diff --git a/CLAUDE.md b/CLAUDE.md
index 50aebd1..35d4cd2 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -18,13 +18,20 @@ and checked end to end against the owner's Mattermost; no finding is open. M4b (
 Mattermost, spec `docs/specs/2026-09-24-m4b-approvals.md`, 18 tasks) is done and merged, reviewed
 in `docs/implementer-log.md` and checked end to end against the owner's Mattermost, including an
 approval asked by a non-approver; no finding is open. M5 (memory, then the scheduler) is split into
-M5a, M5b and M5c by P17 to P21 (applied 2026-09-24). M5a (local memory, `memoryd`) is specified in
-`docs/specs/2026-09-24-m5a-local-memory.md` (approved) and planned in `docs/plans/M5a/` (15 tasks,
-branch `m5a`); its reference is a bundle on straylight, `~/boxmaker-refs/m5a-ref.bundle`. The owner's Honcho client
-`roncho` is on titan, not on this machine. Branches land on master by rebase and
+M5a, M5b and M5c by P17 to P21 (applied 2026-09-24). M5a (local memory, `memoryd`, spec
+`docs/specs/2026-09-24-m5a-local-memory.md`, 22 tasks) is done and merged, reviewed in
+`docs/implementer-log.md` and checked on straylight against the owner's Mattermost; the device
+check found that a recalled tainted note left a session trusted, fixed by task 21. Its one open
+item, a reason in invalid-arguments refusals, is in `docs/decisions.md` for M5b. M5b (Honcho and
+hardening) is next and has no spec yet. P22 (proposed, not applied) makes Boxmaker a fleet of
+independent agents, one per host, deployed with Nix in a last milestone, M8; `flake.nix` builds
+every binary, the tool image and a dev shell. Work happens on titan (macOS, no Nix); build and run
+on straylight, where `~/src/boxmaker-m5a` is a clone built with `nix build`. The owner's Honcho
+client `roncho` is at `~/src/roncho`. Branches land on master by rebase and
 fast-forward, never a merge commit. The owner's Mattermost settings and the
-bot's token are in `mattermost.env` at the repository root: ignored by git, never committed, and
-the token is never printed.
+bot's token are in `mattermost.env` at the repository root (on straylight,
+`~/.config/boxmaker/mattermost.env`): ignored by git, never committed, and the token is never
+printed.
 Straylight now serves Ornith as four slots over one 262,144-token pool; see
 `docs/inference-contract.md`, "Deployment change, 2026-09-20", before relying on cache behaviour.
 `docs/runbook.md` has an entry for every