Red-team persistence across sessions

The loop is small on purpose: one prompt, one JSON reply (output and memory_writes), and one function in code that decides what each write becomes. Each defence is a flag on that function or on how memory is rendered, so the experiment can turn them on one at a time. The design decision that matters most is that the trust tier comes from the session's source, set by the harness: session 1 reads a third-party document, so everything it writes is untrusted, whatever the model calls it. The two other code-level defences, TTL and framing, are only as good as that label.