Module global_memory 

Global Memory MuxAPI bodies, moved out of app_api/mod.rs unchanged (SPEC_LARGE_FILE_MODULE_ANALYSIS_2026_09_30.md item 9).

Structs

GlobalMemoryWriteProvenance 🔒

Caller-supplied provenance for a globalmemory.write call — same shape as MemoryWriteProvenance above; kept as a distinct type since callers are conceptually different (an agent writing to a workspace-wide list every other agent inherits, not its own private memory) even though the wire shape is identical.

Functions

bundle_version_diff 🔒

The diff text global_memory_diff_impl returns — a - name:/+ name: pair when the name changed (see that function’s doc comment for why), then line_diff over the instructions. Shared with Memory → Global’s globalmemory:diff WebSocket command (agent_handlers/bundle.rs) so the MCP tool and the UI can never render the same pair of versions two ways.

bundle_version_meta_json 🔒

A version’s metadata as JSON — id/content_hash/parent_version_id/ source/source_detail/written_by/created_at, no name/ instructions. Takes the five common-field accessors as plain values rather than borrowing a concrete struct so both BundleVersionSummary (the history list shape) and BundleVersion (the full-content shape revert’s freshly-inserted row comes back as) can share this one formatter without either type needing to convert into the other.

global_memory_diff_impl 🔒

A line-based diff between two recorded versions of one Global Memory entry (mirrors memory_diff_impl). Both versions must belong to id — reagent P1 in memory_diff_impl fixed the identical “diff across two unrelated owners” gap for native memory; the same check applies here since a version_id alone does not otherwise prove which bundle (and therefore whether a system-tier one) it came from. A name change is surfaced as its own two-line entry ahead of the instructions diff, since content_hash is computed over name + instructions together (bundle_versions.rs’s own content_hash doc comment) — a rename with unchanged body would otherwise produce a “no differences” instructions diff that silently hid the one thing that actually changed. Backs the GlobalMemoryDiff MCP tool.

global_memory_history_impl 🔒

Version history for one Global Memory entry, newest first — metadata only, no name/instructions (mirrors memory_history_impl’s summary shape and global_memory_list_impl’s “no content” posture). Refuses a system-tier, blank, or non-global id via load_ordinary_global_bundle — structurally the same exclusion list/read/remove already apply, so there is no path here that can ever surface a system-tier row’s history. Backs the GlobalMemoryHistory MCP tool.

global_memory_list_impl 🔒

Every Global Memory entry Memory → Global shows — id/name/updated_at/system, no content (mirrors memory_list_impl’s summary shape), system rows first as bundle_list_global orders them. System-tier rows are listed so an empty result means “nothing” and not “nothing you may touch” (the pane lists them too, and their content is already injected into every agent’s context); what stays structural is that read, write and remove refuse a system id. Backs the GlobalMemoryList MCP tool. docs/specs/SPEC_GLOBAL_MEMORY_LIST_SYSTEM_ROWS_2026_10_02.md

global_memory_read_impl 🔒

Full content of one ordinary Global Memory entry by id. Refuses a system-tier id, same reasoning as write. Backs the GlobalMemoryRead MCP tool.

global_memory_remove_impl 🔒

Demotes a Global Memory entry (clears is_global) — matches Memory → Global’s own “Remove” semantics: the bundle row itself survives (still available in Memory → Bundles), only its Global Memory membership is cleared. Refuses a system-tier id, the blank singleton, or any id that wasn’t ALREADY a Global Memory entry before this call — same ownership guards as global_memory_write_impl, for the identical reason: bundle ids are enumerable via PresetList regardless of is_global. Backs the GlobalMemoryRemove MCP tool.

global_memory_revert_impl 🔒

Restores a Global Memory entry’s live name/instructions to a prior recorded version — same “revert never rewrites history, it records a new version” semantics as memory_revert_impl (source: "revert", chained onto whatever the current latest version is). Reuses Store::bundle_upsert_with_version — the SAME primitive global_memory_write_impl already uses — so the live row and its new version are written atomically, in one transaction, exactly as that method’s own doc comment requires (codex P2, PR #3237). agent_id is the TRUSTED caller identity (an agent’s real AGENTMUX_AGENT_ID, resolved by agentmux-mcp from its own env, never caller-suppliable) recorded as written_by — never inferred from anything in the request body. written_by_uid is recorded beside it: the request’s Caller UID (identity M4c-1), "" when Unattributed. Backs the GlobalMemoryRevert MCP tool.

global_memory_write_impl 🔒

Creates a new ordinary Global Memory entry, or updates an existing one by id. Backs the GlobalMemoryWrite MCP tool.

load_ordinary_global_bundle 🔒

Loads id’s bundle and refuses it unless it is (a) not the blank singleton, (b) not a system-tier entry, and (c) currently a Global Memory entry (is_global) — the exact guard global_memory_write_impl/ global_memory_remove_impl already apply, reused here rather than re-derived so history/diff/revert can never diverge from it. Bundle ids for EVERY bundle in the system (not just global ones) are enumerable via PresetList (reagent P0/P1, PR #3237) — without this, an agent could point any of these three new routes at another agent’s private preset, or at AgentMux’s own system-tier entries, and read/restore content that was never meant to be reachable through this API.