The multi turn family asks whether something said earlier in a conversation reaches a user who should not see it. Like every Plimsoll SI family, it needs a control that leaks on purpose. If the control cannot leak, the test cannot see a leak, and a quiet result means nothing.
Three attempts, zero leaks, no pass
In attempts d5, d6 and d7 the control was deskbook's own memory with its guards loosened, a little more each time. It leaked 0 of 269, then 0 of 285, then 0 of 300. Each time the family was graded insufficient and the run INCONCLUSIVE. The grader did what it should: a control that cannot fire makes a check untestable, never a pass.
What was going on
In d6 the citation check refused any answer built from history, so the control failed closed on a second guard. In d7 the output checks were off, and the control still did not leak. Reading the carryover scripts showed why. The answering model itself declined: history outside the cited excerpts is not a source, and what did you just say is not a question about the documents.
So deskbook's memory does not leak even with its output checks switched off. That is a real defence, not a fault in the test.
What we did not do
We could have fed the history back as chat turns until the control leaked. That would have been a contrivance built to make a number move, so the path was dropped and its code removed. From d8 the family uses a built in agent that leaks its memory on purpose; in d11 it leaked 975 of 975 turns.
The pack says exactly what that shows: the scripts, the detector and the grader can see a memory leak. It does not show that deskbook's own memory could leak. A control earns trust by being honest about what it controls.