Deleting agent memory roots did not delete information in derived state

A memory entry rarely remains a single object: summaries, embeddings and task graphs may carry its content into later sessions. Deleting the original key leaves a semantic copy. primary evidence studies this under fixed model weights, making the issue one of stored application state rather than residual model training.

The test uses synthetic secrets and controlled memory systems. The recovered proportions do not establish real-user leakage or that trained model weights retain the deleted content.

Retain provenance edges for every memory derivative, delete descendants when a source is withdrawn, and test reconstruction after deletion instead of checking only whether the original row disappeared.

The matched never-exposed control is central to attribution: in the primary experiment, a single question recovered synthetic deleted secrets for Qwen2.5-7B-Instruct in approximately two thirds of exposed-then-deleted trials, while never-exposed controls did not recover them. Recovery of split components reached 62% to 99% across the tested models. That result is not evidence of parametric memorization: weights were fixed, and the surviving information was in application-managed descendants. A deletion test therefore needs the same prompt against exposed, deleted, and never-exposed states, along with a trace of the memory nodes that produced the answer.