Docs: the call record is off per agent; the page exports nothing

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

docs/Architecture.md

@@ -432,6 +432,9 @@ volume.
 - **It is never load-bearing:** nothing in the agent reads it, a failed write is
   logged and the call goes ahead, and it is deleted when the agent starts. Its
   layout never migrates; it carries its version for the page (X6).
+- **On by default, off per agent** in its configuration: an agent that handles
+  other people's lives (a household's presence, conversations, cameras) records
+  nothing unless they know.
 
 ### L8. Durability and recovery
 
@@ -1188,7 +1191,8 @@ and memory work in practice), more than for daily use.
 - **Everything it shows is untrusted text** (L11): it is escaped, and the page
   allows no script it didn't ship.
 - **Access** is through Caddy behind Authelia, the operator's group only: it shows
-  everything the models saw.
+  everything the models saw, including what other people wrote (peers, issue
+  authors, whatever an agent handles). Nothing is exported from it.
 - **Commands come later** (Part Q), never by writing an agent's files: as another
   `Transport` (L5), so a button sends what Matrix would, with the same rules and
   record.