docs(memory): document and harden hybrid gateway setup

app-instance/backend/tests/unit/test_config_loader.py

@@ -579,6 +579,29 @@ def test_hybrid_memory_rejects_unknown_scope(tmp_path) -> None:
         load_config(config_path=config_path)
 
 
+def test_hybrid_memory_rejects_empty_scope(tmp_path) -> None:
+    config_path = tmp_path / "config.json"
+    config_path.write_text(
+        json.dumps(
+            {
+                "memory": {
+                    "mode": "hybrid",
+                    "gateway": {
+                        "baseUrl": "http://127.0.0.1:8010",
+                        "userId": "gateway-user",
+                        "userKey": "uk_secret",
+                        "scope": [],
+                    },
+                }
+            }
+        ),
+        encoding="utf-8",
+    )
+
+    with pytest.raises(ValueError, match="scope"):
+        load_config(config_path=config_path)
+
+
 @pytest.mark.parametrize(
     ("gateway_override", "expected_error"),
     [

app-instance/backend/tests/unit/test_memory_gateway_loader.py

@@ -68,7 +68,10 @@ def test_loader_implicit_hybrid_without_credentials_warns_and_degrades(
         loaded.close()
 
 
-def test_loader_explicit_hybrid_without_credentials_fails_without_secret(tmp_path) -> None:
+def test_loader_explicit_hybrid_without_credentials_fails_before_opening_session_store(
+    tmp_path,
+    monkeypatch,
+) -> None:
     config = BeaverConfig(
         memory=MemoryConfig(
             mode="hybrid",
@@ -77,6 +80,11 @@ def test_loader_explicit_hybrid_without_credentials_fails_without_secret(tmp_pat
         )
     )
 
+    monkeypatch.setattr(
+        "beaver.engine.loader.SessionManager",
+        lambda workspace: pytest.fail("session store opened before memory config validation"),
+    )
+
     with pytest.raises(ValueError) as exc_info:
         EngineLoader(workspace=tmp_path, config=config).load()