docs: M5c spec: queries from any session, two workspaces per ask_memory, tools per session

Owner, 2026-09-28: recall and ask_memory query Honcho from a session of any class, since Honcho
stores no query and rift's models and telemetry stay on the owner's hosts; the assumption is
written down, with what changes if rift's configuration does. A query holding a known-prefix
secret is refused. ask_memory names at most two workspaces, both asked at once inside brokerd's
wait. A session keeps the tools array it started with, so M5c-2 needs no new epoch.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/specs/2026-09-27-m5c-honcho.md

@@ -209,17 +209,26 @@ trusted workspace are conclusions: so for those `recall` also queries conclusion
 wrote, both are the same peer). The fleet workspace holds messages, so one search finds the notes
 of every peer in it, including agents this one was never told about (owner).
 
+**Queries from any session** (owner, 2026-09-28). `recall` searches Honcho, and `ask_memory` asks
+it, from a session of any class, `secret` included: a query is not written to Honcho, which stores
+neither searches nor dialectic questions, and on rift it reaches only the owner's own hosts (its
+models run on dixie; its server sends no telemetry, `docs/egress.md`). This is an assumption about
+rift's configuration, not a property of the code: if rift ever uses a hosted model or exports
+telemetry, a `secret` session's queries must stop going to Honcho without the owner's approval
+(the option set aside on 2026-09-28). A query or question that holds a known-prefix secret
+(`sanitize::refuse`'s secret rules) is refused before anything is sent, in every session.
+
 ## 9. `ask_memory`
 
 A new core tool, `ask_memory { question, workspaces?, reasoning? }`:
 
-- `workspaces`: names from `[honcho]`: `own` (default), `untrusted`, `fleet`, or another agent's
-  name from `[[honcho.read]]`;
+- `workspaces`: at most two names from `[honcho]`: `own` (default), `untrusted`, `fleet`, or
+  another agent's name from `[[honcho.read]]` (owner, 2026-09-28: two, so that both chats run at
+  once inside `brokerd`'s wait; the model asks again for more);
 - `reasoning`: `minimal` (default: one search, then the answer) or `low`;
 - `question`: at most 2,000 characters.
 
-One workspace chat (`POST /workspaces/{w}/chat`) per named workspace, in parallel, at most two at a
-time; workspace chat searches every conclusion and message of the workspace without the model
+One workspace chat (`POST /workspaces/{w}/chat`) per named workspace, both at once; workspace chat searches every conclusion and message of the workspace without the model
 choosing a peer (it averaged 13 s on rift, over only three calls; peer chat, 32 s over 318). Each
 has 150 s. The answer lists each workspace's reply, neutralised and capped, tagged like a `recall`
 hit (`memory` for the agent's own trusted workspace and for others the owner labelled trusted,
@@ -227,8 +236,10 @@ hit (`memory` for the agent's own trusted workspace and for others the owner lab
 do. `brokerd`'s wait for this tool is 170 s and `loopd`'s wait on `brokerd` for it 180 s (section
 11).
 
-Adding a tool changes the `tools` array: a new epoch for every session when M5c-2 is deployed,
-and the baseline is measured again against the 3,000-token budget.
+Adding a tool changes the `tools` array, and the baseline is measured again against the
+3,000-token budget. A session keeps the tools array it was created with (its baseline is saved at
+its start and sent on every request), so sessions started before M5c-2 is deployed keep their
+cache and never see `ask_memory`; sessions started after it have it.
 
 ## 10. Configuration and secrets
 
@@ -308,7 +319,10 @@ that records requests and answers from fixtures taken from rift's OpenAPI docume
   from a peer this agent's configuration does not name is found by `recall`.
 - **`recall`**: the fleet sources with their tags and classes; a source that times out is one
   `unavailable` line and the rest still answer; the agent's own workspaces are not searched.
-- **`ask_memory`**: two at a time; the per-workspace limit; labels; unknown workspace names.
+- **`ask_memory`**: at most two workspaces, both at once; the per-workspace limit; labels;
+  unknown workspace names.
+- **Queries**: a query or question holding a known-prefix secret is refused and nothing is sent;
+  a `secret` session's query is sent.
 - **No `[honcho]` section**: M5b's behaviour, every M5b test unchanged.
 - **Attack tests (T37)**: a turn from a session that fetched a page never reaches the trusted
   workspace, even when `brokerd` answers late; a fleet hit taints the reading session.