tinyhumansai · senamakel · Jul 18, 2026 · Jul 17, 2026 · Jul 17, 2026 · Jul 17, 2026
diff --git a/.github/workflows/ci-lite.yml b/.github/workflows/ci-lite.yml
@@ -380,11 +380,16 @@ jobs:
     needs: [changes]
     if: needs.changes.outputs['rust-core'] == 'true' || needs.changes.outputs['rust-tauri'] == 'true'
     runs-on: ubuntu-22.04
-    timeout-minutes: 25
+    # Was 25; raised because the lane now links (--all-targets) and runs a test
+    # binary, not just `cargo check`.
+    timeout-minutes: 40
     container:
       image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
     env:
       CARGO_INCREMENTAL: "0"
+      # Deep-async-stack belt (same as the coverage lanes) — virtual reservation,
+      # zero cost. Keeps a gate-contract test with a deep stack from tripping.
+      RUST_MIN_STACK: "67108864"
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -402,8 +407,68 @@ jobs:
           shared-key: pr-rust-feature-gate-smoke
 
       - name: Check core builds with the default domain gates disabled
+        # Lib-scoped on purpose. `--all-targets` would additionally compile the
+        # `tests/` integration crates, which today name gated symbols
+        # (voice::reply_speech::test_seam, mcp_registry::store, x402::tools) without
+        # a #[cfg] and so do not compile with the gates off. That cleanup is tracked
+        # in #5021 alongside running the full gates-off suite; until it lands, this
+        # lane checks the lib and RUNS the gate-contract lib tests below.
         run: bash scripts/ci-cancel-aware.sh cargo check --manifest-path Cargo.toml --no-default-features --features tokenjuice-treesitter
 
+      - name: Run the gate-contract tests with the default domain gates disabled
+        # `cargo check` (even --all-targets) never RUNS tests, so a gated family that
+        # is asserted WITHOUT a matching #[cfg] compiles fine and only fails at
+        # runtime — exactly how the two ungated `voice` asserts sat red on main
+        # (#5022). This step executes the gate-contract test modules so that class of
+        # regression fails CI, not just a local pre-push.
+        #
+        # Scope is deliberate: the full gates-off `--lib` run aborts on a pre-existing
+        # task_local stack overflow (`agent::harness::session::tests::
+        # turn_dispatches_spawn_subagent_through_full_path`) that reproduces in the
+        # gates-ON build too, and also OOMs unscoped. These filters route AROUND that
+        # test by scope, not by skip. Running the full suite is tracked in #5021.
+        run: |
+          bash scripts/ci-cancel-aware.sh cargo test --manifest-path Cargo.toml \
+            --no-default-features --features tokenjuice-treesitter --lib -- \
+            core::all:: core::cli:: core::jsonrpc:: core::legacy_aliases:: agent_registry::agents::loader::
+
+      - name: Guard — new feature-gated test modules must be acknowledged
+        # Self-maintaining coverage: the set of source files that #[cfg]-gate a test on
+        # a domain feature must equal the allowlist below. When a new gate (or a new
+        # test in an existing gate's domain) adds a gated test file, this fails — the
+        # author then adds it here AND, if it can hold an ungated-assert regression of
+        # the #5022 class, extends the scoped `cargo test` filter above. Prevents the
+        # smoke lane from silently under-covering as the gate surface grows.
+        run: |
+          set -euo pipefail
+          EXPECTED=$(cat <<'EOF'
+          core/all_tests.rs
+          core/cli_tests.rs
+          core/jsonrpc_tests.rs
+          core/legacy_aliases.rs
+          openhuman/agent/harness/builtin_definitions.rs
+          openhuman/agent/harness/definition_tests.rs
+          openhuman/agent/harness/session/tests.rs
+          openhuman/agent/harness/subagent_runner/tool_prep.rs
+          openhuman/agent_registry/agents/loader.rs
+          openhuman/inference/local/mod.rs
+          openhuman/tool_registry/ops_tests.rs
+          openhuman/tool_registry/schemas.rs
+          openhuman/tools/ops_tests.rs
+          openhuman/voice/compile_status.rs
+          openhuman/wallet/stub.rs
+          openhuman/web3/stub.rs
+          openhuman/x402/stub.rs
+          EOF
+          )
+          ACTUAL=$(grep -rlE '#\[cfg\((not\()?feature = "(voice|media|web3|meet|mcp|skills|flows)"' src --include='*.rs' \
+            | xargs grep -lE '#\[test\]|#\[tokio::test\]|fn .*_test' 2>/dev/null | sed 's|^src/||' | sort -u)
+          if ! diff <(echo "$EXPECTED" | sed 's/^ *//' | sort -u) <(echo "$ACTUAL"); then
+            echo "::error::Gated-test file set changed. Update the EXPECTED allowlist in the rust-feature-gate-smoke lane, and extend the scoped 'cargo test' filter if the new module can carry an ungated-assert regression (see #5022)."
+            exit 1
+          fi
+          echo "gate-contract test coverage allowlist is current"
+
   rust-core-coverage:
     name: Rust Core Coverage (cargo-llvm-cov)
     needs: [changes, rust-quality]

diff --git a/app/src-tauri/src/claude_code.rs b/app/src-tauri/src/claude_code.rs
@@ -43,7 +43,7 @@ end tell"#;
             .args(["-e", script])
             .spawn()
             .map_err(|e| format!("failed to open Terminal.app: {e}"))?;
-        return Ok("Terminal.app".into());
+        Ok("Terminal.app".into())
     }
 
     #[cfg(target_os = "linux")]

diff --git a/app/src-tauri/src/imessage_scanner/mod.rs b/app/src-tauri/src/imessage_scanner/mod.rs
@@ -372,7 +372,7 @@ fn extract_text_from_attributed_body(blob: &[u8]) -> Option<String> {
         .filter_map(|r| String::from_utf8(r).ok())
         .filter(|s| {
             let trimmed = s.trim();
-            trimmed.len() >= 2 && !ignored_markers.iter().any(|m| trimmed == *m)
+            trimmed.len() >= 2 && !ignored_markers.contains(&trimmed)
         })
         .max_by_key(|s| s.len())
         .map(|s| s.trim().to_string())

diff --git a/app/src-tauri/src/lib.rs b/app/src-tauri/src/lib.rs
@@ -1195,7 +1195,7 @@ fn mascot_window_show(app: AppHandle<AppRuntime>) -> Result<(), String> {
     log::info!("[mascot-window] show requested");
     #[cfg(target_os = "macos")]
     {
-        return mascot_native_window::show(&app);
+        mascot_native_window::show(&app)
     }
     #[cfg(not(target_os = "macos"))]
     {
@@ -1258,11 +1258,11 @@ fn notch_window_show(app: AppHandle<AppRuntime>) -> Result<(), String> {
     log::info!("[notch-window] show requested");
     #[cfg(target_os = "macos")]
     {
-        return dispatch_notch_on_main(app, |app| {
+        dispatch_notch_on_main(app, |app| {
             if let Err(e) = notch_window::show(app) {
                 log::warn!("[notch-window] show failed: {e}");
             }
-        });
+        })
     }
     #[cfg(not(target_os = "macos"))]
     {
@@ -1277,7 +1277,7 @@ fn notch_window_hide(app: AppHandle<AppRuntime>) -> Result<(), String> {
     log::info!("[notch-window] hide requested");
     #[cfg(target_os = "macos")]
     {
-        return dispatch_notch_on_main(app, |_app| notch_window::hide());
+        dispatch_notch_on_main(app, |_app| notch_window::hide())
     }
     #[cfg(not(target_os = "macos"))]
     {

diff --git a/app/src-tauri/src/mascot_native_window.rs b/app/src-tauri/src/mascot_native_window.rs
@@ -52,6 +52,9 @@ const DRAG_POLL_SECONDS: f64 = 0.016;
 /// dropped webview.
 struct MascotPanel {
     panel: Retained<NSPanel>,
+    // RAII keep-alive: never read, but dropping it deallocates the WKWebView and
+    // blanks the panel. Must outlive the show/hide cycle — do not remove.
+    #[allow(dead_code)]
     webview: Retained<WKWebView>,
     drag_timer: Retained<NSTimer>,
 }
@@ -389,7 +392,7 @@ unsafe fn build_webview(
         let _: () = msg_send![&*webview, setAutoresizingMask: 18u64]; // width|height
 
         // Make the webview the panel's content view so it fills the frame.
-        let webview_ref: &objc2::runtime::AnyObject = &*webview;
+        let webview_ref: &objc2::runtime::AnyObject = &webview;
         let webview_view: *mut objc2::runtime::AnyObject =
             webview_ref as *const _ as *mut objc2::runtime::AnyObject;
         let _: () = msg_send![panel, setContentView: webview_view];

diff --git a/app/src-tauri/src/native_notifications/mod.rs b/app/src-tauri/src/native_notifications/mod.rs
@@ -37,7 +37,7 @@ use crate::AppRuntime;
 pub fn notification_permission_state() -> Result<String, String> {
     #[cfg(target_os = "macos")]
     {
-        return macos::permission_state();
+        macos::permission_state()
     }
     #[cfg(not(target_os = "macos"))]
     {
@@ -51,7 +51,7 @@ pub fn notification_permission_state() -> Result<String, String> {
 pub fn notification_permission_request() -> Result<String, String> {
     #[cfg(target_os = "macos")]
     {
-        return macos::request_permission();
+        macos::request_permission()
     }
     #[cfg(not(target_os = "macos"))]
     {

diff --git a/app/src-tauri/src/notch_window.rs b/app/src-tauri/src/notch_window.rs
@@ -61,10 +61,6 @@ thread_local! {
     static NOTCH: RefCell<Option<NotchPanel>> = const { RefCell::new(None) };
 }
 
-pub(crate) fn is_open() -> bool {
-    NOTCH.with(|cell| cell.borrow().is_some())
-}
-
 pub(crate) fn hide() {
     NOTCH.with(|cell| {
         if let Some(existing) = cell.borrow_mut().take() {
@@ -262,7 +258,7 @@ unsafe fn build_webview(
         // Auto-resize to fill the panel content view.
         let _: () = msg_send![&*webview, setAutoresizingMask: 18u64]; // width|height
 
-        let webview_ref: &objc2::runtime::AnyObject = &*webview;
+        let webview_ref: &objc2::runtime::AnyObject = &webview;
         let webview_view = webview_ref as *const _ as *mut objc2::runtime::AnyObject;
         let _: () = msg_send![panel, setContentView: webview_view];
 

diff --git a/app/src/services/chatService.ts b/app/src/services/chatService.ts
@@ -966,7 +966,7 @@ export function subscribeChatEvents(listeners: ChatEventListeners): () => void {
   }
 
   // Artifact lifecycle events (#2779). The Rust subscriber in
-  // `channels/providers/web::ArtifactSurfaceSubscriber` packs the
+  // `web_chat::ArtifactSurfaceSubscriber` packs the
   // artifact payload into the generic `args` field of the wire
   // envelope (kept the WebChannelEvent struct shape stable to avoid
   // touching ~10 existing call sites with `..Default::default()`).

diff --git a/docs/TEST-COVERAGE-MATRIX.md b/docs/TEST-COVERAGE-MATRIX.md
@@ -182,7 +182,7 @@ Canonical mapping of every product feature to its test source(s). Drives gap-fil
 | 4.2.1 | User Message Handling                                              | WD+RI    | `conversations-web-channel-flow.spec.ts`, `tests/json_rpc_e2e.rs`                                                                                                                                                                                                    | ✅     |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 | 4.2.2 | AI Response Generation                                             | WD       | `agent-review.spec.ts`                                                                                                                                                                                                                                               | ✅     | Mock LLM                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | 4.2.3 | Streaming Responses                                                | RI       | `tests/json_rpc_e2e.rs`, `tests/agent_harness_e2e.rs`                                                                                                                                                                                                                | ✅     | `tests/agent_harness_e2e.rs` adds provider-level SSE tool-arg accumulation (chunked args reassembled + parsed) and engine-level delta forwarding (#3471)                                                                                                                                                                                                                                                                                                                                                                                    |
-| 4.2.4 | Parallel inference (cross-thread + within-thread forked turns)     | RU+VU    | `src/openhuman/channels/providers/web_tests.rs`, `app/src/store/__tests__/chatRuntimeSlice.test.ts`, `app/src/providers/__tests__/ChatRuntimeProvider.test.tsx`                                                                                                      | 🟡     | Concurrent same-/cross-thread dispatch, cooperative `CancellationToken` teardown, and parallel-lane stream routing covered; dedicated WD E2E is a follow-up                                                                                                                                                                                                                                                                                                                                                                                 |
+| 4.2.4 | Parallel inference (cross-thread + within-thread forked turns)     | RU+VU    | `src/openhuman/web_chat/web_tests.rs`, `app/src/store/__tests__/chatRuntimeSlice.test.ts`, `app/src/providers/__tests__/ChatRuntimeProvider.test.tsx`                                                                                                      | 🟡     | Concurrent same-/cross-thread dispatch, cooperative `CancellationToken` teardown, and parallel-lane stream routing covered; dedicated WD E2E is a follow-up                                                                                                                                                                                                                                                                                                                                                                                 |
 | 4.2.5 | Per-thread todo list (plan strip above composer)                   | RU+VU+WD | `src/openhuman/agent/tools/todo.rs`, `app/src/pages/conversations/components/ThreadTodoStrip.test.tsx`, `app/test/e2e/specs/chat-thread-todo-strip.spec.ts`                                                                                                          | ✅     | Read-only thread-scoped todo strip fed by `task_board_updated`; agent `todo` tool guidance + thread binding; E2E drives a `todo` tool call and asserts the card renders                                                                                                                                                                                                                                                                                                                                                                     |
 | 4.2.6 | Background-activity panel (chat-header Background tasks button)    | VU+WD    | `app/src/pages/conversations/hooks/useBackgroundActivity.test.ts`, `app/src/pages/conversations/components/__tests__/BackgroundActivityRows.test.tsx`, `app/test/e2e/specs/chat-background-activity-panel.spec.ts`                                                   | ✅     | View-only panel surfacing this chat's async sub-agents + global cron jobs, subconscious/heartbeat status, and memory syncing; freshness-only "Syncing now" labeling; E2E opens the panel and asserts its sections render and close                                                                                                                                                                                                                                                                                                          |
 | 4.2.7 | Plan-mode review (Approve / Reject / Send-feedback before execute) | RU+RI+VU | `src/openhuman/plan_review/gate.rs`, `src/openhuman/plan_review/tool.rs`, `src/openhuman/plan_review/schemas.rs`, `tests/json_rpc_e2e.rs`, `app/src/pages/conversations/components/PlanReviewCard.test.tsx`, `app/src/pages/__tests__/Conversations.render.test.tsx` | ✅     | Interactive turns call `request_plan_review`, which parks the LIVE turn on the in-memory `PlanReviewGate` (oneshot) until the user decides; `plan_review_request` socket event drives `PlanReviewCard`, which resolves via `openhuman.plan_review_decide` (approve resumes-and-executes / reject resumes-and-stops / revise resumes-with-feedback). RU covers gate park/resolve/timeout + tool auto-approve + parking; RI covers the decide RPC; VU covers the card + provider wiring. WD E2E (agent-driven park flow) tracked as follow-up |

diff --git a/src/core/all.rs b/src/core/all.rs
@@ -388,7 +388,7 @@ fn build_registered_controllers() -> Vec<GroupedController> {
     push(
         &mut controllers,
         DomainGroup::Channels,
-        crate::openhuman::channels::providers::web::all_web_channel_registered_controllers(),
+        crate::openhuman::web_chat::all_web_channel_registered_controllers(),
     );
     push(
         &mut controllers,

diff --git a/src/core/all_tests.rs b/src/core/all_tests.rs
@@ -823,6 +823,9 @@ async fn harness_excludes_gated_namespaces() {
         .collect();
     #[cfg(feature = "flows")]
     assert!(full_ns.contains("flows"), "full() must expose flows");
+    // `voice` was the pathfinder gate (#4803) and predates this per-assert cfg
+    // convention; gate it like its siblings so the disabled build passes (#5022).
+    #[cfg(feature = "voice")]
     assert!(full_ns.contains("voice"), "full() must expose voice");
 
     let ctx = CoreContext::for_test(DomainSet::harness(), None);
@@ -958,6 +961,9 @@ fn group_mapping_smoke() {
     // has no controller to map. Skip when its Cargo feature is off.
     #[cfg(feature = "skills")]
     assert_eq!(group_for_namespace("skills"), Some(DomainGroup::Skills));
+    // `voice` predates the per-assert cfg convention (#4803); registry-derived, so
+    // it has no entry to map when the feature is off. Gate like its siblings (#5022).
+    #[cfg(feature = "voice")]
     assert_eq!(group_for_namespace("voice"), Some(DomainGroup::Voice));
     #[cfg(feature = "web3")]
     assert_eq!(group_for_namespace("wallet"), Some(DomainGroup::Web3));

diff --git a/src/core/event_bus/events.rs b/src/core/event_bus/events.rs
@@ -579,7 +579,7 @@ pub enum DomainEvent {
     /// flow-approval-surface, PR2/PR3). Unlike `ApprovalRequested`, this
     /// event carries no `thread_id`/`client_id` — a flow run has neither, so
     /// the generic chat-routed socket bridge
-    /// (`channels::providers::web::event_bus::ApprovalSurfaceSubscriber`)
+    /// (`web_chat::event_bus::ApprovalSurfaceSubscriber`)
     /// silently drops it (that gap was the original silent-deadlock bug).
     /// Published by `ApprovalGate::intercept_audited` alongside the existing
     /// `ApprovalRequested`, bridged by `core::socketio` directly to a
@@ -611,7 +611,7 @@ pub enum DomainEvent {
     ///
     /// Bridged to the `external_transfer_pending` web-channel socket event by
     /// `EgressSurfaceSubscriber` (defined in
-    /// `src/openhuman/channels/providers/web/event_bus.rs`) when the emitting
+    /// `src/openhuman/web_chat/event_bus.rs`) when the emitting
     /// turn carries chat routing. `thread_id` / `client_id` come from the
     /// ambient `APPROVAL_CHAT_CONTEXT` and are `None` for CLI / cron /
     /// background transfers (no chat surface to route to).