diff --git a/docs/decisions.md b/docs/decisions.md
index ae2dc18..50bdd60 100644
--- a/docs/decisions.md
+++ b/docs/decisions.md
@@ -30,6 +30,7 @@ Approved by the owner on 2026-09-17. One commit each.
 | P3 | Inference contract 7: requests set `return_progress: true`; progress events count as liveness. | M0 (i): otherwise the stream is silent during prefill. |
 | P4 | Inference contract 8: the thinking cap uses `reasoning_control` and the control endpoint. | README b10809. Not yet exercised. |
 | P5 | Settle the open question: chat-completions with server-side tool parsing. | M0 (b), (c). |
+| P6 | Code constraints: `Decision` lives in `brokerd`, has a private field and does not implement `Deserialize`. `proto` carries a plain `DecisionRecord` for the audit log. | Rust privacy is per crate, and a deserializable type can be built by anyone. |
 
 ## Proposed changes to the design brief
 
@@ -37,7 +38,6 @@ From M0 and the kickoff review. None is applied yet. Each lands as its own commi
 
 | # | Change | Evidence |
 |---|---|---|
-| P6 | Code constraints: `Decision` lives in `brokerd`, has a private field and does not implement `Deserialize`. `proto` carries a plain `DecisionRecord` for the audit log. | Rust privacy is per crate, and a deserializable type can be built by anyone. |
 | P7 | Inference contract 1: the baseline budget test needs the server's tokenizer, so `make gate` has an offline part and an on-device part (`make verify-device`). | `/tokenize` is a server endpoint. |
 | P8 | Target environment: describe the shared router as deployed (router mode, `--models-max 2`, other clients on the same Ornith instance, q8_0 KV, six-hour idle unload). Drop "memory is abundant". | `docs/inference-contract.md`, "What is running". |
 | P9 | Inference contract 5: slots are pinned with `id_slot` but not reserved. Another client can evict a harness slot, and the router can unload Ornith. Cache loss is an expected event: `loopd` detects it (`cache_n` far below the previous request's total), logs it in the session log, and carries on. It is never an error. A session always uses the same slot; threads may share the main slot. | Shared router decision. M0 (d): evicted sessions came back from the host-RAM prompt cache in under a second on the same slot, and cost a full re-read on another slot. |
diff --git a/docs/design.md b/docs/design.md
index 16cadf9..912ad33 100644
--- a/docs/design.md
+++ b/docs/design.md
@@ -197,6 +197,8 @@ Files are the source of truth. SQLite is allowed only for rebuildable indexes an
   `inferproxy`, `toolkit` (tool container entrypoints), `bxctl` (owner CLI).
 - No source file over 500 lines. No crate depends on another role's crate, only on `proto`.
 - Authority is encoded in types: a tool cannot execute without a `Decision` value that only
-  `brokerd`'s policy module can construct.
+  `brokerd`'s policy module can construct. `Decision` is defined in `brokerd`, has a private
+  field and does not implement `Deserialize`, so no other crate or wire message can produce one.
+  `proto` carries a plain `DecisionRecord` for the audit log and the wire.
 - Dependencies are few and justified in `docs/dependencies.md`. `cargo-deny` runs in the gate.
 - No telemetry, no update checks, no outbound call not listed in `docs/egress.md`.