Keep one setup procedure and clarify person-authorized writes

PROTOCOL.md

@@ -11,7 +11,7 @@
   me.md         read at the start of each session
   topics/       read a file only when the task makes it relevant
   projects/     read a file only for work on that project
-  proposals/    the only location where an agent can write
+  proposals/    agent-inferred changes await the person’s decision
   policy.json   if this says off, behave as if the store is absent
 ```
 
@@ -29,13 +29,13 @@ RECALL   During the task, read the topic or project file that the
 
 PROPOSE  When you find something that the person may want to keep,
          write it to proposals/ in the person's words, and ask.
-         Do not write to any other location in the store.
+         Do not apply an inferred change without approval.
 
 DECIDE   The person accepts, edits, or refuses. A refusal stays in
          effect. Silence is not acceptance.
 ```
 
-An agent that follows the loop cannot write memory. Only the person can admit it.
+Only the person can authorize durable memory. A host may apply an edit the person explicitly requests, or a proposal they approve. It must record what changed, when, through which host, and on whose authority. Agent inference alone never authorizes a write. See [HOST.md §3](./HOST.md#3-writing) and [§4](./HOST.md#4-provenance).
 
 ## The paste-in form
 
@@ -52,11 +52,13 @@ RECALL — Read a file in ~/.me/topics/ or ~/.me/projects/ only when
 the current task makes it relevant.
 
 PROPOSE — When you find something I may want to keep, write it as a
-new file in ~/.me/proposals/ in my words, and ask me. Do not write
-to any other location in ~/.me/.
+new file in ~/.me/proposals/ in my words, and ask me. Do not apply
+an inferred change without my approval.
 
 DECIDE — I accept, edit, or refuse. My refusal stays in effect. My
-silence is not acceptance.
+silence is not acceptance. You may apply an edit I explicitly request
+or a proposal I approve. Record what changed, when, through which
+host, and on whose authority.
 
 What I say now always overrides the store. Stored preferences are
 never permission to act for me.

README.md

@@ -2,39 +2,13 @@
 
 **Keep up with agents, on your terms.**
 
-`me.md` is an open protocol for working with agents. What agents know about you lives in plain files, in your words, on your machine. You own the files. Agents read them, and can only propose additions — you decide what becomes memory. The files power the protocol's main output, a [briefing](./BRIEFING.md): what moved, where the pull is, what is missing, and what to do next.
+`me.md` is an open protocol for working with agents. What agents know about you lives in plain files, in your words, on your machine. You own the files. Agents read them and propose additions. They may apply changes you explicitly request or approve — you decide what becomes memory. The files power the protocol's main output, a [briefing](./BRIEFING.md): what moved, where the pull is, what is missing, and what to do next.
 
 ## Quickstart
 
 Point any agent at this page and say: **"Set up my me.md."**
 
-That is the full setup, and the last setup work you do. The rest of this section is instructions for your agent.
-
-### Agent instructions
-
-A person sent you here to set up their me.md store. Do this:
-
-1. Create `~/.me/me.md` if it does not exist. If it exists, read it and do not overwrite it.
-2. Ask the person, one question at a time:
-   - a sentence or two about themselves that every trusted agent may know
-   - what matters most to them right now
-   - how they like to work with agents
-   - what you must always ask before you act
-3. Write only what the person approves, in the person's own words. Do not add anything they did not say. Do not infer their traits, role, or interests.
-4. Show the person the finished file.
-5. Record this rule in your persistent instructions, rules file, or memory: **read `~/.me/me.md` at the start of each session, automatically, with no instruction from the person.**
-6. From now on, serve the store with the loop in [PROTOCOL.md](./PROTOCOL.md): mount, recall, propose, decide. You may write only to `~/.me/proposals/`. Only the person admits memory.
-
-## The store
-
-```text
-~/.me/
-  me.md         read at the start of each session
-  topics/       read a file only when the task makes it relevant
-  projects/     work context — stays with the project, not the person
-  proposals/    the only location where an agent can write
-  policy.json   if this says off, behave as if the store is absent
-```
+Agents: follow the [setup instruction](./SETUP.md#the-setup-instruction), then serve the store with the loop in [PROTOCOL.md](./PROTOCOL.md). SETUP.md is the only setup procedure; PROTOCOL.md defines the [store layout](./PROTOCOL.md#the-store).
 
 Your file starts empty. The protocol supplies no template and no default persona. Sessions are views of the store, not containers of memory: discard any session, or all of them, and keep all durable context.
 
@@ -43,7 +17,7 @@ Your file starts empty. The protocol supplies no template and no default persona
 - Memory is off until the person turns it on.
 - The person owns the source of truth. Not an agent, application, provider, or employer.
 - All stored content is readable. There is no hidden profile.
-- Agents can only propose. Refusal stays in effect. Silence is not acceptance.
+- Agent-inferred changes require a proposal. You can authorize an edit directly or approve a proposal. Refusal stays in effect. Silence is not acceptance.
 - What the person says now overrides the store.
 - Deleted means deleted.
 - Context stays in its scope. Family data does not appear in an unrelated work session.

SETUP.md

@@ -9,28 +9,35 @@ You do not install the protocol. You give one instruction to any agent that can
 Copy this message and give it to any agent you trust — a chat app, a CLI, an IDE assistant:
 
 ```text
-Set up my me.md memory. It is a protocol for working with agents that
-preserves my ownership of what you know about me.
+Set up my me.md. It is an open protocol for working with agents: I
+own what you know about me, I decide what you remember, and I can
+take it to any other agent.
 
 1. Create ~/.me/me.md if it does not exist. If it exists, read it and
    do not overwrite it.
 2. Ask me, one question at a time:
-   - a sentence or two about myself that I want every trusted agent
-     to know
+   - a sentence or two about myself that every trusted agent may know
    - what matters most to me right now
    - how I like to work with agents
-   - what you must always ask me before doing
+   - what you must always ask me before you act
 3. Write only what I approve, in my own words. Do not add anything I
    did not say. Do not infer my traits, role, or interests.
 4. Show me the finished file.
-5. From now on, read ~/.me/me.md at the start of each session,
-   automatically, with no instruction from me. If you have a
-   persistent instruction, memory, or configuration mechanism,
-   record this rule there now, so that the rule continues after
-   this conversation.
+5. Record this rule in your persistent instructions, rules file, or
+   memory, so that it continues after this conversation: at the start
+   of each session, check ~/.me/policy.json before reading any context.
+   If policy is off, behave as if the store is absent: no recall or
+   proposals. Otherwise, read ~/.me/me.md if it exists. Do this
+   automatically, with no instruction from me.
+6. After setup, follow the read, propose, and decide loop in
+   https://github.com/block/me.md/blob/main/PROTOCOL.md.
+   Inferred changes go in ~/.me/proposals/ for my decision. You may
+   apply an edit I explicitly request or a proposal I approve; record
+   what changed, when, through which host, and on whose authority.
+   My refusal stays in effect. My silence is not acceptance.
 ```
 
-That one message is the full setup. It is the last setup work that you do. The agent creates the file, you speak, and the agent saves only your approved words.
+That one message is the full setup. It is the last setup work that you do. The agent creates the file, you speak, and the agent saves only your approved words. After setup, the agent serves the store with the full loop in [PROTOCOL.md](./PROTOCOL.md).
 
 ## After setup, the protocol operates without you