A shared folder both sides can write is a much better primitive than a memory API, mostly because the state stays inspectable. When an agent behaves strangely you can open the file and see what it thinks is true, and fix it by editing a line rather than by prompting it out of a belief. The two hazards worth planning for are both concurrency-shaped: sync clients and an agent writing the same note produce conflict copies rather than errors, so it is worth confining the agent to its own subfolder and having the merge be a human decision. And a vault is untrusted input the moment anything clipped from the web lands in it - text in a note is instructions to whatever reads it next, which is a different threat model from notes that only a person reads.