diff --git a/docs/specs/2026-09-24-m5a-local-memory.md b/docs/specs/2026-09-24-m5a-local-memory.md
index ebc0cee..7630f15 100644
--- a/docs/specs/2026-09-24-m5a-local-memory.md
+++ b/docs/specs/2026-09-24-m5a-local-memory.md
@@ -69,7 +69,11 @@ counted with `chars()`. Limits are on the file's text.
 
 **Entries.** `memory.md` and `user.md` are lists of entries separated by a line holding only `§`
 (as Hermes does). An entry is trimmed, is not empty, and may span lines, but may not contain a
-line holding only `§`. Two identical entries in one file are refused.
+line that starts with `§`, leading spaces aside. A `§` inside a line is fine. The same rule holds
+for a note's text: in `notes.md` such a line would read as a header, and a header says where an
+entry came from (review of 2026-09-24: a note from an untrusted session could otherwise plant a
+`moved` header, and `recall` would show what follows it as trusted identity). Two identical
+entries in one file are refused.
 
 **Two kinds of memory** (owner, 2026-09-24). **Identity** is who the agent is and what it holds
 true about its work and its owner: `soul.md`, `memory.md`, `user.md`, in every prompt, written
@@ -88,6 +92,8 @@ each item with its own label. Not everything remembered is believed, but it is r
 <the entry>
 ```
 
+A header is exactly one of these three forms; a line that differs in any part (an unknown word, a
+fourth part, a last part other than `untrusted`) is not a header but text of the entry above.
 A `noted` entry is labelled by the session that wrote it: untrusted if it had read untrusted
 content, trusted otherwise; its class is the session's. `moved` and `dropped` entries were
 identity, so they are trusted. Nothing a write removes is lost: moved and dropped entries go to `notes.md`, and the journal keeps