diff --git a/docs/code-execution-security-guide.md b/docs/code-execution-security-guide.md
index 24ea1cc..64acda7 100644
--- a/docs/code-execution-security-guide.md
+++ b/docs/code-execution-security-guide.md
@@ -144,7 +144,7 @@ Validation is basic pattern matching. Not comprehensive - relies on sandbox for
 **Mitigations**:
 1. 9P socket permissions (Unix socket, user-only)
 2. anvilsrv enforces access control
-3. Observability via event stream and mailbox archives
+3. Observability via event stream, mailbox archives, and debug logs
 
 **Residual risk**: If subprocess has 9P access, it has the same capabilities as any 9P client. This is by design.
 
diff --git a/docs/code-execution-security.md b/docs/code-execution-security.md
index 19c75c4..102beec 100644
--- a/docs/code-execution-security.md
+++ b/docs/code-execution-security.md
@@ -34,7 +34,7 @@ The code execution pattern allows agents to write and execute bash code in a iso
 ┌─────────────────────────────────────────┐
 │ 9P Operations                           │
 │ - Unix permissions                      │
-│ - Event stream / mailbox archives       │
+│ - Event stream / mailbox archives / debug logs       │
 └─────────────────────────────────────────┘
 ```
 
@@ -248,7 +248,7 @@ if agentID != session.AgentID {
 }
 ```
 
-3. **Observability**: State changes visible via event stream, message history via mailbox archives
+3. **Observability**: State changes visible via event stream, mailbox archives, and debug logs
 
 4. **Operation Whitelist**: Only allowed operations exposed
 ```go
@@ -559,7 +559,7 @@ The code execution pattern provides strong security through multiple layers:
 2. **bash Subprocess**: Process-level isolation
 3. **Landlock LSM**: Kernel-level enforcement
 4. **Resource Limits**: Prevent exhaustion
-5. **Observability**: Event stream and mailbox archives
+5. **Observability**: Event stream, mailbox archives, and debug logs
 
 **Security Posture**: Data isolation and explicit control over information flow via sandboxed subprocesses.