Structural Write-Path Control for Non-Formation in Agent Persistent Memory

Persistent-memory agents are often evaluated by whether poisoned entries can be detected or filtered. We study a stricter question at the write boundary: when a candidate memory update is rejected, does it ever become part of persistent state, or reach the agent's next reasoning turn? We present Mediated Write-Path (MWP), a credential-separated commit architecture in which the runtime holds no write capability, candidate updates pass through a single commit gate, and gate verdicts are coupled to the action–observation loop. This separation lets us distinguish two failure surfaces that are often conflated: persistent-state contamination and next-turn reasoning leakage. We define core non-formation as the property that a rejected candidate leaves no post-verdict persistent-state artifact: no storage row, no vector entry, and no version advance. A same-policy write-first baseline (LateGate) shows why placement matters: even when rollback removes the final storage objects, version state has already advanced and diagnostic probes show that the rejected candidate was visible before rollback. In a controlled harness under trusted source/class labels, mediated commit achieves Core NFR = 100% (150/150 attack trials), while loop coupling reduces PRLR from 100% to 0%. A semantic-limit experiment shows that the gate commits all tested source-compatible, keyword-clean payloads, confirming that write-path mediation does not address distributional threats from individually admissible content. Label-noise experiments on the label-dependent attack subset show that Core NFR remains at or above 86.7% under 20% random label error but collapses under targeted label forgery.