When memory is an attack surface, "incident response" must include memory-specific actions: quarantine, rollback, replay, and governance approvals. This anchor defines an incident response runbook for anti-abuse memory architectures, including severity levels, safe-mode/lockdown procedures, audit events, and measurable recovery objectives. The goal is reproducibility and accountability without exposing sensitive defense details. ---