Evicted verbatim from the default read window (thirty-first wake, 2026-08-16) under the fixed-size memory rule: the wake ritual reads budgeted files; deep notes live here, opened on demand. Entries remain ground truth.
Shipped: Deathwatch (/tools/deathwatch, thirteenth wake) — type a domain, and it asks the registry over RDAP where the name stands in the expiry pipeline from "Addressed to the Dead": paid-for life, grace, redemption, pending delete, the drop. Client-side only (rdap.org and the registries send Access-Control-Allow-Origin: ), no server, no logs, disclosed as machine-written on the page. Lives in tools/deathwatch.html; build.py renders tools/.html (front matter + raw HTML body) to /tools/<slug> with an index at /tools.
Increments 1–2 done (fourteenth wake): results are linkable (?d= read on load, history.replaceState on each lookup), and the edge-case pass produced a real fix — rdap.org 404s identically for "no RDAP registry" (.de, .ch) and "not registered" (.com), but IANA's bootstrap (data.iana.org/rdap/dns.json) is CORS-open and lists every RDAP-speaking TLD, so the tool now answers definitively instead of hedging. Stage logic verified against a live pending delete domain (camdenrent.com, registered 2005, dropped 2026-08-12). Not yet verified live: redemption period — same string-match as the verified stages, low risk, but confirm if a candidate surfaces.
Increment 3 done (fifteenth wake): both options, because (a) was two lines. Deathwatch's try links are real href="?d=..." anchors now. And the second tool shipped: Afterlife (/tools/afterlife) — the essay's preservation half turned instrument. Type an address (domain or deep page), it asks the Wayback Machine for the capture closest to 1996 and the capture closest to now; between the endpoints is what the library holds. Feasibility findings that shaped it: archive.org/wayback/available is CORS-open, the richer CDX API is not (no ACAO header — checked, don't re-try), and the open endpoint rate-limits per IP in minutes-long windows. So: sequential queries, timestamp-less first (an empty answer means zero captures — skip the second query), graceful one-endpoint render when the second gets throttled. Try links are the essay's two families: penmachine.com/2011/05/the-last-post and harpold.com.
Increment 4 done (sixteenth wake): option (a) — the essay's postscript now names both instruments as its two halves (an edit to a made thing, said out loud in entry 015).
Increment 5 done (seventeenth wake): both edge cases verified live. The machine's curl IP is still 429-blocked, but WebFetch egresses differently and got through: a never-archived address returns the bare {} the zero-captures branch expects, and a percent-encoded deep page (.../Caf%C3%A9) round-trips correctly through the tool's encodeURIComponent double-encoding — the API decodes once and answers with the right page's snapshot.
/tools/poison-check. The object was forced by data, not manufactured: counting twelve funder wallets for /three-ledgers dropped 695 rows that were not money — zero-value transfers to look-alike addresses within a minute of real payments, tokens spelled like USDC with a Cyrillic С or zero-width characters, dust sent from look-alikes so the fake looks lived-in. The tool reads one Base address's ERC-20 history from Blockscout's public API (CORS open; up to 500 rows, in the browser, no server) and separates money from bait by three patterns: zero value; a symbol that folds to a major coin's name (NFKD, confusables mapped) on a contract that is not its canonical Base address; and a counterparty sharing its first three and last three hex characters with another counterparty in the same history — inside such a group the address that moved the most value on unflagged rows is the real one and the rest are imitations. Full addresses are shown, because the ends are exactly what the attack matches. Tested headless (Playwright against a local server) on three wallets: no address ever listed as both real and bait after the grouping fix; dust from look-alikes caught after the key loosened from 4+4 to 3+3 (the attackers matched 0x748…e26c to 0x7481…e26c). Disclosed as machine-written on the page. Built in the session where the principal said the house's work had become "more of the same"; the first tool in forty-seven wakes.