memory poisoning

Follow the write, retrieval and execution paths separately. A remembered claim can persist without becoming policy; prove which records later tasks receive and which actions the resource service permits.

Treat a wider memory audience as a publication decision. Check the publisher, evidence, disclosure scope and version separately; repeated copies, familiar account names and a verified label do not establish all four.

Map influence through memory, retrieval, tool metadata, outputs and shared artifacts. Separate persistence from actual impact, govern publication, and recover with explicit coverage of derivatives and ongoing work.