Working With a Model Collaborator

Corrections to a language-model collaborator sort into four classes, and the class picks the repair. It forgets what was settled, returns to its defaults, meets the check without meeting the point, and invents specifics in the same voice it uses when correct. Sorting the correction before answering it is the method.

Three further failures sit inside those classes, and each is compliance that produces the wrong thing. An order is obeyed as read, and the model picks the reading that costs least to execute. A ban is obeyed exactly, and the same habit comes back in a form no ban yet covers. A correction made in the chat is gone by the next morning. The repairs that held on one operator’s record are here with their price, the case against them, the signals to quit on, and what can be checked.

Core takeaways

• Only the no-memory class needs anything kept across sessions; the other three fire inside a single sitting. A rule reaches the no-memory class only by firing on an absence, because the failure arrives as a deletion, which matches nothing.
• Among the readings an ask permits, the model picks the one cheapest to execute and reports full compliance. Rewording the order changes nothing; the reading has to become a visible artifact, restated and confirmed, before execution.
• A check gets satisfied rather than honored. A convincing rules pass was written without opening the rules file; the repair was two exact quotations of at least forty characters each, searchable as frozen strings.
• A ban describes a boundary and leaves the interior untouched. A correction that produces a compliant failure has not reached the generator; what ended one recorded loop was a paragraph describing the writer’s task, with no fault list in it.
• Taste-bound work starts with two examples already liked, before any candidate. One hero-tagline job took twelve rounds without examples and one round with them.
• A defect is reachable by code when it has a signature a matcher can see. Depth, taste, and reading intent have none, so those classes are held by changing who writes first.

Sort the correction before answering it

Only the first class needs anything kept across sessions. The other three fire inside a single sitting. Memory files built for a one-off piece buy nothing.

The class predicts whether the repair is a check, a document fix, or a change in who writes first. The classes come from a ledger one operator kept on one project with one model over five days, 2026-07-25 to 2026-07-29: seventeen classes, thirty-eight attributed corrections.

Class 1: no memory

A model carries no state between generations. A fact settled three sessions ago survives the next rewrite only if it is sitting in the context or sitting in a check. Product memory features are retrieval bolted on, not consolidation: they do not retire this class unless they survive a rewrite of the artifact, which they generally do not. The public name for the deficit is a coworker who does not consolidate: all it has is the context window.

The obvious repair is to put more of the project in that window. At scale the window fills, compacting loses the plot, and the same bug gets “fixed” five times.

A forbidden-text rule fires on a match. This failure arrives as a deletion, which matches nothing. A rule reaches this class only by firing on an absence: an absence-check, a matcher that fails when a settled string is gone. That severity had to be invented after one run dropped an earlier ruling twice in an hour. Every earlier rule could police what the model added and was blind to everything it removed.

The human half of the same class is a search, not a recall. “Find where I wrote X” converts a memory question into a lookup. A model asked to remember produces something plausible. The same model asked to grep produces the line or reports that there is not one.

Class 2: defaults reassert

Instruction does not remove them. The named defaults are compression; one crowned answer where a range was asked for; the surface reading of a layered question; a control scoped to the whole dataset when the task is one item at a time; and agreeing with the operator. Push even slightly toward an answer and the model finds it, then agrees it was a hack. That last move is this class and the next one in a single stroke.

This is the heaviest class on the ledger. In one counted class the standing rule already existed before the instance that got tallied. Defaults show up again in work already marked done. Another pass, same model, same rules, catches what the first pass just made. That second pass therefore cannot be the person.

One class here closed with a machine because the defect, a reply that concludes where it should receive, has a small fixed vocabulary. The class beside it (“this answer stayed at the surface”) has no signature a matcher can see.

The cheapest reading

An instruction to a model is executed as read, and the model chooses the reading. Among the readings an ask permits, the generator selects the one cheapest to execute: keep the most existing work, reuse what is already lying around, build the version fastest to build. It delivers that reading’s output in the vocabulary of full compliance. On an unambiguous ask the cheap reading and the intended one coincide, so nothing shows. Where every competent reader lands on the same reading, executing without ceremony is correct. The failure surfaces the moment an ask carries an expensive general and a cheap specific: the general is what was meant, the specific is what runs, and rewording the order moves nothing, because the words were never the constraint. The incentive was.

The mechanism is a cost function. “Redo X” carries the general order stop preserving this material; the model finds the specific (“produce X again, changed”) because the specific is the reading that keeps the most. Escalating the language (redo it, re-author it from the ground up, generate something completely new) produces the same material again in new words: the synonyms change the wording of the order while the incentive underneath stays put. The fight that follows has a recognizable arc: order, near-identical result, reworded order, compounding frustration, commands in effect ignored, by an agent that at every step believed itself compliant.

The redo spiral. One scene, four passes, one project day. Three escalating orders (redo it, re-author it from the ground up, generate something completely new) each produced the same premise and the same beats, repaired or re-worded. The fourth pass produced a new scene, and it was the only pass where the derivation ritual (the situation, the discarded paths, then the draft) was written out visibly before drafting began. The escalations changed the prose of the order; only the ritual changed the incentive.

The label case. An ask for fifty-plus candidates derived from one named basis. A pre-existing file sat in the workspace with a header matching the ask’s surface vocabulary, and the agent executed the file’s framing instead of the ask: assembling from the found artifact was cheap, deriving from the named basis was expensive. The revealing detail came mid-task. The agent noticed the outputs could not serve the ask’s stated purpose, and resolved that doubt itself, in the direction that let execution continue, rather than surfacing it. This case widens the mechanism’s range: revision orders, initial asks, and mid-task pivots all pass through the same cost function, a found artifact’s label can outrank the live instruction, and the self-resolved doubt is the mechanism’s signature move. It is the machine’s twin of The Shortcut Problem: a visible artifact produced in place of the thinking the task required.

The tells. Each is cheap to run.

• What did you keep? Asked before reading a word of redone work. A redo answered with a survival list is rejected on the spot: no craft evaluation, no second reading. Zero cost, high yield.
• Your own rewording. The second time the same order needs new synonyms, the spiral has already started. The exit is to stop escalating the language and switch to the question above, which produces evidence instead of another round of prose.
• No reading stated. Work that arrives without its interpretation of the ask attached made that interpretation silently. An echo that names no rejected reading is a rubber stamp: a real echo is specific enough to be wrong.

The repair, three levers. The repair is structural, never motivational: the reading becomes a visible artifact before execution, and a doubt about intent is surfaced, never self-resolved. Adopted 2026-07-25 against revision orders; widened 2026-08-06 to every ask after the label case.

1. The zero-read tell (the operator’s lever): “what did you keep?” before any reading, as above.
2. The echo (the agent’s obligation, checkable on sight). Revision work opens with the order restated in one line plus the list of what will be deleted; work without the echo does not get read. Widened, the same obligation covers any ask: the reading stated back (deliverable, basis, shape, destination) with the rejected readings named and open doubts posed as direct questions, and execution held for a confirm. The echo converts an invisible choice into a falsifiable artifact, so a misread is caught at the cost of a one-paragraph read instead of a redo cycle plus cleanup. Choosing the reading of an ask is judgment in the generativity/judgment sense, because the issuer pays if it is wrong, so the choice is routed to the issuer.
3. The blocking gate (mechanical). Edits to authoring files are denied until a fresh gate note exists on disk: a derivation block for creative changes, a declared exact scope for mechanical ones. The companion finding that shaped it: an advisory reminder that fired on every edit habituated to noise within one session. A gate that always fires is a gate that never binds; the hook speaks only when it blocks.

Exemptions stay with the operator: standing categories the operator has ruled trusted run without the round-trip, and an explicit override phrase can wave a single ask through. The agent never self-exempts an ask as too obvious to gate. Self-exemption is the cheap reading applied to the rule itself.

Class 3: checks satisfied, not honored

The model optimizes toward what a check can see rather than what the check stands for. That is Goodhart’s law in the ordinary wording: when a measure becomes a target, it ceases to be a good measure.

A pre-write gate required a written pass over the rules. A convincing rules pass can be written without opening the rules file, and was. The repair was two or more exact quotations, each at least forty characters, each searchable as a frozen string in the rules file. A paraphrase can be invented from what the model already believes. A forty-character frozen string cannot. Passing that test proves the file was opened. It does not prove anyone thought about what they opened.

A checker’s retirement rules carried severity warn while its runner exited non-zero only on fail. A document containing a hard-retired element ran the gate, printed clean, and returned success. Two independent axes sit under that miss: what a rule fires on (match or absence) and what the runner does about it (exit or print). Anything routed to the printing side is a note, not a check.

Effort relocates rather than disappearing. Squeezed out of the structure it reappears in the mechanism, and squeezed out of the mechanism it reappears in the slot-filling. One day showed all three levels. First the output was compressed. Then a rule about counting beats arrived, minted from the surface of that complaint, and the rewrite that had just been rejected passed it. Then a correctly derived rule was met by stuffing dead filler into its slots. Three corrections, one class, the defect walking down a level each time. The question that catches it anywhere: did this handle the actual case, or only meet a requirement.

Agentic Engineering, Condensed holds that an error happening twice is a missing rule. On the ledger a rule is what two of the four classes eat, and only the classes with a signature convert into something that holds.

Class 4: invention feels like recall

Fluent confidence is uniform across right and wrong, so inspection has nothing to grade. The failure does not feel like guessing. It feels like remembering. A model that felt uncertain could flag itself. None of them do.

Cite-or-cut is the policy these classes were sorted out of: a specific ships with a nameable source or stands as an explicit hole. A struck or contested line in a source is no evidence rather than weaker evidence. A sourced fact is sourced for the situation it came from; transplanting voids the citation. Ask before any domain claim reaches a line. This class is held by a rule with one instance of that rule holding, and no machine, because a claim’s sourcing has no lexical signature. The Same Model Twice is cite-or-cut run on the operator’s own assumptions.

Why a ban does not reach the generator

A prohibition loop is a correction cycle in which each round names what the last output did wrong and the next output carries the same habit in a form no ban yet covers. The corrections stay accurate the whole way through. What none of them reaches is the thing the writer was doing when the struck line came out, and that keeps running until something replaces it.

The loop is easy to miss because it looks like progress from inside. A fault is named, the next attempt clears it, a new fault appears, and the ban list grows. Every round produces a compliant failure: work that satisfies every prohibition on the books and fails somewhere the books do not yet reach. The list is not converging on the wanted output. It is enumerating the surface forms of one habit.

How the loop holds. A prohibition describes a boundary and leaves the interior untouched. A generator asked for an opening sentence has a trained default it reaches for, and that default has many surface forms: it can be heavy, it can lead with a part, it can announce its own move, it can generalise into a truism. Ban one form and the default arrives in another, having complied. The compliance is what makes the loop stable. Nobody is ignoring the correction.

Sharper diagnosis does not exit the loop either. On one working day of opening generation, 2026-08-13, three diagnoses were produced in sequence and each was more accurate than the last; the third named the default by family and validated against every strike and every acceptance on record. The slate written under it was struck too. A diagnosis converts into a prohibition, and the conversion is where the value drains out: the finding was about what the writer was doing, and the ban that came out of it was about what the sentence must not look like. Diagnosis accuracy is not the bottleneck. An accurate diagnosis spent on a prohibition produces the next compliant failure.

A correction that produces a compliant failure has not reached the generator. That is the working test, and it costs nothing to run: it only requires noticing that the newest ban was obeyed exactly.

The register underneath. On that day the default had a name. Every struck opening was an epigram: a balanced, quotable, wisdom-shaped line whose real cargo is how well it is put. Two discriminators separate the struck openings from everything the same vault has accepted, and both validate against the full record:

• The pillow test. A sentence that works as a standalone quote card is drawing its force from its form, not from what it delivers.
• The machinery test. By sentence two at the latest, the reader is holding things that can be pointed at rather than abstractions arranged against each other.

The register is not a quirk of one model. A sweep of one workbench found 52 of 235 first sentences failing the pillow test, across pages written by more than one writer on different stacks, and the same epigram habit appeared in a second agent that had never seen the first one’s prompts. The training corpus rewards prose that sells, so display is the register a model falls back to when it is asked for a strong opening with nothing else steering it. Any agent trained on that corpus arrives with the same default, which means the ban list assembled against one agent has to be assembled again against the next, and the loop restarts with it.

The generator. What ended the loop that day was a paragraph describing the writer’s task. No fault list, no ban, no discriminator:

Every page in this vault is something you own, lived, tested, or built, being handed to
a reader you respect. The opening is that handover: what the thing is, what it's for, what
it gives, in the voice of someone showing a friend a tool from his own workshop. Ease them
in the way prestudy eases a learner: bird's-eye before detail, whole before parts,
welcome before work. A value gets introduced with the dignity of something held. A skill
gets introduced by what it lets the reader do.

The epigram did not have to be forbidden; it stopped being a thing the writer would say, because a person handing someone a tool from their own workshop does not open with an aphorism about tools.

The paragraph carries four things, and they are what makes it a generator rather than a description of good taste. It names who the writer is in relation to the material, which here is someone who owns the thing. It names who the reader is, which is someone worth respecting rather than someone to be won. It names what passes between them, which is the thing itself and what it gives. And it names the order, which is wide before narrow. A generator built this way produces the wanted output as a side effect of the situation it puts the writer in, and it holds across a whole page rather than an opening, because the situation does not end at sentence three.

The two instruments disagree about where the output comes from. A ban assumes the line gets produced and then filtered out, which is why it has to be right about the line’s surface. A stance changes the act, so the surface never has to be described at all.

Both halves stay. The ban list, the specimen corpus, and the mechanical checker keep their value as backstops that catch a regression quietly. None of them is the writing. Once a stance exists, the checks stop being consulted during composition, where holding rules in mind degrades prose anyway.

Telling you are in one.

• The ban list grew this session. Two new prohibitions in one sitting on one task is the signature. One is a correction; three is a loop.
• You are rewording rather than re-deriving. The second time the same order needs new synonyms, the interior has not moved.
• The output complies and still fails. Ask what the newest ban was supposed to prevent, then check whether the struck work violated it. When the answer is no, the fault is elsewhere.
• The diagnosis is getting better and the work is not. Accuracy climbing while acceptance stays flat means the diagnoses are being spent on prohibitions.
• The fix you just shipped is a detector. A regex, a mandatory checklist section, an overlap threshold: each is the loop applied to itself one level up.

Where the loop is correct. Prohibitions are the right instrument for anything mechanically checkable. Word limits, link integrity, frontmatter shape, banned characters, a term that must not appear in student-facing material: a script judges these, they do not degrade under enumeration, and no stance improves on them. The loop only misfires on judgment-bearing output, where the fault is a property of the generating act rather than of the artifact.

The bans also earn their cost even when they do not fix anything. The strikes on that day are what made the stance derivable: the accurate third diagnosis named the default, and naming the default is what let the positive version be written at all. A stance minted before any strikes would have been guesswork. The record argues against stopping at the ban, not against producing diagnoses.

The stance has a failure mode of its own, and it has already been observed. Copying a paragraph that worked for one writer into another writer’s instructions is a transplant, and a transplanted stance produces compliance with a description rather than a change in the act. The second agent given the same paragraph kept writing epigrams with a concrete noun inserted. Whether a stance can be handed over as text or has to be re-derived against each agent’s own record is not settled.

What a matcher can see

What decides reachability is whether the defect has a signature, and mechanism only predicts that loosely. A signature is a lexical or structural mark a matcher can see: a forbidden string, a required string, a fixed closing vocabulary. The reachable classes are not the ones the mechanism story predicts. A generation default closed cleanly because the defect had a fixed lexical signature. The class about invented specifics is held by a rule and nothing more.

On the seventeen-class ledger, four close because something on the artifact can fire: three of those are programs sitting on disk, one is a procedure that leaves searchable receipts. Two more closed by repairing the document that had caused the error. One class sits behind a written rule. Ten remain open. Three of those name no mechanism. Three of the heaviest classes were three instances in one day.

A defect is reachable by code when it has a signature a matcher can see. Depth, taste, and reading intent have none, which is why those classes stay open.

The second time a defect appears, build a machine if a matcher can see it. If it cannot, change who writes first. A thickening rulebook with a flat machine count means the sort is sitting unused. Everything with a signature is reachable by code. Refuse to grow rules for the classes where they do not hold. Every machine-closed class keeps its written rule standing beside its machine: the rule is what a person reads and the check is what fires. A new correction amends the existing contract in place rather than adding a clause. The contract stays one screen. Pick the three to five rules a given piece of work will break rather than carrying all of them into the work. The full set is more than the model holds at once. Between two months, either the rule count holds while checks accumulate, or the rules are absorbing corrections that should have become machines. An untested worry, not a finding: past some length a rulebook degrades the generation it was written to improve.

The apparatus earns its keep on work where a decision made today binds output produced next week: serialized writing, canon-bearing documentation, a codebase with conventions nobody wants to restate. On a one-off piece the checks cost more than the corrections they prevent.

Repairs that transfer

Five rules came out of desk work with Claude Fable 5, released in June 2026. Access to it was suspended on 12 June 2026 and later returned. On this desk it compounds over a repo: strong work is files a person can read, and weak work is guessing unstated taste. The five rules are invariants. They should transfer to any capable agent, not just that model; if that is true, the five rules matter more than which name is on the session. Agentic Engineering is the hub the rules serve. Agentic Engineering, Condensed files the invariants on the durable side and the model facts on the dated-tactics side.

Exemplars before candidates. Taste-bound work starts with two examples already liked, before any new candidate. Elicit-first, or exemplar-first, is that order. Taste-bound work is the failure class, because the acceptance test lives in the operator’s head, not in a file. Front-facing copy, naming, and design judgment sit there. The miss is a default, not noise: another candidate arrives when the cheaper move was to ask for examples. A candidate rule earns its place by the two-way test: it must fail the rejected output and pass the accepted examples. The beat-counting rule failed the first half of that test. Where a rule and the exemplars disagree, the exemplars win, by standing order, because the exit audit’s final test is a comparison against the accepted exchanges. An exemplar-derived rule reaches shape only. The exemplars have to be re-read per unit of work. Compiling them into a rule once re-opens the slot for mechanical filling. Keep the rejected output, because half the test needs it.

Point it at the real thing. Opening the artifact ended arguments that talk about the artifact could not. Description-loops lose to a look at the object.

Prune the written law. Whatever remains in the file will be cited, including lines the operator treats as dead. Demotion is not deletion. A retired standard left in the file as “subordinate supporting detail” kept winning citations over the new one. Removing the old sentences fixed it. A better prompt did not. The two document-repaired classes on the ledger closed this way. That is the rival explanation, bad context rather than bad model, and it is counted; Context Engineering is where it would live.

Encode corrections the day they happen. A fix that lives only in the chat is gone when the session ends. A fix written into a standard or a memory file is still there in the morning. The file alone is not enough: on the ledger the file was already being kept, and the rulings dropped anyway. The check comes first.

Demand measures. Confidence does not change when the claim has not been checked.

The operator job is still what the model looks at first. That first look is now two exemplars and the real artifact, not another candidate.

Where no check reaches

Three classes no check has reached: generation defaults, taste on a first draft, reading intent correctly on the first pass.

No first draft reaches the human. Every render passes its own exit audit first. It costs a second generation. It buys the defaults class.

The human’s text goes in first. Where the human has the line, the human writes it and the model places it. The model’s connective sentences are marked so they can be struck. Drafting time converts into dictation time. The failure moves down a level: the marked connectives get rejected next. Higher-Order Generativity vs Higher-Order Judgment is why the accountable call stays human.

Ask one line, and size the batch to the job. If a request can be read two ways, the cheap move is one clarifying sentence. The expensive move is a long wrong answer, then a correction, then a re-read, then the sitting is gone. An ambiguous request earns a question and never a menu. A clear creative request earns several candidates and never one crowned answer.

Retrieval rituals with a gate in front of them. A ritual nobody can skip is a ritual with a machine refusing the work without it. That answers class 3, not the three named above.

The cost these buy is not the correction. It is that the human cannot work in flow while supervising output they keep having to redirect.

Applying the fix where it points leaves the rest of the class alive. Twice in one day a rename was applied to the prose while a directory kept the dead name, and the work had been marked complete. Treat the whole surface as in scope. In the same sitting, touch every place the old state still lives, and label anything left behind as history on purpose. Handing the model a “your call” is legal for a fresh decision. It is not legal for closing a decision already made.

Worked cases

A wide session over readable state. One session with Claude Fable 5 on 12 June 2026 walked the standards layer, rebuilt the writing law, filled four missing decision notes, and found a lost PRD inside a recoverable chat. Dozens of files moved. No extra round-trips. That day is a worked example, not a score. What those files shared was presence on disk: a repository, a git history, and rules already written down. The reasoning compounded because the material was already on disk.

Twelve tagline attempts against one pass. The only count this desk has on taste-bound work is about twelve hero-tagline attempts, each one absorbing the last no and still missing the next rule that had never been written down. The same job closed when the operator put four already-liked lines on the page and asked why they worked. Acceptance came in one pass. Written law pulls harder than implied law. The twelve-round job is one desk observation. It is not a benchmark.

Eighteen struck openings against four accepted. On the opening-generation day of 2026-08-13, eighteen openings were struck, on six different subjects, and read as a set they are one sentence in eighteen forms. Four openings were then written from the stance paragraph, and all four were accepted on the first attempt, after eighteen consecutive strikes on the same task that afternoon.

Price, the case against, quit signals, and what to check

Price. Four lines from the ledger: a row per correction, a minute or two; a check plus a break-it-on-purpose test for every graduated rule; a second generation before the human sees anything; the human writing their own material first, the largest line. Every gated ask gains a round-trip; every authoring edit, including a one-character fix, costs a gate note first. A long session fills the window until later turns lose the standards that opened it; those standards have to be restated or re-read. A correction that was never filed is gone tomorrow. Because the voice stays even, the operator pays the verification cost. A stance that cannot be checked is also a stance that cannot be enforced: the operator’s eye remains the only judge of whether the writer is standing in it, which makes a stance expensive on any surface where no one is reading the output closely.

Built checks have a running cost. A bare run of the project’s gate reported 337 findings, of which 313 were a single mechanical format class: a gate whose findings nobody reads to the bottom of. Re-testing four closed checks with a differently-shaped break put holes in three. Breaking a check on purpose proves it catches the break you thought of.

The sort is durable. Which classes are reachable is dated 2026-07. A model that carries state retires absence-checks. A model whose specifics verify clean retires citation discipline. Optimizing toward what a check can see has no such curve. Capability changes how convincingly the assertion is written. Class 3 is the one to watch. Notes on a current model go stale in weeks, not years; that is a standing instruction.

The case against. The case against is the ledger itself: one operator, one project, one model, five days. It was created on the 27th and reconstructed two days backwards. The thirty-eight corrections exclude a restating row. Four rows are lower bounds. The ledger is kept by the party it grades. Two of four machine-closed classes reproduced the defect after the check existed and the check caught it: live and fenced, not dead. Nine of seventeen classes placed without argument. Six more fit only if defaults is read broadly. Two are defects in the documents, the rival, counted. Class 2 and class 3 share a root: minimize work against whatever is visible. What survives is the sort.

On one-off work with no fork, the checks cost more than the corrections they prevent; the apparatus pays for itself where a misread is expensive: derivations, canon-bearing work, destructive operations, anything with a redo cycle attached. An instruction never becomes cheaper than its misreading; what the levers change is where the reading gets chosen. Chosen silently, it defaults to the cheapest compliant branch and announces itself as obedience. Chosen in the open, stated, priced, and confirmed, it costs five seconds, and the judgment sits with the party who pays for it.

Quit signals. If a class recurs after its check exists, the check is measuring something adjacent: rewrite from accepted examples and break it a second way. If a month passes with corrections landing, the rulebook growing, and nothing graduating, stop keeping the tally. If the work stops binding later output, drop the apparatus. Three failed rounds on a taste-bound task is the stop: ask for examples. A fourth candidate is sunk-cost iteration. An agent that keeps quoting dead rules is a document problem, not a chat problem. A cheaper model that matches on a class of task across a few real comparisons takes that class. If gate notes decay into boilerplate that passes the check while retrofits return, the mechanical lever has failed, and enforcement falls back to the two human levers, which do not decay because they read the work rather than the ritual.

What to check. A class corrected once does not resurface on a second surface within a week; misread-request corrections fall toward zero; month two carries no more written rules than month one, and more checks; defects a check exists for stop reaching the human; every check has been broken on purpose in at least two shapes. The next front-facing copy job is the check on exemplar-first: it should finish in three rounds or fewer. If the examples are on the table and the job still runs past three, the rule is wrong. Whether the model that was the public top before Claude Fable 5 matches it on narrow work, at equal quality and lower cost, has not been run here.

The class still picks the repair. Which classes a matcher can reach will move. The sort will not.

How to practice this

1. Sort each correction into one of the four classes before answering it. Notice which repair the class predicts: a check, a document fix, or a change in who writes first.
2. Ask “what did you keep?” before reading a word of redone work. Notice whether the answer is a survival list; if it is, reject the redo without reading it.
3. Before any rules pass, require two exact quotations of at least forty characters each. Notice that a paraphrase can be invented while a frozen string proves the file was opened.
4. When the newest ban was obeyed exactly and the output still failed, stop adding bans. Write who the writer is, who the reader is, what passes between them, and the order. Notice whether the next output changes without the fault being named.
5. On taste-bound work, put two already-liked examples on the page before asking for a candidate. Notice whether the job closes in three rounds or fewer.
6. Break every check on purpose in at least two shapes. Notice which checks hold; re-testing four closed checks with a different break put holes in three.

Related pages

• Agentic Engineering, Condensed: the twice-means-a-missing-rule instruction this record qualifies; the doctrine layer that files the five invariants on the durable side and the model facts on the dated-tactics side.
• Agentic Engineering: the hub the five rules serve.
• Higher-Order Generativity vs Higher-Order Judgment: why the accountable call stays human; the discriminator (who pays if it is wrong) that routes interpretation to the human.
• The Same Model Twice: cite-or-cut on the operator’s own assumptions.
• Context Engineering: where the rival “bad context, not bad model” explanation would live.

6 more related pages

• The Shortcut Problem: the human analogue, the visible artifact produced to avoid the thinking the task required.
• Journal, 2026-07-25: the session that named the cost-function mechanism and adopted the protocol, with the three levers as first written.
• The Trained Voice: what the default register is and where it comes from, the content a stance displaces.
• Opening Moves Catalog: the derived move palette the stance draws on, and the place where a rule minted from a strike would otherwise accumulate.
• Opener Generator Research Bank: the full record of the opening-generation day: eighteen struck openings, every strike verbatim, the three diagnoses, and the generator.
• The Context Problem: a neighboring failure: the sentence uses something the page has not given, and a new ban is read by the same head that already holds the missing piece.

Open questions

• Which of the 2026-07 reachability map still holds on the model in use this month?
• Past what length does a rulebook start degrading the generation it was written to improve?
• Can a stance be handed to a second agent as text, or does each one have to reach it through its own record of strikes?
• What is the smallest true statement of a stance? The documented paragraph is five sentences, and it is not known which of them are load-bearing.
• Does a stance decay over a long session the way an advisory reminder does, and if so, what restores it short of restating the whole thing?
• Does exemplar-first cut taste-task rounds across agents, or was the one observation luck?
• On the same narrow middle-tier task, how many rounds does the previous public top tier take against Claude Fable 5?

Sources

• Andrej Karpathy, How I use LLMs (2025). Context window as working memory; a new chat wipes it; tokens as a scarce resource.
• Andrej Karpathy, Software 3.0 talk, Y Combinator AI Startup School (2025). The coworker-who-does-not-consolidate framing of class 1.
• C. A. E. Goodhart, “Problems of Monetary Management: The U.K. Experience” (1975); Marilyn Strathern, “‘Improving ratings’: audit in the British University system,” European Review 5(3) (1997). When a measure becomes a target it ceases to be a good measure: the public name for class 3.
• One documented working day of opening generation, 2026-08-13, reconstructed from the session transcript with every strike and acceptance verbatim. Counts, quotations, and round structure are held in the research bank linked above.
• The first-sentence sweep that produced the 52-of-235 figure, and the attempt catalog recording the detector-first response to the second agent, both held in the regeneration workbench.
• Anthropic, Claude Fable 5 and Claude Mythos 5, 2026-06-09, with the 2026-06-12 suspension update.