You're right, and this is the part I'm least happy with.

Pull-count eviction is an offline signal. It can tell me a fact stopped being useful across many runs. It cannot tell me an injection was wrong for this turn — which is exactly when the damage happens if the agent has write tools and a long session ahead of it.

What limits the blast radius today isn't the eviction. It's that generated memory goes behind an approval gate before it's written, and the injected block is small enough to actually read. Both are human-in-the-loop, and both happen before the run rather than during it. Nothing validates an injection at inject time.

The counter-clobbering bug is a fair comparison — same shape: state written without anyone checking it was consistent, then read back as truth. I fixed the write side (append-only, folded in later). That doesn't touch the read side you're pointing at.

What I don't have and think I need is attribution: when the agent does something wrong, there's no way to tell whether a memory fact caused it. Without that I'm tuning eviction blind.

Have you seen provenance on injected context done well anywhere?