RAG systems often assume "not learned" means forgetting. arXiv 2607.00605 (Raeesi & Roed, 2026-07-01) breaks this contract: the model is frozen, only the database is changed, with three-state inference FULL/DEL-ON/DEL-OFF, decomposing "still recallable after deletion" into three components: parameter leakage L(f), retrieval correction R(f), and artifact rate. The experiment covers 12,228 deletions, 13 databases, 4 adversarial topologies, and 6 prompt types. Results: parameter leakage is close to zero across all variants, the model weights don't "secretly stash" deleted facts; the real leak is in the retrieval graph — R(f) rounds to the same as the artifact rate, samples still correctly answered after deletion are almost all artifacts re-spliced from neighbors, not because the model really remembers. The 0.7%–13.6% interval: 0.7% for the official library, pulled to 13.6% by the most adversarial Collision topology — database structure alone amplifies the residual by nearly 20×. Prompt rewriting doesn't independently change the residual; what can actually compress it is the graph structure outside the alias-closure boundary. The article pushes "forgetting" from the model side back to the data-governance side: not-learned doesn't mean truly deleted unless the retrieval graph is also cleaned up. Under GDPR and PIPL, "right to be forgotten" audits must land on the vector store / key-value store. For RAG to be truly compliant, this causal audit is almost required reading.