Add operator Mentra memory browser

docs/grid-agent-control-plane.md

@@ -48,15 +48,27 @@ The JSON request envelope is stable and versioned. For example:
 {"version":1,"request_id":"health-1","request":{"method":"health"}}
 ```
 
-Observers can call `health`, `metrics`, `runtime`, `list_sessions`,
+Observers can call `health`, `metrics`, `runtime`, `memory_health`, `list_sessions`,
 `list_scheduled_jobs`, `list_pending_approvals`, `list_audit_events`,
 `list_observability_events`, and `subscribe_events`. Operators can additionally
 call `cancel_request`, `pause_autonomy`, `resume_autonomy`, `cancel_action`,
 `decide_approval`, `force_reconnect`, `expire_conversation`, `set_roaming_job`,
-`inject_operator_message`, and `graceful_shutdown`. Cancellation is a mutation
+`list_memory_agents`, `browse_memories`, `search_memories`, `get_memory`,
+`forget_memory`, `inject_operator_message`, and `graceful_shutdown`. Memory
+identity and content operations enforce operator role in the runtime target as
+well as at the mutation gate; observers receive aggregate memory health only.
+Cancellation is a mutation
 and is operator-only. List requests use an opaque numeric cursor and a page
 size of 1 through 100.
 
+Memory agents come from the persisted authenticated-avatar mapping written
+when an authorized IM agent is used; names are never parsed to recover that
+association. Browsing uses Mentra-owned stable `(created_at, record_id)`
+keyset cursors, filters and tombstones. Queries, pages, previews, detail content,
+metadata, concurrent requests, and response frames remain bounded. Forget uses
+Mentra's agent-scoped tombstone operation and audit records contain identifiers
+and outcomes, never memory content.
+
 Runtime projections contain lifecycle/readiness, session generation, safe
 region and pose fields when known, behavior mode, control-queue utilization,
 and aggregate budget use. Conversation responses contain metadata only. Audit

docs/grid-agent-llm.md

@@ -36,6 +36,9 @@ learning without displacing the command being handled.
 Runtime records use `HybridRuntimeStore`: conversation/runtime state is stored
 in `runtime.sqlite`, with the associated Mentra memory store and transcript,
 task, team, and workspace paths under the configured state directory.
+`memory-agents.json` atomically persists the authenticated avatar, logical
+agent key, and actual Mentra agent ID for operator browsing. This explicit
+mapping is restored independently of generated agent names.
 
 ## Tools and autonomous safety review
 

docs/grid-agent-tui.md

@@ -36,10 +36,18 @@ The Overview dashboard shows readiness, region/pose, behavior, build and visual
 work, approvals, and recent failures. Queues & budgets shows real queue and
 rate-limit gauges, active work, outcome counts, dropped events, aggregate
 latency, and a bounded 120-refresh history. Sessions, roaming schedules,
-approvals, timeline/audit, errors, diagnostics, health, and preferences retain
+approvals, durable memory, timeline/audit, errors, diagnostics, health, and preferences retain
 focused tables or panels and contextual detail. Missing backend data is marked
 unavailable rather than estimated.
 
+The Memory panel is operator-only. Enter loads the selected agent or record,
+`g` changes the explicitly mapped avatar agent, `n`/`b` page, `k` cycles record
+kind, `i` cycles pinned state, `o` changes sort, and `d` confirms a durable
+tombstone. `/` searches content; `source:value`, `from:unix-seconds`, and
+`to:unix-seconds` tokens set provenance and creation-time filters. Empty search
+text browses all non-tombstoned records. Observer clients receive aggregate
+agent/record health only and never memory identity, preview, or content.
+
 Use Tab/Shift-Tab or Left/Right to change panels and Up/Down to select rows.
 `/` searches event, audit, correlation, time, duration, result, and reason data;
 Enter applies the search and Esc clears it. `r` refreshes; `p`/`u` pause or
@@ -60,9 +68,11 @@ when the bounded worker queue is full. The terminal guard restores raw mode,
 cursor visibility, and the alternate screen on success, error, Ctrl-C, or
 panic unwinding.
 
-Diagnostic panels show only explicitly captured redacted envelopes. Prompt
-and response content, API keys, grid passwords, operator tokens, capability
-URLs, and model reasoning have no TUI representation.
+Diagnostic panels show only explicitly captured redacted envelopes. Memory
+content appears only in the operator-only Memory detail panel; it is never
+copied into diagnostics, audit events, or observer responses. API keys, grid
+passwords, operator tokens, capability URLs, and model reasoning have no TUI
+representation.
 
 Focused verification: