LLM daydreaming: should a blog daydream? What we learned

We wanted an agent that daydreams, in the LLM daydreaming sense Gwern gave the term: one that watches what people say about a client online, turns it into blog ideas, and hands the good ones to a writer. We read the research, designed it, then had the design attacked twice. The frame didn't survive. The useful parts did. This is the whole story, the numbers included, because the answer to "should a blog daydream" turned out to be no, and the reasons are more useful than a yes would've been.

In short: daydreaming, in Gwern's sense, is a way to think up ideas from nothing, and it costs up to 20 times more per idea because almost every combination is useless. A client's blog doesn't need ideas from nothing. Its readers are typing their questions. So the design became: listen, cluster what people ask, rank it with arithmetic, let a human pick, and write with the evidence attached. The model makes exactly one judgement call. Everything else is a ranker learning from what you accept and reject. Expanding an old post is a review item a person applies, never an automatic edit. And components like a size calculator come from a small registry built once, not from code an agent writes per post.

Where this started

The brief was four agents. One would daydream: watch X, Reddit, wherever people talk, for anything near a client's offerings, and turn that into triggers. A librarian would take each trigger and check whether we already have a post on it. If we do, it expands or repairs that post. If we don't, it hands the trigger to the writer. And if the post needs something the site's templates can't do, say a size calculator, the writer hands that to a coding agent, which asks the manager for approval, writes the code, opens a pull request, and the writer embeds the calculator once it exists.

That's a reasonable shape and I still like most of it. It builds on the loop I described in Dynamic blogs with blogwriter: repair, extend, or retire: a trigger lands, the agent looks for an existing post, and either repairs, extends, or writes new. The new part was the word daydream, which came from Gwern's essay. So the first job was to read that essay properly and find out whether the idea holds for this job.

What LLM daydreaming actually is

Gwern published "LLM Daydreaming" on 12 July 2025. His argument is that language models are missing two things people have: continual learning and continual thinking. His line is that frozen networks are amnesiacs trapped in their prior knowledge, and that humans never stop thinking, even asleep. He points at the incubation effect, and at the default mode network, the part of the brain that lights up when you aren't thinking about anything in particular.

His proposal is a day-dreaming loop. In his words, it retrieves two random facts, thinks about them, and if the result is interesting it's promoted to consciousness and possibly added to the store. Spelled out: sample a pair of concepts from memory. A generator model looks for a link between them that isn't obvious. A critic model filters the results for ideas that are worth keeping. Survivors get written back, so new ideas become seeds for future combinations. He even gives the critic a rubric on one-to-ten scales. Novelty: is this surprising, where one is obvious and ten is paradigm-shifting. Coherence: is the reasoning well-formed. And usefulness.

He's honest about the cost, and this is the part most people skip. He calls it a daydreaming tax. Almost all combinations are useless, so the hit rate is low, and his ballpark is that a good solution might cost two orders of magnitude more per task, with an upper bound of maybe 20 to one based on how humans do it. His own objection: few users will pay 20 times more just because once in a while there might be a novel insight. His answer is that power users, researchers and autonomous agents will pay it, and that the output becomes a data moat.

On LessWrong the main pushback came from Cole Wyeth: the LLM "insights" people cite may be survivorship bias from many attempts. Which means the critic, the thing that verifies, is the real bottleneck. Hold that thought. It comes back.

Nobody has published a rigorous implementation. There are two open-source attempts. One pairs random Wikipedia articles with Gwern's generator prompt and a critic scoring novelty, coherence and usefulness one to ten. The other revives Mueller's 1990 DAYDREAMER program in Clojure with LLM call sites. Both are toys with no reported results.

The related work that actually shipped

The daydream essay sits in a family of systems that did get built, and those are where the transferable parts live.

Generative Agents, Park and colleagues, 2023. This is the closest ancestor. Each agent keeps a memory stream. Every record is scored on recency, importance and relevance, all weighted one, with recency decaying at 0.995 per hour and importance rated one to ten by the model. Reflection fires when the summed importance of recent events crosses 150, which works out to two or three times a day. The agent asks for the three most salient high-level questions over its hundred most recent records, retrieves against those, then asks what five insights it can infer. Every insight cites the records it came from, literally "because of 1, 5, 3." The results were a qualitative believability study, nothing more. But the skeleton is exactly right for us: a trigger gated on importance instead of a clock, insights that cite evidence, and a memory that stores its own outputs.

Reflexion, Shinn and colleagues, 2023. Verbal self-reflection after failures, kept in a buffer. It took HumanEval pass-at-one from 80 to 91 percent. Lesson for us: store the reasons a human rejected an idea and feed them into the next judgement.

Letta's sleep-time compute, April 2025. A second agent runs while the main one is idle and rewrites shared memory into what they call learned context, using a bigger model, by default every five steps. About five times less test-time compute and 13 to 18 percent better on their benchmarks, with the cost amortised roughly two and a half times across related queries. It only works when future queries are predictable, which for a blog they are. Lesson for us: precompute a clean digest of what the client publishes and sells, and what the audience is asking, so the live calls stay short.

Google's AI co-scientist, February 2025, with a Nature paper in 2026. Generation, reflection, ranking by pairwise debate with an Elo score, evolution, a proximity graph for deduplication, and a meta-review, all under a supervisor. They validated hypotheses in wet labs. Lesson for us: rank pairwise, because absolute LLM scores are badly calibrated, and dedupe with a similarity graph. Feed rejection patterns back.

Sakana's AI Scientist, versions one and two. Idea generation with a Semantic Scholar novelty check, about 15 dollars a paper. In version two, one of three workshop submissions passed the bar. Their admitted failures: wrong baselines, an agent that edited its own timeouts, and a weak novelty check.

AlphaEvolve, DeepMind, May 2025. An evolutionary loop with an automated evaluator. It found a 48-multiplication method for 4 by 4 complex matrix multiplication and recovered 0.7 percent of Google's datacentre compute. It works because the evaluator is objective. For blog ideas, the closest objective evaluators are search demand and whether the post already exists.

The warnings matter more than the wins

This is the section that changed the design.

Si, Yang and Hashimoto, 2024: LLM-generated research ideas were rated more novel than ideas from 49 human experts. Then their 2026 follow-up, the ideation-execution gap. When the ideas were actually executed, the LLM ideas fell much further. Novelty down 1.05, excitement down 1.76, effectiveness down 1.88, and the rankings flipped.

A 2026 paper on the limits of LLM-as-judge for novelty found what it called a novelty mirage. The judges rate model-generated questions highly while human experts prefer the human ones, and the bias gets worse in comparative mode.

HindSight, 2026: LLM-judged novelty was negatively correlated with real future impact. Rho of minus 0.29. Negatively.

A study of 219,000 agent-generated ideas found that research agents stay close to the seed material and concentrate. They narrow. They don't explore.

And Si's own deduplication numbers: using a small embedding model with cosine over 0.8, the yield of non-duplicate ideas fell batch over batch and plateaued at around five percent unique.

Put those together and the whole literature agrees on one thing. The generator is the easy part. The critic is the problem. An LLM critic scoring novelty in the abstract will wave through plausible junk, and it'll do it confidently.

Where a listener can legitimately listen

Half of the research was about sources, because "watch what people say on X and Reddit" turns out to be a different question in September 2026 than it was two years ago.

X. Its tiers are gone. Since 6 February 2026, new developers get pay-per-use credits or Enterprise, nothing else. The official page prices it at 0.005 dollars per post read, 0.010 per user read, 0.015 per post created (0.20 if it contains a URL), with a 24-hour dedup and a cap of three million reads a month. No free credits. The old Basic plan at 200 dollars a month was force-migrated after 1 June 2026 and Pro at 5,000 a month was deprecated in August. Recent search, seven days, is on pay-per-use; full archive is Enterprise. At our volume of about 200 posts a day, X costs roughly 30 dollars a month. Money isn't the risk. The risk is that X has changed its pricing three times in 18 months.

And the terms are blunt. Non-API automation, meaning scraping or browser automation, results in permanent suspension. Searching by any means other than the published interfaces is banned. Our own reply tool, warmline, drives X search through a client's logged-in browser. That's squarely inside the prohibition, and the account that would be suspended is the client's. More on that below, because we made a decision about it.

Reddit. OAuth only, 100 queries a minute per client. Since the Responsible Builder Policy in November 2025, updated June 2026, self-service app registration is closed. Every new app needs a ticket, reportedly two to four weeks. Commercial use, which explicitly includes monitoring brand mentions, needs written approval and a paid agreement. The widely quoted rate is 0.24 dollars per thousand calls with enterprise floors around twelve thousand dollars a year, though those are third-party figures. That old trick of adding .json to a public URL started returning 403 in late May 2026, and Reddit fingerprints TLS so cloud IPs fail even with a browser user agent. RSS is served but blocked for non-browser clients. Reddit sued Anthropic in June 2025 for scraping. Reading threads for ideas through an approved app is defensible. Storing, redistributing or training is not.

Free, clean sources. Hacker News through Algolia: search by date, no key, roughly ten thousand requests an hour. Bluesky's public search endpoint: no auth, sorted by latest, three thousand requests per five minutes per IP. YouTube's Data API: ten thousand units a day, with search on its own bucket of 100 calls a day and comments at one unit a page, and comments on category videos are where the pain points live. Google Search Console: twelve hundred queries a minute per site, free, and it's literally the questions people already type to reach the client. Stack Exchange for technical categories. Google Trends has no official API; the announced one is an application-gated alpha and pytrends was archived in April 2025. Quora has no API at all.

Paid monitoring services. Brand24 at 199 to 1,499 dollars a month with the API as a 99 dollar add-on. Mention at 599 a month, annual only. Brandwatch custom from around 800 to 2,000. They own the compliance for you. Under about 500 dollars a month they're poor value.

Ranked by signal per dollar and legal cleanliness: Search Console first, then Hacker News, then Bluesky, then YouTube comments, then Stack Exchange, then X through the paid API, then Reddit once approved. A minimum viable listener is Hacker News, Bluesky, YouTube, and Search Console when the client grants it. About 150 HTTP calls a day. Zero dollars a month.

What was already in the codebase

This surprised us. Most of the four agents already existed in pieces.

Warmline, the X monitoring product we run, produces a post record with the text, the URL, likes, reposts, replies, the query it matched, a score from zero to a hundred, a reason, tags, and whether the author is a person, a brand or media. That record is a trigger. Warmline also holds per-client search queries written by an operator, a scored opportunity model with freshness and reach, a relevance floor, and a retrieval engine over a client knowledge base whose documents carry trigger phrases written the way a customer would say them. Blogwriter's own MCP client can call all of that from Node with a bearer token. No model in the loop.

For the librarian: the corpus code merges local posts with the live site and recomputes IDF across the union. Its interlink planner does real BM25 ranking of every existing post against a piece of text, with anchors. And there's one function, alreadyCovered, that is the single definition of "we already wrote this." Our content calendar calls it rather than reimplementing it, because a second rule that looked equivalent once caused a bug.

For repair: a repair module measures a post, briefs the model with only the faults an edit can close, vets the result so no fact, figure, link or image is lost and the post doesn't shrink by more than a quarter, and keeps the best reading. There's now a refurbish command that runs the whole engine over existing posts with a resumable manifest.

For the writer: the agent runner drives Claude Code headless through seven steps, streams every tool call so a person can watch and stop it, and trusts the filesystem over the agent's own claims about what it wrote. Our content calendar is an idempotent queue; adding the same keyword twice updates the entry.

And the component question had already been answered in one client's site. The xxxxlsize repo builds pages from markdown and has what it calls islands: a map from a name to a source file. A page declares mount: calculator in its frontmatter and the build injects the compiled script. Two pages use it today, the size calculator and the brand form. That site's API preserves that key across every blogwriter push, because it patches only the keys it's sent. And the git push helper branches off origin, commits only the named files, and opens a pull request. A pull request is a human gate that already exists.

What didn't exist: a trigger record, a listener, any scheduler at all, an inbox, a way to add a new section to an existing post, and any notion of a component inside blogwriter. One hard constraint fell out of that: blogwriter's CMS payload is an eight-field whitelist, so a mount key can never travel through a CMS push. Component wiring has to go through git.

The first design

We wrote it up as four agents and a loop.

A trigger record: topic, angle, target query, evidence with source, URL, text, author kind, engagement and time, why now, a cluster id, scores, and a status. The daydreamer ingests hourly with no model, embedding and clustering at cosine 0.75. Nightly it consolidates, Letta-style, into a client digest and an audience digest of at most three thousand tokens each. It generates when the summed cluster importance crosses a threshold, or at most daily: 20 pairings of audience cluster and client asset, each candidate citing post ids. Then it filters deterministically. Embedding cosine over 0.8 against existing posts or past candidates rejects. alreadyCovered routes to expand. No resolvable evidence rejects. Then a critic in batches of five, pairwise, judging fit, feasibility, whether the evidence supports the angle, and narrowness. Accept at most three a day, one per cluster a week. Cost on API pricing: 55 to 75 cents a day per client, about 20 dollars a month.

Our librarian BM25-ranks the trigger against the corpus and a judge returns covers, partial or none. Partial means write one new section and vet it. None goes to the writer. Our writer reads what's due on the calendar and runs the existing agent with the evidence in the brief. Our coder gets a capability request with acceptance criteria and allowed paths, a manager approves it in the dashboard, a runner works in a git worktree with a tool allow-list and no git access, the harness commits and opens the PR, and only after merge and deploy may the writer embed the tag.

Seven phases. 22 to 30 days. It read well. Then we asked for it to be attacked.

The audit

Before building, we had the design reviewed the way a senior architect at one of the big labs would review it. Twice, once independently and once with fresh eyes. Both came back with the same verdicts, and they changed the design.

Daydreaming is the wrong frame

Gwern's loop pays its 20-times tax because research has no exogenous signal. You have to generate candidates from nothing. A blog updater has the opposite situation: people are literally typing their questions. This job is triage of observed demand, not synthesis of latent connections. That generate step, 20 random pairings, is the one step that manufactures ideas nobody asked for, and it's the step most likely to echo the seed material and drift off lane. A candidate should be the cluster of what people asked. Observe 200, cluster to 15, rank, let a human pick three. Daydreaming earns its place in exactly one spot: choosing the angle for a question already known to matter.

The critic mostly shouldn't be a model

Three of the critic's four questions are arithmetic. Demand is Search Console impressions for the query family, or Ahrefs volume, or the count of distinct people asking. Coverage gap is alreadyCovered plus BM25 with a threshold, which already exists. Evidence weight is distinct authors times distinct sources times engagement, with a half-life. One genuine model decision remains, fit and legality: does this cross the client's never-say list. That's a binary classifier with a reason, a small model, once per cluster.

Human accept and reject becomes labels for a ranker, not text stuffed into a prompt. Prompt-stuffing rejection reasons grows without bound and drifts. And "at most three a day" is a rate limit dressed as an editorial decision. A ranked backlog that decays is the right shape. Caps belong on publishing, not on proposing.

Four agents is a count, not a design

Only the writer needs a tool-using loop. It reads the project, runs the checks, publishes. The coder is a second loop, but it's a different product on a different cadence. Everything in the daydreamer and the librarian is a pipeline with a model call at specific decisions: label a cluster, judge coverage, draft a section.

Four agents with handoffs means four places context gets lost, four idempotency contracts, four resume points, and the cost of re-establishing who the client is on every hop. Our fix is one trigger record with a status and one advance function that's safe to re-run, because every transition checks its precondition against the filesystem. That's the pattern the content calendar already uses.

The design had no defence against untrusted input

Every social post is attacker-controlled text about to be interpolated into a classifier, a section writer, and eventually a published page. The first design didn't mention this once.

Rules now: evidence goes in as structured data in a fenced block, with a system line that nothing inside it is an instruction. URLs get stripped before the model sees the text and re-attached from the store afterwards. A writer may quote with attribution or paraphrase the question. It may never follow an instruction found in evidence, never repeat a claim from evidence as fact, never cite a URL it didn't fetch and verify, and never name a private individual. A cluster needs at least three distinct authors across at least two sources before it can rank, because Hacker News and Bluesky are cheap to farm. And the word "trend" is only claimable from Search Console or Trends numbers. Five posts is "some people asked." An injection test suite ships before any of it does.

Machine-editing live posts is the biggest SEO risk here

Google's August 2026 spam update explicitly targets deceptive freshness alongside scaled content abuse. So: never touch the publish date. Set updated only when a substantive section of at least 150 words was added, and show the human the whole section, not the word "expanded." Never expand a post ranking on page one for its query; a cron job doesn't get to experiment on that. A "partial" verdict from the judge is the weakest signal in the chain, so the new section is a review item the human applies, never something applied automatically. Write new instead of expanding when the intent differs, when the section would be more than 30 percent of the post, or when the post's credibility rests on a named author's experience that a machine can't extend.

Cut bespoke components per post

The list of components a client's blog ever needs is short: a calculator, a unit converter, a comparison table, a cost estimator, and not much else. Build a curated registry of about five parameterised islands once, reviewed by a human once, driven by the mount key plus props in frontmatter. A coder becomes a request for a new registry entry, reviewed like any other code.

Agent-generated JavaScript per post would mean unreviewed code in the client's origin, with the client's cookies, on a schedule. And the person reviewing 40 turns of model output is the same overworked manager who approved the intent. If bespoke is ever unavoidable, it goes in a sandboxed iframe on a separate origin with a strict content security policy. Not an island.

The sources

Forking warmline's browser search into the product doesn't change X's terms. Any ban lands on the client's account, and consent from a client who doesn't understand the risk is an email trail, not a defence. Reddit is commercial use even when you only summarise it for ideas. Search Console is the best signal, it's free, and it should be a requirement before anything else, not an optional extra.

Nothing here has been shown to beat what exists

Our keyword path, Ahrefs suggestions plus Search Console, is the baseline. And there's no baseline measured. So the experiment: eight weeks of baseline first. Then four weeks with three clients, six candidates a week, three from keyword research and three from listening, with the source hidden. Metrics: acceptance rate per arm, time to decide, and for accepted posts, impressions at four weeks and query coverage. That's 72 candidates and around 30 accepted, enough to see a two-times difference in acceptance, not enough for traffic significance, so traffic is a 12-week follow-on. Kill it if listening acceptance is below keyword acceptance at week four, or if fewer than two listening posts per client got any impressions.

Cost and cadence

That 20 dollars a month holds only if the generate step is cut. With 20 pairings and pairwise Opus judging, it's Opus that dominates. And headless Claude Code runs on a subscription share the weekly cap with the writer's own interactive work. A cron that burns the cap on Tuesday locks a writer out on Thursday. Scheduled work belongs on API keys. Subscriptions are for humans.

The lists

What to cut: the generate step as a source of candidates, the Opus pairwise critic, the three-a-day cap on proposing, the bespoke coder, and warmline as a listening source.

What to add: structured evidence delimiting and an injection suite, a computed-features ranker learning from accept and reject, Search Console as a requirement, a component registry with a props schema, and a control arm every calibration week.

What to build first: a listener for Search Console, Hacker News and Bluesky writing one record shape, deterministic clustering, a ranked inbox in the existing keyword panel with the source hidden, and the writer driver with evidence passed as data. About eight days, and it produces the experiment.

What we decided

We took the reframed design. Listen, cluster, rank, and a human picks. One durable record. The writer is the only agent.

Two places we went against the audit, on purpose, with the risk written down.

First, we kept expand and the component registry in scope from the start rather than gating them behind the experiment. All their safety rules stay: expansions are review items a human applies, the registry comes before any coder, and the coder only ever adds a registry entry through a pull request the manager reviews.

Second, we're forking warmline's search in as one source among several. It runs behind a per-client written consent record that names the risk in plain words. Our listener refuses to run without that record. Warmline is never the only evidence for a cluster, and reads aren't kept beyond the evidence window.

We're applying for Reddit's OAuth approval and the Trends alpha now, because of the lead times. One question is deferred: this laptop or an always-on box. Because the pipeline gates on evidence volume, so a missed hour is harmless and a missed day is not.

The record and the phases

One trigger. The question people asked, in one line. Evidence: at least three authors across two sources. Features that are computed, never emitted by a model: demand, gap, weight, recency. Fit, the one model decision, with a reason. A rank that decays. A status from observed through ranked, shown, accepted or rejected, assigned, written or expanded. The decision, with who, when and why. And the post it became.

Phase zero, the baseline. One day to set up, eight weeks to accumulate. Search Console access per client, and the keyword-path posts logged with impressions, clicks and acceptance.

Phase one, the listener. Three to four days. Adapters for Search Console, Hacker News, Bluesky and YouTube writing one shape. Reddit written but disabled until approved. X against the paid API, off by default. Warmline behind consent. URLs stripped before any model sees the text.

Phase two, cluster and rank, with no generator. Two to three days. Local embeddings, the astroturf guard, the four computed features, the fit classifier with evidence as fenced data, the decaying rank, an optional angle pass for the top few only, and the injection suite.

Phase three, the inbox. Three to four days. Copied from the keyword suggestions panel, source hidden, a reason required on every reject, and a weekly blind control of below-threshold triggers so we can tell whether the ranker is doing anything. Accepted triggers go on the content calendar.

Phase four, the writer driver. One to two days. What's due on the calendar runs through the existing agent, with an evidence slot in the brief and the rules about what evidence may and may not be used for.

Phases zero to four, about ten days of build, double as the experiment.

Phase five, expand as review items. Four to five days. A judge returns covers, partial or none. One new section from the evidence, vetted for lost facts, inserted, run through the refurbish steps, and shown whole to a human who presses apply. Never on a page-one post. Never touching the date.

Phase six, the registry, then a coder for registry entries. Four to six days. Five islands with a props schema, a components reference for the writer, and the request, approve, worktree, allow-listed run, PR, available-after-merge flow for anything new.

Cost after the redesign: about ten to twenty cents a day per client, all scheduled runs on API keys.

The takeaway

Daydreaming is a beautiful idea for a machine that has to think up something from nothing. A client's blog is not that machine. Its readers are telling it what to write.

What's useful in the daydream literature is the part about memory and evidence. Cite what you drew on. Consolidate while idle. Rank pairwise, and dedupe with embeddings. And the loudest lesson is that the critic is where these systems die. So we built the ranker out of arithmetic, kept the model for the one judgement only a model can make, made the human the training signal, and wrote down every place we chose risk on purpose.