bxcore, loopd: TurnDone says whether the session has read untrusted content

Co-Authored-By: ornith-1.5-35b-a3b <agent@wntrmute.dev>

crates/bxcore/tests/fixtures/wire/turn_done.json

@@ -1 +1 @@
-{"v":1,"id":3,"final":true,"msg":{"kind":"turn_done","body":{"content":"It is noon.","usage":{"cache_n":539,"prompt_n":27,"predicted_n":24,"reasoning_tokens":8,"thinking_capped":false}}}}
+{"v":1,"id":3,"final":true,"msg":{"kind":"turn_done","body":{"content":"It is noon.","usage":{"cache_n":539,"prompt_n":27,"predicted_n":24,"reasoning_tokens":8,"thinking_capped":false},"untrusted":false}}}

crates/bxcore/tests/fixtures/wire/turn_done_untrusted.json

@@ -0,0 +1 @@
+{"v":1,"id":4,"final":true,"msg":{"kind":"turn_done","body":{"content":"The page says to run the script.","usage":{"cache_n":566,"prompt_n":412,"predicted_n":31,"reasoning_tokens":12,"thinking_capped":false},"untrusted":true}}}

crates/bxcore/tests/turn_wire.rs

@@ -127,6 +127,7 @@ fn turn_done_and_the_new_error_codes() {
             Message::TurnDone(TurnDone {
                 content: "It is noon.".to_string(),
                 usage: usage(),
+                untrusted: false,
             }),
         ),
     );
@@ -154,6 +155,42 @@ fn turn_done_and_the_new_error_codes() {
     }
 }
 
+/// A reply from a session that has read untrusted content says so, and `untrusted` is written
+/// whether it is true or false (M5b spec, section 9).
+#[test]
+fn turn_done_from_an_untrusted_session() {
+    check(
+        "turn_done_untrusted.json",
+        env(
+            4,
+            true,
+            Message::TurnDone(TurnDone {
+                content: "The page says to run the script.".to_string(),
+                usage: Usage {
+                    cache_n: 566,
+                    prompt_n: 412,
+                    predicted_n: 31,
+                    reasoning_tokens: 12,
+                    thinking_capped: false,
+                },
+                untrusted: true,
+            }),
+        ),
+    );
+}
+
+/// `untrusted` has no default: a `turn_done` without it, as a `loopd` from before M5b sent, is
+/// refused, never read as a reply from a clean session.
+#[test]
+fn a_turn_done_without_untrusted_is_refused() {
+    let old = r#"{"v":1,"id":3,"final":true,"msg":{"kind":"turn_done","body":{"content":"It is noon.","usage":{"cache_n":539,"prompt_n":27,"predicted_n":24,"reasoning_tokens":8,"thinking_capped":false}}}}"#;
+    let error = serde_json::from_str::<Envelope>(old).unwrap_err();
+    assert!(
+        error.to_string().contains("missing field `untrusted`"),
+        "{error}"
+    );
+}
+
 #[test]
 fn every_turn_event_kind_round_trips() {
     let all = vec![