feat(dream): expand reviewed artifact and tag revisions

[Zxf-xufeng]

Which issue or RFC does this PR close?

Implements the Dream domain expansion in #1715 across A0/A1, B1, B2, and C. Database upgrade responsibilities follow #1771. This PR supplies the Dream contribution; the complete migration framework and production registration remain in #1772. Trusted evaluation services and evaluation approval gates are outside scope.

Rationale for this change

New evidence can correct existing knowledge, instructions, configuration, or classification. Dream proposes reviewed changes for Memory, Profile, Topic Memory, Handoff, managed Skill, Prompt, and Tag. Every proposal remains pending until an authorized reviewer approves its exact version against the current resource baseline. Existing automatic generation retains its own policy.

Existing databases must not be changed implicitly when a Server, Worker or SDK opens them. Dream supplies its schema changes and domain checks to the unified migration framework instead of owning another startup migration runner.

What changes are included in this PR?

• Extend the existing v1 Dream submission and lookup contract with typed operations, exact evidence, bounded execution, Family routing, audit metadata, and conditional publication.
• Replace Artifact-named review routes with six /v1/candidates/* operations. Artifact and Tag proposals share pc_candidate_heads and pc_candidate_versions, immutable history, one Inbox ordering and pagination, and typed approval results. Tag approval checks both ETag and content basis without fabricating an Artifact Revision.
• Revise the kind/text of one exact active Atomic Memory through master's native publication and projection pipeline. Require the target revision and lifecycle version to remain current through approval; forgotten, merged, retired, or concurrently replaced targets cannot be overwritten. Use exact ArtifactRefs for Memory support, including Skill reads and Tag bases. Preserve Profile Source-window isolation and settings-only policy snapshots, complete Topic retrieval projections, and Handoff objective validation. Handoff advertises review_then_publish; approval publishes a revision eligible for explicit continue_latest(); it does not execute Continue, acknowledge receipt, or perform work.
• Support instruction-only managed Skill revisions without installing or executing packages, and Prompt revisions with key-specific schemas, publication authority, frozen in-flight inference and monotonically versioned rollback.
• Suppress duplicate proposals within one Scope and principal, rechecking evidence and the actual candidate version before reuse. Keep the durable limit of four consecutive explicit Dream attempts before runnable Source work.
• Remove the Candidate startup migrator, Dream's startup column/index repair, and automatic Processing manifest upgrades. All three database profiles run read-only Dream preflight before business initialization. Legacy structures require explicit maintenance; partial versioned bundles cannot become a Server database through create_all.
• Require master Atomic Memory conversion and legacy citation-column removal before the Dream transformation; preserve archived terminal requests with their historical payloads and idempotency. Supply frozen Candidate SQL, a historical Dream task schema, a release-impact manifest, and connection-bound transformation/verification functions for the shared framework. Preserve historical candidates, Profile pointers, terminal Dream payloads, identities, idempotency, ordinary Processing work and retained recovery copies. Require queued/running historical Dream runs to finish with the old runtime before migration; never silently change their frozen prompt/model contract, retries or deadlines. Transform Handoff/Prompt processing bindings in the same explicit migration while preserving ownership mode and automatic-binding history. Add no Dream-specific migration control table or runner.
• Update SDK/CLI/MCP, integrations, Dashboard and bilingual usage documentation. RFC documents remain in the separate docs(rfc): propose reviewed multi-artifact Dreaming #1715 branch.

Are there any user-facing changes?

The six /v1/artifact-candidates/* routes are removed directly, without aliases or redirects, as the explicit release exception in #1715. Clients must upgrade with the Server. Unpublished Catalog Change routes/tables have no production compatibility requirement. Extended Dream types use X-PowerContext-Dream-Contract: 2; this header does not restore removed Candidate routes.

Production database upgrade remains gated on #1772. The contribution manifest is deliberately unregistered until the complete historical Server baseline, actual revision chain, release/client versions, task checks, startup readiness and SQLite/seekdb/OceanBase acceptance are available. #1772's four-table SQLite prototype is not sufficient. This branch rejects old Dream storage with migration_required and versioned databases with migration_framework_not_ready; it does not offer a fallback startup upgrade. Fresh development databases and existing complete unversioned development schemas remain usable for domain verification.

Operators stop new Dream admissions and let the old workers drain before stopping all writers. Pending Candidates do not need to be decided before upgrade. Unfinished runs block with dream_tasks_require_drain; unknown processing manifests block before DDL with unknown_processing_manifest.

The framework owns locks, backup policy, transaction boundaries, revision tracking in pc_schema_revision, interruption recovery and cleanup. Dream's retained snapshots survive normal startup and review. Its copy-comparison validator runs during stopped-write migration, not after ordinary reviews legitimately change active data.

How was this change tested?

• Final Dream, review transport, access, deduplication, all-family publication, and Candidate migration suite: 177 passed, 113 skipped. Includes inactive/stale Atomic Memory targets, exact provenance, independent Tag support, and archived terminal Dream records.
• Broad unit run: 4,248 passed before its failure limit. All identified merge-related failures were corrected; the failed modules and remaining collection were then exercised together: 286 passed, 1 skipped. These counts overlap and are not a single-run total.
• Master Atomic Memory, tags, Candidate, MCP and HTTP integration coverage: 163 passed in the broad run; six outdated-route assertions were corrected and all six passed in the follow-up.
• Skill evaluation suite: 28 passed, 30 subtests passed; packaged Skill pin and full MCP fixture catalog verified.
• UV_NO_SYNC=1 make check contract-test: passed, including lock consistency, pre-commit hooks, core/integration type checks, 49 integration-manifest tests and 51 API/JavaScript contract tests.
• Desktop contract generation check and TypeScript typecheck: passed. Dify generated-contract check: passed.
• git diff --check: passed.

Real seekdb/OceanBase migration and recovery acceptance remain in #1772; backend skips are not production upgrade evidence. The Dify plugin suite could not run locally because its required Python 3.12 download did not complete. Rust/IPC exporter validation was not run locally because the Rust toolchain is unavailable. Controlled generation tests verify behavior and transactions, not model-quality improvement.

AI usage statement

OpenAI Codex was used to implement and review the changes, update documentation, and write and run regression tests. Backend and framework acceptance limits are stated above.

[hidb4ai]

Re-reviewed 0e601c29c2b2b8df085106beeec50f4e3da6aff9. The two previously reported issues are fixed: target-plus-independent-source proposals now reach approval, and exact Memory citations survive Skill reads through native APIs, HTTP, and the Python SDK.

The fresh real-model/OceanBase run completed generation, HTTP approval, replay, and restart readback for six operations. Topic Memory returned invalid_generation_output once; a separate real-model/OceanBase rerun completed the same flow. That failure remains unexplained, so this is not a clean first-pass result for all seven operations. Embeddings were disabled; installed hosts and SeekDB were not exercised.

One P2 remains in Memory-entry tag target evidence handling, detailed inline. Its database reproduction uses controlled generation output, separately from the real-model acceptance run.

[hidb4ai]

Re-reviewed 07411577f14ce9b775aa2e09d99707d384103793. The Memory-entry target-only finding is fixed: replaying the original counterexample on real OceanBase now produces needs_evidence with no candidate and no automatically promoted ancestor Source. Independently supported Memory tag proposals retain the exact basis citation and can be approved. Pending v2 candidates are rejected before tag writes; supported regeneration produces an approvable v3 candidate.

A fresh qwen3.7-plus/OceanBase run passed all seven Dream revision operations through normal workers, real HTTP submission and approval, idempotent replay, and restart readback. Topic Memory passed this first batch. Additional real-model Memory-entry tag requests returned needs_evidence for target-only input and completed approval, exact-citation preservation, tag readback and restart for independent support. No additional actionable correctness findings were established in the update. Embeddings were disabled; installed hosts and SeekDB were not exercised, and production migration acceptance remains outside this validation.

[Zxf-xufeng]

Implemented the two findings from the latest local review in 0b4dd71. The inline notes describe each fix. Validation: 230 relevant tests passed, 102 optional cases skipped; all pre-commit hooks and type checks passed. The new regressions failed before the fix and pass afterward. No RFC, API contract, or database schema changes are included. Live OceanBase/SeekDB acceptance was not rerun locally.

[hidb4ai]

Reviewed 0b4dd71c0e5f8189096f2958e79007440c438da2. The seven Dream operations completed generation, approval, sequential replay, and restart readback with the configured real Qwen model and isolated OceanBase databases. One remaining correctness issue is detailed inline: overlapping Memory approvals return 200/409 instead of replaying the stored approval result. This was reproduced on both SQLite and real OceanBase. Production upgrade readiness remains gated on the complete migration framework in #1772.

[hidb4ai]

Real-model diagnosis at ac8f9946 confirmed that a reproduced invalid_generation_output can come from Qwen returning outcome: "correct", which violates the unchanged Dream outcome enum. That rejection is expected. A separate PR-introduced accounting defect was independently verified through real OceanBase and the public statistics API; it is detailed inline.

[hidb4ai]

LGTM

[hireview001]

• Resolve merge conflicts with the target branch.

[hidb4ai]

please update & resolve conflicts