Deleted Is Not Forgotten: Deletion in Persistent LLM Agents Fails by Resurrection, Not Only by Residue

We argue that current deletion audits for persistent LLM agents measure the wrong invariant. They verify a snapshot property (right after a deletion request, the fact is unrecoverable from the memory store) and show it is nearly achievable. Erasure is a trajectory property: the fact must stay unrecoverable at every later time, from every state the agent can reach. Between the two lie resurrection channels: tool-written artifacts, peer-agent copies, restored checkpoints, and consolidation write-back from retained correlates, plus source revocation that never triggers deletion. In a pilot, dependency-aware deletion leaves 7% immediate grey-box residue (1% in the store itself), yet 93% of facts become recoverable again within five routine, non-adversarial sessions, 85% written back into the store; resurrection is structural (restore 92%, artifacts 77%, peer copies 71%) rather than inferential (consolidation 12%), and revocation without deletion retains 99%. We map channels to GDPR obligations and recommend trajectory audits, scope-aware deletion APIs with receipts, and revocation as a deletion trigger.