fix(mcp): keep implicit recall within readable scope

[abhinav7x94]

Summary

• keep unselected search_memory calls unscoped instead of forcing sm_project_default
• validate durable active-space state against the current OAuth grant before using it
• let downstream authorization choose readable scope when no usable selection exists, reporting containerTag: null
• align MCP guidance and documentation with the runtime behavior

Why

A scoped OAuth connection could receive a misleading 403 because MCP turned "no usable selection" into an explicit request for sm_project_default. Durable active state could also outlive or cross OAuth client grants and cause the same failure.

This restores the behavior fixed by #1357 and later regressed by #1394.

Scope resolution

Request state	Search target
Explicit space	Explicit space; no visibility preflight
Active space visible to the current grant	Active space
Missing or inaccessible active space	Caller-authorized readable scope; containerTag: null

The visibility preflight uses the current bearer. If it fails, the tool returns an error without searching.

Testing

• cd apps/mcp && bun run test:unit - 28/28 passed, including the production widget build
• cd apps/mcp && bun run check-types - passed
• bunx biome check ... - passed
• git diff --check - passed

Test Coverage

Coverage gate: PASS (19/22 paths, 86%). Repository test files: 46 -> 48 (+2).

search_memory scope
|-- tested: no explicit/active space stays unscoped
|-- tested: visible active space is retained
|-- tested: explicit space wins and skips validation
|-- tested: inaccessible active falls back to unscoped/null
|-- tested: visibility and resolver failures stop the search
|-- tested: scoped/unscoped SDK payload boundaries
`-- gap: real restricted-token OAuth E2E (integration-only)

Pre-Landing Review

Independent testing, maintainability, API-contract, security, performance, and adversarial reviews completed. Contract/documentation drift and cross-client stale-active behavior were found and fixed. The final adversarial review reported no fixable security or correctness findings.

The inherited-active path intentionally adds one space-visibility request so a generic 403 is never retried as a broader search.

Design Review

No frontend files changed; visual review was not applicable.

Scope Drift

CLEAN - all nine changed files directly implement, test, or document this regression fix.

Documentation

• apps/mcp/README.md: documents search-specific scope resolution and nullable output
• apps/docs/supermemory-mcp/mcp.mdx: updates the tool reference and profile behavior
• apps/docs/supermemory-mcp/setup.mdx: clarifies active-space and OAuth-scope fallback behavior

[MaheshtheDev]

🤖 AI-assisted triage, reviewed by @MaheshtheDev.

Thanks! Replaced by the v5 migration (#1783): MCP now uses namespace instead of containerTag scoping. Closing.