Reduce Rust binary bloat from duplicate dependency versions and monomorphization

[senamakel]

Summary

A release-mode cargo machete / cargo bloat audit on 2026-08-13 found several meaningful Rust binary-size opportunities beyond the straightforward unused direct dependencies removed on the audit branch.

Measured on Linux x86_64 with Cargo release profiles:

Binary	File size	.text
openhuman-core	336.4 MiB	78.3 MiB
desktop OpenHuman	407.3 MiB	93.7 MiB

Commands:

cargo bloat --release --bin openhuman-core --crates -n 40
cargo bloat --manifest-path app/src-tauri/Cargo.toml --release --bin OpenHuman --crates -n 40
cargo tree --manifest-path app/src-tauri/Cargo.toml --duplicates

Findings

1. Align TOML versions

The desktop binary links toml 0.8 and 1.1. cargo bloat attributes 1.5 MiB of .text to TOML in desktop, compared with 173 KiB in the core CLI.

The 0.8 runtime users are:

• app/src-tauri/src/window_state.rs
• vendor/tinycortex memory configuration/source registry

OpenHuman core and Tauri runtime paths already use TOML 1.1. Investigate migrating the two 0.8 users while pinning serialization compatibility for existing window-state and memory configuration files.

2. Align reqwest where practical

The desktop binary links:

• reqwest 0.12.28 through OpenHuman, its direct desktop client, and vendored domain crates
• reqwest 0.13.1 exclusively through tauri-plugin-updater 2.10.1

cargo bloat attributes 1.3 MiB combined to reqwest. Determine whether a Tauri updater upgrade can converge versions, or whether migrating the wider OpenHuman client stack to 0.13 is justified. Avoid a broad migration unless measured savings outweigh compatibility cost.

3. Reduce TinyAgents monomorphization

The release binaries contain 54 tinyagents::graph::compiled::executor::*execute_run* symbols totaling approximately 900 KiB:

openhuman-core: symbols=54, 891.4 KiB
OpenHuman:      symbols=54, 901.3 KiB

Investigate moving large generic bodies behind non-generic/type-erased boundaries or otherwise reducing repeated CompiledGraph::execute_run instantiations. Preserve graph typing at the public boundary where it provides value.

4. Remaining dependency cleanup

• Decide whether the unused optional root rppal dependency and peripheral-rpi feature are intentional placeholders or should be removed/implemented.
• Remove unused futures from vendor/tinyplace dev-dependencies in its upstream repository.
• Validate/remove serde-big-array from the tinychannels whatsapp-web feature in its upstream repository. Machete reports no direct use, but the feature needs a WhatsApp-enabled build before removal.
• TOML, reqwest, tokio-tungstenite, zip, directories, and crypto primitives have multiple versions in the desktop graph. Prioritize by measured retained code rather than duplicate count.
• tokio-tungstenite 0.24/0.29 convergence is already tracked by build: bump socketioxide to unify tokio-tungstenite on 0.29 in the default profile #5463.

5. Verify production symbol stripping

The raw release binaries contain roughly 200-240 MiB of DWARF sections because [profile.release] enables line-table debugging and does not strip. Confirm whether release packaging strips or separates symbols. If not, evaluate split debug artifacts or strip = "debuginfo" while preserving Sentry symbolication and useful crash backtraces.

Acceptance criteria

• Add a reproducible size baseline or audit command suitable for future comparisons.
• Harmonize TOML versions, with compatibility tests for persisted data, or document why convergence is blocked.
• Resolve or document the reqwest 0.12/0.13 split.
• Measure and reduce TinyAgents execute_run monomorphization, or document why the code-size tradeoff is required.
• Resolve the remaining machete findings in their owning repositories/features.
• Confirm and document production stripping/symbol handling.
• Re-run release cargo bloat and record before/after .text sizes.

[senamakel]

Additional evidence from #5540: the TinyFlows host-stack advance in #5537 also moved vendor/tinyflows to reqwest = "0.13". The --no-default-features --features flows kernel profile now resolves both reqwest 0.12 and 0.13, increasing resolved packages from 307 to 308 while unique crate names stay at 284 and native builds stay at 2. Reqwest convergence should therefore account for TinyFlows as well as tauri-plugin-updater.