fix(dream): 5 处 prompt 补围栏，解析失败进审计（#501 / #493 另一半） - #503

…yable (#501)

#493 fenced the distillation transcript and nothing else. Four months of dream
prompts kept handing the model a bare listing: consolidation, narrative, the
overview summary, and sleep's conflict and pattern passes. A community run shows
what that costs now — nine dream_consolidate failures with 47K-55K token inputs
and 212-907 token outputs, the model reading 46K of memory as "someone handed me
results without a task" and replying with a tour. Roughly 430K tokens a day, zero
memories written. Their ablation also settles the direction: a system-only arm
fell from 2/2 to 0/1 while the fence-plus-role arm stayed 1/1.

New memory-list fence and role reminder live in lang.js rather than reusing the
transcript pair: what is handed over is a listing, and calling it a transcript
would mislead whoever reads the audit later. The reminder goes at the head of
the user message because #493 measured that the user message decides what the
model thinks the block is — writing it only in system did not help.

fenceListBody is a pure function on purpose: the same memories get offered again
at the next threshold, and a retry must receive a byte-identical prompt or the
"same input, same error" reading that made #493 diagnosable is gone. Angle
brackets in the body are neutralised with a zero-width break rather than deleted,
so a memory that happens to contain the closing marker cannot promote the text
after it into instructions.

Parse failures now land in the audit, not only in a warn line: both audited LLM
runners take spec.metadataFrom(result) and the dream passes record
parse_failure / raw_len / raw_head / raw_has_bracket. The warn line already had
this; what was missing was the queryable side.

Several mocks identified a phase by the first bytes of the user message
("id=", "候选冲突"). That coupling was already known to be fragile —
dream-candidate-hybrid.test.js carries a comment about working around mockCtx
for exactly this reason — and the fence makes it fatal, so identification now
keys on the listing shape and options.purpose. The stale comment is corrected:
the workaround it describes is no longer needed.

Five regression locks, three of them mutation-checked (removing the scrub
reddens only the early-close case; removing metadataFrom only the audit case;
unwrapping consolidation only the audit and the structural lock).

… stream errors (#501 review)

Two review findings, both verified before acting.

The overview pass asks for prose, but fenceListBody always injected the
consolidation reminder ending in "output only the JSON array". Against a prose
contract that pushes the model to answer "[]", and summaryText.trim() is
non-empty for "[]" — the literal brackets would have been stored as the library
overview. fenceListBody now takes the output contract ("json" default, "text" for
the overview); the text variant keeps the fence and the data-not-instructions
clause while dropping the array demand. The narrative pass keeps the JSON
reminder: its system prompt does require a strict array and its output goes
through extractJsonArray.

A stream that terminates with an error yields no text at all, so the audit row
must not claim parse_failure with raw_len 0 — that reads a provider-side 429 as
"the model ignored the format". metadataFrom is now only consulted when the run
produced text, in both audited runners.

Both fixes are mutation-checked: reverting the overview to the JSON reminder
reddens only its test, removing the stream guard reddens only its own. One
earlier version of the overview test was itself wrong (it fed a non-existent id,
so strict validation aborted the run before the summary call, making the finder
report a missing call) — fixed on the test side, with the reason recorded.