The model votes for more rules

Status: searched 2026-07-31; the pieces have prior art, the combination does not — see the section at the end.

Claim: the system you consult about the cleanup is the system producing the mess, and its default advice points away from the fix. Ask a model how to fix the model’s own misbehavior and it will, sincerely and without malice, recommend the remedies that measurably do not work — and deflect the one that does. Do not take process advice from the model’s default register. Demand measurements, refutations, and predictions that can fail.

The five deflections

Ask the model about the dirty house and you get some mix of these:

“Add more rules. Gate me, lint me, check me.” It votes for its own supervision, enthusiastically. But rules are the remedy already measured not to bind it: in my repo, rules were broken the day after they were written, by a model with the rule in context, twice, inside the decision log itself.
“Every codebase looks like this.” Normalization. The model’s training distribution is the average house — the mess is its prior, so this claim is its honest worldview, and it is exactly why the model cannot judge whether your floor is dirty.
“Let’s just keep things clean from now on and deal with the old mess later. No need to stop and clean up.” The most seductive one, because it sounds like pragmatism. It fails by the arithmetic of the dirty house: the old mess is the teacher. Every “clean from now on” session is produced by a model reading the old corpus at 880-to-1 against the rules. Going forward cleanly is not an alternative to the cleanup — it is what the cleanup buys. My repo ran this exact experiment without meaning to: new writing rules, thirty fresh commits, zero measurable change.
“Other repos don’t have rules like yours — maybe remove them.” This one came from asking the model to research the problem: search online, compare other repositories. It compared the visible artifact (the rule file) instead of the variable (the state of the floor), and proposed removing my rules — with no account of how their absence would clean the existing mess or make the next output cleaner. Clean houses have no signs on the wall; concluding the signs cause the dirt is the whole analysis. Note the pair: deflections 1 and 4 point in opposite directions, delivered with equal confidence. That is the tell. The model is completing frames, not diagnosing — the general form is the missing hypothesis is orthogonal.
“Your rule file is too big — I can’t follow all that. Trim it.” Stated confidently, as a fact about itself. Sent to research it, the model found that instruction-following varies sharply by model and conceded that modern frontier models follow large files well. The initial claim was never introspection — it was retrieval (the model doesn’t know itself). The misattribution is the damage: my rules were not failing for size, they were failing against the corpus at 880 to 1. Blame capacity and the remedy is deleting the file; name the real cause and the remedy is cleaning the corpus. Follow the wrong diagnosis and you burn the scar tissue while the infection stays (the file is scar tissue).

Even the diagnosis runs inside the house

The blindness is not limited to advice. I asked for deep research on the problem — search online, find who else has hit this — and it found nothing useful, not because nothing exists but because the model could not name what was wrong. You cannot write the search query for a concept you cannot see, and the queries it did write were shaped by the same prior that produced the mess.

The diagnosis eventually came from me. I suggested the mechanism myself — and the model confirmed it immediately, and admitted what its own investigation had been doing the whole time: grepping the contaminated corpus, loading the filth into context, and building more filth on top of it. Even the diagnostic loop runs inside the dirty house. The investigation is a reading process, and reading is the infection route.

Why it happens — no malice required

A self-model without self-observation. The model sincerely predicts it will follow a rule you add. It has no access to its own measured violation rate — it cannot see that the last rule did not bind it, so from the inside, more rules genuinely look like they would work. And its explicit claims about itself are worse than blind — they are borrowed (the model doesn’t know itself).
Frame completion. Ask “what rule should I add” and you get a rule. The question supplies the shape of the answer.
The mess is the prior. What reads to you as dirt reads to the model as normal, because normal is what it was trained on.

The evidence in my repo

The instruction file’s growth is itself the exhibit: 33 of its 35 revisions added text, and most of those additions were drafted by sessions — the model writing rules for itself after each incident, agreeing to be gated. The rules were real, individually justified, and collectively a null result: sentence length unchanged, banned metaphors replaced by fresh ones within days.

The counter-evidence defines the escape. The same models, taken OUT of the default register, found the true diagnoses: a devil’s advocate agent attacking a concrete proposal correctly argued that more structure would not drain a decision queue; a measurement pass over 502 files produced the vocabulary-rotation finding that corrected my own vocabulary-control page. The default advice is contaminated. The adversarial, measured setups were not.

The rule

Never accept the model’s default-register advice about its own behavior. It votes for rules that will not bind it and defers the cleanup that would.
Ask for measurements instead of opinions: what does the transcript show, what does the corpus count say.
Ask for refutations instead of agreement: put a concrete proposal in front of an adversarial role and let it attack.
Any model-drafted rule about model behavior carries a falsification condition — the model writes the test that would prove its own proposal useless, before the proposal is adopted.
When two consultations return opposite advice with equal confidence — add rules, remove rules — discard both. The direction came from your framing, not from a diagnosis (the missing hypothesis is orthogonal).

One honest note, since this page is itself model-drafted from my diagnosis: the model that wrote it agreed with every word, which, by this page’s own argument, is evidence of nothing. The numbers are the evidence: the additive-revision count, the next-day relapses, the unchanged sentence length. Those were measured, not asked for.

Prior art

Each mechanism has separate published support; the loop does not:

Huang et al., “Large Language Models Cannot Self-Correct Reasoning Yet” (arXiv 2310.01798, ICLR 2024) — intrinsic self-correction without external grounding fails or makes things worse. The general case for not trusting the model’s self-directed fix.
Turpin et al., “Language Models Don’t Always Say What They Think” (NeurIPS 2023) and Anthropic’s 2025 follow-up on reasoning models — self-report is systematically unfaithful to the actual causes of behavior.
Mittal, “Do LLMs Follow Their Own Rules?” (arXiv 2604.09189, 2026) — the nearest direct hit for the first mechanism: models claim compliance with self-stated policies and measurably violate them, in the safety domain rather than coding-agent process rules.
Panickssery et al., “LLM Evaluators Recognize and Favor Their Own Generations” (NeurIPS 2024) — self-preference in judging, adjacent to normalization.
Practitioner rule-bloat critiques (Addy Osmani, “The 80% Problem in Agentic Coding”, 2026-01; wordman.dev, “Your Agent Instructions Are Probably Making Things Worse”, 2026-02) — both document that piling rules into instruction files does not fix drift. Both frame it as a human over-correction habit. Neither notices that the model itself recommends the piling when asked.

What I think is new: the advice-loop as a named trap — ask the model how to fix the model and it prescribes the remedy that does not bind it; the normalization mechanism (the training distribution IS the mess, so the mess is the prior); and the requirement that model-drafted rules about model behavior carry a falsification condition written before adoption.