Add operator Mentra memory browser

docs/grid-agent-control-plane.md

@@ -48,15 +48,27 @@ The JSON request envelope is stable and versioned. For example:
 {"version":1,"request_id":"health-1","request":{"method":"health"}}
 ```
 
-Observers can call `health`, `metrics`, `runtime`, `list_sessions`,
+Observers can call `health`, `metrics`, `runtime`, `memory_health`, `list_sessions`,
 `list_scheduled_jobs`, `list_pending_approvals`, `list_audit_events`,
 `list_observability_events`, and `subscribe_events`. Operators can additionally
 call `cancel_request`, `pause_autonomy`, `resume_autonomy`, `cancel_action`,
 `decide_approval`, `force_reconnect`, `expire_conversation`, `set_roaming_job`,
-`inject_operator_message`, and `graceful_shutdown`. Cancellation is a mutation
+`list_memory_agents`, `browse_memories`, `search_memories`, `get_memory`,
+`forget_memory`, `inject_operator_message`, and `graceful_shutdown`. Memory
+identity and content operations enforce operator role in the runtime target as
+well as at the mutation gate; observers receive aggregate memory health only.
+Cancellation is a mutation
 and is operator-only. List requests use an opaque numeric cursor and a page
 size of 1 through 100.
 
+Memory agents come from the persisted authenticated-avatar mapping written
+when an authorized IM agent is used; names are never parsed to recover that
+association. Browsing uses Mentra-owned stable `(created_at, record_id)`
+keyset cursors, filters and tombstones. Queries, pages, previews, detail content,
+metadata, concurrent requests, and response frames remain bounded. Forget uses
+Mentra's agent-scoped tombstone operation and audit records contain identifiers
+and outcomes, never memory content.
+
 Runtime projections contain lifecycle/readiness, session generation, safe
 region and pose fields when known, behavior mode, control-queue utilization,
 and aggregate budget use. Conversation responses contain metadata only. Audit