Admission Governs Entry: How Stored Corrections Fail After Entering the Memory of a Continuously Learning Agent

Can a retrieval-augmented agent learn from its own interaction memory without corrupting itself, and would standard evaluation notice? We study a Korean insurance agent under four memory conditions (no learning, verbatim accumulation, an embedding gate, and an embedding plus LLM-judge gate) over a scripted thirty-day stream, on four dimensions, with greedy decoding and predictions registered before each run. Three of our own theses died on their registered tests. What survives is a claim about where the defence stops: admission governs what enters memory, not how memory is applied. Corrections from trusted sources are written to memory directly, by design, and both failures we trace occur after entry. In one, a correction stored without scope is applied to an exception; in the other, a correction that names one wrong class moves the answer into the adjacent wrong class. Both recur on a second serving stack; neither recurs on a second generator. In a pre-registered synthetic probe, the adjacency mechanism recurs weakly on the generator of record (2 to 6 of 12 items, not significant) and defining the target class removes it (6 to 0, p = .016); the scope mechanism did not reproduce. Shown the error each corrects, the gate the corrections bypass admits all seven, including the one behind the scope failure. Our own correction metric, which checks only the named error, credits 29 cells of the classification query, 20 of which place the disease in the adjacent class; a whole-boundary re-grade, checked against a blind human rating, does not. Composite scores hide all of this: verbatim accumulation raises the composite while factual knowledge falls, and the failing answers are produced with their correct memories retrieved.