design: Honcho as the M5c spec settles it (P23, amended)

Memory items 4 and 5: two workspaces per agent and one fleet workspace
for untrusted notes; the private ceiling, secret sessions never synced;
trusted memory writes mirrored as conclusions; the agent's peer not
observed; no rebuild, corrections by contra-fact or deleting our own
conclusion; the fleet workspace always untrusted. Recorded in
docs/decisions.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/design.md

@@ -199,16 +199,22 @@ the inference contract, and it must not become a way for injected text to persis
 3. **Local index.** SQLite FTS5 over the session logs and `memory/notes.md`, kept by `memoryd`
    and rebuildable with `bxctl reindex`. It needs no network and no model, so it still answers
    when Honcho is down. `memoryd` counts `recall` hits per note and when each was last found. Retrieval sits behind a `Retriever` trait.
-4. **Honcho.** The fleet's memory service; it and the models it calls run on the owner's hosts. Each
-   Boxmaker writes finished turns to its own workspace, and only turns from sessions that saw no
-   untrusted content and are within a configured data class; `memoryd` enforces this itself. Entries
-   moved by `consolidate` are written there too. Honcho's own extraction, summaries and
-   consolidation replace a flush job of ours. What Honcho holds is derived from the session logs and
-   `memory/notes.md`, and can be rebuilt from them.
-5. **Workspaces and trust.** `memoryd` can read other workspaces. The owner marks each one
-   trusted or untrusted; untrusted is the default. Results from an untrusted workspace are marked
-   untrusted and taint the session. Honcho's conclusions carry no per-entry provenance, so the
-   filter is applied when writing and the label is per workspace.
+4. **Honcho.** The fleet's memory service; it and the models it calls run on the owner's hosts.
+   Each Boxmaker writes finished turns (the speaker's message and its own final reply, from their
+   own peers) to two workspaces of its own: a trusted one for turns from sessions that saw no
+   untrusted content, an untrusted one for the rest. Nothing above `private` is written, and a
+   session that reached `secret` is never synced; `memoryd` enforces this itself, asking
+   `brokerd` for the session's state when the turn ends. Every trusted memory write is mirrored
+   there as a conclusion at once; untrusted notes go, as messages, to one workspace the whole
+   fleet shares. The owner and other people are observed peers; the agent is not, so Honcho draws
+   no conclusions from its replies. Honcho's own extraction, summaries and consolidation replace a
+   flush job of ours. Honcho is not rebuilt from the logs: what it holds wrongly is corrected by
+   writing a contrary fact, or, for a conclusion `memoryd` wrote, by deleting it.
+5. **Workspaces and trust.** `memoryd` reads other agents' trusted workspaces, which the owner
+   marks trusted or untrusted (untrusted is the default), and the fleet workspace, which is always
+   untrusted. Results from an untrusted workspace are marked untrusted and taint the session.
+   Honcho's conclusions carry no per-entry provenance, so the filter is applied when writing and
+   the label is per workspace.
 6. **Provenance on recall.** Recalled text is presented as data with its source and data class,
    never placed in the system prompt, and taints the session with that class; a `memory-tainted` hit
    marks the session untrusted.