[senamakel]

Stacked on #5692 — review that one first. This branch is cut from
#5692's head, so until that merges the diff here also shows its 44 commits.
It targets main rather than memory-bus-only because that branch lives
only on the fork; GitHub will shrink this diff to just the new work the
moment #5692 lands. The commits unique to this PR start after
21dcfe1b7.

Two deliverables, plus an inventory that says honestly what is left.

1. The memory Cargo gate

Default-ON, product-ON, forwarded to the shell. Facade + stub, the voice
shape with skills' refinement.

With memory off: the memory* controllers are unregistered
(unknown-method over /rpc, absent from /schema), every memory agent tool is
absent rather than degraded to an error, the memory subscribers are not
installed, the agent_memory builtin is not advertised — and, the point of the
gate for an embedding host, no memory cdylib is downloaded or dlopened.
Recall inside a turn returns nothing, which is what NullMemoryProvider
already produces at runtime and what DomainSet already models with
memory: false.

Six carve-outs, each with ONE definition

The work here was not the #[cfg]s. It was finding the parts of the family
that are not behaviour, and each one is compiled in both builds rather than
given a stub twin — a twin is a second definition free to drift, and nothing
would catch the drift.

Ungated	What	Why it cannot be gated
memory::api	the tinymemory-api re-export	contract vocabulary in always-on agent-harness signatures
memory::host	MemoryHostConfig for Config + the bus event sink	~20 always-compiled callers pass &Config where dyn MemoryHostConfig is expected. Gating it makes Config stop satisfying a bound that has nothing to do with the family
memory::ranking (new)	hybrid_score, WeightProfile, cosine_similarity, mmr_select	host arithmetic; both search tools already fetch through the guard first
memory::citation (new)	MemoryCitation, CROSS_CHAT_HEADER	inert serde type in the agent's last_turn_citations field
memory::namespaces (new)	CONVERSATION_RAW_NAMESPACE, REFLECTIONS_NAMESPACE	gated producer, always-compiled reader; a &'static str cannot fail without a driver
flows::namespace (new)	flow_namespace, FLOW_MEMORY_NAMESPACE_PREFIX	a format!; flows_delete needs it with memory off

flow_namespace carries a stated security invariant — "the only place in the
codebase that may construct this namespace string". Moving it kept that
true: there is one definition, not two, and memory_tools re-exports it.

Three mis-housings fixed rather than stubbed

The Composio provider catalogue, the conversation store threads uses, and the
rpc_models request types were all always-compiled code reaching the engine
through a memory::… shim. They name tinymemory_core directly now — the
same move the channels gate made for its three tinychannels imports. That
removed ~37 always-on → gated edges without a single stub.

Stubs answer in two shapes, deliberately

• Registration sites want absence. The all_*_registered_controllers
  aggregators return empty vectors, so core/all.rs needs no #[cfg] for
  them. A stub returning a controller that answers "memory disabled" would make
  memory.* a known method that fails at run time — the opposite of the
  intended unknown-method.
• Writes want a build fact. Silently discarding a write is the one failure
  mode that looks like success.

The openhuman memory and tree-summarizer CLI arms are kept rather than
deleted, answering with the gate name. Falling through to generic namespace
resolution would say "unknown namespace: memory", which reads like a typo.
Same shape as the existing mcp and tui arms.

CoreContext::current_memory_capabilities gets a not(feature) arm answering
closed — the one place it does. The open default exists because a
capability set is unknowable until a driver answers; with the family compiled
out the state is not "unknown", it is "absent".

2. Handler work: one migration done, one deliberately reverted

Done. The ranking maths moved host-side, ported verbatim, with parity tests
pinned to literal expected values rather than calls back into the engine —
a test written the other way stops compiling on exactly the day it matters.
Both search tools already fetched through the guard, so nothing about this
needed a driver.

Reverted, and this is the interesting half. I migrated
memory_tree_list_chunks / get_chunk onto MemoryChunks. It compiled
cleanly and broke four round-trip tests, which turned out to be right.

I migrated memory_tree_list_chunks / get_chunk onto MemoryChunks. It
compiled cleanly and broke four ingest_document round-trips, which turned out
to be right. Getting to why took six attempts; the five wrong ones are in the
spec because each reads as correct.

Why the zero happens. default_memory_driver() returns "tinycortex",
binding::admit aliases it to the module id, no artifact exists in a unit test,
so the documented fallback installs the null driver — while the fixtures
write through ingest_pipeline to the engine's SQLite. Neither the config
argument (wrong turn 1) nor a guard_for_config honouring it (wrong turn 2,
built and discarded) changes that.

The writer migration is cheaper than I first wrote, and that correction
matters because the expensive version would deter the work.
TinycortexProvider::ingest_document calls
tinymemory_core::ingest_pipeline::ingest_document_with_scope — the same
pipeline the host already calls. Nothing relocates. Its title: String::new()
drops DocumentInput.title, but canonicalise reads title only in its
emptiness guard, so the only delta is a document with an empty body and a
non-empty title. provider is inert.

The actual blocker is that IngestOutcome is narrower than IngestResult.
This RPC answers six fields; the bus carries three.

IngestResult	IngestOutcome	Survives?
chunks_written	written	yes
chunk_ids	ids	yes
source_id	—	caller knows it
chunks_dropped	folded into skipped	only when not already-ingested
already_ingested	folded into skipped	no — ambiguous
extract_jobs_enqueued	—	no

The adapter collapses two facts into one number:
skipped = if already_ingested { 1 } else { chunks_dropped }. That is precisely
the ambiguity already_ingested exists to prevent —
wipe_all_clears_ingest_gate pins a shipped bug where a wiped source could
never re-ingest, and "0 chunks written" was distinguishable from a normal no-op
only by that flag. Migrating today would put that back as a public RPC response
narrowing.

So A9 needs one upstream tinymemory change carrying two additions: a wider
IngestOutcome, and an email ingest method (ingest_rpc dispatches
Chat/Email/Document; MemoryIngest has no email arm). The four methods
themselves are already served by the pinned v1.2.0 — verified with
git show v1.2.0:crates/tinymemory-module/src/service/mod.rs, not assumed.

The host-side half is done and is in this PR. InMemoryChunks +
guarded_in_memory_chunks() (memory/guard/in_memory.rs) is a storing provider
implementing MemoryIngest and MemoryChunks, so a write and a read that both
cross a real MemoryGuard reach the same store. InMemoryProvider could not
serve this — mandatory three only, so as_chunks() is None and the guard
answers Unsupported. Three tests pin the round trip, source_id dedupe, and
scope-applied-before-limit. It is test infrastructure with no production caller
yet, deliberately: it is the piece that turns the next attempt from a research
problem into a seam plus fixtures, and guard_over is the documented extension
point for exactly this.

The handlers stay on the store meanwhile, with the reasoning at the call site.
One line there is load-bearing: do not make those four tests pass by binding a
global client in the fixture. They are the only tests that go red when a
reader moves to the guard while the writer stays on the store.

3. What is left, and why (docs/specs/2026-08-23-memory-bus-only-remaining-surface.md)

The previous round's note concluded that "what blocks the migration is release
lag, not seam width". That was true of v1.2.0's five families and is false in
general. Fully retiring tinycortex needs roughly twelve new bus families
upstream — the ingest queue (36 refs), conversations (~25), the source
registry (~20; MemorySourceSink has only accept_source_items and
forget_source), the composio sync pipelines (~25), the chat host seam (17),
preferences, recency recall, persona compilation — plus a design pass for
read_rpc, which writes raw SQL against the engine's schema with an
entity-index join and a total that ChunkQuery cannot express.

Each is a tinymemory PR → release → registry re-pin → host change. The spec
enumerates them with call sites and an order of operations, so the upstream
work is a mechanical read rather than a rediscovery.

A9 needs one upstream change too, but a smaller one than the twelve above:
a wider IngestOutcome plus an email ingest method. The methods themselves
already exist in v1.2.0, so it is a contract widening rather than new plumbing,
and the host-side fixtures for it are already in this PR.

Ratchets

direct_engine_refs_tests gains 19 FacadeRevealed entries. No new engine
dependency: these are the always-compiled callers that the retarget above
made honest about a dependency they already had. The ALLOWED header now
documents both reveals — the facade deletion and this gate — and each entry's
reason says which one it came from.

The ratchet also caught me: a twentieth entry I added
(flows/tinyflows/caps/tools/composio.rs) names the engine only in a doc
comment, and the scanner skips comment lines, so the staleness half rejected it
as stale on arrival. That is the guard working, and the reason to run it rather
than trust a file-level diff.

Testing

• cargo check green in both directions: product features, and default
  minus memory.
• cargo fmt --all --check clean; both ratchets green.
• Full --lib suite: the only failures are the seven known pre-existing ones —
  six git tests that fail because this checkout is a worktree, plus the
  multi_batch_volume_builds_full_tree 60s seal timeout, all verified
  identical on untouched main.
• The disabled build is the only thing that catches stub drift — CI's smoke
  lane runs cargo check, never cargo test --no-default-features. Run
  cargo check --no-default-features --features "media,skills,flows,mcp,channels,medulla,http-server,scheduler-gate,file-logging,modules"
  before touching this surface.

Summary by CodeRabbit

• New Features

  • Added source-scoped memory retrieval for more relevant results.
  • Added hybrid ranking and diverse result selection.
  • Added shared citations and namespace handling for conversations and reflections.
  • Expanded memory capabilities for people, chunks, retrieval, and profiles.
  • Added memory-disabled support with clear unavailable behavior.

• Bug Fixes

  • Prevented memory recall from returning results from the current session.
  • Updated the bundled memory module and capability reporting.
  • Improved sensitive-data redaction in logs.
  • Improved behavior when memory features are unavailable.

[tinysweeper]

Requesting changes: 1 lane(s) blocking, worst finding is high.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

             $0.2296 · 2,365,263 in / 44,562 out · 272,288 cached (12%) · openrouter/openai/text-embedding-3-small, deepseek/deepseek-v4-flash, z-ai/glm-5.2 · 749 embedded
critique:    $0.1004 · 1,145,959 in / 18,223 out · 51,004 cached (4%)   · deepseek/deepseek-v4-flash, z-ai/glm-5.2
security:    $0.1053 · 1,095,040 in / 16,160 out · 179,992 cached (16%) · deepseek/deepseek-v4-flash, z-ai/glm-5.2
tests:       $0.0054 · 65,825 in    / 224 out    · 0 cached (0%)        · deepseek/deepseek-v4-flash
description: $0.0184 · 58,439 in    / 9,955 out  · 41,292 cached (71%)  · z-ai/glm-5.2

[tinysweeper]

The previously-blocking findings are resolved. Clearing the changes request.

             $0.0502 · 314,870 in / 19,629 out · 132,276 cached (42%) · openrouter/openai/text-embedding-3-small, deepseek/deepseek-v4-flash, z-ai/glm-5.2 · 754 embedded
critique:    $0.0122 · 95,598 in  / 4,078 out  · 10,095 cached (11%)  · deepseek/deepseek-v4-flash, z-ai/glm-5.2
security:    $0.0105 · 94,604 in  / 2,395 out  · 21,192 cached (22%)  · deepseek/deepseek-v4-flash, z-ai/glm-5.2
tests:       $0.0150 · 65,938 in  / 8,105 out  · 56,104 cached (85%)  · z-ai/glm-5.2
description: $0.0125 · 58,730 in  / 5,051 out  · 44,885 cached (76%)  · z-ai/glm-5.2