Greywall's built-in pi profile leaves the agent's persistence vectors writable. Analysis of the gaps (network, inaccurate XDG paths, overly broad allowWrite) and a corrective denyWrite profile, with the limits the sandbox cannot cover on its own.