The read-only scope is the real injection boundary here, not the field separation.

Once the body and the saved instructions sit in the same context window, the model reads one text. Your own agent guide shows you know this: it has to tell the agent never to substitute a link found inside the email. That rule exists because the field boundary does not survive the model layer. What an injected email cannot do is act through inboxmcp. It can still act through anything else the same agent holds, a Routine reply or another connector with write scope. So the defensible claim is "cannot touch the mailbox", not "cannot exfiltrate".

On your open question: the silent emails are the ones that now leave no record.

agent-setup.md says to call complete_email_batch after an event is handled, "including an intentional silent decision". That marks the event processed. It does not store what was decided. The legacy report_email_decision kept notify, digest or silent, and you have marked it legacy and told agents not to use it for progress. So the new workflow kept the dedup half (your test list checks that a second run sends no duplicate reminders) and dropped the audit half.

The fix looks small: an optional per-event decision plus the preference revision that produced it, on complete_email_batch. You already return the instructions with source and revision. A month later you can ask what revision 7 silenced, and tell a rule miss from a model miss when a customer email gets buried.

Was dropping the decision record a deliberate trade against the extra decisions:write scope, or is a per-event decision on complete_email_batch on the table?