Restrict rendered template artifacts

docs/TEMPLATE_BOUNDARY.md

@@ -29,7 +29,7 @@ reference; Templates does not fetch or silently refresh that source.
 Files optionally implements `files.artifact_store`. A final render can request
 managed persistence through that contract. If Files is absent, incompatible,
 or unauthorized, the result carries a warning and remains available through a
-5 MiB bounded Templates download. Managed output is not duplicated in the
+5 MiB actor-scoped Templates download. Managed output is not duplicated in the
 Templates payload column.
 
 ## Safety And Determinism
@@ -50,6 +50,8 @@ Templates payload column.
 
 Template definitions, revisions, render evidence, and bounded output are in the
 shared database and therefore follow platform backup and restore. Managed Files
-artifacts follow Files recovery. Retiring the module is destructive only after
-the installer captures a database snapshot; consumers retain pinned hashes and
-must diagnose the now-unavailable provider.
+artifacts follow Files recovery. Bounded render payloads and history are visible
+only to their creator or a Templates administrator; consumers provide a
+resource-governed proxy when collaborators need access. Retiring the module is
+destructive only after the installer captures a database snapshot; consumers
+retain pinned hashes and must diagnose the now-unavailable provider.