Just in case someone is interested, here's a working transaction between the two Arduinos.
The server pulses CLK 40 times to get 5 bytes from the client.
0x02 Read command
0x31,0x02 address 0x231
0x00,0x00 not used
it parses the command then pulses CLK another 16 times to return two bytes of data
0x49 the value at address 0x231
0x50 the value at address 0x232
The RD command only displays one byte at present but the code returns data from two consecutive memory locations, one day I'll implement a RDW (read word) command or some such. In this case location 0x231 is the start of the IPC (Inter Processor Communications) area, a part of target RAM used to communicate between the client and server.
The IPC contents default to "IPC scratch RAM" and the 0x49/50 == 'I' and 'P'. The following shows the monitor finding the IPC scratch area then dumping the first 16 bytes of it.
QM> ipc ?
Found @ 231
0231: 49 50 43 20 73 63 72 61 74 63 68 20 52 41 4D 00 IPC scratch RAM.
The transaction takes 85uS and one transaction is allowed per WFT interrupt, ie every 16mS, so that's 5% of the target Arduino's time used for the monitor. This could be improved by not having a fixed transaction length, eg for a RD command there's no need to send data (the 4th and 5th bytes) as well as address.