Kai confirmed memo-inbox is working and, consistent with the "no extra isolation complexity" call on bubblewrap, the L1/L2/env gaps are to be recorded but not executed. The profile stays deploy = "mirror" and deploy-scenario.sh keeps refusing --apply; nothing about the live service changes.