memory: remote-ssh MCP live and narrow; record the two traps that cost time

Records what the fork now contains and, more usefully, the two things that will
waste a future session's time: .mcp.json points at built output so an unbuilt
edit serves stale code, and a finite stdin pipe kills the server mid-handshake
while reporting what looks exactly like a remote-side SSH fault.

Also records the disproven hypothesis — irv-ml1's zsh login shell was not the
cause, because the server invokes bash explicitly — so nobody re-derives it.

persistent-memory.md

@@ -297,8 +297,32 @@ below is a live commitment or a known-open risk._
   with wildcards deliberately ignored. Two things to settle before use: the
   reboot/shutdown denial will block legitimate infra-ops work, and
   `.github/workflows/star-history.yml` is upstream chore CI sitting in a repo where
-  `has_actions=True`. Left the fork pristine (no commits) so it still diffs cleanly
+  `has_actions=True`. **Both actioned — three commits landed 2026-09-05, LOCAL
-  against upstream.
+  ONLY and NOT PUSHED (push is the operator's call):** (1) stripped upstream
+  furniture — star-history CI, its generated assets, the `server.json` registry
+  manifest, branding JPEGs, zh-CN README; (2) removed the power-control denylist
+  rule and documented in code + tests + README that the list guards ACCIDENTS and
+  is not a boundary, with three bypasses asserted as ALLOWED so a green suite is
+  never read as containment; (3) **`strictAllowlist`** — upstream's allowlist was
+  additive and discovery unconditional, so the default allowlist was all 18 `Host`
+  entries in `~/.ssh/config`. Strict makes explicit hosts authoritative and
+  discovery metadata-only. Verified live: `corviduo-dev` is in ssh_config, not in
+  our allowlist, and is refused `host_not_allowed`. 41/41 tests green.
+
+- **`remote-ssh` MCP server is LIVE** — registered project-scoped in
+  `eshpfi-management/.mcp.json` with `SSH_MCP_STRICT_ALLOWLIST=1`; allowlist in
+  `~/.config/remote-ssh-mcp/config.json` starts deliberately narrow at
+  **`irv-ml1`, `nh3-extdev`** (widen there, not by discovery). Smoke-verified end
+  to end on both: persistent shell, `cd` and exported vars survive across calls,
+  **~6 ms/command on nh3-extdev and ~22 ms on irv-ml1** (WireGuard) versus a fresh
+  handshake each time. ⚠ **`.mcp.json` points at the built `dist/`** — edit the
+  fork without `npm run build` and the server keeps serving old code; that bit me
+  mid-session. ⚠ **A finite stdin pipe is NOT a valid smoke harness** — closing
+  stdin kills the server mid-handshake and reports `connect_failed: SSH shell
+  exited during the open handshake`, which looks exactly like a remote-side fault
+  and is not. Use a client that holds stdin open. (I briefly suspected irv-ml1's
+  zsh login shell; wrong — the server invokes `bash --noprofile --norc`
+  explicitly, so the login shell is irrelevant.)
 
 ## Recent decisions