brokerd: the ledger raises a session's state by the stricter label

M5a task 21. The work is Ornith's, from the stopped run; the design
model checked it against the task file and committed it after finding
that the gate's failure came from its own reference worktree's stale
test binaries in the shared target/ (fixed with cargo clean; 944 tests).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

crates/brokerd/src/ledger/answer.rs

@@ -6,7 +6,7 @@ use proto::{ApprovalAnswer, AuditEvent, DataClass, DenyReason, Timestamp, ToolRe
 
 use super::{Answer, Answered, Call, Grants, Inner, Ledger};
 use crate::approvals::Verdict;
-use crate::policy::{Ask, Denial, SessionState};
+use crate::policy::{Ask, Denial, Label, SessionState};
 
 impl Ledger {
     /// Re-decide an approval and record it.
@@ -159,10 +159,17 @@ impl Ledger {
         };
 
         match &response {
-            // 3. A result raises the state, then is recorded.
-            ToolResponse::Result { .. } => {
+            // 3. A result raises the state, then is recorded. The state follows the stricter of
+            //    the grant's label and the result's own: `memoryd` can make a result stricter.
+            ToolResponse::Result {
+                class, untrusted, ..
+            } => {
+                let label = Label {
+                    class: call.label.class.max(*class),
+                    untrusted: call.label.untrusted || *untrusted,
+                };
                 let raised = match self.state_read(&guard, &call.session) {
-                    Ok(state) => match guard.state.raise(&call.session, state, call.label) {
+                    Ok(state) => match guard.state.raise(&call.session, state, label) {
                         Ok(raised) => raised,
                         Err(e) => {
                             (self.log)(&format!("brokerd: {e}"));