PR #77884: fix(memory-core): re-throw unexpected I/O errors in readPhaseSignalStore to prevent silent phase signal data loss

• Repository: openclaw/openclaw
• Author: SimbaKingjoe
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/77884

Description (problem / solution / changelog)

Summary

readPhaseSignalStore silently swallows non-ENOENT I/O errors, returns an empty store, and the caller writes it back to disk — permanently losing all dreaming phase signal history.

• Problem: All errors (EACCES, EIO, EBUSY, EMFILE, ENOSPC) were caught and treated identically to ENOENT, returning an empty store that overwrites the on-disk file.
• Why it matters: Phase signal data (lightHits/remHits counts) accumulates across dreaming cycles and is critical for short-term memory promotion ranking. Silent data loss causes promotion candidates to be missed.
• What changed: Split the catch block: ENOENT → empty store (file doesn't exist), SyntaxError → empty store (corrupt data), everything else → re-throw so the caller's workspace-level try/catch in dreaming.ts:555 handles it (logs the error, increments failedWorkspaces, skips the write).
• What did NOT change: The ENOENT and SyntaxError recovery paths — both still return emptyPhaseSignalStore. No changes to the callers, the lock mechanism, or the write path.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #77881
• Related # N/A

Root Cause

• Root cause: The original catch block used a single combined condition if (code === "ENOENT" || err instanceof SyntaxError) followed by a fallback return emptyPhaseSignalStore(nowIso) that caught all other errors. There was no re-throw path for unexpected I/O errors.
• Missing detection / guardrail: No test covers I/O error scenarios on readPhaseSignalStore; the existing tests mock the filesystem or use temp directories where EACCES/EIO never occur.
• Contributing context: The caller recordDreamingPhaseSignals does a read → mutate → write cycle under withShortTermLock. Returning an empty store on read failure means the subsequent write overwrites the disk with empty/sparse data.

Regression Test Plan

• Coverage level that should have caught this: Unit test
• Target test or file: extensions/memory-core/src/short-term-promotion.test.ts
• Scenario the test should lock in: readPhaseSignalStore throws on EACCES (not ENOENT/SyntaxError), the error propagates to caller, phase signal file is not overwritten.
• Why this is the smallest reliable guardrail: The read path is a pure function of the filesystem — a unit test mocking fs.readFile to throw EACCES verifies the throw path exists.
• Existing test that already covers this: None
• If no new test is added, why not: EACCES/EIO are inherently hard to trigger in cross-platform unit tests without filesystem mocking. The behavioral fix (throw vs swallow) is simple enough that the code shape is the guard.

User-visible / Behavior Changes

None. In normal operation (file exists and is valid JSON) the behavior is identical. The only change is on unexpected I/O errors, which now surface via the existing dreaming error log instead of being silently lost.

Security Impact

• New permissions/capabilities? No
• Secrets/tokens handling changed? No
• New/changed network calls? No
• Command/tool execution surface changed? No
• Data access scope changed? No

Repro + Verification

Environment

• OS: macOS 15.x
• Runtime/container: Node 22, local
• Model/provider: N/A
• Integration/channel: N/A
• Relevant config: N/A (code-level bug)

Steps

1. Apply a permission restriction to the phase signal file: chmod 000 <phase-signal-path>
2. Trigger a dreaming cycle (or call recordDreamingPhaseSignals directly)
3. Observe behavior

Expected Error logged: memory-core: dreaming promotion failed for workspace ..., failedWorkspaces incremented, phase signal file NOT overwritten

Actual (before fix) No error log, phase signal file overwritten with empty store, all historical lightHits/remHits lost

Evidence N/A — code-level change verified by review of the catch block structure. The fix removes the unconditional return emptyPhaseSignalStore(nowIso) fallback and replaces it with throw err.

Real behavior proof (required for external PRs)

• Behavior or issue addressed: readPhaseSignalStore now throws on non-ENOENT/non-SyntaxError I/O errors instead of returning emptyPhaseSignalStore and silently overwriting disk.
• Real environment tested: macOS 15.x, Node 22, OpenClaw main branch at 1d6de8da9f with the 3-line fix applied.
• Exact steps or command run after this patch: pnpm test extensions/memory-core/src/short-term-promotion.test.ts
• Evidence after fix: All 44 existing tests pass:

✅ Test Files  1 passed (1)
     Tests  44 passed (44)
  Duration  1.50s

• Observed result after fix: Existing tests covering ENOENT (missing file → empty store) and SyntaxError (corrupt JSON → empty store) continue to pass. The changed behavior (EACCES → throw) is structurally verifiable: return emptyPhaseSignalStore(nowIso) → throw err at line 840.
• What was not tested: Live EACCES on a real filesystem (requires root or chmod 000, cross-platform). The fix is a 3-line structural change to the catch block.
• Before evidence: The original catch block treated all errors identically to ENOENT, returning an empty store that overwrote on-disk data.

Human Verification

• Verified scenarios: Code review of the catch block and caller chain (recordDreamingPhaseSignals → runLightDreaming/runRemDreaming → runDreamingSweepPhases → dreaming.ts:555 try/catch)
• Edge cases checked: ENOENT (still returns empty store), SyntaxError (still returns empty store), any other Error (now throws)
• What you did not verify: Live reproduction with EACCES on a real filesystem

Compatibility / Migration

• Backward compatible? Yes
• Config/env changes? No
• Migration needed? No

Risks and Mitigations

• Risk: Throwing on unexpected I/O errors could cause the dreaming sweep to abort earlier than before.
  • Mitigation: The caller (dreaming.ts:555) already has a per-workspace try/catch that logs the error and continues to the next workspace. Throwing is strictly better than silent data loss.

Changed files

• extensions/memory-core/src/short-term-promotion.ts (modified, +5/-2)

PR #77894: fix(memory): preserve phase signal store on read errors

• Repository: openclaw/openclaw
• Author: yelog
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/77894

Description (problem / solution / changelog)

Summary

• Problem: readPhaseSignalStore treated non-ENOENT read failures as an empty store, so the next dreaming phase write could erase accumulated phase-signal history.
• Why it matters: Light/REM reinforcement counts are durable ranking signals in memory/.dreams/phase-signals.json; losing them silently weakens deep promotion behavior after transient filesystem failures.
• What changed: non-ENOENT/non-SyntaxError phase-signal read errors now throw, atomic recall/phase-signal writes clean up their current temp file if rename fails, and repair removes stale recall/phase-signal temp files older than one hour.
• What did NOT change (scope boundary): missing phase-signal files and corrupt phase-signal JSON still recover to an empty store.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #77881
• Closes #77888
• This PR fixes a bug or regression

Real behavior proof (required for external PRs)

• Behavior or issue addressed: phase-signal store I/O failures no longer get converted into an empty store, and stale short-term recall/phase-signal temp files are cleaned during repair.
• Real environment tested: local macOS OpenClaw checkout on 2026-05-05, Node via pnpm exec tsx, real filesystem-backed temporary memory workspace with memory/.dreams stores.
• Exact steps or command run after this patch: pnpm exec tsx ran production memory-core APIs: recordShortTermRecalls -> recordDreamingPhaseSignals(read error) -> repairShortTermPromotionArtifacts.
• Evidence after fix: terminal output from the real OpenClaw memory storage path:

REAL_OPENCLAW_MEMORY_PROOF {"workspaceBasename":"openclaw-real-memory-proof-x2rsNY","command":"recordShortTermRecalls -> recordDreamingPhaseSignals(read error) -> repairShortTermPromotionArtifacts","readErrorCode":"EACCES","phaseStorePreservedAfterReadError":true,"repairChanged":true,"removedTempFiles":2,"staleRecallTmpRemoved":true,"stalePhaseTmpRemoved":true,"finalPhaseSignalKeys":["memory:memory/2026-05-05.md:3:3"]}

• Observed result after fix: the EACCES read failure surfaced without overwriting phase-signals.json; repair removed both stale short-term tmp files and left the live phase-signal key intact.
• What was not tested: a long-running Gateway scheduled dreaming sweep and external model/provider calls; this proof exercised the same production storage helpers used by dreaming.
• Before evidence: source inspection matched the issues: non-ENOENT phase-signal read errors previously fell back to emptyPhaseSignalStore(nowIso), and repair had no stale temp-file cleanup path.

Root Cause (if applicable)

• Root cause: readPhaseSignalStore used the same empty-store fallback for operational read failures as it used for first-run missing files and corrupt JSON recovery.
• Missing detection / guardrail: there was no regression test for non-ENOENT phase-signal read failures, and repair only normalized the main recall store plus stale locks.
• Contributing context (if known): recall and phase-signal stores used duplicate write-then-rename code without a shared cleanup path for failed renames.

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file: extensions/memory-core/src/short-term-promotion.test.ts
• Scenario the test should lock in: non-ENOENT phase-signal reads reject without overwriting the existing store; repair removes stale short-term store temp files only.
• Why this is the smallest reliable guardrail: it runs the exported memory-core storage APIs against real temp files without needing a full Gateway dreaming schedule.
• Existing test that already covers this (if any): none for these failure paths.
• If no new test is added, why not: N/A

User-visible / Behavior Changes

Dreaming repair can now remove stale short-term recall/phase-signal temp files and reports the count in the repair summary. Operational phase-signal read failures are surfaced to the existing caller error handling instead of silently truncating durable reinforcement state.

Diagram (if applicable)

Before:
phase-signals read EACCES -> empty store -> write replacement -> old signals lost
repair -> ignores stale *.tmp files

After:
phase-signals read EACCES -> throw -> caller failure handling -> old signals preserved
repair -> remove stale recall/phase-signal *.tmp files -> report count

Security Impact (required)

• New permissions/capabilities? (Yes/No) No
• Secrets/tokens handling changed? (Yes/No) No
• New/changed network calls? (Yes/No) No
• Command/tool execution surface changed? (Yes/No) No
• Data access scope changed? (Yes/No) No
• If any Yes, explain risk + mitigation: N/A

Repro + Verification

Environment

• OS: macOS local checkout
• Runtime/container: Node 22+/pnpm repo scripts
• Model/provider: N/A
• Integration/channel (if any): memory-core bundled plugin
• Relevant config (redacted): N/A

Steps

1. Seed short-term recall and phase-signal stores in a temporary workspace.
2. Mock the phase-signal store read path to throw an EACCES-style error.
3. Call recordDreamingPhaseSignals and verify the original phase-signal file contents remain unchanged.
4. Seed stale and fresh .tmp files in memory/.dreams/, run repairShortTermPromotionArtifacts, and verify only stale recall/phase-signal temp files are removed.

Expected

• Non-ENOENT phase-signal read errors are not treated as empty stores.
• Repair removes stale short-term store temp files and preserves fresh/unrelated temp files.

Actual

• Matches expected after this patch.

Evidence

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

Verification run:

pnpm test extensions/memory-core/src/short-term-promotion.test.ts extensions/memory-core/src/cli.test.ts
Test Files  2 passed (2)
Tests       97 passed (97)

Additional checks:

pnpm exec oxfmt --check --threads=1 CHANGELOG.md extensions/memory-core/src/short-term-promotion.ts extensions/memory-core/src/short-term-promotion.test.ts extensions/memory-core/src/cli.runtime.ts
All matched files use the correct format.

git diff --check
passed

Known unrelated local typecheck blocker:

pnpm tsgo:extensions
pnpm tsgo:extensions:test

Both currently stop on existing Feishu callback type errors and web-tree-sitter type export errors outside this PR's touched files.

Human Verification (required)

• Verified scenarios: phase-signal EACCES-style read failure preserves existing store bytes; stale recall/phase-signal temp files are removed by repair; fresh and unrelated temp files are preserved; CLI repair tests still pass.
• Edge cases checked: ENOENT remains recoverable by existing behavior; corrupt JSON remains recoverable by existing behavior; unrelated .tmp files are ignored.
• What you did not verify: a live scheduled Gateway dreaming sweep.

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? (Yes/No) Yes
• Config/env changes? (Yes/No) No
• Migration needed? (Yes/No) No
• If yes, exact upgrade steps: N/A

Risks and Mitigations

• Risk: surfacing operational phase-signal read errors may mark a dreaming workspace sweep as failed instead of continuing with reduced signals.
  • Mitigation: that is intentional for non-ENOENT I/O failures; missing files and corrupt JSON still use the previous recovery behavior.

Changed files

• CHANGELOG.md (modified, +1/-0)
• extensions/memory-core/src/cli.runtime.ts (modified, +3/-0)
• extensions/memory-core/src/short-term-promotion.test.ts (modified, +104/-0)
• extensions/memory-core/src/short-term-promotion.ts (modified, +71/-8)

PR #77924: fix(memory-core): preserve phase signals on read errors

• Repository: openclaw/openclaw
• Author: bennewell35
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/77924

Description (problem / solution / changelog)

Summary

• only treat missing phase-signal files and JSON parse corruption as empty-store cases
• rethrow other filesystem read errors so dreaming fails safely instead of overwriting existing phase data
• add regression coverage for unreadable phase-signal stores
• add the required changelog entry and remove the follow-up lint failures from the regression test

Fixes #77881.

Testing

• pnpm run lint:extensions:bundled
• pnpm exec vitest run extensions/memory-core/src/short-term-promotion.test.ts

Real behavior proof

• Behavior or issue addressed: non-recoverable phase-signal store read errors no longer zero persisted phase-signal history during dreaming updates.
• Real environment tested: macOS local checkout of issue-77881-phase-signal-read-errors, Node v24.14.0, temp workspace on the local filesystem.
• Exact steps or command run after this patch: PATH=/Users/imprvhealth/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/bin:$PATH corepack pnpm exec tsx /tmp/openclaw-phase-proof.ts
• Evidence after fix:

  workspace=/var/folders/8v/_5ty9g0d1xxf95myks9gs0jr0000gn/T/openclaw-phase-proof-zw6Koe
  phase_store=/var/folders/8v/_5ty9g0d1xxf95myks9gs0jr0000gn/T/openclaw-phase-proof-zw6Koe/memory/.dreams/phase-signals.json
  caught_code=EACCES
  preserved=true
  entries_before=1
  entries_after=1

• Observed result after fix: recordDreamingPhaseSignals surfaced EACCES and left the existing phase-signals.json contents unchanged instead of overwriting the store.
• What was not tested: full pnpm build is still blocked locally by ENOSPC, and I did not run a full interactive app-session reproduction through the UI.

Notes

• AI-assisted
• I understand this change: it prevents transient I/O failures from silently zeroing persisted phase-signal counts.
• Full pnpm build remains locally blocked by ENOSPC during scripts/write-cli-startup-metadata.ts.

Changed files

• CHANGELOG.md (modified, +1/-0)
• extensions/memory-core/src/short-term-promotion.test.ts (modified, +88/-0)
• extensions/memory-core/src/short-term-promotion.ts (modified, +1/-1)

PR #78037: fix(memory-core): preserve dreaming phase-signal history on transient I/O errors (#77881)

• Repository: openclaw/openclaw
• Author: lonexreb
• State: closed | merged: False
• Link: https://github.com/openclaw/openclaw/pull/78037

Description (problem / solution / changelog)

Summary

Fixes #77881. readPhaseSignalStore in extensions/memory-core/src/short-term-promotion.ts previously caught every error and returned an empty store. The caller (recordDreamingPhaseSignals, line ~1151) then mutates that empty store with the current cycle's hits and writes it back via writePhaseSignalStore — silently destroying every previously accumulated lightHits/remHits count on a transient I/O failure (EACCES, EIO, EBUSY, EMFILE, ENOSPC, antivirus lock, etc.).

This patch classifies errors at the read boundary:

This restores symmetry with the sibling readStore function in the same file (which already throws on non-ENOENT). The bug was a one-line regression: a fall-through return emptyPhaseSignalStore(nowIso) after the conditional return path.

Behavior contract (mathematical guarantee)

Let Φ be the on-disk phase-signal store and Φ' the result of one recordDreamingPhaseSignals cycle. For any read error e thrown inside the lock body:

• e.code = "ENOENT" ⇒ Φ' = update(∅, current_cycle) and previous Φ did not exist (no loss).
• e instanceof SyntaxError ⇒ Φ' = update(∅, current_cycle) and Φ was already unrecoverable JSON (loss already on-disk; bounded).
• otherwise ⇒ Φ' = Φ (untouched on disk), error propagates, failedWorkspaces++.

The previous behavior was: for every e ≠ ENOENT and ≠ SyntaxError, Φ' = update(∅, current_cycle) even though Φ was healthy — destroying all prior lightHits/remHits history that the dreaming pipeline depends on for promotion gating.

Real behavior proof

3 new tests in extensions/memory-core/src/short-term-promotion.test.ts:

1. ENOENT path — no prior file ⇒ recordDreamingPhaseSignals resolves, file written with lightHits: 1. Locks in the existing-correct branch.
2. SyntaxError path — pre-write garbage JSON ⇒ resolves with a console.warn mentioning phase-signal store … corrupt JSON. Validates graceful corrupt-JSON recovery.
3. EISDIR path (the regression site) — pre-populate phase signals via the public API, replace the JSON file with a directory of the same name (reliably reproducible cross-platform; no chmod), call recordDreamingPhaseSignals ⇒ rejects with code: "EISDIR", and phase-signals.json is still a directory on disk. The destructive empty-write did not occur.

$ pnpm test extensions/memory-core/src/short-term-promotion.test.ts
Test Files  1 passed (1)
     Tests  47 passed (47)

The 3 new tests are scoped to describe("readPhaseSignalStore error classification (issue #77881)") so reviewers can locate them quickly.

Risk

• Surface: one private function (readPhaseSignalStore) with three call sites all inside withShortTermLock — the lock is released cleanly via the helper's existing finally (line 726), so re-throwing does not leak locks.
• Semantics: ENOENT and SyntaxError paths are unchanged. Only the previously-silent error class becomes loud.
• Caller compatibility: dreaming.ts:551–665 already wraps runDreamingSweepPhases (and downstream phase-signal writes) in a per-workspace try/catch that increments failedWorkspaces. No new caller plumbing needed.

Why this matters

The dreaming pipeline's promotion gates (PHASE_SIGNAL_LIGHT_BOOST_MAX, PHASE_SIGNAL_REM_BOOST_MAX, the consolidation component) all depend on accumulated phase-signal history. A single antivirus lock or transient EIO during a cron-driven dream cycle was enough to wipe weeks of consolidation signal silently — the user would only notice that promotions stopped happening, with no error in the logs and no entry in the failed= count. After this patch, the failure is loud, accounted for, and non-destructive.

Closes #77881

🤖 Generated with Claude Code

Changed files

• extensions/memory-core/src/short-term-promotion.test.ts (modified, +159/-0)
• extensions/memory-core/src/short-term-promotion.ts (modified, +19/-2)