Summary

• Problem. lineRangeOverlapsDreamingFence in extensions/memory-core/src/short-term-promotion.ts tracked insideFence state from the fence marker lines but never flagged ranges that included the marker lines themselves. A relocated promotion range that ended on a <!-- openclaw:dreaming:*:start --> line, began on a <!-- openclaw:dreaming:*:end --> line, or covered only a marker line passed the guard, and the snippet built from those raw lines carried the marker text into MEMORY.md.
• Why it matters. The guard's contract is to refuse rehydrated ranges that overlap managed dreaming fences so dream artifacts cannot be promoted. Treating the marker lines themselves as outside-the-fence leaves a narrow but real leak: any window the relocator picks that clips a marker produces a snippet that includes the literal <!-- openclaw:dreaming:*:start/end --> text, and (when the window straddles content on either side of the marker) the adjacent line. This is the residual edge case noted by ClawSweeper on fix(memory-core): redact managed dreaming blocks during promotion rehydration (#80613) #80702 ("the managed-block leak half is related but should be handled by a focused memory-core promotion fix"), narrowed to the guard itself rather than a parallel sanitizer.
• What changed. extensions/memory-core/src/short-term-promotion.ts: marker lines are now checked against the range bounds; if a marker is inside the relocated range, the range is rejected. The pre-existing inside-fence tracking remains so interior lines between a start/end pair are still flagged. The contract elsewhere — the contamination predicate, the relocator, the apply path, the MEMORY.md writer — is untouched.
• What did not change (scope boundary). No change to relocateCandidateRange, isContaminatedDreamingSnippet, applyShortTermPromotions, buildDailySnippetChunks, stripManagedDailyDreamingLines, the CJK dedupe path (the second sub-bug of [Bug]: dreaming pipeline leaks raw candidate content into MEMORY.md and CJK dedup is ineffective in tokenizeSnippet #80613 is being addressed separately by fix(memory-core): use CJK-aware tokenizer for dreaming dedupe (#80613) #80620), or any MEMORY.md rendering. No new sanitizer is introduced — this is a narrowing of the existing guard.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Refs [Bug]: dreaming pipeline leaks raw candidate content into MEMORY.md and CJK dedup is ineffective in tokenizeSnippet #80613 (does not fully close; the dramatic full-Candidate leak from the issue body is already prevented by the merged fence-overlap guard in fix(memory-core): prevent staged dream candidates from leaking into MEMORY.md #68774. This PR narrows a residual marker-line edge case in the same guard.)
• Related: fix(memory-core): use CJK-aware tokenizer for dreaming dedupe (#80613) #80620 (CJK dedupe half, separate PR), fix(memory-core): redact managed dreaming blocks during promotion rehydration (#80613) #80702 (closed sanitizer approach, intentionally not duplicated here).
• This PR fixes a bug or regression

Real behavior proof (required for external PRs)

• Behavior addressed: lineRangeOverlapsDreamingFence now flags relocated promotion ranges that include a dreaming fence marker line, preventing the marker text (and any adjacent fenced content captured by the same raw-line window) from being promoted into MEMORY.md.
• Real environment tested: Local OpenClaw source checkout on macOS (Apple Silicon, Node v22.14.0, pnpm 11.1.0). The fix is mechanical and exercised by Vitest unit tests against the helper directly.
• Exact steps or command run after this patch:
  • pnpm test extensions/memory-core/src/short-term-promotion.test.ts -t "lineRangeOverlapsDreamingFence" — targeted run of the affected describe block.
  • pnpm test extensions/memory-core/src/short-term-promotion.test.ts — full file regression.
  • pnpm test extensions/memory-core/src/dreaming-phases.test.ts — adjacent file regression.
  • pnpm format:check extensions/memory-core/src/short-term-promotion.ts extensions/memory-core/src/short-term-promotion.test.ts — format on changed files.
  • pnpm lint extensions/memory-core/src/short-term-promotion.ts extensions/memory-core/src/short-term-promotion.test.ts — lint on changed files.
  • pnpm tsgo:extensions and pnpm tsgo:extensions:test — typecheck.
• Evidence after fix:
  • Before the source change, the four added tests reproduce the gap (output captured locally):

    Tests  4 failed | 4 passed | 50 skipped (58)
    × returns true when the range ends on a Light Sleep start marker
    × returns true when the range begins on a Light Sleep end marker
    × returns true when the range covers only a marker line
    × returns true for REM marker single-line ranges even with no body between markers
    

    Each failure form: expected false to be true, confirming that the pre-patch guard returns false for a range that includes only a marker line.
  • After the source change:

    Tests  8 passed | 50 skipped (58)            # lineRangeOverlapsDreamingFence -t filter
    Tests  58 passed (58)                         # full short-term-promotion.test.ts
    Tests  41 passed (41)                         # full dreaming-phases.test.ts
    

  • Format/lint/typecheck on changed files: all clean. (Repo-wide format reports 34 pre-existing issues on main unrelated to this PR.)
• Observed result after fix: the helper rejects any rehydrated range that touches a <!-- openclaw:dreaming:*:start --> or <!-- openclaw:dreaming:*:end --> marker line. No regressions in the existing lineRangeOverlapsDreamingFence describe block or the broader test files.
• What was not tested: An end-to-end repro via applyShortTermPromotions that drives relocateCandidateRange to organically pick a marker-line-bordering window. Probe attempts on current main could not construct an organic trigger — the relocator's compare/quality scoring rarely prefers such windows when cleaner alternatives exist in the file — so the demonstration is at the unit level. The repo-wide format/lint/build/CI suite was not run locally; the changed files pass all relevant lanes individually.