## memory-entry-excluded

**What you see.** `memoryd` logged `memoryd: an entry of memory.md was left out of the block by
the rule <rule>; see docs/runbook.md#memory-entry-excluded` (or `user.md`), each time a session
starts. Sessions start as usual, but the agent does not know that entry.

**Why.** When a session starts, every entry of `memory.md` and `user.md` is checked again against
the sanitizer's refuse rules (M5b spec, section 7), and an entry that breaks one is left out of
the prompt. So a rule added later, or an entry an editor put in by hand, protects at once, with no
migration. The file itself is not changed. Flag rules are not checked here, so an entry you moved
from `notes.md` by hand stays in, and `soul.md` is the owner's and is not checked at all.

**Confirm.** The rule in the log line names the kind of text (`secret-github`, `invisible`, …).
Run each entry of the file through `bxctl sanitize check`: the one it reports is the one left out.

**Fix.** Edit the file with an editor: remove the entry, or the part of it that breaks the rule.
Entries are separated by a line holding only `§`. A secret does not belong in memory: rotate it
if it was real.

**Check.** Start a new conversation: `memoryd` does not log the line again.