test: move inline tests into *_tests.rs files across vendored submodules

.github/workflows/ci-full.yml

@@ -132,8 +132,8 @@ jobs:
           # and leave a stale digest that only fails after the download. Both values
           # are the ubuntu-22.04-x86_64 row of `crates/openhuman-core/src/modules/registry.rs`,
           # which is the authoritative pin — copy them from there, never recompute.
-          memory_version="1.21.1"
-          memory_sha256="f208b1bf05e52af4ef7a9902d656827c471aa0a50aa3015ddb0ef9058e524c53"
+          memory_version="1.22.2"
+          memory_sha256="89f1da9f53e939263f3a7d9f4c6c19b52951bde308a9beb6efedc2b6c272163e"
           module_root="/opt/openhuman-test-modules/${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
           memory_dir="$module_root/tinymemory"
           juice_dir="$module_root/tinyjuice"
@@ -333,8 +333,8 @@ jobs:
           # tinybus validates every directory ancestor. GitHub mounts the
           # checkout as the host runner uid while this container runs as root,
           # so keep native fixtures in a root-owned, ephemeral tree.
-          memory_version="1.21.1"
-          memory_sha256="f208b1bf05e52af4ef7a9902d656827c471aa0a50aa3015ddb0ef9058e524c53"
+          memory_version="1.22.2"
+          memory_sha256="89f1da9f53e939263f3a7d9f4c6c19b52951bde308a9beb6efedc2b6c272163e"
           module_root="/opt/openhuman-test-modules/${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
           memory_dir="$module_root/tinymemory"
           juice_dir="$module_root/tinyjuice"

.github/workflows/e2e-playwright.yml

@@ -68,8 +68,8 @@ jobs:
           # tinybus validates every directory ancestor. GitHub mounts the
           # checkout as the host runner uid while this container runs as root,
           # so keep native fixtures in a root-owned, ephemeral tree.
-          memory_version="1.21.1"
-          memory_sha256="f208b1bf05e52af4ef7a9902d656827c471aa0a50aa3015ddb0ef9058e524c53"
+          memory_version="1.22.2"
+          memory_sha256="89f1da9f53e939263f3a7d9f4c6c19b52951bde308a9beb6efedc2b6c272163e"
           module_root="/opt/openhuman-test-modules/${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
           memory_dir="$module_root/tinymemory"
           juice_dir="$module_root/tinyjuice"

.github/workflows/e2e-reusable.yml

@@ -168,8 +168,8 @@ jobs:
           # and leave a stale digest that only fails after the download. Both values
           # are the ubuntu-22.04-x86_64 row of `crates/openhuman-core/src/modules/registry.rs`,
           # which is the authoritative pin — copy them from there, never recompute.
-          memory_version="1.21.1"
-          memory_sha256="f208b1bf05e52af4ef7a9902d656827c471aa0a50aa3015ddb0ef9058e524c53"
+          memory_version="1.22.2"
+          memory_sha256="89f1da9f53e939263f3a7d9f4c6c19b52951bde308a9beb6efedc2b6c272163e"
           module_root="/opt/openhuman-test-modules/${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
           memory_dir="$module_root/tinymemory"
           memory_archive="$memory_dir/tinymemory-module-${memory_version}-ubuntu-22.04-x86_64.tar.gz"
@@ -373,8 +373,8 @@ jobs:
           # and leave a stale digest that only fails after the download. Both values
           # are the ubuntu-22.04-x86_64 row of `crates/openhuman-core/src/modules/registry.rs`,
           # which is the authoritative pin — copy them from there, never recompute.
-          memory_version="1.21.1"
-          memory_sha256="f208b1bf05e52af4ef7a9902d656827c471aa0a50aa3015ddb0ef9058e524c53"
+          memory_version="1.22.2"
+          memory_sha256="89f1da9f53e939263f3a7d9f4c6c19b52951bde308a9beb6efedc2b6c272163e"
           module_root="/opt/openhuman-test-modules/${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
           memory_dir="$module_root/tinymemory"
           connectors_dir="$module_root/tinyconnectors"
@@ -487,8 +487,8 @@ jobs:
           # fixture outside the checkout owned by the host runner.
           # Version and digest are the ubuntu-22.04-x86_64 registry pin; do
           # not derive a replacement checksum from a local build.
-          memory_version="1.21.1"
-          memory_sha256="f208b1bf05e52af4ef7a9902d656827c471aa0a50aa3015ddb0ef9058e524c53"
+          memory_version="1.22.2"
+          memory_sha256="89f1da9f53e939263f3a7d9f4c6c19b52951bde308a9beb6efedc2b6c272163e"
           juice_version="0.5.0"
           juice_sha256="94c8998c830d9454560c00055187198a598eefaf5be51bcecdcd194a66f3b388"
           module_root="/opt/openhuman-test-modules/${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"

.gitignore

@@ -155,3 +155,6 @@ diff-coverage.md
 # Local/self-hosted CI run output (never commit)
 ci-out/
 ci-out-ex63/
+
+# Cargo build output inside the in-tree motosan-ai-oauth crate
+vendor/motosan-ai-oauth/target/

AGENTS.md

@@ -131,6 +131,17 @@ coverage must be at least 80 percent.
 
 - Frontend unit tests are colocated as `*.test.ts` or `*.test.tsx` under
   `app/src/`. Use Vitest and test behavior rather than implementation.
+- Rust unit tests are never inline. Put them in a sibling `<module>_tests.rs`
+  (`mod_tests.rs` beside a `mod.rs`) declared at the bottom of the module with
+  `#[cfg(test)]` and `#[path = "<module>_tests.rs"]` above `mod tests;`. The file
+  starts with `use super::*;` and carries no `#[cfg(test)]` of its own. Never name
+  one `test.rs`, `tests.rs` or `<module>_test.rs`, and never write an inline
+  `#[cfg(test)] mod tests { ... }` (`pnpm rust:layout` fails on an inline module
+  and on `test.rs`/`tests.rs`; it does not yet catch `<module>_test.rs`). The same
+  rule binds every `vendor/` submodule: `node scripts/externalize-inline-tests.mjs
+  <repo-root> --write` converts one mechanically, and a crate root directly in
+  `src/bin/` keeps its tests in `src/bin/<stem>/` because Cargo builds any `.rs`
+  placed straight in `src/bin/` as a binary.
 - Rust domain tests live beside their modules. Use
   `scripts/test-rust-with-mock.sh` for tests that need the shared mock backend.
 - JSON-RPC behavior belongs in Rust E2E tests, commonly

app/scripts/e2e-web-session.sh

@@ -239,6 +239,41 @@ if [ "$BUILT_CORE_PORT" != "$OPENHUMAN_CORE_PORT" ]; then
   exit 1
 fi
 
+# Refuse a bundle older than the sources it was built from (#5919).
+#
+# The session serves the prebuilt `dist-web`, so editing `app/src` and re-running
+# changes nothing in the browser: the spec runs against the PREVIOUS bundle and
+# passes, which makes a revert-proof or a fault injection prove nothing at all.
+# The marker is written after `build:web` returns, so anything newer than it is a
+# source change this bundle does not contain. `-quit` stops at the first hit, so
+# this is a stat walk rather than a hash of the tree, and directories are scanned
+# too: a file added, removed or renamed after the build shows up as a newer
+# directory even when no surviving file is newer.
+#
+# A missing input is an error rather than a skipped check. `find` on a path that
+# does not exist reports nothing, so a renamed input would silently turn this
+# gate off and leave the stale bundle served again.
+STALE_SOURCE=""
+for bundle_input in src public index.html vite.config.ts; do
+  input_path="$APP_DIR/$bundle_input"
+  if [ ! -e "$input_path" ]; then
+    echo "ERROR: bundle input $input_path does not exist, so staleness cannot be checked." >&2
+    echo "       Update the input list in $(basename "$0") to match the current layout." >&2
+    exit 1
+  fi
+  if [ -z "$STALE_SOURCE" ]; then
+    STALE_SOURCE="$(find "$input_path" -newer "$E2E_BUNDLE_MARKER" -print -quit)"
+  fi
+done
+if [ -n "$STALE_SOURCE" ]; then
+  echo "ERROR: $APP_DIR/dist-web is older than the sources it was built from." >&2
+  echo "       Newer than the bundle: $STALE_SOURCE" >&2
+  echo "       The bundle does not carry that change, so the specs would run against" >&2
+  echo "       the previous one and pass." >&2
+  echo "       Rebuild first: pnpm --filter openhuman-app test:e2e:web:build" >&2
+  exit 1
+fi
+
 export OPENHUMAN_CORE_BIN="$E2E_WEB_CORE_TARGET_DIR/debug/openhuman-core"
 if [ ! -x "$OPENHUMAN_CORE_BIN" ]; then
   echo "ERROR: standalone core binary is missing at $OPENHUMAN_CORE_BIN. Run pnpm --filter openhuman-app test:e2e:web:build first." >&2

app/src/pages/Brain.tsx

@@ -24,6 +24,7 @@ import SettingsTabbedPage from '../components/settings/layout/SettingsTabbedPage
 import MemoryEngineErrorAlert from '../components/settings/panels/MemoryEngineErrorAlert';
 import { classifyMemoryEngineError } from '../components/settings/panels/memoryEngineUtils';
 import { Alert, AlertDescription, Card } from '../components/ui';
+import { CenteredLoadingState } from '../components/ui/LoadingState';
 import { useT } from '../lib/i18n/I18nContext';
 import { useCoreState } from '../providers/CoreStateProvider';
 import type { ToastNotification } from '../types/intelligence';
@@ -421,7 +422,17 @@ export default function Brain() {
                           />
                         ) : error !== null ? (
                           <MemoryEngineErrorAlert error={error} fallbackText={t('brain.error')} />
-                        ) : null}
+                        ) : (
+                          // The first load can take seconds — a hosted engine
+                          // builds the graph from its derived layers — and an
+                          // empty canvas meanwhile reads as a broken page.
+                          <div role="status" data-testid="brain-graph-loading">
+                            <CenteredLoadingState
+                              label={t('workspace.loadingGraph')}
+                              className="h-[640px] rounded-lg border border-line-subtle bg-surface-muted/40"
+                            />
+                          </div>
+                        )}
                       </div>
                     </MemoryFamilyGate>
                   )}

app/src/pages/__tests__/Brain.test.tsx

@@ -111,6 +111,28 @@ describe('Brain page', () => {
     });
   });
 
+  it('shows a loading state, not an empty canvas, until the graph arrives', async () => {
+    let resolveGraph!: (graph: ReturnType<typeof makeGraph>) => void;
+    graphExportMock.mockReturnValue(
+      new Promise(resolve => {
+        resolveGraph = resolve;
+      })
+    );
+    await act(async () => {
+      renderWithProviders(<Brain />, { initialEntries: ['/?tab=graph'] });
+    });
+    expect(screen.getByTestId('brain-graph-loading')).toHaveTextContent('workspace.loadingGraph');
+    expect(screen.queryByTestId('memory-graph')).not.toBeInTheDocument();
+
+    await act(async () => {
+      resolveGraph(makeGraph(2));
+    });
+    await waitFor(() => {
+      expect(screen.getByTestId('memory-graph')).toHaveTextContent('nodes:2');
+    });
+    expect(screen.queryByTestId('brain-graph-loading')).not.toBeInTheDocument();
+  });
+
   it('renders empty-state graph when there are no nodes', async () => {
     graphExportMock.mockResolvedValue(makeGraph(0));
     await act(async () => {