Give A17 its canonical event, and point Part G at the contract

Two loose ends in the A17 amendment, both found by asking whether the
build order needed changing:

- A17 requires retrieved content to be snapshotted into the canonical
  log, but A10's event table — the authoritative list — had no row for
  it, so an implementer reading A10 would never know to add one.
  knowledge_retrieved now carries the text as read, the document ID,
  its revision, and when it was read
- Part G step 10 already scheduled Outline, so the ordering does not
  change; it now names A17 rather than only Part D, and says which
  half arrives first — the world model, with operator procedures
  waiting on the C2 taxonomy they bind to

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/Architecture-Build-Spec.md

@@ -335,6 +335,7 @@ The durable record is a **canonical event log** in SQLite, not a provider-shaped
 | `delegation_started` | brief, target role, resolved model, caps |
 | `delegation_completed` | handback note, artifacts, tokens, duration, exit status |
 | `compaction` | summary, producing model, range of events replaced |
+| `knowledge_retrieved` | document text as read, document ID, revision, retrieved-at (A17) |
 
 Rules:
 - **Canonical tool-call IDs are minted locally.** Provider IDs are mapped at the
@@ -884,7 +885,8 @@ each agent is built — not standing up the service itself.
    here). Crash-atomic writes and reconcile-on-boot must be in place first.
 10. **Extract `nisse-core`**; build the **Sysadmin Agent** (`nisse-ops`): policy
     engine (C2), SSO + scoped browser (A8/A6), secrets (A7), Vikunja control (C4),
-    Outline runbooks (D), scheduled checks, alert intake.
+    knowledge store (A17/D) — world model first, operator procedures when the
+    C2 taxonomy they bind to exists — scheduled checks, alert intake.
     - With the monorepo layout (Part H, decided), extraction is a **package split**
       within one tree: move code behind a package boundary, no release machinery
       required.