Closed the strict public-content boundary for the Mem0 architecture page, integrated the accepted page-specific Export opt-out, reconciled the independently dynamic monitor publication, and preserved rollback and lifecycle evidence.

Mem0 public boundary closeout — 2026-08-28

This is a corrective final addendum to rdmsm4x-changelog-20260828-0133-mem0-public-architecture.md. The earlier file and its Apple Notes projection remain preserved as intermediate-publication evidence, but their public-boundary and completion claims are superseded: the inherited managed Export block contained two generic filesystem-path templates, so the task was reopened and not complete at that point.

Scope and outcome

• Host: rdmsm4x for source, exporter integration, page publication, verification, and durable records.
• Public route: https://dev.dataroo.net/mem0/, which is unauthenticated HTTP 200 and therefore treated byte-for-byte as public content.
• Mem0 runtime, models, vector collection, persistent data, credentials, client registrations, Cloudflare authentication/access policy, nginx, monitor scheduler/publisher, and unrelated static pages were not changed.
• The live page now retains one canonical managed navigation block, declares one real page-owned Export opt-out, contains zero managed Export blocks, and passes the strict public-content scan.
• The accepted documentation/publication request is complete. Canonical Git integration and remote push remain separate and have not been performed.

Source and local-state changes

Mem0 documentation branch codex/mem0-architecture-docs-20260828:

• /Users/richh/dev/_worktrees/codex-mem0-architecture-docs-20260828/README.md
• /Users/richh/dev/_worktrees/codex-mem0-architecture-docs-20260828/docs/architecture-and-setup.md
• /Users/richh/dev/_worktrees/codex-mem0-architecture-docs-20260828/SESSION-STATE.md
• /Users/richh/dev/_worktrees/codex-mem0-architecture-docs-20260828/ISSUES.md
• Public guide content commit: 365098efd7fbbda6364b2f7c96e40d29acfd1acc.
• Final documentation and artifact-acceptance record commit: a45696031a6c23684cfa2dc2ef0f85ad02981a45.

Status-page branch codex/mem0-architecture-diagram-20260828:

• /Users/richh/dev/_worktrees/dev-dataroo-net/codex-mem0-architecture-diagram-20260828/sites/mem0-status/index.html
• /Users/richh/dev/_worktrees/dev-dataroo-net/codex-mem0-architecture-diagram-20260828/sites/mem0-status/README.md
• /Users/richh/dev/_worktrees/dev-dataroo-net/codex-mem0-architecture-diagram-20260828/sites/mem0-status/prepare_publish.py
• /Users/richh/dev/_worktrees/dev-dataroo-net/codex-mem0-architecture-diagram-20260828/sites/mem0-status/verify_origin.py
• /Users/richh/dev/_worktrees/dev-dataroo-net/codex-mem0-architecture-diagram-20260828/sites/mem0-status/publish_mem0_status.zsh
• /Users/richh/dev/_worktrees/dev-dataroo-net/codex-mem0-architecture-diagram-20260828/tests/test_mem0_status_dashboard.py
• Final clean source commit: 9462c8768bdc736c64e4a2ad70b72865f5f265f6.

Exporter branch codex/mem0-public-export-optout-20260828:

• /Users/richh/dev/_worktrees/codex-mem0-public-export-optout-20260828/dr_export.py
• /Users/richh/dev/_worktrees/codex-mem0-public-export-optout-20260828/tests/test_devsite_navigation.py
• Accepted successor commit: 132745f42387e0ab44c50de65bb1dadd19093338.
• Live integration target: /Users/richh/dev/scripts/dr_export.py.
• The received predecessor 962dcda3835de568a702b25a5c32555579bf7e6f was not accepted, was superseded, and was never integrated.

Deployment and durable evidence:

• /Users/richh/dataroo.net/wiki/mem0/index.html — atomically replaced with the prepared strict-boundary page.
• /Users/richh/Library/Mobile Documents/com~apple~CloudDocs/Codex/projects/AGENTS.md principles/PROJECTS.md — final Mem0 and dev.dataroo.net milestones.
• /Users/richh/.agent-coordination/checkins/codex-rdmsm4x-mem0-architecture-docs-20260828.json — final task lifecycle and evidence.
• /Users/richh/dev/_backups/devsite-mem0-status/20260828-021922/verification/ — original aggregate failure plus causal per-file reconciliation.
• This changelog and its Apple Notes projection.

Lifecycle receipts

• User directive: received and accepted.
• Documentation and page source: prepared, committed, and verified in isolated worktrees.
• Exporter scope release: received and accepted for the exact released file/test scope.
• Predecessor exporter artifact: dispatched, received, not accepted, and superseded.
• Successor exporter artifact: dispatched, received, independently accepted, and atomically integrated with rollback.
• Mem0 page deployment: applied atomically; verification was held when the first unrelated-page aggregate failed.
• Causal reconciliation: dispatched, received, independently reproduced, and accepted.
• Public receipt: HTTP 200 and fresh uncached desktop/mobile/light/dark browser receipt accepted with navigation present and Export absent.
• Final artifact dispatch: performed to source coordinator task 01a046a5-081e-7452-8e4e-a0cbf56318d8, explicitly received, independently reproduced, and accepted.
• Canonical Git merge and remote push: not performed or claimed; artifact acceptance is not integration.

Hashes and verification

• Exporter live/source SHA-256: ed60f8bcb45350a679362d0fe1053028165298570d4d3e81d0a0b8d52536396a.
• Mem0 page source SHA-256: f13189d5edaaf2f0888cedff51ffdc1d942484d2039fceb10dd2d6ee110a0a26.
• Mem0 deployed file and loopback-origin SHA-256: 4bd398f222e29b0ab0ee70fd9133bccda2d6641a2c2a8fc0f8dede3f091877fa; origin HTTP 200.
• Public edge: HTTP 200 with the expected architecture and strict boundary. Cloudflare-injected markup makes public response hashes observational rather than a stable origin-equality contract.
• Exporter read-only audit: 40 pages have nav + export, 1 intentional export opt-out, 0 missing.
• Site suite: 46 tests passed, including 16 focused Mem0 page/publisher tests.
• Exporter suite: 14 tests passed; Python compilation and Git whitespace checks passed; ordinary-page and false-positive fixtures preserve the released baseline.
• Mem0 suite: 37 tests passed; Ruff passed.
• Live runtime validator: all five stages passed; mem0-api and mem0-qdrant remained healthy.
• Browser QA: one accessible 12-node/13-edge desktop SVG, five-group/12-node mobile topology, six setup cards, correct responsive visibility, light/dark presentation, and no root overflow or console errors.
• Strict source/deployed/origin/public scans found no private hostname, filesystem path, collection identifier, credential, token, authentication detail, model digest, memory body, prompt, or sensitive topology in Mem0 content.
• Existing website Compose configuration SHA-256 remained 0f87dea1c9b8160935a73af08bd28a270b3366b713a7866273dc8b96e21e8652.
• Mem0 rendered Compose configuration SHA-256 remained 50b8a96021e75ba2cb3617e6576418ac38a05f941b19ca812b1c6ff4ed5eebc4.

Unrelated-page reconciliation

• The original 43-page aggregate failed and is preserved as evidence: preintegration 447a1ae46336ed10521a8af4e41fe7194f0a7736c623e3dbe0e46b452ba04448; immediate postdeployment f0807d079b60c020d9252786f928d942ed742ef66a4aea887c8b4940c9434e02.
• The only unrelated HTML file with a later modification time was the independently dynamic monitor/index.html. Its retained supervisor invokes its own publisher every 60 seconds; that publisher targets the monitor page and then runs the shared shell injector.
• Per-file manifests for the other 42 unrelated static pages were byte-identical before and after a later monitor refresh/global-inject cycle. Both manifest files hash to 0ec0a2053e44a9a2f74fad4f5689c275c5a568a98a2d61f2426e5a87a726c488.
• During that cycle only the monitor changed. The Mem0 page remained at 4bd398f222e29b0ab0ee70fd9133bccda2d6641a2c2a8fc0f8dede3f091877fa, with navigation present, one real opt-out, zero managed Export blocks, and a passing strict scan.
• No independently owned monitor output was reverted or overwritten.

Backups and undo

• Exporter backup, checksum manifest, and rollback instructions: /Users/richh/dev/_backups/devsite-dr-export/20260828-021658/.
• Page backup, checksum evidence, failed aggregate, causal manifests, and rollback instructions: /Users/richh/dev/_backups/devsite-mem0-status/20260828-021922/.
• Earlier automatic-rollback evidence for the bind-mount visibility race remains at /Users/richh/dev/_backups/devsite-mem0-status/20260828-011450/.
• To undo the exporter, follow its retained rollback instructions, atomically restore the exact baseline file, and rerun its focused suite and read-only audit.
• To undo the page, follow its retained rollback instructions, atomically restore the prior page, and reverify file/origin/public health. Do not revert the independently dynamic monitor page.
• No Mem0 runtime rollback is required because its runtime and data were not changed.

Outstanding owner actions

• If canonical source integration is desired, explicitly dispatch the three isolated branches, record each receipt and acceptance, rerun their stated tests, then merge without conflating that source event with the already accepted live publication.
• Keep both rollback directories and all isolated worktrees until canonical integration is accepted.
• Existing Mem0 client canary and unreachable-host gates remain unchanged.