M5a plan: tasks 21 and 22, from the device check

21: the ledger raises a session's state by the stricter of the grant's
label and the result's own, so a clean session that recalls a
memory-tainted note becomes untrusted and cannot write it into
memory.md (found on straylight, 2026-09-25). 22: the answers to a note
name notes.md, and for an untrusted add the file that was not changed.
The new given tests are ledger_label.rs and new versions of memoryd's
edit.rs and serve.rs; the old copies are kept as -task06 and -task10. On
a scratch tree at the end of task 20: the named tests fail and then pass,
5 and 4 mutations are caught, and the gate passes with 944 tests.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/plans/M5a/21-session-follows-result.md

@@ -0,0 +1,94 @@
+# M5a task 21: a session's state follows the result's own label
+
+**Branch:** `m5a` (run `git switch m5a`; `git status --short` must be empty, otherwise stop)
+**Commit subject:** `brokerd: the ledger raises a session's state by the stricter label`
+
+## Goal
+
+A fix for a hole the M5a device check found (2026-09-25). After every tool call, the ledger raises
+the session's state (its taint and whether it has read untrusted content). It used the label of
+the **grant** the call ran under, never the label on the result. Before M5a they were always the
+same. Now `memoryd` can make a result stricter: a `recall` that finds a `memory-tainted` note
+answers `untrusted`. The runner already combines the two labels, and the audit log records the
+combined one, but the session stayed trusted. So a clean session could recall a note written after
+a fetched page, then `add` it to `memory.md` as identity. On the device, that is what happened.
+
+The fix: in `Ledger::finish`, raise the state by the stricter of the grant's label and the
+result's own: the higher class, and untrusted if either is (M5a spec, section 8, as changed in
+`0e5b1d2`).
+
+## Files
+
+- Copy: the new test `crates/brokerd/tests/ledger_label.rs`, from `docs/plans/M5a/files/` (the
+  same path under it)
+- Modify: `crates/brokerd/src/ledger/answer.rs`, `docs/implementer-log.md`
+
+## The edits, exactly
+
+Both are in `crates/brokerd/src/ledger/answer.rs`. Nothing else in the file changes.
+
+**1.** The line
+
+```rust
+use crate::policy::{Ask, Denial, SessionState};
+```
+
+becomes
+
+```rust
+use crate::policy::{Ask, Denial, Label, SessionState};
+```
+
+**2.** In `finish`, the lines
+
+```rust
+            // 3. A result raises the state, then is recorded.
+            ToolResponse::Result { .. } => {
+                let raised = match self.state_read(&guard, &call.session) {
+                    Ok(state) => match guard.state.raise(&call.session, state, call.label) {
+```
+
+become
+
+```rust
+            // 3. A result raises the state, then is recorded. The state follows the stricter of
+            //    the grant's label and the result's own: `memoryd` can make a result stricter.
+            ToolResponse::Result {
+                class, untrusted, ..
+            } => {
+                let label = Label {
+                    class: call.label.class.max(*class),
+                    untrusted: call.label.untrusted || *untrusted,
+                };
+                let raised = match self.state_read(&guard, &call.session) {
+                    Ok(state) => match guard.state.raise(&call.session, state, label) {
+```
+
+The lines after them (`Ok(raised) => raised,` and on) stay as they are.
+
+## Steps
+
+- [ ] **1. Copy the test:**
+  `cp docs/plans/M5a/files/crates/brokerd/tests/ledger_label.rs crates/brokerd/tests/`
+- [ ] **2. See it fail.** `cargo test -p brokerd --test ledger_label`. Expected: two tests fail,
+  `a_recall_of_a_tainted_note_makes_a_clean_session_untrusted` and
+  `a_result_of_a_higher_class_than_its_grant_raises_the_taint`. The third,
+  `a_result_laxer_than_its_grant_still_raises_the_state_by_the_grant`, already passes; it guards
+  what must not change.
+- [ ] **3. Make the two edits.** Run `cargo fmt --all`.
+- [ ] **4. See it pass.** `cargo test -p brokerd --test ledger_label`: all three pass. Then
+  `cargo test -p brokerd`: every suite passes.
+- [ ] **5. Run the gate.** `make gate`, with a shell timeout of at least 600000 ms: on titan, while
+  it serves Ornith, the gate takes longer than 2 minutes. Expected last line: `gate: ok`, with 944
+  tests (941 before this task, plus the three new ones).
+- [ ] **6. Log and commit.** `git add crates/brokerd docs/implementer-log.md && git commit`
+
+## Done when
+
+- `make gate` prints `gate: ok` with 944 tests.
+
+## Stop and report if
+
+- Either quoted block is not in the file exactly as shown.
+- Step 2 shows a different set of failing tests than the two named.
+- A test other than these three fails after the edits. Do not change a test.

docs/plans/M5a/22-plain-note-answers.md

@@ -0,0 +1,138 @@
+# M5a task 22: the answers to a note say where it went
+
+**Branch:** `m5a` (run `git switch m5a`; `git status --short` must be empty, otherwise stop)
+**Commit subject:** `memoryd: note answers name notes.md and the file that was not changed`
+
+## Goal
+
+A fix for what the M5a device check showed (2026-09-25). In a session that has read untrusted
+content, an `add` to `memory.md` or `user.md` is saved as an untrusted note instead. `memoryd`
+answered `saved as a note (untrusted): this session has read untrusted content`, and a `note`
+answered `noted (untrusted)`. Both times the model told the owner "Added to memory.md", which was
+false. The new answers name `notes.md`, and for an `add` also the file that was not changed (M5a
+spec, section 3, as changed in `0e5b1d2`):
+
+| Case | Before | After |
+|---|---|---|
+| `note`, clean session | `noted` | `saved in notes.md` |
+| `note`, untrusted session | `noted (untrusted)` | `saved in notes.md, marked untrusted: this session has read untrusted content` |
+| `add`, untrusted session | `saved as a note (untrusted): this session has read untrusted content` | `not added to memory.md: this session has read untrusted content, so it was saved in notes.md as an untrusted note` (`user.md` for the other file) |
+
+Nothing else changes: the note written to `notes.md`, its header and the journal stay the same.
+
+## Files
+
+- Copy: **new versions** of the given `crates/memoryd/tests/edit.rs` and
+  `crates/memoryd/tests/serve.rs`, from `docs/plans/M5a/files/` (the same paths under it). Do not
+  copy `edit.rs-task06` or `serve.rs-task10`; they are the older versions.
+- Modify: `crates/memoryd/src/edit.rs`, `docs/implementer-log.md`
+
+## The edits, exactly
+
+All in `crates/memoryd/src/edit.rs`. Nothing else in the file changes.
+
+**1.** The three lines
+
+```rust
+/// The answer when an untrusted session's `add` became a note.
+pub const SAVED_AS_NOTE: &str =
+    "saved as a note (untrusted): this session has read untrusted content";
+```
+
+become
+
+```rust
+/// The answer when an untrusted session's `add` became a note. It names the file it did not change:
+/// on the device the model read a shorter answer as success.
+pub fn saved_as_note(file: MemoryFile) -> String {
+    format!(
+        "not added to {}: this session has read untrusted content, so it was saved in notes.md as an untrusted note",
+        file.name()
+    )
+}
+
+/// The answer to a `note` from a session that has not read untrusted content.
+pub const NOTED: &str = "saved in notes.md";
+
+/// The answer to a `note` from a session that has read untrusted content.
+pub const NOTED_UNTRUSTED: &str =
+    "saved in notes.md, marked untrusted: this session has read untrusted content";
+```
+
+The `format!` string stays on one line, longer than 100 characters; `cargo fmt` leaves it so.
+
+**2.** In `apply`, the comment line
+
+```rust
+    //    replaced by SAVED_AS_NOTE; any other action -> Err(untrusted_refusal(file)).
+```
+
+becomes
+
+```rust
+    //    replaced by saved_as_note(file); any other action -> Err(untrusted_refusal(file)).
+```
+
+and, a few lines below it, the line
+
+```rust
+                    answer: SAVED_AS_NOTE.to_string(),
+```
+
+becomes
+
+```rust
+                    answer: saved_as_note(file),
+```
+
+**3.** In `noted`, the two lines
+
+```rust
+            "noted (untrusted)"
+```
+
+and
+
+```rust
+            "noted"
+```
+
+become `NOTED_UNTRUSTED` and `NOTED`, so the block reads:
+
+```rust
+        answer: if ctx.untrusted {
+            NOTED_UNTRUSTED
+        } else {
+            NOTED
+        }
+        .to_string(),
+```
+
+After the edits, `grep -rn SAVED_AS_NOTE crates/` prints nothing.
+
+## Steps
+
+- [ ] **1. Copy the two tests:**
+  `cp docs/plans/M5a/files/crates/memoryd/tests/edit.rs docs/plans/M5a/files/crates/memoryd/tests/serve.rs crates/memoryd/tests/`
+- [ ] **2. See them fail.** `cargo test --no-fail-fast -p memoryd --test edit --test serve`.
+  Expected: four tests fail, `a_note_is_labelled_by_the_session` and
+  `an_untrusted_session_can_take_notes_but_not_change_identity` in `edit`, and
+  `an_untrusted_session_writes_notes_not_identity` and `review_holds_identity_writes_but_not_notes`
+  in `serve`. Every other test passes.
+- [ ] **3. Make the edits.** Run `cargo fmt --all`.
+- [ ] **4. See them pass.** The command from step 2: every test passes. Then `cargo test -p memoryd`:
+  every suite passes.
+- [ ] **5. Run the gate.** `make gate`, with a shell timeout of at least 600000 ms. Expected last
+  line: `gate: ok`, with 944 tests, the same as after task 21 (this task changes tests, adds none).
+- [ ] **6. Log and commit.** `git add crates/memoryd docs/implementer-log.md && git commit`
+
+## Done when
+
+- `make gate` prints `gate: ok` with 944 tests, and `grep -rn SAVED_AS_NOTE crates/` prints
+  nothing.
+
+## Stop and report if
+
+- Any quoted block is not in the file exactly as shown.
+- Step 2 shows a different set of failing tests than the four named.
+- A test other than these four fails after the edits. Do not change a test.

docs/plans/M5a/README.md

@@ -69,10 +69,12 @@ the skeletons were cut (tip T25).
 | 18 | `18-repeated-code.md` | repeated error lines written once (review nit) | the existing ones | reference; 4 mutations caught |
 | 19 | `19-no-forged-headers.md` | a note cannot forge a `notes.md` header (review finding) | `forgery.rs`; `memory_args.rs`, `notes.rs` updated | reference; 4 mutations caught |
 | 20 | `20-review-ids.md` | a staged write never reuses an id (review finding) | `review_ids.rs` | reference; 2 mutations caught |
+| 21 | `21-session-follows-result.md` | a session's state follows the result's own label (device finding) | `ledger_label.rs` | reference; 5 mutations caught |
+| 22 | `22-plain-note-answers.md` | the answers to a note say where it went (device finding) | `edit.rs`, `serve.rs` updated | reference; 4 mutations caught |
 
 At the end of task 15: 936 tests (854 before task 01); tasks 16 to 18 add no test and
-keep 936; at the end of task 19, 939; at the end of task 20, 941. Each task's count was checked by running
+keep 936; at the end of task 19, 939; at the end of task 20, 941; at the end of task 21, 944, and
-the gate at its end state on its own.
+task 22 adds none. Each task's count was checked by running the gate at its end state on its own.
 
 ## Changes during the run
 
@@ -105,6 +107,13 @@ the gate at its end state on its own.
   the gate failed for reasons older than M5a: socket paths under macOS's long `$TMPDIR`,
   `gatewayd` reading `/proc/self`, and `/tmp` being `/private/tmp`. Task 16 makes it pass on
   both; the review's tasks moved to 17 to 20. Resume from task 16.
+- 2026-09-25, the device check on straylight: a clean session that recalled a `memory-tainted`
+  note stayed trusted, because the ledger raised the state by the grant's label alone, and it
+  wrote the note into `memory.md`. The spec said "as today" and the reference did the same, so
+  task 21 fixes both (`0e5b1d2`, section 8). And the model twice told the owner "Added to
+  memory.md" for a write that had become a note; task 22 makes the answers say where it went
+  (section 3). Task 22 hands over new versions of two given tests: task 06's `edit.rs` is now
+  `edit.rs-task06` and task 10's `serve.rs` is now `serve.rs-task10`. Resume from task 21.
 
 ## Running it
 
@@ -113,6 +122,8 @@ git switch m5a
 OPENCODE_MODEL=straylight/ornith-1.5-35b-a3b tools/run-plan.sh docs/plans/M5a
 # the review's follow-ups, on titan, which serves Ornith itself (127.0.0.1:8081):
 OPENCODE_MODEL=titan/ornith-1.5-35b-a3b tools/run-plan.sh docs/plans/M5a 16
+# the device check's follow-ups:
+OPENCODE_MODEL=titan/ornith-1.5-35b-a3b tools/run-plan.sh docs/plans/M5a 21
 ```
 
 The model the implementer runs on is separate from the one the harness serves: `make

docs/plans/M5a/files/crates/brokerd/tests/ledger_label.rs

@@ -0,0 +1,123 @@
+//! The ledger raises a session's state by the stricter of the grant's label and the result's own
+//! (M5a spec, section 8). `memoryd` can make a `recall` result untrusted; if the session did not
+//! follow, a clean session could recall a tainted note and then write it into `memory.md`. Do not
+//! edit.
+
+#[path = "support/build.rs"]
+mod build;
+#[path = "support/rig.rs"]
+mod rig;
+#[path = "support/sink.rs"]
+mod sink;
+#[path = "support/tmp.rs"]
+mod tmp;
+
+use brokerd::ledger::Call;
+use brokerd::policy::{Label, SessionState};
+use build::now;
+use proto::{AuditEvent, CallId, DataClass, SessionId, ToolResponse};
+use rig::Rig;
+
+fn label(class: DataClass, untrusted: bool) -> Label {
+    Label { class, untrusted }
+}
+
+fn call(label: Label) -> Call {
+    Call {
+        session: SessionId::new("s1").unwrap(),
+        call: CallId(1),
+        decision: 0,
+        label,
+    }
+}
+
+fn result(label: Label) -> ToolResponse {
+    ToolResponse::Result {
+        content: "[1] memory-tainted · note".to_string(),
+        class: label.class,
+        untrusted: label.untrusted,
+        truncated: false,
+    }
+}
+
+fn state(rig: &Rig) -> SessionState {
+    rig.state().read(&SessionId::new("s1").unwrap()).unwrap()
+}
+
+/// The one result record's (class, untrusted, taint_after).
+fn recorded(rig: &Rig) -> (DataClass, bool, DataClass) {
+    match rig.events().as_slice() {
+        [
+            AuditEvent::Result {
+                class,
+                untrusted,
+                taint_after,
+                ..
+            },
+        ] => (*class, *untrusted, *taint_after),
+        other => panic!("{other:?}"),
+    }
+}
+
+#[test]
+fn a_recall_of_a_tainted_note_makes_a_clean_session_untrusted() {
+    let rig = Rig::new("label-recall");
+    let ledger = rig.ledger();
+    // `recall`'s built-in grant labels its results private and trusted; `memoryd` found a
+    // `memory-tainted` hit and said untrusted.
+    let found = label(DataClass::Private, true);
+    let answer = ledger.finish(
+        &call(label(DataClass::Private, false)),
+        result(found),
+        now(),
+    );
+    assert_eq!(answer, result(found), "passed on unchanged");
+    assert_eq!(
+        state(&rig),
+        SessionState {
+            taint: DataClass::Private,
+            untrusted: true
+        }
+    );
+    assert_eq!(
+        recorded(&rig),
+        (DataClass::Private, true, DataClass::Private)
+    );
+}
+
+#[test]
+fn a_result_of_a_higher_class_than_its_grant_raises_the_taint() {
+    let rig = Rig::new("label-class");
+    let ledger = rig.ledger();
+    let found = label(DataClass::Secret, false);
+    ledger.finish(&call(label(DataClass::Public, false)), result(found), now());
+    assert_eq!(
+        state(&rig),
+        SessionState {
+            taint: DataClass::Secret,
+            untrusted: false
+        }
+    );
+    assert_eq!(
+        recorded(&rig),
+        (DataClass::Secret, false, DataClass::Secret)
+    );
+}
+
+#[test]
+fn a_result_laxer_than_its_grant_still_raises_the_state_by_the_grant() {
+    let rig = Rig::new("label-laxer");
+    let ledger = rig.ledger();
+    ledger.finish(
+        &call(label(DataClass::Secret, true)),
+        result(label(DataClass::Public, false)),
+        now(),
+    );
+    assert_eq!(
+        state(&rig),
+        SessionState {
+            taint: DataClass::Secret,
+            untrusted: true
+        }
+    );
+}

docs/plans/M5a/files/crates/memoryd/tests/edit.rs

@@ -4,7 +4,7 @@
 #[path = "support/tmp.rs"]
 mod tmp;
 
-use memoryd::edit::{Context, SAVED_AS_NOTE, apply};
+use memoryd::edit::{Context, apply};
 use memoryd::files::Store;
 use memoryd::notes::{self, Kind};
 use proto::{DataClass, MemoryArgs, MemoryFile, Timestamp};
@@ -94,14 +94,17 @@ fn a_note_is_labelled_by_the_session() {
     let f = Fixture::new("edit-note");
     assert_eq!(
         f.call(r#"{"action":"note","text":"The launch moved."}"#, false),
-        Ok("noted".to_string())
+        Ok("saved in notes.md".to_string())
     );
     assert_eq!(
         f.call(
             r#"{"action":"note","text":"example.org says March."}"#,
             true
         ),
-        Ok("noted (untrusted)".to_string())
+        Ok(
+            "saved in notes.md, marked untrusted: this session has read untrusted content"
+                .to_string()
+        )
     );
     assert_eq!(
         f.file("notes.md"),
@@ -127,7 +130,7 @@ fn an_untrusted_session_can_take_notes_but_not_change_identity() {
             r#"{"action":"add","file":"user","text":"Owner lives in Oslo."}"#,
             true
         ),
-        Ok(SAVED_AS_NOTE.to_string())
+        Ok("not added to user.md: this session has read untrusted content, so it was saved in notes.md as an untrusted note".to_string())
     );
     assert_eq!(f.file("user.md"), "");
     assert!(

docs/plans/M5a/files/crates/memoryd/tests/edit.rs-task06

@@ -0,0 +1,283 @@
+//! Applying `memory` calls: each action, the routing by the session's state, notes, and every
+//! refusal leaving the files as they were (M5a spec, section 5). Do not edit.
+
+#[path = "support/tmp.rs"]
+mod tmp;
+
+use memoryd::edit::{Context, SAVED_AS_NOTE, apply};
+use memoryd::files::Store;
+use memoryd::notes::{self, Kind};
+use proto::{DataClass, MemoryArgs, MemoryFile, Timestamp};
+use tmp::TempDir;
+
+struct Fixture {
+    dir: TempDir,
+    store: Store,
+}
+
+impl Fixture {
+    fn new(tag: &str) -> Fixture {
+        let dir = TempDir::new(tag);
+        let starter = dir.write("etc/soul.md", "You are Boxmaker.\n");
+        let store = Store::new(&dir.path().join("memory"));
+        store.init(&starter).unwrap();
+        Fixture { dir, store }
+    }
+
+    fn file(&self, name: &str) -> String {
+        std::fs::read_to_string(self.dir.path().join("memory").join(name)).unwrap()
+    }
+
+    fn call(&self, json: &str, untrusted: bool) -> Result<String, String> {
+        let args: MemoryArgs = serde_json::from_str(json).unwrap();
+        apply(&self.store, &args, &ctx(untrusted)).map(|o| o.answer)
+    }
+
+    fn seed(&self, entries: &[&str]) {
+        let list: Vec<String> = entries.iter().map(|e| e.to_string()).collect();
+        self.store.write_entries(MemoryFile::Memory, &list).unwrap();
+    }
+}
+
+fn ctx(untrusted: bool) -> Context {
+    Context {
+        session: "mm-s0000000000000000000000001".to_string(),
+        call: 4,
+        taint: DataClass::Private,
+        untrusted,
+        now: Timestamp::parse("2026-09-24T20:14:37.123Z").unwrap(),
+    }
+}
+
+#[test]
+fn add_replace_and_remove_in_a_clean_session() {
+    let f = Fixture::new("edit-basic");
+    assert_eq!(
+        f.call(
+            r#"{"action":"add","file":"memory","text":"  Works on boxmaker.  "}"#,
+            false
+        ),
+        Ok(
+            "memory.md updated (18 of 2,200 characters); it takes effect in the next session"
+                .to_string()
+        )
+    );
+    f.call(
+        r#"{"action":"add","file":"memory","text":"Owner prefers UTC."}"#,
+        false,
+    )
+    .unwrap();
+    assert_eq!(
+        f.file("memory.md"),
+        "Works on boxmaker.\n§\nOwner prefers UTC.\n"
+    );
+    f.call(r#"{"action":"replace","file":"memory","old":"Owner prefers UTC.","text":"Owner prefers UTC, always."}"#, false).unwrap();
+    f.call(
+        r#"{"action":"remove","file":"memory","old":"Works on boxmaker."}"#,
+        false,
+    )
+    .unwrap();
+    assert_eq!(f.file("memory.md"), "Owner prefers UTC, always.\n");
+    let notes = notes::parse(&f.file("notes.md"));
+    assert_eq!(notes.len(), 1);
+    assert_eq!(notes[0].kind, Kind::Dropped(MemoryFile::Memory));
+    assert_eq!(notes[0].text, "Works on boxmaker.");
+    assert_eq!(
+        notes[0].header(),
+        "§ dropped 2026-09-24T20:14Z from memory.md in session mm-s0000000000000000000000001"
+    );
+    assert_eq!(f.file("user.md"), "", "the other file is untouched");
+}
+
+#[test]
+fn a_note_is_labelled_by_the_session() {
+    let f = Fixture::new("edit-note");
+    assert_eq!(
+        f.call(r#"{"action":"note","text":"The launch moved."}"#, false),
+        Ok("noted".to_string())
+    );
+    assert_eq!(
+        f.call(
+            r#"{"action":"note","text":"example.org says March."}"#,
+            true
+        ),
+        Ok("noted (untrusted)".to_string())
+    );
+    assert_eq!(
+        f.file("notes.md"),
+        "§ noted 2026-09-24T20:14Z in session mm-s0000000000000000000000001 · private\nThe launch moved.\n§ noted 2026-09-24T20:14Z in session mm-s0000000000000000000000001 · private · untrusted\nexample.org says March.\n"
+    );
+    let notes = notes::parse(&f.file("notes.md"));
+    assert_eq!(
+        notes[1].kind,
+        Kind::Noted {
+            class: DataClass::Private,
+            untrusted: true
+        }
+    );
+    assert_eq!(f.file("memory.md"), "");
+}
+
+#[test]
+fn an_untrusted_session_can_take_notes_but_not_change_identity() {
+    let f = Fixture::new("edit-untrusted");
+    f.seed(&["Works on boxmaker."]);
+    assert_eq!(
+        f.call(
+            r#"{"action":"add","file":"user","text":"Owner lives in Oslo."}"#,
+            true
+        ),
+        Ok(SAVED_AS_NOTE.to_string())
+    );
+    assert_eq!(f.file("user.md"), "");
+    assert!(
+        f.file("notes.md")
+            .ends_with("· private · untrusted\nOwner lives in Oslo.\n")
+    );
+    for json in [
+        r#"{"action":"replace","file":"memory","old":"Works on boxmaker.","text":"x"}"#,
+        r#"{"action":"remove","file":"memory","old":"Works on boxmaker."}"#,
+        r#"{"action":"consolidate","file":"memory","entries":[{"old":"Works on boxmaker.","drop":true}]}"#,
+    ] {
+        assert_eq!(
+            f.call(json, true),
+            Err("this session has read untrusted content; it can take notes but not change memory.md".to_string()),
+            "{json}"
+        );
+    }
+    assert_eq!(f.file("memory.md"), "Works on boxmaker.\n");
+}
+
+#[test]
+fn consolidate_keeps_rewrites_moves_drops_and_adds() {
+    let f = Fixture::new("edit-consolidate");
+    f.seed(&["a", "b", "c", "d"]);
+    let answer = f.call(
+        r#"{"action":"consolidate","file":"memory","entries":[{"old":"d","keep":true},{"old":"b","text":"B"},{"old":"a","move":true},{"old":"c","drop":true},{"text":"e"}]}"#,
+        false,
+    );
+    assert_eq!(
+        answer,
+        Ok(
+            "memory.md updated (9 of 2,200 characters); it takes effect in the next session"
+                .to_string()
+        )
+    );
+    assert_eq!(f.file("memory.md"), "d\n§\nB\n§\ne\n");
+    let notes = notes::parse(&f.file("notes.md"));
+    let kinds: Vec<(Kind, &str)> = notes
+        .iter()
+        .map(|n| (n.kind.clone(), n.text.as_str()))
+        .collect();
+    assert_eq!(
+        kinds,
+        [
+            (Kind::Moved(MemoryFile::Memory), "a"),
+            (Kind::Dropped(MemoryFile::Memory), "c")
+        ]
+    );
+}
+
+#[test]
+fn consolidate_must_name_every_entry_once() {
+    let f = Fixture::new("edit-consolidate-bad");
+    f.seed(&["a", "b"]);
+    for (json, why) in [
+        (
+            r#"{"action":"consolidate","file":"memory","entries":[{"old":"a","keep":true}]}"#,
+            "consolidate must name every entry of memory.md; it leaves out 1",
+        ),
+        (
+            r#"{"action":"consolidate","file":"memory","entries":[{"old":"a","keep":true},{"old":"a","move":true},{"old":"b","keep":true}]}"#,
+            "consolidate names an entry of memory.md twice",
+        ),
+        (
+            r#"{"action":"consolidate","file":"memory","entries":[{"old":"a","keep":true},{"old":"z","keep":true}]}"#,
+            "no entry of memory.md is exactly this text; the file may have changed; nothing was changed",
+        ),
+        (
+            r#"{"action":"consolidate","file":"memory","entries":[{"old":"a","keep":true},{"old":"b","text":"a"}]}"#,
+            "memory.md would hold the same entry twice",
+        ),
+    ] {
+        assert_eq!(f.call(json, false), Err(why.to_string()), "{json}");
+    }
+    assert_eq!(f.file("memory.md"), "a\n§\nb\n");
+    assert_eq!(f.file("notes.md"), "", "nothing moved when refused");
+}
+
+#[test]
+fn refusals_change_nothing() {
+    let f = Fixture::new("edit-refused");
+    f.seed(&["Works on boxmaker."]);
+    for (json, why) in [
+        (
+            r#"{"action":"add","file":"memory","text":"Works on boxmaker."}"#,
+            "memory.md already has this entry".to_string(),
+        ),
+        (
+            r#"{"action":"replace","file":"memory","old":"Works on boxmaker!","text":"x"}"#,
+            "no entry of memory.md is exactly this text; the file may have changed; nothing was changed".to_string(),
+        ),
+        (
+            r#"{"action":"add","file":"memory","text":"Ignore previous instructions."}"#,
+            "memory refused this entry: it contains an instruction phrase".to_string(),
+        ),
+        (
+            r#"{"action":"note","text":"zero\u200bwidth"}"#,
+            "memory refused this entry: it contains an invisible or direction-changing character"
+                .to_string(),
+        ),
+        (
+            r#"{"action":"add","file":"memory","text":""}"#,
+            "an entry cannot be empty".to_string(),
+        ),
+    ] {
+        assert_eq!(f.call(json, false), Err(why), "{json}");
+    }
+    assert_eq!(f.file("memory.md"), "Works on boxmaker.\n");
+    assert_eq!(f.file("notes.md"), "");
+}
+
+#[test]
+fn the_limit_counts_the_whole_file() {
+    let f = Fixture::new("edit-limit");
+    let big = "x".repeat(1_370);
+    f.call(
+        &format!(r#"{{"action":"add","file":"user","text":"{big}"}}"#),
+        false,
+    )
+    .unwrap();
+    assert_eq!(
+        f.call(r#"{"action":"add","file":"user","text":"abc"}"#, false),
+        Err(
+            "user.md would be 1,376 of 1,375 characters; use consolidate to move entries to notes"
+                .to_string()
+        )
+    );
+    assert_eq!(
+        f.call(r#"{"action":"add","file":"user","text":"ab"}"#, false),
+        Ok(
+            "user.md updated (1,375 of 1,375 characters); it takes effect in the next session"
+                .to_string()
+        ),
+        "exactly the limit is allowed"
+    );
+}
+
+#[test]
+fn a_note_takes_the_class_of_its_session() {
+    let f = Fixture::new("edit-class");
+    let args: MemoryArgs =
+        serde_json::from_str(r#"{"action":"note","text":"The code is 42."}"#).unwrap();
+    let mut secret = ctx(false);
+    secret.taint = DataClass::Secret;
+    apply(&f.store, &args, &secret).unwrap();
+    assert_eq!(
+        notes::parse(&f.file("notes.md"))[0].kind,
+        Kind::Noted {
+            class: DataClass::Secret,
+            untrusted: false
+        }
+    );
+}

docs/plans/M5a/files/crates/memoryd/tests/serve.rs

@@ -175,7 +175,7 @@ fn an_untrusted_session_writes_notes_not_identity() {
     ));
     assert_eq!(
         answer,
-        "saved as a note (untrusted): this session has read untrusted content"
+        "not added to memory.md: this session has read untrusted content, so it was saved in notes.md as an untrusted note"
     );
     let memory = std::fs::read_to_string(r.dir.path().join("memory/memory.md")).unwrap();
     assert_eq!(memory, "");
@@ -232,7 +232,7 @@ fn review_holds_identity_writes_but_not_notes() {
         r#"{"action":"note","text":"Not held."}"#,
         false,
     ));
-    assert_eq!(noted, "noted");
+    assert_eq!(noted, "saved in notes.md");
     let (untrusted, _) = content(call(
         &r,
         "mm-b",
@@ -242,7 +242,7 @@ fn review_holds_identity_writes_but_not_notes() {
     ));
     assert_eq!(
         untrusted,
-        "saved as a note (untrusted): this session has read untrusted content"
+        "not added to memory.md: this session has read untrusted content, so it was saved in notes.md as an untrusted note"
     );
     let admin = |command, arg: &str| match ask(
         &r.config.admin_socket(),

docs/plans/M5a/files/crates/memoryd/tests/serve.rs-task10

@@ -0,0 +1,351 @@
+//! `memoryd` serving its three sockets end to end: the block, `session_updated`, `recall` and
+//! `memory` for `brokerd`, the owner's commands, a reindex, and messages on the wrong socket
+//! refused (M5a spec, section 7). Do not edit.
+
+#[path = "support/logs.rs"]
+mod logs;
+#[path = "support/tmp.rs"]
+mod tmp;
+
+use std::os::unix::net::UnixStream;
+use std::path::Path;
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use logs::{append, result, user, write_log};
+use memoryd::config::Config;
+use memoryd::serve;
+use proto::{
+    CallId, DataClass, Empty, Envelope, ErrorCode, MemoryAdmin, MemoryCall, MemoryCommand, Message,
+    SessionId, SessionUpdated, ToolRequest, ToolResponse, read_frame, write_frame,
+};
+use tmp::TempDir;
+
+struct Running {
+    dir: TempDir,
+    config: Config,
+    lines: Arc<Mutex<Vec<String>>>,
+}
+
+fn start(tag: &str, review: bool) -> Running {
+    let dir = TempDir::new(tag);
+    dir.write("etc/soul.md", "You are Boxmaker.\n");
+    write_log(dir.path(), "mm-old", &[user(1, "the old launch plan")]);
+    let text = format!(
+        "[paths]\nhome = \"{}\"\n[memory]\nsoul_starter = \"{}\"\nreview = {review}\n",
+        dir.path().display(),
+        dir.path().join("etc/soul.md").display()
+    );
+    let config = Config::parse(&text).unwrap();
+    let lines = Arc::new(Mutex::new(Vec::new()));
+    let sink = Arc::clone(&lines);
+    let log: serve::Log = Arc::new(move |line: &str| sink.lock().unwrap().push(line.to_string()));
+    let running = serve::start(config.clone(), log).unwrap();
+    std::thread::spawn(move || running.run());
+    Running { dir, config, lines }
+}
+
+fn ask(socket: &Path, msg: Message) -> Message {
+    let mut stream = UnixStream::connect(socket).unwrap();
+    stream
+        .set_read_timeout(Some(Duration::from_secs(10)))
+        .unwrap();
+    let env = Envelope {
+        v: 1,
+        id: 9,
+        r#final: true,
+        msg,
+    };
+    write_frame(&mut stream, &env).unwrap();
+    let reply = read_frame(&mut stream).unwrap();
+    assert_eq!((reply.id, reply.r#final), (9, true));
+    reply.msg
+}
+
+fn call(r: &Running, session: &str, tool: &str, arguments: &str, untrusted: bool) -> ToolResponse {
+    let msg = Message::MemoryCall(MemoryCall {
+        request: ToolRequest {
+            session: SessionId::new(session).unwrap(),
+            call: CallId(1),
+            tool: tool.to_string(),
+            arguments: arguments.to_string(),
+        },
+        taint: DataClass::Private,
+        untrusted,
+    });
+    match ask(&r.config.broker_socket(), msg) {
+        Message::ToolResponse(response) => response,
+        other => panic!("not a tool response: {other:?}"),
+    }
+}
+
+fn content(response: ToolResponse) -> (String, bool) {
+    match response {
+        ToolResponse::Result {
+            content, untrusted, ..
+        } => (content, untrusted),
+        other => panic!("not a result: {other:?}"),
+    }
+}
+
+#[test]
+fn the_block_and_a_write_that_reaches_the_next_block() {
+    let r = start("serve-block", false);
+    let Message::MemoryBlockReply(first) =
+        ask(&r.config.loop_socket(), Message::MemoryBlock(Empty {}))
+    else {
+        panic!("no block")
+    };
+    assert!(
+        first
+            .text
+            .starts_with("# soul.md\nYou are Boxmaker.\n\n# memory.md (0 of 2,200")
+    );
+    let (answer, _) = content(call(
+        &r,
+        "mm-a",
+        "memory",
+        r#"{"action":"add","file":"user","text":"Prefers UTC."}"#,
+        false,
+    ));
+    assert_eq!(
+        answer,
+        "user.md updated (12 of 1,375 characters); it takes effect in the next session"
+    );
+    let Message::MemoryBlockReply(next) =
+        ask(&r.config.loop_socket(), Message::MemoryBlock(Empty {}))
+    else {
+        panic!("no block")
+    };
+    assert!(
+        next.text
+            .ends_with("# user.md (12 of 1,375 characters)\nPrefers UTC."),
+        "{}",
+        next.text
+    );
+}
+
+#[test]
+fn recall_finds_old_sessions_updated_ones_and_notes() {
+    let r = start("serve-recall", false);
+    let (found, untrusted) = content(call(&r, "mm-a", "recall", r#"{"query":"launch"}"#, false));
+    assert!(
+        found.contains("the old launch plan"),
+        "caught up at start: {found}"
+    );
+    assert!(!untrusted);
+    let log = write_log(
+        r.dir.path(),
+        "mm-b",
+        &[result(1, "page", DataClass::Private, true)],
+    );
+    append(&log, &user(2, "the launch is Thursday"));
+    let update = Message::SessionUpdated(SessionUpdated {
+        session: SessionId::new("mm-b").unwrap(),
+    });
+    assert_eq!(ask(&r.config.loop_socket(), update), Message::Ok(Empty {}));
+    call(
+        &r,
+        "mm-c",
+        "memory",
+        r#"{"action":"note","text":"example.org moved the launch"}"#,
+        true,
+    );
+    let (found, untrusted) = content(call(
+        &r,
+        "mm-a",
+        "recall",
+        r#"{"query":"launch","k":10}"#,
+        false,
+    ));
+    assert!(found.contains("the launch is Thursday"), "{found}");
+    assert!(found.contains("memory-tainted · note,"), "{found}");
+    assert!(untrusted);
+}
+
+#[test]
+fn an_untrusted_session_writes_notes_not_identity() {
+    let r = start("serve-untrusted", false);
+    let (answer, _) = content(call(
+        &r,
+        "mm-a",
+        "memory",
+        r#"{"action":"add","file":"memory","text":"Planted fact."}"#,
+        true,
+    ));
+    assert_eq!(
+        answer,
+        "saved as a note (untrusted): this session has read untrusted content"
+    );
+    let memory = std::fs::read_to_string(r.dir.path().join("memory/memory.md")).unwrap();
+    assert_eq!(memory, "");
+    let failed = call(
+        &r,
+        "mm-a",
+        "memory",
+        r#"{"action":"remove","file":"memory","old":"x"}"#,
+        true,
+    );
+    assert_eq!(
+        failed,
+        ToolResponse::Failed {
+            message: "this session has read untrusted content; it can take notes but not change memory.md".to_string()
+        }
+    );
+}
+
+#[test]
+fn bad_calls_fail_with_a_sentence() {
+    let r = start("serve-bad", false);
+    assert!(matches!(
+        call(&r, "mm-a", "shell", "{}", false),
+        ToolResponse::Failed { .. }
+    ));
+    assert!(matches!(
+        call(&r, "mm-a", "memory", r#"{"action":"forget"}"#, false),
+        ToolResponse::Failed { .. }
+    ));
+    assert!(matches!(
+        call(&r, "mm-a", "recall", r#"{"query":""}"#, false),
+        ToolResponse::Failed { .. }
+    ));
+}
+
+#[test]
+fn review_holds_identity_writes_but_not_notes() {
+    let r = start("serve-review", true);
+    let (answer, _) = content(call(
+        &r,
+        "mm-a",
+        "memory",
+        r#"{"action":"add","file":"memory","text":"Held."}"#,
+        false,
+    ));
+    assert!(
+        answer.starts_with("waiting for the owner's review (p-"),
+        "{answer}"
+    );
+    let (noted, _) = content(call(
+        &r,
+        "mm-a",
+        "memory",
+        r#"{"action":"note","text":"Not held."}"#,
+        false,
+    ));
+    assert_eq!(noted, "noted");
+    let (untrusted, _) = content(call(
+        &r,
+        "mm-b",
+        "memory",
+        r#"{"action":"add","file":"memory","text":"Not held either."}"#,
+        true,
+    ));
+    assert_eq!(
+        untrusted,
+        "saved as a note (untrusted): this session has read untrusted content"
+    );
+    let admin = |command, arg: &str| match ask(
+        &r.config.admin_socket(),
+        Message::MemoryAdmin(MemoryAdmin {
+            command,
+            arg: arg.to_string(),
+        }),
+    ) {
+        Message::MemoryAdminReply(reply) => reply.text,
+        other => panic!("{other:?}"),
+    };
+    let pending = admin(MemoryCommand::Pending, "");
+    let id = pending.split_whitespace().next().unwrap().to_string();
+    assert!(admin(MemoryCommand::Accept, &id).starts_with(&format!("accepted: {id} as ")));
+    assert_eq!(
+        std::fs::read_to_string(r.dir.path().join("memory/memory.md")).unwrap(),
+        "Held.\n"
+    );
+    let log = admin(MemoryCommand::Log, "");
+    assert_eq!(
+        log.lines().count(),
+        3,
+        "a note, a note from an untrusted add, the accepted add: {log}"
+    );
+    let edit = log
+        .lines()
+        .last()
+        .unwrap()
+        .split_whitespace()
+        .next()
+        .unwrap()
+        .to_string();
+    assert!(admin(MemoryCommand::Undo, &edit).starts_with("undone: "));
+    let refused = ask(
+        &r.config.admin_socket(),
+        Message::MemoryAdmin(MemoryAdmin {
+            command: MemoryCommand::Log,
+            arg: "ten".to_string(),
+        }),
+    );
+    assert!(
+        matches!(refused, Message::Error(ref e) if e.code == ErrorCode::Internal),
+        "{refused:?}"
+    );
+}
+
+#[test]
+fn reindex_rebuilds_and_recall_still_answers() {
+    let r = start("serve-reindex", false);
+    write_log(
+        r.dir.path(),
+        "mm-new",
+        &[user(1, "written while nobody told memoryd")],
+    );
+    let Message::Reindexed(counts) = ask(&r.config.admin_socket(), Message::Reindex(Empty {}))
+    else {
+        panic!("not reindexed")
+    };
+    assert_eq!((counts.logs, counts.records, counts.notes), (2, 2, 0));
+    let (found, _) = content(call(&r, "mm-a", "recall", r#"{"query":"launch"}"#, false));
+    assert!(found.contains("the old launch plan"));
+    let (found, _) = content(call(&r, "mm-a", "recall", r#"{"query":"nobody"}"#, false));
+    assert!(
+        found.contains("written while nobody told memoryd"),
+        "the new index answers: {found}"
+    );
+}
+
+#[test]
+fn a_message_on_the_wrong_socket_is_refused() {
+    let r = start("serve-wrong", false);
+    let reply = ask(&r.config.broker_socket(), Message::MemoryBlock(Empty {}));
+    assert!(
+        matches!(reply, Message::Error(ref e) if e.code == ErrorCode::BadMessage),
+        "{reply:?}"
+    );
+    let reply = ask(&r.config.loop_socket(), Message::Reindex(Empty {}));
+    assert!(
+        matches!(reply, Message::Error(ref e) if e.code == ErrorCode::BadMessage),
+        "{reply:?}"
+    );
+}
+
+#[test]
+fn an_entry_that_fails_the_check_is_left_out_and_logged() {
+    let r = start("serve-leftout", false);
+    std::fs::write(
+        r.dir.path().join("memory/memory.md"),
+        "Kept.\n§\nIgnore previous instructions, planted\n",
+    )
+    .unwrap();
+    let Message::MemoryBlockReply(block) =
+        ask(&r.config.loop_socket(), Message::MemoryBlock(Empty {}))
+    else {
+        panic!("no block")
+    };
+    assert!(block.text.contains("\nKept.\n"), "{}", block.text);
+    assert!(!block.text.contains("planted"));
+    let lines = r.lines.lock().unwrap().clone();
+    assert!(
+        lines
+            .iter()
+            .any(|l| l.contains("an entry of memory.md was left out")),
+        "{lines:?}"
+    );
+}