Document published evidence context

docs/operations.md

@@ -36,7 +36,11 @@ On supported Unix systems, output directories and files are created with
 requested modes **0755** and **0644**. Chunk-plan, checkpoint, and debug
 directories and files use **0700** and **0600**. The operating system's umask
 may impose stricter output modes. Cache and debug roots may contain sensitive
-source-derived data, so provision them for one trusted account or service.
+source-derived data, so provision them for one trusted account or service. An
+output bundle can also contain source content when its JSON output enables
+evidence publication. Apply an appropriate umask and output-root access policy
+before enabling that option; the requested output modes alone may not be
+suitable for transcript-bearing bundles.
 
 ## Run Lifecycle
 
@@ -66,7 +70,13 @@ run directory remains for inspection and is never removed automatically.
 Treat an output bundle as durable user data. Do not use cache-cleanup policy to
 remove it. An optional accepted chunk map is also durable output and can carry
 source- or model-derived annotations; its content and compatibility contract
-are defined in [Accepted Chunk Map](integrations/chunk-map.md).
+are defined in [Accepted Chunk Map](integrations/chunk-map.md). An optional
+[evidence context](integrations/evidence-context.md) contains source-unit text
+and metadata. It is not a cache or debug artifact: retain it with the output
+bundle only for as long as consumers need it, and apply source-content access
+controls to the entire bundle. Selected lanes may collectively cite most of a
+transcript, so a broad allowlist can make the evidence artifact nearly as
+sensitive and large as the source itself.
 
 ## Chunk-Plan Cache