host: preserve journals, full traps and embedded agent output

Write new journal entries under logs/core and merge read-only legacy
history without moving SQLite/WAL files. Atomically spool failed batches,
retaining unspoolable entries for event-driven retries. Journal full trap
diagnostics before UTF-8-safe status display. Port session overflow archives
and followable line/byte excerpts to the still-shipped embedded agent.
Document retention/recovery and cover the contracts with regressions.
Include one rustfmt-only normalization in the existing SDK WASI test.

Card: SAU-143

PROTOCOL.md

@@ -34,7 +34,8 @@ Rust plugins use the SDK `sausage-plugin`. Its source is at
     source/                   the source. `cargo.build` builds it from here.
       imports/<plugin>.json   descriptions of the imported plugins
   state/<plugin>/             persistent state of a plugin, by convention
-  state/core/journal.sqlite   the journal
+  logs/core/journal.sqlite    the journal
+  state/core/                console history (state, not logs)
   config/                     global configuration
     boot.yaml                 the services
     agent.yaml                the API, base URL, model, and key of the agent
@@ -279,9 +280,23 @@ for example the control interface of a web server.
 
 ## 7. The journal
 
-- An SQLite file at `/state/core/journal.sqlite`. Only the core writes it.
+- New entries go to `/logs/core/journal.sqlite`. Only the core writes it.
+  An existing `/state/core/journal.sqlite` stays in place and is opened
+  read-only; queries merge both databases by entry ID before applying the
+  limit. The host never renames a live SQLite/WAL trio. Console history stays
+  in `/state/core`. No journal or log files are automatically pruned.
+- If a journal transaction fails, the complete batch (including original
+  IDs and timestamps) is saved in an exclusive, synced JSON file under
+  `/logs/core/failed-batches/`; the host reports its path on stderr. These
+  files are recovery artifacts, not query results: recovery/import is
+  deliberate, using IDs to avoid duplicates, and never deletes the source.
+  If spooling also fails, entries stay in memory and retry on the next
+  command (no polling); at writer shutdown their full text is reported to
+  host stderr. Storage failure plus host loss can still lose unsaved data.
 - Each entry has a UUIDv7 (it sorts by time), the process ID, the plugin, the
   stream (`stderr` or `core`), and the line.
+- Traps retain their full diagnostic text in the journal; short exit-status
+  displays are UTF-8-boundary-safe.
 - The core writes its own events too: start (with method and params), exit
   status, stop, kill, upgrades, and the warning about discarded stdout.
 - `core.log {plugin?, pid?, since?, until?, grep?, limit?}` queries the
@@ -473,3 +488,19 @@ Tests:
   files through `env!("CARGO_MANIFEST_DIR")`.
 - The test runner answers `core.lock`, `core.unlock`, `core.notify`, and
   `core.log`. A call to a plugin fails: a test has no other plugins.
+
+## 12. Embedded agent tool output
+
+The agent shipped by `sausage init` uses a context-size guard of 50 KiB or
+2000 lines, not a data-retention limit. Oversized tool results, including
+errors, are saved in full under `/logs/agent/<date>/default/` before history
+and provider delivery receive an excerpt. Overflow JSON string values are
+rendered as physical text lines so the reference's one-based inclusive line
+ranges can be followed with `read_file {path, line_offset, line_limit}`
+(zero-based offset; default 200 lines). Huge single lines give exact byte
+ranges and continuation offsets. Command/log/build/test results show the
+tail; other tools show the head. Reading an existing `/logs` file excerpts
+that same file without making another archive. Archives are exclusive and
+never automatically deleted. If archival fails, the agent reports the error
+to stderr and keeps the complete result instead of discarding it. Existing
+history formats and paths are unchanged.