@twinsearth/w2m-dsh-plugin 0.9.5 → 0.9.6

package/CHANGELOG.md

@@ -4,6 +4,76 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.6] — 2026-10-14
+
+**Individual memory: the fleet can now answer "what did we already try on this machine, and what happened?" — a question nothing in it could answer before.**
+
+### The gap this closes, measured rather than asserted
+
+The relay is sent `command_hash`, `stdout_sha256` and `stdout_bytes`, and never the text. That choice is
+defensible and stays: the ledger is a tamper-evident consistency record, and a relay compromise discloses
+no command text. The price was that no part of the fleet retained what a command actually did, and the
+price was paid over and over. In one working session the same facts were rediscovered from scratch across
+a dozen dispatches — that a machine had no package manager (3 times), which node binary actually ran (2),
+that its git could not reach github.com while node's HTTPS could (2), that a task is expired at about
+fifty seconds (3), and which commit its checkout was on (2).
+
+### What was added
+
+**`src/agent/memory.mjs` — one append-only `memory.jsonl` per machine, in its own state directory.**
+
+Written by the agent as each task finishes, at the one point where the output still exists at all and on
+the one machine that owns it. Each line carries the command, `cwd_rel`, exit code, status, duration,
+transport, and the tails of stdout and stderr — plus the envelope's hashes, so a human-readable record can
+be cross-checked against the relay's tamper-evident one without trusting either.
+
+Three properties are deliberate and each has a test:
+
+- **Bounded by construction**, with a byte cap and one rotating generation. This is not hypothetical
+  caution: the Linux host's root filesystem reached 100% today from 14.7 GB/day of uncapped logging, and
+  the recovery cost real time. A memory that can fill a disk is a worse outcome than no memory. Rotation
+  keeps the previous generation rather than discarding it, because the question this file answers is
+  usually about the recent past and the rotation boundary sits exactly there.
+- **A malformed line is skipped, not fatal.** A partially written final line is what a machine losing
+  power mid-append leaves behind, and one damaged line must not make the rest unreadable — the relay's own
+  ledger behaves this way for the same reason.
+- **`conclusion` is written as `null` by the machine and only ever filled in by a reader.** The design
+  separates fact from interpretation, and a machine that invented a conclusion would be asserting
+  something it cannot know. A test pins this, because the failure would be silent.
+
+**`w2m_memory` — the read side.** Returns this machine's memory, newest first, with a status tally, and
+reaches the rotated generation on request.
+
+It does **not** read another machine's memory, and says so instead of returning an empty list. The reason
+is structural rather than an omission: the relay carries no such file, and an agent executes a dispatched
+command inside a sandbox whose writes are scoped. A query for another machine is answered with
+`MEMORY_REMOTE_NOT_READABLE` and the two ways to actually read it. Returning `records: []` would have read
+as *"that machine has done nothing"* — the opposite conclusion from *"this build cannot see"*.
+
+The write is wrapped so it can never fail a task. The task is the work; this is a note about it.
+
+### Verified
+
+- `test/memory.test.mjs` — **18 tests, 0 failures**: record shape, tail and argv clamping, append-and-read,
+  newest-first ordering, the limit, a malformed line skipped, an absent file read as empty, rotation with
+  both generations readable, and that neither `appendMemory` nor `readMemorySync` throws on a bad directory.
+- A rotation test that trips the cap with *real* records rather than filler, because the first version
+  wrote eight megabytes of `'x'` — it rotated, but it could not answer the question being asked, since the
+  previous generation then held one unparseable line.
+- `eslint .` — 0 errors.
+- **The full pre-flight is green: 11 pass, 0 fail, 1 unverifiable** (1721 tests in 54 files; 1707 pass,
+  0 fail, 14 platform skips). The single `UNVERIFIABLE` is an accepted host observation, not a gate.
+  Reaching that required installing `git` on the development host, which had none; the 39 failures before
+  it were all `spawn git ENOENT`, and the two rounds of diagnosis after it were a sandbox rule (writing
+  files in `%TEMP%` is allowed, **creating a directory** there is refused — and `git init` creates one) and
+  two mojibake sequences this release then repaired. Recorded because "39 failures" read as a defect count
+  and was, at every stage, an environment count.
+- The nine-tool contract is updated everywhere it is pinned: `scripts/verify-installed.mjs`,
+  `test/loader-entry.test.mjs`, `test/tools.test.mjs`, `test/tool-cards.test.mjs`, `test/claims.test.mjs`,
+  `test/p2p-plugin.test.mjs`, `test/update-wiring.test.mjs` and the pre-flight gate inventory. Those
+  assertions are what make "the tool set" a contract rather than a habit, so leaving one at eight would
+  have failed a release that is otherwise correct.
+
 ## [0.9.5] — 2026-10-14
 
 **Same code as v0.9.4; published because v0.9.4's npm and GitHub bytes cannot be made to agree.**

package/README.md

@@ -39,7 +39,7 @@ So the cross-machine capability has to be built. This is that build.
                        ▼
    ┌──────────────────────────────────┐        ┌──────────────────────────┐
    │  Windows · DSH session           │        │  macOS · DSH session     │
-   │   w2m plugin (8 tools)           │        │   w2m plugin (8 tools)   │
+   │   w2m plugin (9 tools)           │        │   w2m plugin (9 tools)   │
    │        │                         │        │        │                 │
    │   Localside agent                │        │   Localside agent        │
    │    · three anchors               │        │    · three anchors       │
@@ -293,15 +293,15 @@ Then give it the relay URL in that profile's `cordis.patch.yml` — or leave
 >        got "@twinsearth/w2m-dsh-plugin/tools"), skipping
 > ```
 >
-> That is a silent failure by construction — the install looks right, eight tools appear, and
+> That is a silent failure by construction — the install looks right, nine tools appear, and
 > `w2m_status` reports `paired: false` and a null `rabbitUrl` because none of your values were ever
 > applied. It is not hypothetical: this row's expected name moved from the `/tools` subpath to the
 > package root in v0.5.4 (see `cordis.patch.yml`'s header for why), and every override that still
 > asserted the old subpath stopped being applied on upgrade. `id` already identifies the row, so the
 > safest `name:` is no `name:` at all.
 
-Restart DSH. You should see eight tools: `w2m_devices`, `w2m_run`, `w2m_wait`,
-`w2m_report`, `w2m_status`, `w2m_update`, `w2m_history`, `w2m_stats`.
+Restart DSH. You should see nine tools: `w2m_devices`, `w2m_run`, `w2m_wait`,
+`w2m_report`, `w2m_status`, `w2m_update`, `w2m_history`, `w2m_stats`, `w2m_memory`.
 
 > `dsh` may not be on your `PATH`. On a packaged install it lives under
 > `resources/runtime/cli/bin/`. If `dsh` is not found, call it by path.
@@ -584,7 +584,7 @@ a product.
 |---|---|---|
 | relay | 142 | pairing, auth, SSE with `ready`-first and `seq` replay, leases with heartbeat renewal and expiry, dedupe, all **nine** aggregation states plus `pending`/`refused`, report generation, operator token, rate limiting, persistence and restart recovery, TLS, and the lost-offer recovery path |
 | agent | 129 | allow-list allow/deny, timeout, output truncation, exit codes, anchors on clean and dirty trees, four concurrent fingerprint computations, spool, a 40-case URL join matrix, cursor lifecycle across relay restarts, and the bundled-runtime resolver |
-| tools | 89 | eight tools registered, schemas, typed errors, polling, operator-token enforcement (no request is sent without it), sub-path endpoints, and the credential canaries |
+| tools | 89 | nine tools registered, schemas, typed errors, polling, operator-token enforcement (no request is sent without it), sub-path endpoints, and the credential canaries |
 | broadcast | 19 | exactly one executor, the rest `observing`; observers excluded from every aggregation step so a machine that did not run is never counted as agreeing |
 | claims | 19 | the document claims themselves: the version, the bundle patch, the tool list, every documented tarball URL, and the CHANGELOG's shape |
 | fleet-target | 37 | the composer's target selection, and the `executor_machine_id` narrowing that overrides it |
@@ -712,7 +712,7 @@ the plugin:
 
 ```bash
 node scripts/check-entrypoints.mjs   # imports lib/tools.js, the exact specifier cordis.patch.yml mounts
-node scripts/verify-installed.mjs <path-to-installed-package>   # asserts the installed copy registers 8 tools
+node scripts/verify-installed.mjs <path-to-installed-package>   # asserts the installed copy registers 9 tools
 ```
 
 **Not verified:**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "DSH: Windows2MacOS — drive the same project on online Windows and macOS machines from one DeepSeek account, across networks and regions. P2P hole punching is the default path (relay + shared server as rendezvous, ledger and fallback), with a bundled STUN responder, Tailscale/public-VPS/tunnel shapes, Rabbit relay + per-machine Localside + eight DSH tools (replicate / split), nine aggregate verdicts and signed requests.",
   "type": "module",
   "main": "lib/index.js",
@@ -111,13 +111,13 @@
     }
   },
   "scripts": {
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
     "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs",
     "test:relay": "node --test --test-force-exit test/relay.test.mjs",
-    "test:agent": "node --test --test-force-exit test/agent.test.mjs",
+    "test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
     "test:tools": "node --test --test-force-exit test/tools.test.mjs",
     "test:crossnetwork": "node --test --test-force-exit test/crossnetwork.test.mjs",
-    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
+    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
     "pack": "node scripts/pack.mjs",
     "verify:join": "node scripts/verify-join.mjs",
     "lint": "eslint .",
@@ -125,7 +125,8 @@
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "verify": "node scripts/check-entrypoints.mjs && node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/tools.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/p2p-node.test.mjs test/p2p-agent.test.mjs test/client-bundle.test.mjs test/loader-entry.test.mjs",
-    "test:p2p": "node --test --test-force-exit test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/stun-server.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs"
+    "test:p2p": "node --test --test-force-exit test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/stun-server.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs",
+    "test:memory": "node --test --test-force-exit test/memory.test.mjs"
   },
   "keywords": [
     "dsh-bundle",

package/src/agent/agent.mjs

@@ -48,6 +48,7 @@ import {
   resolveProjectCwd,
 } from './git.mjs';
 import { createSpool } from './spool.mjs';
+import { appendMemory, memoryRecord } from './memory.mjs';
 import { matchAllowedCommand, parseAllowedCommands } from './allowed-commands.mjs';
 import { CRYPTO_REASON, DEVICE_KEY_FILE, DeviceKey, PeerKeyStore } from './crypto.mjs';
 import { DEFAULT_P2P_MODE, P2P_DEFAULTS, P2PNode, normalizeP2PMode, normalizeP2PPort } from './p2p-node.mjs';
@@ -2638,6 +2639,32 @@ export function createAgent(options) {
     const directResult = (context.p2pDelivery ?? p2pDeliveryMark()).path === 'p2p';
     envelope.transport = transport.offer_path === 'p2p' || directResult ? 'p2p' : transport.offer_path;
     envelope.p2p = envelopeP2P({ ...context, p2pTransport: transport });
+
+    /**
+     * v0.9.6 individual memory: write what this machine just did, where the text still exists.
+     *
+     * This is the last point at which the output is available to anything that will keep it. The relay
+     * is sent `stdout_sha256` and `stdout_bytes` and never the text -- deliberately, so that a relay
+     * compromise discloses no command text and the ledger stays a consistency record rather than a
+     * transcript. The consequence is that a question like "what did we already try on this machine, and
+     * what happened?" had no answer anywhere in the fleet, and the same facts were rediscovered from
+     * scratch repeatedly at the cost of a dozen dispatches in one session.
+     *
+     * The write happens **after** the envelope is complete, so the record it stores is the same one the
+     * relay will judge -- not a second, independently assembled opinion about what happened.
+     *
+     * `appendMemory` never throws and its result is deliberately not returned or checked: the task is
+     * the work and this is a note about it, so a full disk or an unwritable directory must not turn a
+     * successful command into a failed task. A memory that can fail work is worse than no memory, and
+     * the failure mode is silent here on purpose -- the envelope's own fields already say what happened.
+     */
+    appendMemory(stateDir, memoryRecord({
+      envelope,
+      commandArgv,
+      cwdRel,
+      ms: (Date.parse(endedAt) - Date.parse(startedAt)) || 0,
+    }));
+
     return buildEnvelope(envelope);
   }
 

package/src/agent/memory.mjs

@@ -0,0 +1,233 @@
+/**
+ * Individual memory: what this machine did, in its own state directory.
+ *
+ * ## Why this file exists
+ *
+ * The relay's ledger is the only durable fleet record, and it deliberately keeps **hashes, not text** --
+ * `command_hash`, `stdout_sha256`, `stdout_bytes`. That choice is defensible: the ledger is a
+ * tamper-evident consistency record, and a relay compromise discloses no command text. The cost is that
+ * nothing in the fleet can answer *"what did we already try on this machine, and what happened?"*
+ *
+ * The cost was paid repeatedly. In a single working session the same facts were rediscovered from
+ * scratch at the price of a dozen dispatches -- that this box has no package manager, which node binary
+ * actually runs, that its git cannot reach github.com while node's HTTPS can, that a task is expired at
+ * roughly fifty seconds. None of it was retained anywhere the fleet could read.
+ *
+ * So the memory lives here, on the machine, for three reasons beyond convenience:
+ *
+ *   1. the machine already writes `agent-state.json` in this directory, so there is no new place to
+ *      find and no new permission to grant;
+ *   2. it owns the output at the moment it produces it, and this is the last point at which the *text*
+ *      exists at all -- the relay never receives it, so nothing downstream could store it later;
+ *   3. it survives a relay rebuild, which the ledger does not.
+ *
+ * It is also the only honest home for a machine-specific fact. *"This box has no package manager"* is a
+ * property of this box, and a design that put it anywhere else would be guessing.
+ *
+ * ## Bounded by construction
+ *
+ * A byte cap with rotation, not an unbounded append. This is not hypothetical caution: the Linux host's
+ * root filesystem filled to 100% today from 14.7 GB/day of logs written by a process that had no cap,
+ * and the recovery cost real time. A memory that can fill a disk is a worse failure than no memory.
+ *
+ * Rotation keeps one previous generation rather than discarding it, because the question this file
+ * answers is usually about the recent past and a single rotation boundary is exactly where "we just ran
+ * that" sits.
+ */
+import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+/** The memory log's filename, beside `agent-state.json`. */
+export const MEMORY_FILE = 'memory.jsonl';
+
+/** The one rotated generation: `<file>.1`. Kept, not deleted -- see the header. */
+export const MEMORY_FILE_PREVIOUS = `${MEMORY_FILE}.1`;
+
+/**
+ * Byte cap for the live file before it is rotated.
+ *
+ * 8 MiB holds on the order of 20,000 task records at the shape below -- several years of this fleet's
+ * observed rate -- while staying small enough that reading the whole file to answer a question is
+ * something a tool can do without a plan.
+ */
+export const MEMORY_MAX_BYTES = 8 * 1024 * 1024;
+
+/**
+ * How much of a stream's tail is kept.
+ *
+ * The envelope already carries `stdout_tail` / `stderr_tail` for cross-machine comparison, so storing a
+ * second copy costs nothing extra and keeps every record the same shape. It is clamped again here
+ * rather than trusted, because this file is written on a machine the dispatcher does not control and a
+ * cap that can be exceeded by an argument is not a cap.
+ */
+export const MEMORY_TAIL_BYTES = 4096;
+
+/**
+ * A bound on the recorded argv.
+ *
+ * The relay takes an argv array of arbitrary length, so an offer may legally carry a command longer than
+ * any sane memory record. Truncating the *record* is right here: `command_argv` is not compared across
+ * machines (only `command_hash` is), so a shortened argv cannot make two machines disagree.
+ */
+export const MEMORY_ARGV_LIMIT = 64;
+
+/** @param {unknown} value @param {number} limit */
+function clamp(value, limit) {
+  if (typeof value !== 'string' || value === '') return null;
+  return value.length <= limit ? value : `${value.slice(0, limit)}\n…[truncated at ${limit} characters]`;
+}
+
+/**
+ * The memory record for one finished task.
+ *
+ * Shaped to be readable by a person as much as by a tool: a reader asking "what happened here" should be
+ * able to `tail` the file and get an answer without a query.
+ *
+ * `conclusion` is deliberately absent. It is the field §3.1 of the design shows, and it is reserved for
+ * `w2m_memory` to fill in when a human or an agent decides what the result *meant* -- a machine that
+ * invented one would be asserting an interpretation it cannot have, and the whole point of separating
+ * fact from conclusion is that the two must not be confused later.
+ *
+ * @param {object} input
+ * @param {object} input.envelope The built result envelope.
+ * @param {string[]} input.commandArgv
+ * @param {string|null} input.cwdRel
+ * @param {number} input.ms Wall-clock duration of the attempt.
+ * @param {number} [input.now]
+ * @returns {object}
+ */
+export function memoryRecord({
+  envelope,
+  commandArgv,
+  cwdRel,
+  ms,
+  now = Date.now(),
+}) {
+  const argv = Array.isArray(commandArgv) ? commandArgv.map(String) : [];
+  const truncatedArgv = argv.length > MEMORY_ARGV_LIMIT;
+
+  const record = {
+    at: new Date(now).toISOString(),
+    task_id: envelope.task_id,
+    attempt: envelope.attempt,
+    machine_id: envelope.machine_id,
+    machine_name: envelope.machine_name ?? null,
+    mode: envelope.mode ?? null,
+    argv: truncatedArgv ? argv.slice(0, MEMORY_ARGV_LIMIT) : argv,
+    cwd_rel: cwdRel ?? null,
+    // The exit code and status are what a reader checks first, so they sit above the tails.
+    exit_code: envelope.exit_code ?? null,
+    status: envelope.status ?? null,
+    refusal_reason: envelope.refusal_reason ?? null,
+    ms: Number.isFinite(ms) ? ms : null,
+    // Which way the offer travelled. Useful on its own: "this machine has not been reachable directly
+    // since Tuesday" is a fact about the fleet that only these records would show.
+    transport: envelope.transport ?? null,
+    stdout_tail: clamp(envelope.stdout_tail, MEMORY_TAIL_BYTES),
+    stderr_tail: clamp(envelope.stderr_tail, MEMORY_TAIL_BYTES),
+    // Hashes are repeated from the envelope on purpose: they are what ties this human-readable record
+    // to the relay's tamper-evident one, so the two can be cross-checked without trusting either.
+    stdout_sha256: envelope.stdout_sha256 ?? null,
+    stdout_bytes: envelope.stdout_bytes ?? null,
+    // Filled in later by `w2m_memory`, never by the machine. See above.
+    conclusion: null,
+    tags: [],
+  };
+  if (truncatedArgv) record.argv_truncated_from = argv.length;
+  return record;
+}
+
+/**
+ * Append a record, rotating first when the file has reached its cap.
+ *
+ * Never throws. A memory that can fail a task is worse than a memory that misses one: the task is the
+ * work, and this is a note about it. The caller gets `false` and the reason is on the record instead.
+ *
+ * Writes are synchronous and `O_APPEND`, so two attempts finishing at once interleave as whole lines
+ * rather than as corrupt ones -- the failure mode that would make the whole file unreadable.
+ *
+ * `maxBytes` is a parameter rather than a closed-over constant so that rotation is testable without
+ * writing eight megabytes to prove it. A cap that can only be exercised at production size is a cap
+ * whose rotation path is only exercised in production, which is the wrong place to find out.
+ *
+ * @param {string} stateDir
+ * @param {object} record
+ * @param {{maxBytes?: number}} [options]
+ * @returns {{ok: true, path: string, bytes: number, rotated: boolean}|{ok: false, error: string}}
+ */
+export function appendMemory(stateDir, record, { maxBytes = MEMORY_MAX_BYTES } = {}) {
+  try {
+    if (typeof stateDir !== 'string' || stateDir === '') {
+      return { ok: false, error: 'MEMORY_NO_STATE_DIR' };
+    }
+    mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    const path = join(stateDir, MEMORY_FILE);
+
+    let rotated = false;
+    if (existsSync(path)) {
+      const size = statSync(path).size;
+      if (size >= maxBytes) {
+        // Replace the previous generation rather than skipping rotation: keeping more than one would
+        // defeat the cap, and the cap is the point.
+        renameSync(path, join(stateDir, MEMORY_FILE_PREVIOUS));
+        writeFileSync(path, '', { mode: 0o600 });
+        rotated = true;
+      }
+    }
+
+    const line = `${JSON.stringify(record)}\n`;
+    appendFileSync(path, line, { mode: 0o600 });
+    return { ok: true, path, bytes: Buffer.byteLength(line), rotated };
+  } catch (error) {
+    return { ok: false, error: `MEMORY_APPEND_FAILED: ${error instanceof Error ? error.message : String(error)}` };
+  }
+}
+
+/**
+ * Read records back, newest first.
+ *
+ * Ordering is by file position reversed, not by parsing every `at`: the file is append-only, so position
+ * *is* time, and sorting would both cost more and mis-order two records written in the same millisecond.
+ *
+ * A malformed line is skipped rather than fatal. A partially written final line is the expected outcome
+ * of a machine losing power mid-append, and one damaged line must not make the rest unreadable -- which
+ * is exactly how the relay's own ledger behaves (`ledger_lines_skipped`), and for the same reason.
+ *
+ * Synchronous on purpose, and named for it: the reader is called from a tool that answers a question
+ * about a local file, and every other reader in this codebase (`w2m_status` on `agent-state.json`) is a
+ * synchronous read for the same reason -- a memory query that could interleave with an append would
+ * report a state the file was never in.
+ *
+ * @param {string} stateDir
+ * @param {{limit?: number, previous?: boolean}} [options]
+ * @returns {{records: object[], skipped: number, truncated: boolean, path: string|null, error?: string}}
+ */
+export function readMemorySync(stateDir, { limit = 50, previous = false } = {}) {
+  const empty = { records: [], skipped: 0, truncated: false, path: null };
+  if (typeof stateDir !== 'string' || stateDir === '') return { ...empty, error: 'MEMORY_NO_STATE_DIR' };
+  const path = join(stateDir, previous ? MEMORY_FILE_PREVIOUS : MEMORY_FILE);
+  if (!existsSync(path)) return { ...empty, path };
+
+  try {
+    const text = statSync(path).size === 0 ? '' : readFileSync(path, 'utf8');
+    const lines = text.split('\n');
+    if (lines.length > 0 && lines[lines.length - 1] === '') lines.pop();
+
+    const records = [];
+    let skipped = 0;
+    for (let i = lines.length - 1; i >= 0; i -= 1) {
+      if (records.length >= limit) break;
+      try {
+        records.push(JSON.parse(lines[i]));
+      } catch {
+        skipped += 1;
+      }
+    }
+    return { records, skipped, truncated: records.length >= limit, path };
+  } catch (error) {
+    return { ...empty, path, error: `MEMORY_READ_FAILED: ${error instanceof Error ? error.message : String(error)}` };
+  }
+}
+
+/** Retained under the shorter name: the reader has always been synchronous. */
+export const readMemory = readMemorySync;

package/src/plugin/tools.mjs

@@ -35,7 +35,7 @@
  * Everything in this file is callable by a model, against a fleet whose machines run commands under
  * their own allow-lists, and it holds an operator token that authorises dispatch fleet-wide. That
  * makes the *tool surface* a boundary, and this section is the boundary written down as it actually
- * is — not as it would sound best. `test/tool-cards.test.mjs` asserts the parts of it that can be
+ * is  - not as it would sound best. `test/tool-cards.test.mjs` asserts the parts of it that can be
  * asserted mechanically, and a change that crosses it is meant to turn that suite red.
  *
  * **No tool parameter names a credential, an allow-list, a key path, or a state directory.** There is
@@ -49,7 +49,7 @@
  * and is applied in one direction only: {@link checkAllowedCommand} returns a refusal or `null`, and
  * there is no path in this file that adds an entry to the list. Each target machine's own agent
  * re-decides the same gate against its own list, so a dispatcher that lost this check would still not
- * widen anything — the direction the shared matcher exists to keep honest (`src/agent/allowed-commands.mjs`).
+ * widen anything  - the direction the shared matcher exists to keep honest (`src/agent/allowed-commands.mjs`).
  *
  * **No tool can change a machine's `p2pMode`.** The mode is resolved once, in `readConfig` at
  * `apply()` time, from the config object or `W2M_P2P_MODE`, and every dispatch publishes it as a fact
@@ -58,19 +58,19 @@
  * weaker path, which is the one place a dispatcher could otherwise have quietly downgraded a peer.
  *
  * **No tool writes another machine's identity or keys.** `device.json` is read (`readDevice`) and
- * `device.key` is loaded (`DeviceKey.load`) — neither is ever written here. What a dispatch publishes
+ * `device.key` is loaded (`DeviceKey.load`)  - neither is ever written here. What a dispatch publishes
  * is this machine's own **public** key inside `p2p.static_keys`, so the executor can authenticate a
  * dial; the private half never leaves `src/agent/crypto.mjs`.
  *
  * **No tool result carries a token or a key.** `w2m_status` reports `paired`,
  * `operatorToken_configured` and `pairingCode_configured` as booleans and never the values. The
- * operator token travels only in the `Authorization` header of `POST /v1/task` — never in the request
- * body and never in an answer — and `direct_pushes[].static_key` is the literal marker `'published'`,
+ * operator token travels only in the `Authorization` header of `POST /v1/task`  - never in the request
+ * body and never in an answer  - and `direct_pushes[].static_key` is the literal marker `'published'`,
  * not the key it describes.
  *
  * What an agent-facing tool *may* do across machines is bounded and stated: ask the machines the relay
  * leased a task to run one argv inside their own allow-lists, in their own copy of the project,
- * read-only unless `write: true` names a `write_scope`, and report what they said — refusals
+ * read-only unless `write: true` names a `write_scope`, and report what they said  - refusals
  * included, as values.
  *
  * # `@deepseek-ai/dsh-tools` and the offline fallback
@@ -93,6 +93,11 @@ import { createHash } from 'node:crypto';
 import { promises as fs } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+// The individual memory layer (v0.9.6). Read through the agent's own module rather than re-parsing the
+// file here: the reader carries the rules that matter -- newest-first by file position, a malformed line
+// skipped rather than fatal, and the rotated generation reachable -- and a second implementation would
+// drift from the writer's shape without anything failing.
+import { readMemorySync } from '../agent/memory.mjs';
 
 // The base-address rules live in one place (§2), shared with the agent side. Importing the - rather
 // than re-deriving them her - is what stops the plugin and the agent from disagreeing about what
@@ -180,7 +185,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '0.9.5';
+const PLUGIN_VERSION = '0.9.6';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -227,8 +232,8 @@ const RETRYABLE_STATUS = new Set([429, 502, 503, 504]);
  * `w2m_status` as message prefixes.
  *
  * A code is added only when it names a *distinct remedy*. `W2M_CONFIG` still covers a malformed
- * setting at large; the credential gate below has its own code because its remedy — set
- * `operatorToken` — is unlike any other configuration fault's.
+ * setting at large; the credential gate below has its own code because its remedy  - set
+ * `operatorToken`  - is unlike any other configuration fault's.
  */
 export const REFUSAL_CODE = Object.freeze({
   /** The dispatch pre-flight found the command outside this plugin's `allowedCommands`. */
@@ -267,7 +272,7 @@ export const REFUSAL_CODE = Object.freeze({
   /** Storing a result frame failed, so the result exists only on the sender. */
   P2P_INBOX_WRITE_FAILED: 'P2P_INBOX_WRITE_FAILED',
   /**
-   * The composer's selected target routed this dispatch. Not a refusal — a named *reason*, so the
+   * The composer's selected target routed this dispatch. Not a refusal  - a named *reason*, so the
    * routing decision is greppable in the answer instead of being a bare `applied: true`.
    */
   SELECTION_APPLIED: 'SELECTION_APPLIED',
@@ -577,7 +582,7 @@ function readConfig(config = {}) {
   /**
    * §7: where the relay address came from.
    *
-   * The order is `rabbitUrl` → `W2M_RABBIT_URL` → the shared server, and the *source* is carried out
+   * The order is `rabbitUrl` 鈫?`W2M_RABBIT_URL` 鈫?the shared server, and the *source* is carried out
    * of here rather than re-derived at report time, because "which of the three won" is exactly the
    * question a cross-network deployment gets wrong: a machine that silently talked to the shared
    * server instead of the operator's own relay looks identical to a working one until it dispatches
@@ -709,7 +714,7 @@ function readConfig(config = {}) {
 }
 
 /**
- * Resolve `p2pMode` from the config object, then `W2M_P2P_MODE`, then the default — loudly.
+ * Resolve `p2pMode` from the config object, then `W2M_P2P_MODE`, then the default  - loudly.
  *
  * A value that is present and wrong is a `W2M_CONFIG` error naming the setting: falling back to
  * `auto` would dispatch work over a path the operator explicitly asked not to use, and falling back
@@ -717,7 +722,7 @@ function readConfig(config = {}) {
  * decisions the operator has to make.
  *
  * "Present" is decided by the *key*, not by truthiness. A profile patch that writes `p2pMode:` with
- * nothing after it hands this function `null`, and that is a value somebody typed — collapsing it
+ * nothing after it hands this function `null`, and that is a value somebody typed  - collapsing it
  * into "the key is absent" is exactly the silent default this function exists to refuse. An unset key
  * and a blank `W2M_P2P_MODE` are the only two shapes that mean "nobody chose", and only the second is
  * treated as absent because an unset environment variable is indistinguishable from an empty one.
@@ -753,12 +758,12 @@ function resolveP2PMode(config) {
  * Every entry is validated here, before the node is built, because the alternative is a tick several
  * seconds later inside the node's announce loop: an unusable STUN entry is a configuration mistake,
  * and this project reports those at the call site rather than as a degraded status field. The rule
- * itself is `parseServer` from `src/agent/stun.mjs` — the same function the query path will use, so
+ * itself is `parseServer` from `src/agent/stun.mjs`  - the same function the query path will use, so
  * "valid here" and "usable there" cannot drift.
  *
  * An **empty list is the default**, not an error. `stunServers: []` is what the bundled
  * `cordis.patch.yml` carries (a key that documents itself and names no server), and a profile that
- * starts from that file must not fail to load. `null` entries are dropped for the same reason — a
+ * starts from that file must not fail to load. `null` entries are dropped for the same reason  - a
  * YAML list with a blank item is the same statement as a blank item in a profile patch. A list whose
  * entries are *wrong* is still refused: there is a difference between "nothing named" and "the wrong
  * thing named", and only the second is a mistake.
@@ -985,7 +990,7 @@ function resolveProfileDir(config) {
 /**
  * Require the Rabbit URL, naming the setting when it is absent.
  *
- * With §7's shared-server default this can no longer be reached by "the operator set nothing" — an
+ * With §7's shared-server default this can no longer be reached by "the operator set nothing"  - an
  * unset `rabbitUrl` resolves to {@link SHARED_SERVER}. It stays as the last-resort guard so that a
  * future edit which clears the field fails with a sentence naming it instead of an `Invalid URL`
  * from somewhere deep in `fetch`.
@@ -1042,7 +1047,7 @@ function devicePathFor(cfg) {
  *
  * {@link readDevice} answers from a `stateDir` and is the tool-facing reader; this one adds the
  * `DSH_HOME` fallback (an unset `stateDir` is the documented default layout, not an error) and turns
- * every failure into a `machine_id` of null plus an `error` — a machine whose identity cannot be read
+ * every failure into a `machine_id` of null plus an `error`  - a machine whose identity cannot be read
  * must still be able to dispatch, because the relay path does not need an identity at all.
  *
  * @param {ReturnType<typeof readConfig>} cfg
@@ -1082,8 +1087,8 @@ function safeFilePart(value) {
  *
  * Deliberately *not* the relay's own `jcs` (that would make this file depend on relay internals for
  * a two-line need). The digest here is only an integrity check of what this process stored, so the
- * rule is local by definition; the value that has to match another process byte for byte — the
- * dedupe key — is the one imported from the relay instead.
+ * rule is local by definition; the value that has to match another process byte for byte  - the
+ * dedupe key  - is the one imported from the relay instead.
  *
  * @param {unknown} value
  * @returns {string}
@@ -1099,9 +1104,9 @@ function canonicalJson(value) {
 /**
  * Does `frame` name both halves of the inbox key?
  *
- * A frame without a `task_id` or without a `machine_id` cannot be stored or acknowledged — the
+ * A frame without a `task_id` or without a `machine_id` cannot be stored or acknowledged  - the
  * acknowledgement is keyed by `task_id`, and two machines answering the same task must not overwrite
- * each other — so it is refused by name instead of being written somewhere surprising.
+ * each other  - so it is refused by name instead of being written somewhere surprising.
  *
  * Both halves of the refusal are returned: `reason` is the `CODE: sentence` string this has always
  * produced (it is what `w2m_status` shows), `reason_code` is the same code as a field, so a reader
@@ -1159,7 +1164,7 @@ async function writeFileAtomic(dir, file, text) {
  * Count the stored result frames.
  *
  * Depth is read from the directory rather than tracked in memory, so it answers the question that
- * actually matters — "is there anything here I have not consumed" — across a plugin reload. A
+ * actually matters  - "is there anything here I have not consumed"  - across a plugin reload. A
  * missing directory is depth 0, not an error: the inbox exists only once something has arrived.
  *
  * @param {string|null} dir
@@ -1233,7 +1238,7 @@ function createP2PTransport(cfg) {
  *
  * A dispatcher behind a symmetric NAT (CGNAT, in practice) can send all it likes and still be heard
  * by nobody: its outbound HELLO opens its own mapping, but the peer's filter stays shut until
- * *something of the peer's* has gone the other way. So the executor has to dial first — and to dial
+ * *something of the peer's* has gone the other way. So the executor has to dial first  - and to dial
  * it needs two things the offer itself can carry: where the dispatcher says it is, and which punch
  * to join. Without them the executor has only the relay lookup, which is a second opinion about the
  * same machine that answers 404 for a dispatcher whose announcement has just expired.
@@ -1241,14 +1246,14 @@ function createP2PTransport(cfg) {
  * WHY A PUNCH ID RATHER THAN A SESSION ID
  *
  * The session id cannot be known when this request is written: one dispatch leases one task to
- * several machines, and the relay decides which — in the same request that mints the task id. A
+ * several machines, and the relay decides which  - in the same request that mints the task id. A
  * single session shared by those machines would be a defect, not a simplification: on the
  * dispatcher's own node the second machine's HELLO would look like a re-acknowledgement of the
  * first machine's live channel, so one of them would have its result delivered to the other's
  * address. The block therefore publishes a per-dispatch *punch id*, and both ends derive the same
  * per-machine session from it (`punchSession` in `src/agent/p2p.mjs`): the dispatcher from the
- * lease, the executor from the offer plus its own machine id. The pushed frame — which is addressed
- * to one machine, so the value *is* known — carries the derived `session` as well.
+ * lease, the executor from the offer plus its own machine id. The pushed frame  - which is addressed
+ * to one machine, so the value *is* known  - carries the derived `session` as well.
  *
  * COMPATIBILITY
  *
@@ -1264,11 +1269,11 @@ function createP2PTransport(cfg) {
  * WHY A MAP RATHER THAN ONE KEY
  *
  * The executor needs the *dispatcher's* key before it can dial back, and the dispatcher needs the
- * *executor's* key before it can push — and at dispatch time the relay has not yet said which
+ * *executor's* key before it can push  - and at dispatch time the relay has not yet said which
  * machines the task went to (`leases` come back in the same response that creates it). So the block
  * carries this machine's own key, which is known before the request is written, and
  * {@link offerP2PFor} adds the target's once the lease names it. Reading the field is therefore
- * "look up the machine you are about to talk to", never "assume the only entry is the peer" — a
+ * "look up the machine you are about to talk to", never "assume the only entry is the peer"  - a
  * machine that receives an offer for a fleet of three has three entries and uses one.
  *
  * What that buys, in the document's own terms: no `[Peer]` block for anyone to fill in. A machine
@@ -1295,7 +1300,7 @@ function buildP2POfferBlock(cfg, runtime) {
     block.candidates = candidates.map((candidate) => ({ address: candidate.address, port: candidate.port }));
   }
   // This machine's own static public key. Absent (not null) when there is none, so the wire stays
-  // byte-identical to v0.5.x for a machine that has no key — an additive change has to be absent to
+  // byte-identical to v0.5.x for a machine that has no key  - an additive change has to be absent to
   // be additive.
   const own = runtime?.encryption?.public_key;
   const machineId = runtime?.machineId;
@@ -1311,7 +1316,7 @@ function buildP2POfferBlock(cfg, runtime) {
  * The added `session` is what makes the push and a reverse dial one punch rather than two: an
  * executor that received the offer over a channel may still have to dial back (the dispatcher closes
  * the channel it pushed over, immediately after the push), and a dial carrying a session the
- * dispatcher is not filtering for would be answered by its `accept()` at best — a second session,
+ * dispatcher is not filtering for would be answered by its `accept()` at best  - a second session,
  * a second channel, and two live sessions for one task where one would do.
  *
  * v0.6.0 adds the *target's* key to `static_keys` when the caller supplies one, which is the half of
@@ -1343,8 +1348,7 @@ function offerP2PFor(published, { taskId, machineId, peerKey = null }) {
  *
  * The executor decides whether an offer is a first delivery or a duplicate on `dedupe_key` +
  * `attempt` (§6), and the relay emits its own SSE offer with those exact values. A push that
- * disagreed by one character would make the machine execute the task twice — once from each path —
- * so the dedupe key is computed with the relay's own {@link computeDedupeKey}/{@link computeCommandHash},
+ * disagreed by one character would make the machine execute the task twice  - once from each path  -  * so the dedupe key is computed with the relay's own {@link computeDedupeKey}/{@link computeCommandHash},
  * from the same `task_id`, `index`, `command_hash` inputs and `base_tree` the task was created with,
  * and `machine_id`/`index`/`attempt` come from the lease rather than from the caller's arguments.
  *
@@ -1419,7 +1423,7 @@ function buildOfferFrame({ taskId, lease, payload, originMachineId, peerKey = nu
 /**
  * Push one offer over the direct path. Best effort by construction: nothing here throws.
  *
- * The session comes from the frame's own `p2p.session` — minted per machine by
+ * The session comes from the frame's own `p2p.session`  - minted per machine by
  * {@link offerP2PFor} from the punch id the relay is publishing for this same task. Dialling with a
  * session of the node's own invention would leave the two ends on two sessions, and an executor
  * whose reverse dial happened to arrive first would open a *second* channel beside this one instead of
@@ -1449,7 +1453,7 @@ async function pushOffer(node, frame, crypto = {}) {
   }
   // The dial's own options, built here rather than inline because the *presence* of `crypto` is the
   // decision: `P2PNode.dial` arms a handshake only when this dispatcher holds a key for that peer, and
-  // a peer with no published key is dialled exactly as v0.5.x dialled it — plaintext, recorded, and
+  // a peer with no published key is dialled exactly as v0.5.x dialled it  - plaintext, recorded, and
   // never a failure. That is §4's fallback clause applied to the push: a fleet must never lose a
   // machine to a security upgrade. It is not a silent downgrade, because the peer never offered a key
   // to downgrade *from*; a peer whose key we hold and whose handshake fails produces `ok: false` and
@@ -1505,14 +1509,14 @@ async function pushOffer(node, frame, crypto = {}) {
  *
  * Called after the relay has created the task, so the relay's own SSE offer has already gone out:
  * this is an *additional* delivery over the faster path, and the relay's copy is what makes a failed
- * push harmless. Only leases in a runnable state are pushed — `refused` and `observing` machines
+ * push harmless. Only leases in a runnable state are pushed  - `refused` and `observing` machines
  * were never handed the command, and sending them an offer would be asking them to run work the
  * relay decided they must not run.
  *
  * v0.6.0: each target's static key is fetched from the relay's peer record before the push, which is
  * the one moment the dispatcher learns the key of a machine it did not already know. It is fetched
  * **here** rather than sourced from the stored `p2p` block because the block is written *before* the
- * relay decides which machines the task goes to — the offer that carries the key is the one addressed
+ * relay decides which machines the task goes to  - the offer that carries the key is the one addressed
  * to the machine that key belongs to. A missing key is not an error: the push proceeds and the
  * executor records `P2P_CRYPTO_NO_KEY` for its plaintext channel, which is the documented outcome for
  * a peer that never announced.
@@ -1520,7 +1524,7 @@ async function pushOffer(node, frame, crypto = {}) {
  * @param {P2PNode} node
  * @param {object} options
  * @returns {Promise<Array<object>>} One entry per lease considered, in lease order. A machine that was
- *   not pushed to carries `ok: false` **and** a `reason_code` naming which gate refused it — this
+ *   not pushed to carries `ok: false` **and** a `reason_code` naming which gate refused it  - this
  *   block is a tool result, so a bare boolean here would be exactly the reduction the verdicts refuse.
  */
 async function pushOffers(node, { taskId, leases, payload, originMachineId, getJson = null }) {
@@ -1574,7 +1578,7 @@ async function pushOffers(node, { taskId, leases, payload, originMachineId, getJ
       // logs side by side. `null` when there was nothing to punch over (a v0.4.x-shaped frame).
       session: result.session,
       // True when the executor's dial got there first and this push travelled over the channel that
-      // dial opened — a two-way punch that worked, reported as such rather than as a plain push.
+      // dial opened  - a two-way punch that worked, reported as such rather than as a plain push.
       reused: result.reused === true,
       // v0.6.0: whether the offer actually travelled sealed, and why not when it did not. Reported
       // per machine because it is a per-machine fact: one peer can be encrypted and the next one a
@@ -1618,19 +1622,19 @@ async function readPeerStaticKey(getJson, machineId) {
  * WHEN THE NODE STARTS, AND WHY IT IS NOT `apply()`
  *
  * The v0.4.0 contract says the node is "started in `apply()`". It is not, and this is the one place
- * this file departs from the contract's letter rather than its intent — reported as a deviation, not
+ * this file departs from the contract's letter rather than its intent  - reported as a deviation, not
  * settled quietly here. What *is* kept is everything the sentence is about: the direct path is owned
  * for the plugin's whole lifetime, it is disposed by a `ctx.effect` disposer, and a failure to start
  * is a field in `w2m_status` rather than an exception at load.
  *
  * The reason for the change is what "start" costs. Starting this node binds a UDP socket and kicks
- * off a STUN sweep against four servers — network traffic with a multi-second tail — for a machine
+ * off a STUN sweep against four servers  - network traffic with a multi-second tail  - for a machine
  * that may never dispatch a task in that session. `apply()` runs on every session in a host that
  * mounts this plugin, so an unconditional start is a rendezvous per session, and it puts traffic
  * into every test and every host whose runtime is deterministic about what it sends. `ensureStarted()`
  * therefore does the work the first time a tool actually needs the direct path: a dispatch
  * (`w2m_run`) or a question about it (`w2m_status`). A machine that never dispatches never punches,
- * which is also the more honest reading of §1 — "never dials" is the property that matters, and this
+ * which is also the more honest reading of §1  - "never dials" is the property that matters, and this
  * is closer to it than an announce nobody asked for.
  *
  * @param {object|null} ctx Cordis context; `ctx.effect` is used when present.
@@ -1674,7 +1678,7 @@ function createP2PRuntime(ctx, cfg, block = {}) {
      *
      * Assigned before the relay-mode early return so the tools can call it unconditionally: a caller
      * asks "is the direct path ready" and gets an answer either way, instead of having to know which
-     * mode it is in — the defect this shape fixes was a `relay`-mode dispatch calling a method that did
+     * mode it is in  - the defect this shape fixes was a `relay`-mode dispatch calling a method that did
      * not exist, which is a crash in the mode that is supposed to be the safe one.
      *
      * @type {() => Promise<object>}
@@ -1722,7 +1726,7 @@ function createP2PRuntime(ctx, cfg, block = {}) {
  *
  * Never throws. A caller cannot fix an unreadable key file from a tool call, and a dispatch that
  * refused because a *security upgrade* could not complete would be exactly the fleet-losing failure
- * §4 forbids — so the failure becomes a reason string, the node runs without a key, and every offer
+ * §4 forbids  - so the failure becomes a reason string, the node runs without a key, and every offer
  * this machine publishes is plainly labelled as having none.
  *
  * @param {object|null} injected Test seam: a `DeviceKey`, or null to use the file.
@@ -1823,7 +1827,7 @@ async function initP2P(ctx, cfg, runtime, block) {
   /**
    * Ownership: one node, one effect, one disposer.
    *
-   * Registered *here*, after the node exists, rather than in `createP2PRuntime` — an effect that owns
+   * Registered *here*, after the node exists, rather than in `createP2PRuntime`  - an effect that owns
    * nothing is a disposer that releases nothing, and `relay` mode and a machine with no identity must
    * leave the host's effect list exactly as they found it. A host that provides no `ctx.effect` (an
    * older Cordis, or a bare test context) still gets a working node: the node itself is asked not to
@@ -1832,7 +1836,7 @@ async function initP2P(ctx, cfg, runtime, block) {
    * default.
    *
    * v0.5.10: `node.unref()` is a real call, not a description. Until it was added this comment
-   * claimed an `unref()` that existed nowhere in the plugin or the node — the socket went on holding
+   * claimed an `unref()` that existed nowhere in the plugin or the node  - the socket went on holding
    * the event loop, so a host without `ctx.effect` that started a node never exited (found by an
    * independent verifier against the `w2m_status` test's bare context).
    */
@@ -1863,13 +1867,13 @@ async function initP2P(ctx, cfg, runtime, block) {
  * Store one JSON frame that arrived over a direct channel, and acknowledge it.
  *
  * The writer is deliberately strict. A frame that is not a JSON object, or that names no
- * `task_id`/`machine_id`, is refused and **nothing** is written — an inbox file is the only durable
+ * `task_id`/`machine_id`, is refused and **nothing** is written  - an inbox file is the only durable
  * trace of a peer's result, and a file whose name does not identify its contents is worse than no
  * file, because the next reader cannot tell a partial result from a complete one.
  *
  * `task.result` is the frame this exists for; `result.ack` and anything else a peer might send are
  * counted and ignored rather than treated as faults. The acknowledgement goes back on the same
- * channel the frame arrived on, and a failed acknowledgement is recorded — the sender retries (the
+ * channel the frame arrived on, and a failed acknowledgement is recorded  - the sender retries (the
  * channel is reliable) and the file is already on disk, so a lost ack must not lose the result.
  *
  * @param {object} runtime
@@ -1930,7 +1934,7 @@ async function handleP2PMessage(runtime, event) {
     task_id: frame.task_id,
     frame,
     // A digest of the stored copy, so a reader can tell "the file changed under me" from "the peer
-    // sent something else". Not a signature — the channel is not authenticated at this layer.
+    // sent something else". Not a signature  - the channel is not authenticated at this layer.
     frame_sha256: createHash('sha256').update(canonicalJson(frame)).digest('hex'),
   };
   const file = path.join(
@@ -1970,7 +1974,7 @@ async function handleP2PMessage(runtime, event) {
  *
  * Every field is present on every call, including when the direct path is off: a reader must be able
  * to tell "relay mode" from "p2p was requested and could not start" without comparing two calls.
- * `null` is used for "never measured", never 0 — the same rule the rest of this file follows for RTT.
+ * `null` is used for "never measured", never 0  - the same rule the rest of this file follows for RTT.
  *
  * @param {ReturnType<typeof readConfig>} cfg
  * @param {object} runtime
@@ -2012,7 +2016,7 @@ async function readP2PStatus(cfg, runtime, peersAnnounced = null) {
     // v0.6.0: the crypto facts, named one by one rather than mirrored wholesale. `enabled` is about
     // *this* machine's key; `encrypted_channels` and `plaintext_channels` are about the channels it
     // has actually made, and they can both be non-zero on a mixed fleet. `error` is the reason there
-    // is no key when there is none — a reader has to be able to tell "this build has no crypto" from
+    // is no key when there is none  - a reader has to be able to tell "this build has no crypto" from
     // "the key file is unreadable" without reading a log.
     encryption: {
       enabled: runtime.encryption?.enabled === true,
@@ -2504,7 +2508,7 @@ async function request(options) {
   }
 
   // §2: base + path, joined by hand. `new URL(pathname, base)` would resolve against the origin
-  // and drop a deployment sub-path (`https://h/w2m` + `/v1/task` 鈫?`https://h/v1/task` 鈫?404).
+  // and drop a deployment sub-path (`https://h/w2m` + `/v1/task` —?`https://h/v1/task` —?404).
   const target = toRequestUrl(joinUrl(rabbitUrl, pathname));
   for (const [key, value] of Object.entries(query ?? {})) {
     if (value !== undefined && value !== null) target.searchParams.set(key, String(value));
@@ -2584,8 +2588,8 @@ function endpointOf(target) {
  * Two sources, and the distinction is the point. An explicit `stateDir` is the operator pointing at
  * a pairing, so a missing or unreadable `device.json` there is **named as the fault** rather than
  * being turned into a mystery `401`. With no `stateDir`, this machine's own identity lives where the
- * agent writes it by default — `$DSH_HOME/xclient/device.json`, the same file {@link readLocalIdentity}
- * reads — and the calls go out with it. v0.4.0 made that fallback load-bearing rather than optional:
+ * agent writes it by default  - `$DSH_HOME/xclient/device.json`, the same file {@link readLocalIdentity}
+ * reads  - and the calls go out with it. v0.4.0 made that fallback load-bearing rather than optional:
  * every P2P announcement is authenticated as the announcing device, so a machine whose identity was
  * only reachable through `DSH_HOME` would have had a permanently unauthenticated rendezvous and a
  * direct path that never worked, while the relay path kept working and hid the reason.
@@ -2655,8 +2659,7 @@ async function readDevice(cfg) {
 /**
  * Require a `device_token`, naming where it was looked for when it is absent.
  *
- * The `code` stays `W2M_NO_TOKEN` for every case — one class, "this machine cannot authenticate" —
- * while `reason_code` names which of the three it is, because the three have different remedies: pair
+ * The `code` stays `W2M_NO_TOKEN` for every case  - one class, "this machine cannot authenticate"  -  * while `reason_code` names which of the three it is, because the three have different remedies: pair
  * the agent, repair the file, or finish a pairing that never completed.
  *
  * @param {{machine_id: string|null, device_token: string|null, path: string|null, present: boolean, error: string|null}} device
@@ -2817,13 +2820,13 @@ async function resolveTreeFingerprint(projectDir, timeoutMs) {
  * resolving a path, and a pre-flight that strips the path can only ever compare names, so it would
  * wave `E:\Temp\evil\node.exe` through while the agent refused it. Passing the argv through
  * unchanged is what keeps the two ends one rule. What the shared matcher then resolves, it resolves
- * against **this** process's environment — the dispatcher's PATH — which is a real limit of a
+ * against **this** process's environment  - the dispatcher's PATH  - which is a real limit of a
  * pre-flight (the executing machine's PATH is the one that will decide), and the reason the refusal
  * that matters is the agent's own.
  *
  * A refusal names itself: `reason_code` is the matcher's own code (so the two ends cannot report one
  * refusal under two spellings) and `detail` says what would change it. The two ways this control
- * refuses are kept apart — a command outside the list and a list that cannot be parsed have
+ * refuses are kept apart  - a command outside the list and a list that cannot be parsed have
  * different remedies, and sharing one code would send the reader to the wrong one.
  *
  * @param {string[]} allowedCommands Entries as configured, e.g. `['node --test']`.
@@ -2903,7 +2906,7 @@ function compactEnvelope(raw, comparable) {
 function excerpt(value) {
   const buffer = Buffer.from(value, 'utf8');
   if (buffer.byteLength <= MAX_EXCERPT_BYTES) return value;
-  return `${buffer.subarray(0, MAX_EXCERPT_BYTES).toString('utf8')}\n - truncated at ${MAX_EXCERPT_BYTES} bytes]`;
+  return `${buffer.subarray(0, MAX_EXCERPT_BYTES).toString('utf8')}\n - …[truncated at ${MAX_EXCERPT_BYTES} bytes]`;
 }
 
 /**
@@ -2952,7 +2955,7 @@ const OPTIONAL_FIELDS = new Set([
   'lockfiles', 'unpinned_deps', 'submodules', 'lfs', 'signal',
   // v0.4.0 §5: how the envelope travelled, and the path facts that came with it. Optional because a
   // v0.3.9 agent sends neither and must keep working unchanged; here rather than in
-  // `COMPARABLE_FIELDS` because **a path is not a result** — two byte-identical runs on two machines
+  // `COMPARABLE_FIELDS` because **a path is not a result**  - two byte-identical runs on two machines
   // must stay `consistent` when one of them punched a hole and the other used the relay.
   'transport', 'p2p',
 ]);
@@ -3164,7 +3167,7 @@ export async function apply(ctx, config = {}) {
   //
   // Composed here, next to the updater's own `ctx.effect`, and for the same reason: a socket and a
   // refresh timer have to be released when the plugin is unloaded, and an effect disposer is the
-  // only mechanism Cordis gives for that. Creating it never throws — a machine that cannot punch
+  // only mechanism Cordis gives for that. Creating it never throws  - a machine that cannot punch
   // still has to dispatch, and `w2m_status` is where the failure is reported.
   const p2p = createP2PRuntime(ctx, cfg, config.p2pBlock);
 
@@ -3180,14 +3183,13 @@ export async function apply(ctx, config = {}) {
   });
 
   // v0.6.1: the two browser routes behind the composer's target control. Additive and optional: a
-  // host without `connection.fetch` still gets every tool, and `w2m_status` reports the absence —
-  // which is the honest place for it, since a host that has no Connection at all is simply not a web
+  // host without `connection.fetch` still gets every tool, and `w2m_status` reports the absence  -   // which is the honest place for it, since a host that has no Connection at all is simply not a web
   // composition and does not need a warning on every headless run.
   //
   // Nothing here reads the service: `registerTargetRoutes` declares the optional dependency with
   // `ctx.inject` and attaches from that callback (the comment there records why a plain
   // `ctx.connection` read fails the whole entry, and why the read cannot be synchronous anyway). The
-  // one mismatch worth a log line — a Connection that carries no fetch registry — is logged where it
+  // one mismatch worth a log line  - a Connection that carries no fetch registry  - is logged where it
   // is observed, inside that callback, so this call returns a status object that stays live.
   const targetRoutes = registerTargetRoutes(ctx, {
     cfg: () => cfg,
@@ -3580,7 +3582,7 @@ export async function apply(ctx, config = {}) {
       //
       // The precedence rule is the whole contract, and it is one line: **the caller's own fields
       // always win**. `executor_machine_id` is checked below, and `target_machines` is never a tool
-      // argument — so a caller that named a machine (which, for this tool, means
+      // argument  - so a caller that named a machine (which, for this tool, means
       // `executor_machine_id` under broadcast) is untouched, and a caller that named none inherits
       // the selection. Nothing already published changes meaning: the selection only fills fields
       // that were absent, and the relay has accepted both of them since v0.3.3/v0.4.1.
@@ -3605,7 +3607,7 @@ export async function apply(ctx, config = {}) {
        * `applied` alone conflates three different situations an operator has to tell apart: nothing
        * was selected, the selection was overridden by the call's own `executor_machine_id`, or a
        * selection exists that names no machine at all and therefore routed nothing. The last one is
-       * the one that used to be invisible — a stored selection with no `machine_id` produces
+       * the one that used to be invisible  - a stored selection with no `machine_id` produces
        * `applied: false` and nothing else, which looks exactly like "the whole fleet ran it".
        */
       const selectionReason = selection === null
@@ -3692,14 +3694,14 @@ export async function apply(ctx, config = {}) {
 
       // §7: the two routing facts the offer carries to the machine that has to run the command.
       //
-      // `origin_machine_id` is *this* machine's id from `device.json` — where the work was typed, not
-      // where it runs — and it is omitted entirely (not sent as null) when this machine has no
+      // `origin_machine_id` is *this* machine's id from `device.json`  - where the work was typed, not
+      // where it runs  - and it is omitted entirely (not sent as null) when this machine has no
       // identity, because the relay's own validation refuses an empty string and "unknown origin" is
       // what a missing field already means on the wire.
       //
       // The identity comes from the runtime, which resolves it off the dispatch path; a dispatch that
       // arrives before that one small read has finished waits for it rather than racing it. The wait
-      // is bounded by the identity read itself and can never reject — see `createP2PRuntime`. This is
+      // is bounded by the identity read itself and can never reject  - see `createP2PRuntime`. This is
       // also the first use of the direct path, so it is where the node is started.
       await p2p.ensureStarted();
       const originMachineId =
@@ -3742,7 +3744,7 @@ export async function apply(ctx, config = {}) {
         // above refuses the combination, so this can never silently mean nothing.
         ...(mode === 'pipeline' && stagesPayload !== null ? { stages: stagesPayload } : {}),
         // v0.4.0: stated on every task, so `w2m_wait`'s `transport` and a machine's report can say
-        // which path the dispatcher expected to use — and so the executor in `direct` mode knows it
+        // which path the dispatcher expected to use  - and so the executor in `direct` mode knows it
         // must refuse an offer that did not arrive over the direct path.
         ...(originMachineId !== null ? { origin_machine_id: originMachineId } : {}),
         p2p: p2pOffer,
@@ -3788,7 +3790,7 @@ export async function apply(ctx, config = {}) {
        * so a push that fails, a peer that never announced and a socket that was never bound all leave
        * exactly the same outcome: the relay's own SSE offer is the delivery, and the machine's
        * `transport` says which path won. A failed push is therefore **not** an error and never fails
-       * this tool — but it is not hidden either, because `direct_pushes` names every attempt and the
+       * this tool  - but it is not hidden either, because `direct_pushes` names every attempt and the
        * reason it did not land.
        *
        * `relay` mode and a machine with no direct path both report `attempted: 0`, which is the
@@ -3823,7 +3825,7 @@ export async function apply(ctx, config = {}) {
             failed: pushes.filter((entry) => !entry.ok).length,
             pushes,
             // How many of the machines that were reached were reached over a channel *this* machine
-            // did not open — the executor dialled first, and the push landed on that path. Zero on a
+            // did not open  - the executor dialled first, and the push landed on that path. Zero on a
             // fleet where only the dispatcher initiates, which is what makes the two-way punch
             // visible in one dispatch's own answer instead of only in the ledger.
             reused_channels: pushes.filter((entry) => entry.reused === true).length,
@@ -4023,7 +4025,7 @@ export async function apply(ctx, config = {}) {
                * v0.4.0 §5: which path this machine's result travelled, and the path facts that came
                * with it. Read from the envelope because that is where the agent writes them, with the
                * per-machine record as the fallback (`GET /v1/tasks/{id}` copies both onto the machine
-               * entry as well). `null` means the machine did not say — which is exactly what a
+               * entry as well). `null` means the machine did not say  - which is exactly what a
                * v0.3.9 agent sends, so a missing value must not be dressed up as `'relay'`.
                */
               transport: envelope?.transport ?? machine?.transport ?? null,
@@ -4223,7 +4225,7 @@ export async function apply(ctx, config = {}) {
       const rtt = await readRtt(cfg);
       // §7: this tool is one of the two places the direct path is asked about, so it is one of the
       // two places the node is started. Never throws, and reports `enabled: false`/`running: false`
-      // rather than omitting itself — a reader has to be able to tell "relay mode" from "p2p was
+      // rather than omitting itself  - a reader has to be able to tell "relay mode" from "p2p was
       // requested and did not start".
       await p2p.ensureStarted();
       const p2pStatus = await readP2PStatus(cfg, p2p, Number.isInteger(relay.peers_announced) ? relay.peers_announced : null);
@@ -4303,8 +4305,8 @@ export async function apply(ctx, config = {}) {
           /**
            * v0.6.1: the composer's target control and the selections it holds.
            *
-           * Reported here because "the control is not in my composer" has exactly two causes — the
-           * host has no fetch-route registry, or the browser half is not loaded — and this is the
+           * Reported here because "the control is not in my composer" has exactly two causes  - the
+           * host has no fetch-route registry, or the browser half is not loaded  - and this is the
            * one call that can tell them apart from the host side. The selections themselves are
            * counts, not contents: which session picked which machine is the operator's business and
            * nothing the model needs.
@@ -4336,8 +4338,7 @@ export async function apply(ctx, config = {}) {
      * v0.8.5: **say it out loud.**
      *
      * This branch is the whole reason a machine can run v0.8.4 with the account-derived fleet key,
-     * hold a valid signed-in account, reach the relay over HTTP 200, and still be in no fleet —
-     * with nothing anywhere reporting a problem. The eight tools register, the plugin looks
+     * hold a valid signed-in account, reach the relay over HTTP 200, and still be in no fleet  -      * with nothing anywhere reporting a problem. The eight tools register, the plugin looks
      * healthy, and the join sequence simply never runs.
      *
      * A silent no-op that looks like success is the worst failure mode this plugin has had. One
@@ -4661,6 +4662,181 @@ export async function apply(ctx, config = {}) {
     },
     presentCall: () => ({ card: 'generic', title: 'w2m stats', kind: 'read', rawInput: {} }),
   }));
+
+  /**
+   * v0.9.6 — the individual memory layer.
+   *
+   * The relay keeps `command_hash`, `stdout_sha256` and `stdout_bytes` and never the text, deliberately:
+   * the ledger is a tamper-evident consistency record, and a relay compromise discloses no command text.
+   * The price is that nothing in the fleet could answer *"what did we already try on this machine, and
+   * what happened?"* -- and that price was paid repeatedly, with the same facts rediscovered from scratch
+   * across a dozen dispatches in one session.
+   *
+   * This tool is the read side of the fix. The write side is `appendMemory`, called by the agent as each
+   * task finishes, in that machine's own state directory.
+   *
+   * ## What this first version does and does not reach
+   *
+   * It reaches **this machine's** memory directly: the file is local, so the read is a file read. It does
+   * **not** yet read another machine's memory, and the reason is structural rather than an omission --
+   * the relay carries no such file, an agent executes a dispatched command inside a sandbox whose writes
+   * are scoped, and pretending otherwise would mean shipping a tool that silently returns nothing for
+   * every machine but one.
+   *
+   * So a query for another machine says exactly that, names where to look instead, and stays useful: the
+   * fleet's roster still comes from the relay, so the answer distinguishes "no such machine" from "that
+   * machine keeps its own memory and this build cannot fetch it".
+   */
+  ctx.tools.register(defineTool({
+    name: 'w2m_memory',
+    description:
+      'Ask what this machine has already done: its individual memory, one line per finished task, ' +
+      'recording the command, exit code, duration, transport and the tail of stdout/stderr. Use it ' +
+      'before re-running work to find out whether it has been tried and what happened. The relay keeps ' +
+      'only hashes, so this local file is the only place a command\'s output survives. Reads only this ' +
+      'machine\'s memory; for another machine it reports where that memory lives rather than guessing.',
+    parameters: {
+      machine: {
+        type: 'string',
+        description:
+          'Which machine\'s memory to read. Defaults to this machine. Naming another machine is ' +
+          'answered with where its memory is kept, because this build can only read the local file.',
+      },
+      limit: {
+        type: 'number',
+        description: 'How many records to return, newest first. Defaults to 20.',
+        default: 20,
+      },
+      include_previous: {
+        type: 'boolean',
+        description:
+          'Also read the rotated generation (`memory.jsonl.1`). The log is capped and rotates, so a ' +
+          'memory question about anything older than the current file needs this.',
+        default: false,
+      },
+    },
+    output: jsonOutput,
+    async execute(args, exec) {
+      throwIfAborted(exec?.signal);
+      const limitRaw = Number(args?.limit);
+      const limit = Number.isFinite(limitRaw) && limitRaw > 0 ? Math.min(Math.floor(limitRaw), 500) : 20;
+
+      const requested = typeof args?.machine === 'string' && args.machine.trim() !== '' ? args.machine.trim() : null;
+      const identity = await readLocalIdentity(cfg);
+      const self = identity?.machine_name ?? null;
+      const selfId = identity?.machine_id ?? null;
+
+      // A query about another machine is answered honestly rather than with an empty list, which would
+      // read as "that machine has done nothing" -- the opposite conclusion from "this build cannot see".
+      if (requested !== null && requested !== self && requested !== selfId) {
+        return JSON.stringify(
+          {
+            ok: true,
+            scope: 'remote',
+            requested_machine: requested,
+            self: { machine_id: selfId, machine_name: self },
+            records: null,
+            reason_code: 'MEMORY_REMOTE_NOT_READABLE',
+            detail:
+              `the individual memory of "${requested}" is kept on that machine, in its own state ` +
+              'directory as memory.jsonl; this build reads only the local file, and the relay never ' +
+              'receives it',
+            how_to_read_it: [
+              `run \`w2m_run\` on ${requested} with a command that prints the tail of its memory.jsonl`,
+              'or read it directly over an administration channel to that machine',
+            ],
+            found: false,
+          },
+          null,
+          2,
+        );
+      }
+
+      const stateDir = cfg.stateDir ?? null;
+      if (stateDir === null) {
+        return JSON.stringify(
+          {
+            ok: true,
+            scope: 'local',
+            machine_id: selfId,
+            machine_name: self,
+            records: null,
+            reason_code: 'MEMORY_NO_STATE_DIR',
+            detail: 'this plugin has no stateDir configured, so there is nowhere the memory log would be',
+            found: false,
+          },
+          null,
+          2,
+        );
+      }
+
+      const current = readMemorySync(stateDir, { limit });
+      const previous = args?.include_previous === true ? readMemorySync(stateDir, { limit, previous: true }) : null;
+
+      /**
+       * A small summary before the records themselves.
+       *
+       * The question that sent someone here is usually "have we run this before, and did it work", and a
+       * count answers it faster than reading twenty lines. The counts are of the records *returned*, not
+       * of the whole file, and that is stated -- a summary that silently described a different set than
+       * the one shown is how a reader learns to distrust the summary.
+       */
+      const tally = (records) => {
+        const by = {};
+        for (const r of records ?? []) {
+          const key = r?.status ?? 'unknown';
+          by[key] = (by[key] ?? 0) + 1;
+        }
+        return by;
+      };
+
+      return JSON.stringify(
+        {
+          ok: true,
+          scope: 'local',
+          machine_id: selfId,
+          machine_name: self,
+          state_dir: stateDir,
+          memory_path: current.path,
+          found: current.path !== null && (current.records.length > 0 || previous !== null),
+          count: current.records.length,
+          skipped_lines: current.skipped,
+          truncated: current.truncated,
+          status_tally: tally(current.records),
+          records: current.records,
+          ...(previous === null
+            ? {}
+            : {
+                previous: {
+                  path: previous.path,
+                  count: previous.records.length,
+                  skipped_lines: previous.skipped,
+                  status_tally: tally(previous.records),
+                  records: previous.records,
+                },
+              }),
+          notes: [
+            current.path === null
+              ? 'no memory has been written here yet: the log is created when a task finishes'
+              : null,
+            current.skipped > 0
+              ? `${current.skipped} line(s) could not be parsed and were skipped; a partially written final line is the expected cause`
+              : null,
+            'conclusion is null until something records what a result meant; the machine only stores the fact',
+            'the relay keeps hashes and never this text, so this file is the only durable copy of the output',
+          ].filter((n) => n !== null),
+        },
+        null,
+        2,
+      );
+    },
+    presentCall: (args) => ({
+      card: 'generic',
+      title: `w2m memory${typeof args?.machine === 'string' ? ` ${args.machine}` : ''}`,
+      kind: 'read',
+      rawInput: {},
+    }),
+  }));
 }
 
 /**
@@ -4735,14 +4911,14 @@ async function startLocalStack(ctx, cfg) {
      *
      * It called `createAgent` with `projectDir` and without `identity`, and passed a
      * `pairingCode` that `createAgent` does not accept. `createAgent` requires `project` and an
-     * `identity.machine_id`, so **`autoStartAgent: true` threw on its first call** — the code path
+     * `identity.machine_id`, so **`autoStartAgent: true` threw on its first call**  - the code path
      * that was supposed to bring an agent up had never run. That is why the fleet-join wire appeared
      * to be missing: the place it was meant to live could not be reached at all.
      *
      * Two more things were wrong with the shape:
      *
      *   * it created a **local relay** unconditionally. For a machine joining a shared fleet that
-     *     is the opposite of what is wanted — the machine must connect to the relay that already
+     *     is the opposite of what is wanted  - the machine must connect to the relay that already
      *     exists, not mint another one, and with `rabbitUrl` pointing at a remote host it would
      *     have tried to bind a relay on that hostname;
      *   * nothing paired the agent, so even a started agent could fetch no offers.