.js

@@ -62,10 +62,13 @@ test("archived or summary entries cannot be decision targets", () => {
   assert.equal(ok, false);
 });
 
-test("empty decision list rejects", () => {
-  const { ok, errors } = validateDecisions([], snapshot(["a"]));
-  assert.equal(ok, false);
-  assert.ok(errors.some((e) => e.includes("non-empty array")));
+test("empty decision list is a no-op success (model: nothing to consolidate)", () => {
+  // 合法 JSON [] 是模型完整评估后确认无需操作（CONSOLIDATION_PROMPT 允许空输出），
+  // 不是空体/截断——显式短路 ok，避免隐式 keep 的覆盖率检查误判 0% 为失败。
+  const { ok, errors, skipped } = validateDecisions([], snapshot(["a"]));
+  assert.equal(ok, true);
+  assert.deepEqual(errors, []);
+  assert.deepEqual(skipped, []);
 });
 
 test("empty ids rejects", () => {
@@ -825,7 +828,9 @@ test("consolidation prompt pins the decision schema (action field, single-string
     logger: { warn: () => {} },
     llm: {
       async *stream(options) {
-        systemText = options.messages.find((m) => m.role === "system")?.content?.[0]?.text ?? "";
+        // 只捕获第一次调用（consolidation）的 system 文本：空数组现在走 no-op 成功、
+        // summary 会照常跑并覆盖 systemText，所以最后一次调用捕获到的是 SUMMARY_PROMPT。
+        if (!systemText) systemText = options.messages.find((m) => m.role === "system")?.content?.[0]?.text ?? "";
         yield { type: "text-delta", text: "[]" };
         yield { type: "finish", reason: { kind: "ok" } };
       }

package/test/reasoning-effort.test.js

@@ -8,7 +8,7 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import { Config } from "../src/config.js";
-import { createDreamScheduler } from "../src/dream.js";
+import { createDreamScheduler, parseReceipt } from "../src/dream.js";
 import { runSleep } from "../src/dream/sleep.js";
 import { createStore } from "../src/store.js";
 import { createService } from "../src/service.js";
@@ -24,12 +24,20 @@ const embedder = {
 
 // ---------------------------------------------------------------- config schema
 
-test("issue#9: dreamMaxTokens accepts the widened 131072 cap and defaults to 4096", () => {
-  assert.equal(Config({}).dreamMaxTokens, 8192, "default unchanged");
+test("issue#9: dreamMaxTokens defaults to 32768 and accepts values up to 131072", () => {
+  assert.equal(Config({}).dreamMaxTokens, 32768, "default raised for thinking-model headroom");
   assert.equal(Config({ dreamMaxTokens: 131072 }).dreamMaxTokens, 131072, "new upper bound accepted");
   assert.equal(Config({ dreamMaxTokens: 65536 }).dreamMaxTokens, 65536, "intermediate value accepted");
 });
 
+test("issue#9: dreamMaxTokens clamps to [256, 131072], out-of-range values are rejected", () => {
+  assert.equal(Config({ dreamMaxTokens: 256 }).dreamMaxTokens, 256, "lower bound accepted");
+  assert.equal(Config({ dreamMaxTokens: 100000 }).dreamMaxTokens, 100000, "raised default tier accepted");
+  assert.throws(() => Config({ dreamMaxTokens: 255 }), "below min rejected");
+  assert.throws(() => Config({ dreamMaxTokens: 131073 }), "above max rejected");
+  assert.throws(() => Config({ dreamMaxTokens: 0 }), "zero rejected");
+});
+
 test("issue#9: reasoningEffort config defaults to none and rejects unknown values", () => {
   const cfg = Config({});
   assert.equal(cfg.dreamReasoningEffort, "none");
@@ -107,6 +115,63 @@ test("issue#9: dream forwards dreamReasoningEffort on both LLM calls", async ()
   store.close();
 });
 
+test("issue#9: dreamMaxTokens is forwarded as maxTokens on consolidation and summary calls", async () => {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const dream = createDreamScheduler({ onRun: () => Promise.resolve({ ok: true, skipped: true }) });
+  const { memory: a } = service.saveWithDedupe({ type: "project", title: "插件", content: "旧", importance: 3 });
+  const { memory: b } = service.saveWithDedupe({ type: "project", title: "插件2", content: "新细节", importance: 4 });
+  const captured = [];
+  const ctx = dreamCtx({
+    captured,
+    onConsolidation: () => JSON.stringify([
+      { action: "merge", ids: [a.id, b.id], keepSource: b.id, title: "插件总览", content: "合并内容", importance: 4 }
+    ])
+  });
+  const result = await dream.runDream(ctx, service, { dreamMaxTokens: 100000 });
+  assert.equal(result.ok, true);
+  assert.equal(captured.length, 2, "consolidation + summary both hit the LLM");
+  for (const options of captured) {
+    assert.equal(options.maxTokens, 100000, `raised budget forwarded on ${options.purpose}`);
+  }
+  store.close();
+});
+
+test("issue#9: thinking-model empty body (no text emitted, budget burnt on reasoning) fails as no json array", async () => {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  service.saveWithDedupe({ type: "preference", title: "语言", content: "中文" });
+  const dream = createDreamScheduler({ thresholdCount: 1, thresholdChars: 0, delayMs: 0 });
+  const ctx = dreamCtx({ onConsolidation: () => "" }); // 思考型模型把预算烧光 → 无正文
+  const result = await dream.runDream(ctx, service, { dreamMaxTokens: 32768 });
+  assert.equal(result.ok, false, "empty body is a hard failure, never faked ok");
+  assert.match(result.error, /no json array/);
+  const run = store.listDreamRuns()[0];
+  assert.equal(run.status, "failed", "audit row records failed");
+  assert.match(run.error, /no json array/, "audit error_message carries the empty-body cause");
+  assert.equal(parseReceipt(run.receipt).status, "failed", "receipt records failed");
+  store.close();
+});
+
+test("legal empty decision list [] is a no-op success, not a failure", async () => {
+  // 真实模型在记忆无冗余时合法输出 []（CONSOLIDATION_PROMPT 允许"无问题无需输出"），
+  // 此前被 validateDecisions 判 failed → 审计表反复失败。现在应 ok:true、applied 0、
+  // 审计记 ok，且 summary 照常产出。
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  service.saveWithDedupe({ type: "project", title: "插件", content: "内容", importance: 3 });
+  const dream = createDreamScheduler({ thresholdCount: 1, thresholdChars: 0, delayMs: 0 });
+  const ctx = dreamCtx({ onConsolidation: () => "[]" }); // 模型：无需合并
+  const result = await dream.runDream(ctx, service, { dreamMaxTokens: 32768 });
+  assert.equal(result.ok, true, "empty [] is a valid no-op, never failed");
+  assert.equal(result.applied, 0, "no decisions to apply");
+  assert.equal(result.summary, true, "summary still produced");
+  const run = store.listDreamRuns()[0];
+  assert.equal(run.status, "ok", "audit row records ok, not failed");
+  assert.equal(parseReceipt(run.receipt).status, "ok", "receipt records ok");
+  store.close();
+});
+
 test("issue#25: dreamProvider/dreamModel config wins over the agentDefaultModel route", async () => {
   const store = createStore(":memory:");
   const service = createService({ store, mirror: null, config: {} });

package/test/skip-invalid-restore.test.js

@@ -0,0 +1,260 @@
+// --- Issue #89 恢复功能的全量单测（v0.7.22）----------------------------------
+// v0.7.22 把 v0.6.9（Issue #26）的 skipInvalid 宽容校验路径原样搬回。核心行为
+// 契约：单条非法决策只跳过该条（记入 skipped、不 claim 任何 id），合法子集照常
+// 应用、run 记 degraded；但全局信号（update/create 上限、显式覆盖率下限）不受
+// 该开关影响、始终整单拒绝。以下测试逐条锁死恢复后的分支：非法动作按原因分类
+// 跳过（create/unknown/archived/summary/重复 claim/merge 参数/update 参数/
+// conflict 参数）、skipInvalid 与覆盖率下限/上限/allowCrossTypeMerge 的交互，
+// 以及 runDream 层"全非法仍 failed / 部分非法 degraded 如实进审计"。
+import test from "node:test";
+import assert from "node:assert/strict";
+import { validateDecisions, createDreamScheduler, parseReceipt } from "../src/dream.js";
+import { createStore } from "../src/store.js";
+import { createService } from "../src/service.js";
+import { mockCtx } from "./helpers/dream-mock.js";
+
+function dreamSetup() {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  return { store, service };
+}
+
+// 合法记忆快照工厂：id 首字母作 type 前缀（p=preference / 其余 project），
+// created_at 默认 2020 年（保证 update 保护期检查放行）。
+function makeSnap(ids) {
+  return new Map(ids.map((id) => [
+    id,
+    {
+      id,
+      type: id.startsWith("p") ? "preference" : "project",
+      title: `标题${id}`,
+      content: `内容${id}`,
+      importance: 3,
+      archived: false,
+      forgotten: false,
+      created_at: "2020-01-01T00:00:00.000Z"
+    }
+  ]));
+}
+
+// ------------------------------------------------------------- 按原因逐条跳过
+
+test("validateDecisions skipInvalid: create with empty title is skipped; strict mode rejects it", () => {
+  const emptySnap = new Map(); // create 不 claim id：空快照下覆盖率恒 1
+  const decisions = [
+    { action: "create", title: "", content: "body", type: "pattern" },
+    { action: "create", title: "ok", content: "c", type: "pattern" }
+  ];
+  const { ok, errors, skipped } = validateDecisions(decisions, emptySnap, { skipInvalid: true });
+  assert.equal(ok, true, `valid create should survive, got: ${errors.join("; ")}`);
+  assert.equal(skipped.length, 1);
+  assert.match(skipped[0].error, /create needs non-empty title/);
+  assert.deepEqual(decisions.map((d) => d.action), ["create"], "empty-title create spliced out");
+  assert.deepEqual(decisions[0].title, "ok");
+
+  const strict = validateDecisions([{ action: "create", title: "", content: "b", type: "pattern" }], emptySnap);
+  assert.equal(strict.ok, false, "strict mode hard-rejects a bad create");
+  assert.ok(strict.errors.some((e) => e.includes("create needs non-empty title")));
+});
+
+test("validateDecisions skipInvalid: unknown id, archived, and summary targets are skipped, valid siblings survive", () => {
+  const snap = new Map([
+    ...makeSnap(["b", "c"]),
+    ["arch", { id: "arch", type: "project", title: "旧arch", content: "x", importance: 3, archived: true, forgotten: false, created_at: "2020-01-01T00:00:00.000Z" }],
+    ["s", { id: "s", type: "summary", title: "总览", content: "y", importance: 3, archived: false, forgotten: false, created_at: "2020-01-01T00:00:00.000Z" }]
+  ]);
+  const decisions = [
+    { action: "archive", ids: ["zzz"], reason: "gone" },
+    { action: "archive", ids: ["arch"], reason: "stale" },
+    { action: "archive", ids: ["s"], reason: "stale" },
+    { action: "archive", ids: ["b"], reason: "stale" },
+    { action: "archive", ids: ["c"], reason: "stale" }
+  ];
+  const { ok, errors, skipped } = validateDecisions(decisions, snap, { skipInvalid: true });
+  assert.equal(ok, true, `valid archives should survive, got: ${errors.join("; ")}`);
+  assert.equal(skipped.length, 3);
+  assert.match(skipped[0].error, /unknown id/);
+  assert.match(skipped[1].error, /archived or summary/);
+  assert.match(skipped[2].error, /archived or summary/);
+  // claimed = {b,c} = 2/4 = 50% 恰好过下限；arch/s 未 claim → 隐式 keep
+  assert.deepEqual(decisions.map((d) => d.action), ["archive", "archive", "keep", "keep"]);
+  assert.deepEqual(decisions[0].ids, ["b"]);
+});
+
+test("validateDecisions skipInvalid: a later decision re-claiming an already-claimed id is skipped, first survives", () => {
+  const snap = makeSnap(["a", "b", "c"]);
+  const decisions = [
+    { action: "merge", ids: ["a", "b"], keepSource: "a", title: "合并", content: "m", importance: 4 },
+    { action: "merge", ids: ["b", "c"], keepSource: "b", title: "合并2", content: "m2", importance: 4 }
+  ];
+  const { ok, errors, skipped } = validateDecisions(decisions, snap, { skipInvalid: true });
+  assert.equal(ok, true, `first merge should survive, got: ${errors.join("; ")}`);
+  assert.equal(skipped.length, 1);
+  assert.equal(skipped[0].index, 1);
+  assert.match(skipped[0].error, /claimed by multiple/);
+  // claimed = {a,b} = 2/3 = 67% 过下限；c 隐式 keep，绝不因重复 claim 双 keep
+  assert.deepEqual(decisions.map((d) => d.action), ["merge", "keep"]);
+  assert.deepEqual(decisions[0].ids, ["a", "b"]);
+});
+
+test("validateDecisions skipInvalid: merge with keepSource outside ids is skipped", () => {
+  const snap = makeSnap(["a", "b"]);
+  const decisions = [
+    { action: "merge", ids: ["a", "b"], keepSource: "zzz", title: "t", content: "c", importance: 4 },
+    { action: "archive", ids: ["a"], reason: "stale" }
+  ];
+  const { ok, errors, skipped } = validateDecisions(decisions, snap, { skipInvalid: true });
+  assert.equal(ok, true, `valid archive should survive, got: ${errors.join("; ")}`);
+  assert.equal(skipped.length, 1);
+  assert.match(skipped[0].error, /keepSource must be one of ids/);
+  assert.deepEqual(decisions.map((d) => d.action), ["archive", "keep"]);
+});
+
+test("validateDecisions skipInvalid: update targeting multiple ids / no change / summary / too-young memory is skipped", () => {
+  const now = Date.now();
+  const snap = new Map([
+    ...makeSnap(["a", "b"]),
+    ["s", { id: "s", type: "summary", title: "总览", content: "y", importance: 3, archived: false, forgotten: false, created_at: "2020-01-01T00:00:00.000Z" }],
+    ["y", { id: "y", type: "project", title: "Y", content: "新Y", importance: 3, archived: false, forgotten: false, created_at: new Date(now).toISOString() }]
+  ]);
+  const decisions = [
+    { action: "update", ids: ["a", "b"], content: "x" },
+    { action: "update", ids: ["a"], content: "内容a" },
+    { action: "update", ids: ["s"], content: "x" },
+    { action: "update", ids: ["y"], content: "x" },
+    { action: "update", ids: ["a"], content: "新A" },
+    { action: "update", ids: ["b"], content: "新B" }
+  ];
+  const { ok, errors, skipped } = validateDecisions(decisions, snap, { skipInvalid: true });
+  assert.equal(ok, true, `valid updates should survive, got: ${errors.join("; ")}`);
+  assert.equal(skipped.length, 4);
+  assert.match(skipped[0].error, /exactly one id/);
+  assert.match(skipped[1].error, /change at least one field/);
+  assert.match(skipped[2].error, /cannot update summary/);
+  assert.match(skipped[3].error, /too young/);
+  // claimed = {a,b} = 2/4 = 50% 过下限；s/y 隐式 keep
+  assert.deepEqual(decisions.map((d) => d.action), ["update", "update", "keep", "keep"]);
+});
+
+test("validateDecisions skipInvalid: conflict without a distinct winner/loser is skipped", () => {
+  const snap = makeSnap(["w", "l", "c"]);
+  const decisions = [
+    { action: "conflict", winner: "w", loser: "l" },
+    { action: "conflict", loser: "c" }
+  ];
+  const { ok, errors, skipped } = validateDecisions(decisions, snap, { skipInvalid: true });
+  assert.equal(ok, true, `valid conflict should survive, got: ${errors.join("; ")}`);
+  assert.equal(skipped.length, 1);
+  assert.match(skipped[0].error, /conflict needs distinct winner and loser/);
+  assert.deepEqual(decisions.map((d) => d.action), ["conflict", "keep"]);
+});
+
+// ------------------------------------------------------- skipInvalid 与全局闸门
+
+test("validateDecisions skipInvalid: valid subset below the coverage floor still rejects the whole batch", () => {
+  const snap = makeSnap(["p", "j", "x"]);
+  const decisions = [
+    { action: "archive", ids: ["p"], reason: "stale" },
+    { action: "merge", ids: ["p", "j"], keepSource: "p", title: "跨类型", content: "m", importance: 4 }
+  ];
+  const { ok, errors, skipped } = validateDecisions(decisions, snap, { skipInvalid: true });
+  assert.equal(ok, false, "skip does not bypass the coverage floor");
+  assert.equal(skipped.length, 1);
+  assert.ok(errors.some((e) => e.includes("coverage")), "coverage error present");
+  assert.equal(decisions.length, 2, "rejected batch left untouched (splice only on the success path)");
+});
+
+test("validateDecisions skipInvalid: updates skipped for other reasons do not count toward the update cap", () => {
+  const snap = makeSnap(["a", "b", "c", "d"]);
+  const decisions = [
+    { action: "update", ids: ["a"], content: "内容a" },
+    { action: "update", ids: ["b"], content: "内容b" },
+    { action: "update", ids: ["c"], content: "新C" },
+    { action: "archive", ids: ["d"], reason: "stale" }
+  ];
+  const { ok, errors, skipped } = validateDecisions(decisions, snap, { skipInvalid: true, maxUpdatePerRun: 2 });
+  assert.equal(ok, true, `cap counts survivors only, got: ${errors.join("; ")}`);
+  assert.equal(skipped.length, 2);
+  // 3 条 update 输入 → 2 条跳过 → 幸存 1 条 ≤ cap 2；claimed {c,d} = 2/4 = 50%
+  assert.deepEqual(decisions.map((d) => d.action), ["update", "archive", "keep", "keep"]);
+});
+
+test("validateDecisions skipInvalid: creates skipped for other reasons do not count toward the create cap", () => {
+  const emptySnap = new Map();
+  const decisions = [];
+  for (let i = 0; i < 5; i++) decisions.push({ action: "create", title: `t${i}`, content: "c", type: "pattern" });
+  decisions.push({ action: "create", title: "", content: "x", type: "pattern" });
+  const { ok, errors, skipped } = validateDecisions(decisions, emptySnap, { skipInvalid: true, maxCreatePerRun: 5 });
+  assert.equal(ok, true, `cap counts survivors only, got: ${errors.join("; ")}`);
+  assert.equal(skipped.length, 1);
+  assert.equal(decisions.length, 5, "only the 5 valid creates survive the cap");
+});
+
+test("validateDecisions skipInvalid + allowCrossTypeMerge compose: cross-type merge allowed, unrelated invalid entry still skipped", () => {
+  const snap = makeSnap(["p", "j", "b", "c"]);
+  const decisions = [
+    { action: "merge", ids: ["p", "j"], keepSource: "p", title: "合并", content: "m", importance: 4 },
+    { action: "archive", ids: ["zzz"], reason: "gone" }
+  ];
+  const { ok, errors, skipped } = validateDecisions(decisions, snap, { skipInvalid: true, allowCrossTypeMerge: true });
+  assert.equal(ok, true, `flag-enabled merge survives, got: ${errors.join("; ")}`);
+  assert.equal(skipped.length, 1);
+  assert.match(skipped[0].error, /unknown id/);
+  assert.deepEqual(decisions.map((d) => d.action), ["merge", "keep", "keep"]);
+});
+
+// ----------------------------------------------------------- runDream 层 e2e
+
+test("issue#89: with default skipInvalid on, an all-invalid batch still fails the run (nothing valid survives)", async () => {
+  const { store, service } = dreamSetup();
+  const a = service.saveWithDedupe({ type: "project", title: "旧A", content: "过时A" }).memory;
+  const b = service.saveWithDedupe({ type: "project", title: "旧B", content: "过时B" }).memory;
+  const pref = service.saveWithDedupe({ type: "preference", title: "语言", content: "中文" }).memory;
+  const pref2 = service.saveWithDedupe({ type: "preference", title: "语气", content: "轻松" }).memory;
+  const ctx = mockCtx({
+    onConsolidation: () => JSON.stringify([
+      { action: "merge", ids: [pref.id, a.id], keepSource: pref.id, title: "跨类型", content: "x", importance: 4 },
+      { action: "merge", ids: [pref2.id, b.id], keepSource: pref2.id, title: "跨类型2", content: "y", importance: 4 }
+    ])
+  });
+  const dream = createDreamScheduler({ thresholdCount: 1, thresholdChars: 0, delayMs: 0 });
+  const result = await dream.runDream(ctx, service, { dreamProvider: "mock", dreamModel: "mock-model" });
+  assert.equal(result.ok, false, "all invalid → whole batch rejected, not silently kept");
+  assert.match(result.error, /invalid decisions/);
+  const run = store.listDreamRuns()[0];
+  assert.equal(run.status, "failed", "audit row marks failed, not degraded (nothing valid landed)");
+  assert.equal(parseReceipt(run.receipt).status, "failed", "receipt marks failed");
+  assert.equal(store.getById(a.id).archived, false, "nothing applied");
+  assert.equal(store.getById(b.id).archived, false, "nothing applied");
+  store.close();
+});
+
+test("issue#89: a partial-invalid run is marked degraded in the audit row and receipt", async () => {
+  const { store, service } = dreamSetup();
+  const a = service.saveWithDedupe({ type: "project", title: "旧A", content: "过时A" }).memory;
+  const b = service.saveWithDedupe({ type: "project", title: "旧B", content: "过时B" }).memory;
+  const pref = service.saveWithDedupe({ type: "preference", title: "语言", content: "中文" }).memory;
+  const c = service.saveWithDedupe({ type: "project", title: "旧C", content: "过时C" }).memory;
+  const warnings = [];
+  const ctx = {
+    ...mockCtx({
+      onConsolidation: () => JSON.stringify([
+        { action: "merge", ids: [pref.id, a.id], keepSource: pref.id, title: "跨类型", content: "x", importance: 4 },
+        { action: "archive", ids: [b.id], reason: "stale" },
+        { action: "archive", ids: [c.id], reason: "stale" }
+      ])
+    }),
+    logger: { warn: (m) => warnings.push(String(m)) }
+  };
+  const dream = createDreamScheduler({ thresholdCount: 1, thresholdChars: 0, delayMs: 0 });
+  const result = await dream.runDream(ctx, service, { dreamProvider: "mock", dreamModel: "mock-model" });
+  assert.equal(result.ok, true, "valid subset absorbed (ok for the baseline)");
+  assert.equal(result.status, "degraded", "run marked degraded, not faked ok");
+  const run = store.listDreamRuns()[0];
+  assert.equal(run.status, "degraded", "audit row records degraded, never ok");
+  assert.equal(parseReceipt(run.receipt).status, "degraded", "receipt records degraded");
+  assert.equal(store.getById(b.id).archived, true, "valid archive landed");
+  assert.equal(store.getById(pref.id).archived, false, "invalid merge did not touch its targets");
+  assert.ok(warnings.some((w) => w.includes("skipped") && w.includes("multiple types")), "skip reason logged");
+  store.close();
+});

package/test/webServer-optional.test.js

@@ -0,0 +1,49 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { Context } from "@deepseek-ai/cordis";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import * as mneme from "../lib/index.js";
+
+// webServer 可选依赖回归（v0.7.24 修复）：v0.7.23 曾把 webServer 从 inject 声明
+// 中去掉想支持 headless，但 apply 里 `if (ctx.webServer)` 在 cordis 4 的 Proxy
+// 下访问未注入属性会抛 "cannot get property without inject"（不会返回
+// undefined），桌面端插件树直接加载失败。本测试用真实 cordis Context 复现两种
+// 宿主形态，守住「有 webServer 时注册 API 路由 / 无 webServer 时不崩」两条底线。
+//
+// 修复后 webServer 保留在 inject（cordis 等待宿主服务就绪后再 apply，路由注册
+// 不落时序），apply 守卫用 ctx.reflect.get 而非直接属性访问。headless 宿主
+// 缺 webServer 时 fiber 静默不激活（与 v0.7.22 一致），不抛错。
+
+function buildHost(withWebServer) {
+  const ctx = new Context();
+  const apiRoutes = [];
+  ctx.provide("tools", { register() { return () => {}; } });
+  ctx.provide("commands", { register() { return () => {}; } });
+  ctx.provide("systemPrompt", { context() { return () => {}; } });
+  ctx.provide("agentDefaultModel", { currentSelection() { return { provider: "mock", model: "mock" }; } });
+  ctx.provide("llm", {
+    async *stream() { yield { type: "finish", reason: { kind: "stop" } }; }
+  });
+  if (withWebServer) {
+    ctx.provide("webServer", { register(route) { apiRoutes.push(route); return () => {}; } });
+  }
+  return { ctx, apiRoutes };
+}
+
+test("desktop host (webServer present): plugin boots and registers API routes", async () => {
+  const { ctx, apiRoutes } = buildHost(true);
+  const fiber = ctx.plugin(mneme, { memoryDir: mkdtempSync(join(tmpdir(), "mneme-desk-")) });
+  await fiber;
+  assert.ok(apiRoutes.length > 0, "webServer routes must be registered on desktop");
+  assert.ok(apiRoutes.some((r) => r.kind === "exact"), "expect exact routes, got: " + apiRoutes.map((r) => r.kind).join(","));
+});
+
+test("headless host (no webServer): plugin must not throw", async () => {
+  const { ctx } = buildHost(false);
+  const fiber = ctx.plugin(mneme, { memoryDir: mkdtempSync(join(tmpdir(), "mneme-head-")) });
+  // INACTIVE fiber 静默等待依赖，fiber promise 不会 reject；只要不抛错即为通过。
+  await fiber;
+  assert.ok(true, "headless load must not throw");
+});