diff --git a/Cargo.lock b/Cargo.lock
index acbc223..83f73f6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -239,6 +239,7 @@ name = "memoryd"
 version = "0.1.0"
 dependencies = [
  "bxcore",
+ "roncho",
  "rusqlite",
  "serde",
  "serde_json",
@@ -295,6 +296,21 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "roncho"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5ccccc22910c51737352c2f0967c7aa40712a0afa7dc740f21354d8daf42e40"
+dependencies = [
+ "rustls",
+ "rustls-native-certs",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "toml",
+ "zeroize",
+]
+
 [[package]]
 name = "rsqlite-vfs"
 version = "0.1.1"
diff --git a/Cargo.toml b/Cargo.toml
index 276d119..93c6386 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -30,4 +30,5 @@ rustls = { version = "0.23.45", default-features = false, features = ["ring", "s
 rustls-native-certs = "0.8.4"
 zeroize = "1.9.0"
 rusqlite = { version = "0.40.2", features = ["bundled"] }
+roncho = { version = "1.0.0", default-features = false, features = ["tls"] }
 
diff --git a/crates/memoryd/Cargo.toml b/crates/memoryd/Cargo.toml
index 3505eee..629bca8 100644
--- a/crates/memoryd/Cargo.toml
+++ b/crates/memoryd/Cargo.toml
@@ -10,6 +10,7 @@ workspace = true
 
 [dependencies]
 bxcore.workspace = true
+roncho.workspace = true
 rusqlite.workspace = true
 serde.workspace = true
 serde_json.workspace = true
diff --git a/docs/dependencies.md b/docs/dependencies.md
index 8237339..9808fc6 100644
--- a/docs/dependencies.md
+++ b/docs/dependencies.md
@@ -13,6 +13,7 @@ Every external crate has a row here. `scripts/check-dep-docs.sh` enforces it.
 | `rustls-native-certs` | 0.8.4 | `gatewayd` | The host's trusted certificates, so a CA installed on the host is trusted too; adds `openssl-probe`. Apache-2.0 OR ISC OR MIT. |
 | `zeroize` | 1.9.0 | `bxcore`, feature `secrets` (enabled by `gatewayd`; never by `loopd`) | Wipes a secret's memory when it is dropped (`Secret`). Already a dependency of `rustls`. Apache-2.0 OR MIT. |
 | `rusqlite` | 0.40.2 | `memoryd` from M5a | The full-text index (`index/memory.sqlite3`, FTS5), disposable and rebuilt from files. Feature `bundled`: `libsqlite3-sys` compiles SQLite from source with FTS5 on, so no system SQLite is needed. With its dependencies: `libsqlite3-sys` (MIT; build: `cc`, `pkg-config`, `vcpkg`), `hashlink`, `hashbrown`, `foldhash` (Zlib, added to `deny.toml` for it), `fallible-iterator`, `fallible-streaming-iterator`, `smallvec`, `bitflags`. MIT. |
+| `roncho` | 1.0.0 | `memoryd` from M5c | The owner's Honcho client (`docs/specs/2026-09-25-roncho-requirements.md`). `default-features = false`, feature `tls` (which implies `blocking`): a blocking client over `std::net`, no async runtime; TLS through `rustls`, already a dependency of `gatewayd`. It adds only itself to the lock file: `serde`, `serde_json`, `thiserror`, `toml`, `zeroize` and the TLS crates are already there. Checked against its requirements on 2026-09-27 (every client built with `.without_config_file()`, spec M5c section 6). Apache-2.0. |
 
 ## Ported code
 
diff --git a/docs/egress.md b/docs/egress.md
index 2c3198d..bc7a3a9 100644
--- a/docs/egress.md
+++ b/docs/egress.md
@@ -11,6 +11,8 @@ allowed.
 | Run time (M2a) | `inferproxy` | the `llama-server` router on the host (`straylight:11434`) | Every inference request `loopd` makes, forwarded byte for byte |
 | Run time (M3b) | `brokerd`'s egress proxy container, for one `http_fetch` call | only the hosts the call's grant names, on port 443, at public addresses | The tool's HTTPS request, end to end; the proxy sees only the host name |
 | Run time (M4a) | `gatewayd` | the owner's Mattermost at `https://straylight.scylla-hammerhead.ts.net` (tailnet) | REST calls and one WebSocket: the owner's messages in, Boxmaker's answers out. Mattermost stores messages unencrypted in its database; the server is the owner's |
+| Run time (M5c) | `memoryd`, through `roncho` | the owner's Honcho at `[honcho] url` (rift: `http://rift.scylla-hammerhead.ts.net:8000`, tailnet) | Finished turns (the speaker's message and the final reply), conclusions mirroring trusted memory writes and untrusted notes, deletions of those conclusions; from M5c-2, searches and dialectic questions. Nothing from a `secret` session or above `private`. Honcho runs its own models on the owner's hosts to derive conclusions (none on the fleet workspace); its server counts telemetry events but sends none (`telemetry_events_emitted_total`, 0 on 2026-09-27) |
+| Development (M5c) | the design model, planning M5c-1 | rift's Honcho | Recording real responses for the tests' fake server, in the throwaway workspace `boxmaker-plan-probe` only, deleted afterwards |
 
 The two run-time rows for M2a and M3b were missing until 2026-09-23; they were added with the M4a
 spec.