memoryd: the Honcho workspaces it reads, with their clients and labels

Co-Authored-By: ornith-1.5-35b-a3b <agent@wntrmute.dev>

crates/memoryd/tests/honcho_start.rs

@@ -204,6 +204,22 @@ fn a_key_for_an_agent_not_read_stops_memoryd() {
     assert_no_key(&stderr);
 }
 
+/// The readers are built at start (M5c-2): a read workspace's key that cannot be read stops
+/// `memoryd`, as a written workspace's does.
+#[test]
+fn a_read_key_that_cannot_be_read_stops_memoryd() {
+    let extra = format!("{SECTION}[secrets.honcho_read_boxmaker1]\nenv = \"HONCHO_NOT_SET\"\n");
+    let home = Home::new("honcho-read-key", &extra);
+    let (code, stderr) = home.run_to_end();
+    assert_eq!(code, Some(1), "{stderr}");
+    assert!(stderr.contains("honcho_read_boxmaker1"), "{stderr}");
+    assert!(
+        stderr.contains("see docs/runbook.md#secret-unavailable"),
+        "{stderr}"
+    );
+    assert_no_key(&stderr);
+}
+
 #[test]
 fn an_unknown_key_in_the_section_is_still_a_start_failure() {
     let extra = SECTION.replace("fleet = \"fleet\"", "fleet = \"fleet\"\nfleat = \"x\"");
@@ -234,5 +250,13 @@ fn a_valid_section_with_keys_starts_memoryd_as_before() {
     let stderr = home.stderr();
     assert!(stderr.contains("memoryd: serving\n"), "{stderr}");
     assert_no_key(&stderr);
+    // The writers and the readers both load the fleet's key file; its warning is logged once.
+    assert_eq!(
+        stderr
+            .matches("secret honcho_fleet is read in plaintext")
+            .count(),
+        1,
+        "{stderr}"
+    );
     assert!(!stderr.contains(POINTER), "{stderr}");
 }