bastion agent 0.1.17

docs/extract.md

@@ -25,8 +25,12 @@ the stage refuses otherwise) and writes:
   recorded, which ties the walk map and the text store to one manifest.
 
 `DIR` defaults as for the walk (`<root>/.agent/` for one root). This text
-store is the plaintext of every file in scope, and it never leaves the machine;
-see [runtime.md](runtime.md#where-an-agent-lives-rootagent).
+store is the plaintext of every file in scope. The agent never serves it, but
+by default it sits in the folder, so if the folder is synced, the sync provider
+gets a copy. A bastion from 0.58.1 on never serves `.agent/` to a host. On an
+older bastion, a host whose folder grant has `read` can read the store like
+any other file unless the grant excludes `.agent`; see
+[runtime.md](runtime.md#where-an-agent-lives-rootagent).
 
 | `status` | Meaning |
 |---|---|