diff --git a/openwiki/.last-update.json b/openwiki/.last-update.json
index 3021e2b9a..369a0e9f9 100644
--- a/openwiki/.last-update.json
+++ b/openwiki/.last-update.json
@@ -1,6 +1,6 @@
 {
-  "updatedAt": "2026-08-03T01:06:15.779Z",
+  "updatedAt": "2026-08-11T03:50:11.351Z",
   "command": "update",
-  "gitHead": "22f4decb23425c5c085e4723e23231116468b2da",
+  "gitHead": "faa2a4cab16ffbc588f0229d02f89e8a1c9f5594",
   "model": "zai.glm-5"
 }
diff --git a/openwiki/architecture/overview.md b/openwiki/architecture/overview.md
index 6be370e4b..ae197993b 100644
--- a/openwiki/architecture/overview.md
+++ b/openwiki/architecture/overview.md
@@ -147,17 +147,30 @@ See [api-integration/overview.md](../api-integration/overview.md) for authentica
 
 Amazon Bedrock Guardrails wraps all AI interactions:
 - Blocks violence, hate speech, sexual content
-- Input and output filtering
-- PII detection and tokenization before provider requests
+- Input and output filtering with configurable thresholds
+- Topic-based detection (drugs, weapons, self-harm) with telemetry-only mode
 
-### PII Protection
+### Zero-Data-Retention Inference
 
-Automatically detects and tokenizes:
-- Student names, emails, phone numbers
-- Location data
-- Identifiable information
+AI providers do not retain inference data. Student names, emails, and other context reach the selected model byte-identical and are not stored by the provider. This is critical for tool calls such as district-data queries where the model must use real identifiers supplied by authorized users.
 
-See `/docs/features/k12-content-safety.md` for implementation details.
+### PII Detection Gates
+
+Amazon Comprehend detection runs at two durable-content boundaries:
+
+1. **Nexus memory writes** — Detected entity types logged as telemetry (never values). Writes proceed; detector errors are non-fatal.
+2. **Published agent content** — Detected entity types logged as telemetry. Content remains unmodified.
+
+Automatic memory extraction excludes third-party identifiers at the prompt level, not via refusal, because it runs unattended after each persisted Nexus turn.
+
+| PII Type | Source |
+|----------|--------|
+| Names, emails, phone numbers, addresses | Amazon Comprehend |
+| SSN, dates, ages | Amazon Comprehend |
+| Student IDs (7-digit patterns) | Custom patterns |
+| District-specific identifiers | Custom patterns |
+
+See `/docs/features/k12-content-safety.md` for implementation details and filtering configuration.
 
 ## Request Flow Example
 
diff --git a/openwiki/quickstart.md b/openwiki/quickstart.md
index a31309897..b9c393e34 100644
--- a/openwiki/quickstart.md
+++ b/openwiki/quickstart.md
@@ -98,6 +98,7 @@ The following areas have substantial existing documentation and are deferred fro
 - **API Reference**: See `/docs/API_REFERENCE.md`
 - **Deployment Guide**: See `/docs/DEPLOYMENT.md`
 - **Testing Guide**: See `/docs/guides/TESTING.md`
+- **Open Adaptive District Skill**: Skill category description in agent-platform/overview.md uses outdated "adaptive learning platform" label. Should align with simplified OAD model (six-week build cycle) when agent-platform docs next refreshed. Source: `/infra/agent-image/skills/psd-open-adaptive-district/SKILL.md`.
 - **K-12 Content Safety**: See `/docs/features/k12-content-safety.md`
 - **Individual Skill Docs**: See `/infra/agent-image/skills/*/SKILL.md`
 - **Database Migrations**: See `/docs/database/drizzle-migration-guide.md`