# M5b task 14: the runbook entry `sanitizer-rules`

**Branch:** `m5b` (run `git switch m5b`; `git status --short` must be empty, otherwise stop)
**Commit subject:** `docs: runbook: sanitizer-rules, how to change a sanitizer rule`

## Goal

The M5b spec, section 6.5, gives the procedure for changing a sanitizer rule. Tasks 06, 08 and 12
added the runbook entries that code points to; this task adds the last one, `sanitizer-rules`,
which no code points to, and makes the entries `memory-write-refused` and `memory-write-flagged`
send the reader to it instead of to the spec. Only `docs/runbook.md` changes. No code changes.

## Files

- Given: `docs/plans/M5b/files/runbook-sanitizer-rules.md`, appended verbatim.
- Modify: `docs/runbook.md` (edits R1 and R2, then the append).

## The edits, exactly

**R1.** `docs/runbook.md`, in the entry `memory-write-refused`, under **Fix.**: the lines

```text
Ordinary text refused by mistake: add it to the code-work corpus and narrow the rule, as the M5b
spec's section 6.5 says; the change reaches the agent when it is rebuilt.
```

become

```text
Ordinary text refused by mistake: add it to the code-work corpus and narrow the rule, as
[`sanitizer-rules`](#sanitizer-rules) says; the change reaches the agent when it is rebuilt.
```

**R2.** `docs/runbook.md`, in the entry `memory-write-flagged`, under **Fix.**: the lines

```text
stays in `notes.md`, which is append-only. If the rule catches ordinary text, narrow it as the M5b
spec's section 6.5 says.
```

become

```text
stays in `notes.md`, which is append-only. If the rule catches ordinary text, narrow it as
[`sanitizer-rules`](#sanitizer-rules) says.
```

## Steps

- [ ] **1. Edits R1 and R2.** Each "before" block is in `docs/runbook.md` exactly once. Change
  nothing else in the file. Then `grep -c "section 6.5" docs/runbook.md` prints `0`.
- [ ] **2. The entry.** From the repository root:

  ```sh
  { echo; cat docs/plans/M5b/files/runbook-sanitizer-rules.md; } >> docs/runbook.md
  ```

  Then `grep -c '^## sanitizer-rules$' docs/runbook.md` prints `1`, and
  `grep -c '(#sanitizer-rules)' docs/runbook.md` prints `2`.
- [ ] **3. Run the gate.** `make gate`, with a shell timeout of 600000 ms. Expected last line:
  `gate: ok`, with 1118 tests, the same count as before this task: no test changes.
- [ ] **4. Log and commit.** `git status --short` lists `docs/runbook.md` and your log as
  modified, and nothing else. Stage with `git add docs/runbook.md docs/implementer-log.md`, then
  commit as `AGENTS.md` says.

## Done when

- `make gate` prints `gate: ok` with 1118 tests.
- `git diff HEAD~1 --stat` lists only `docs/runbook.md` and `docs/implementer-log.md`.

## Stop and report if

- A "before" block of R1 or R2 is not in `docs/runbook.md` exactly as shown, or is there more than
  once.
- `docs/runbook.md` already has a line `## sanitizer-rules`.
- A grep in step 1 or 2 prints another number.
- The gate fails, or passes with a count other than 1118. This task changes no code, so do not
  try to fix it: stop, and give the gate's last lines.