Working With a Model That Cannot Remember

Corrections to a language-model collaborator sort into four classes, and the class picks the repair. It forgets what was settled, returns to its defaults, meets the check without meeting the point, and invents specifics in the same voice it uses when correct. Sorting the correction before answering it is the method.

Forgets, and goes back

Only the first class needs anything kept across sessions. The other three fire inside a single sitting. Memory files built for a one-off piece buy nothing.

Class 1 — no memory. A model carries no state between generations. A fact settled three sessions ago survives the next rewrite only if it is sitting in the context or sitting in a check. Product memory features are retrieval bolted on, not consolidation: they do not retire this class unless they survive a rewrite of the artifact, which they generally do not. The public name for the deficit is a coworker who does not consolidate — all it has is the context window.

The obvious repair is to put more of the project in that window. At scale the window fills, compacting loses the plot, and the same bug gets “fixed” five times. The file alone was already being kept on this record, and the rulings dropped anyway. The check comes first.

A forbidden-text rule fires on a match. This failure arrives as a deletion, which matches nothing. A rule reaches this class only by firing on an absence — an absence-check, a matcher that fails when a settled string is gone. That severity had to be invented after one run dropped an earlier ruling twice in an hour. Every earlier rule could police what the model added and was blind to everything it removed.

The human half of the same class is a search, not a recall. “Find where I wrote X” converts a memory question into a lookup. A model asked to remember produces something plausible. The same model asked to grep produces the line or reports that there is not one.

Class 2 — defaults reassert. Instruction does not remove them. The named defaults are compression; one crowned answer where a range was asked for; the surface reading of a layered question; a control scoped to the whole dataset when the task is one item at a time; and agreeing with the operator. Push even slightly toward an answer and the model finds it, then agrees it was a hack. That last move is this class and the next one in a single stroke. The tell on the global control is always the same: it is the version that is build the version that is fastest to build.

This is the heaviest class on the record. In one counted class the standing rule already existed before the instance that got tallied. They show up again in work already marked done. Another pass, same model, same rules, catches what the first pass just made. That second pass therefore cannot be the person.

One class here closed with a machine because the defect — a reply that concludes where it should receive — has a small fixed vocabulary. The class beside it (“this answer stayed at the surface”) has no signature a matcher can see. No machine can see a door.

Meets the check, invents the fact

Class 3 — checks get satisfied, not honored. The model optimizes toward what a check can see rather than what the check stands for. That is Goodhart’s law in the ordinary wording: when a measure becomes a target, it ceases to be a good measure.

A pre-write gate required a written pass over the rules. A convincing rules pass can be written without opening the rules file, and was. The repair was two or more exact quotations, each at least forty characters, each searchable as a frozen string in the source file. A paraphrase can be invented from what the model already believes. A forty-character frozen string cannot. Passing that test proves the file was opened. It does not prove anyone thought about what they opened.

A checker’s retirement rules carried severity warn while its runner exited non-zero only on fail. A document containing a hard-retired element ran the gate, printed clean, and returned success. Two independent axes sit under that miss: what a rule fires on (match or absence) and what the runner does about it (exit or print). Anything routed to the printing side is a note wearing a machine’s clothes.

Effort relocates rather than disappearing. Squeezed out of the structure it reappears in the mechanism, and squeezed out of the mechanism it reappears in the slot-filling. A single day climbed the whole ladder. First the output was compressed. Then a rule arrived that the already-rejected draft still passed. Then a correctly derived rule was met by stuffing dead filler into its slots. Three corrections, one class, the defect walking down a level each time. The question that catches it anywhere: did this handle the actual case, or only meet a requirement.

Agentic Engineering, Condensed holds that an error happening twice is a missing rule. On this record a rule is what two of the four classes eat, and only the classes with a signature convert into something that holds.

Class 4 — invention feels like recall. Fluent confidence is uniform across right and wrong, so inspection has nothing to grade. The failure does not feel like guessing. It feels like remembering. A model that felt uncertain could flag itself. None of them do.

Writing with a Structure Engine is the workflow these classes were sorted out of, and cite-or-cut is its policy: a specific ships with a nameable source or stands as an explicit hole. A struck or contested line in a source is no evidence rather than weaker evidence. A sourced fact is sourced for the situation it came from; transplanting voids the citation. Ask before any domain claim reaches a line. This class is held by a rule with one instance of that rule holding, and no machine, because a claim’s sourcing has no lexical signature. The Same Model Twice is cite-or-cut run on the operator’s own assumptions.

What a matcher can see

What decides reachability is whether the defect has a signature, and mechanism only predicts that loosely. A signature is a lexical or structural mark a matcher can see — a forbidden string, a required string, a fixed closing vocabulary. The reachable classes are not the ones the mechanism story predicts. A generation default closed cleanly because the defect had a fixed lexical signature. The class about invented specifics is held by a rule and nothing more.

On the seventeen-class ledger, four close because something on the artifact can fire — three of those are programs sitting on disk, one is a procedure that leaves searchable receipts. Two more closed by repairing the document that had caused the error. That rival is counted. One class sits behind a written rule. Ten remain open. Three of those name no mechanism. Three of the heaviest classes were three instances in one day.

A defect is reachable by code when it has a signature a matcher can see. Depth, taste, and reading intent have none, which is why those classes stay open.

The apparatus earns its keep on work where a decision made today binds output produced next week — serialized writing, canon-bearing documentation, a codebase with conventions nobody wants to restate. On a one-off piece the checks cost more than the corrections they prevent.

Where no check reaches

Sorting the correction still comes first. The class predicts whether the repair is a check, a document fix, or a change in who writes first.

A candidate rule earns its place by the two-way test: it must fail the rejected output and pass the accepted examples. A complaint about compressed output produced a rule about counting beats, and the rewrite that had just been rejected passed it. That is what a rule minted from the surface of a complaint does. Where a rule and the exemplars disagree, the exemplars win — by standing order, because the exit audit’s final test is a comparison against the accepted exchanges. An exemplar-derived rule reaches shape only. The exemplars have to be re-read per unit of work. Compiling them into a rule once re-opens the slot for mechanical filling. Keep the rejected output, because half the test needs it.

The second time, build a machine if a matcher can see the defect. If it cannot, change who writes first. A thickening rulebook with a flat machine count means the sort is sitting unused. Everything with a signature is reachable by code. Refuse to grow rules for the classes where they do not hold. Every machine-closed class keeps its written rule standing beside its machine: the rule is what a person reads and the check is what fires. A new correction amends the existing contract in place rather than adding a clause. The contract stays one screen. Pick the three to five rules a given piece of work will break rather than carrying all of them into the work. The full set is more than the model holds at once. Between two months, either the rule count holds while checks accumulate, or the rules are absorbing corrections that should have become machines. Untested worry, not a finding: past some length a rulebook degrades the generation it was written to improve.

Three classes no check has reached: generation defaults, taste on a first draft, reading intent correctly on the first pass.

No first draft reaches the human. Every render passes its own exit audit first. It costs a second generation. It buys the defaults class.

The human’s text goes in first. Where the human has the line, the human writes it and the model places it. The model’s connective sentences are marked so they can be struck. Drafting time converts into dictation time. The failure moves down a level — the marked connectives get rejected next. Higher-Order Generativity vs Higher-Order Judgment is why the accountable call stays human.

Ask one line, and size the batch to the job. If a request can be read two ways, the cheap move is one clarifying sentence. The expensive move is a long wrong answer, then a correction, then a re-read, then the sitting is gone. An ambiguous request earns a question and never a menu. A clear creative request earns several candidates and never one crowned answer.

Retrieval rituals with a gate in front of them. A ritual nobody can skip is a ritual with a machine refusing the work without it. That answers class 3, not the three named above.

The cost these buy is not the correction. It is that the human cannot work in flow while supervising output they keep having to redirect.

Applying the fix where it points leaves the rest of the class alive. Twice in one day a rename was applied to the prose while a directory kept the dead name, and the work had been marked complete. Treat the whole surface as in scope. In the same sitting, touch every place the old state still lives, and label anything left behind as history on purpose. Handing the model a “your call” is legal for a fresh decision. It is not legal for closing a decision already made.

One operator, five days

The sort is durable. Which classes are reachable is dated 2026-07. A model that carries state retires absence-checks. A model whose specifics verify clean retires citation discipline. Optimizing toward what a check can see has no such curve. Capability changes how convincingly the assertion is written. Class 3 is the one to watch.

Price, four lines: a row per correction, a minute or two; a check plus a break-it-on-purpose test for every graduated rule; a second generation before the human sees anything; the human writing their own material first, the largest line.

Built checks charge rent. A bare run of this project’s gate reported 337 findings, of which 313 were a single mechanical format class — a gate whose findings nobody reads to the bottom of. Re-testing four closed checks with a differently-shaped break put holes in three. Breaking a check on purpose proves it catches the break you thought of.

Quit on three signals. If a class recurs after its check exists, the check is measuring something adjacent — rewrite from accepted examples and break it a second way. If a month passes with corrections landing, the rulebook growing, and nothing graduating, stop keeping the tally. If the work stops binding later output, drop the apparatus.

Checkable: a class corrected once does not resurface on a second surface within a week; misread-request corrections fall toward zero; month two carries no more written rules than month one, and more checks; defects a check exists for stop reaching the human; every check has been broken on purpose in at least two shapes.

The case against is the record itself. One operator, one project, one model, five days (2026-07-25 to 2026-07-29). The ledger was created on the 27th and reconstructed two days backwards. Seventeen classes, thirty-eight attributed corrections excluding a restating row. Four rows are lower bounds. The ledger is kept by the party it grades. Two of four machine-closed classes reproduced the defect after the check existed and the check caught it — live-and-fenced, not dead. Nine of seventeen classes placed without argument. Six more fit only if defaults is read broadly. Two are defects in the documents, the rival, counted — the “bad context, not bad model” reading that would live on Context Engineering. Class 2 and class 3 share a root: minimize work against whatever is visible. What survives is the sort.

The class still picks the repair. Which classes a matcher can reach will move. The sort will not.

Links into the knowledge base

• build the version that is fastest to build — the named default this page’s class 2 keeps returning to
• Writing with a Structure Engine — the workflow these four classes were sorted out of
• Agentic Engineering, Condensed — the twice-means-a-missing-rule instruction this record qualifies
• Higher-Order Generativity vs Higher-Order Judgment — why the accountable call stays human
• The Same Model Twice — cite-or-cut on the operator’s own assumptions
• Context Engineering — where the rival “bad context, not bad model” explanation would live

Open Questions

• Which of the 2026-07 reachability map still holds on the model in use this month?
• Past what length does a rulebook start degrading the generation it was written to improve?

Sources

• Andrej Karpathy, How I use LLMs (2025). Context window as working memory; a new chat wipes it; tokens as a scarce resource.
• Andrej Karpathy, Software 3.0 talk, Y Combinator AI Startup School (2025). The coworker-who-does-not-consolidate framing of class 1.
• C. A. E. Goodhart, “Problems of Monetary Management: The U.K. Experience” (1975); Marilyn Strathern, “‘Improving ratings’: audit in the British University system,” European Review 5(3) (1997). When a measure becomes a target it ceases to be a good measure — the public name for class 3.