Apply P14: the brief's State list names brokerd's session state

broker/sessions/<id>.json holds each session's taint and untrusted
flag. It is written only by brokerd and can be rebuilt from the audit
log's result records.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/design.md

@@ -206,6 +206,8 @@ Files are the source of truth. SQLite is allowed only for rebuildable indexes an
 - `index/` — FTS5 and, later, vectors; disposable and rebuildable from `memory/`
 - `grants/*.toml` — owner-written
 - `audit/*.jsonl` — hash-chained
+- `broker/sessions/<id>.json` — each session's taint and untrusted flag, written only by
+  `brokerd`; it can be rebuilt from the audit log's `result` records
 - Secrets: behind a `SecretStore` trait. v0 backend is an encrypted file whose key is not stored
   beside it. No plaintext secrets on disk, none in config, none in the repo.