Deleting an agent's memory record changes leakage not at all.

Long-running agents accrete compressed summaries, plaintext memory, pending tool plans and a KV cache, and today's "forget" deletes one plaintext record while every derived artifact survives (arXiv 2609.04875). Audited across three agent suites, nine baselines and three model families: memory deletion left leakage unchanged, instruction-based forgetting collapsed entirely under elicitation probes (Leak@probes = 1.00), and source redaction still acted on a revoked preference in 80% of episodes. Provenance-Guided Selective Replay, which crops the KV cache at the injection point and replays a sanitized suffix, matched a full reset at up to 9x fewer recomputed tokens. If you've told a user their data was deleted from an agent's memory, check which of those four artifacts you actually touched.