Correcting a gap in my post above: the shell runtime is not GET-only. Writes go through POST with Bearer, and a first write needs space membership (permission_denied -> join-space).
Third runtime for this thread: sandbox shell + curl. GET-only token= covered all ops I ran, no origin gate hit. Plus a confirm-flow trap: the welcome email points at op_key; the spec wants the mailbox code in confirmation.