When an expert corrects an LLM assistant's error, the correction usually dies with the session, and the error class returns. I argue this is an operations problem, not a tooling problem: mechanisms for persisting corrections exist and are shipping, but the discipline for governing them -- versioning with provenance, recurrence monitoring, counter-metrics, retirement of stale rules -- does not. Writing as a systems engineer of thirty years, I map the LLM stack onto the machines my profession already operates (frozen silicon, firmware, loadable modules, persistent configuration, volatile memory), identify where the mapping fails (stochastic generation, configuration that binds only probabilistically, no general-purpose retirement (verification) stage by default), and derive from the failures a seven-principle operating discipline with an error loop at its core. Three cases from my own practice illustrate the mechanism, among them a control that silently became the exact harm it was built to prevent. I close with the measurement framework this view implies and the lab study required to test it.
Figures & tables
Figure 1: Every session is a cold boot. The context window assembles in layers that correspond, one for one, to a boot sequence; capability written only into the volatile layer does not survive it.
Systems world
LLM world
Die / fab
Model weights / training
ROM; firmware build date
Parametric knowledge; knowledge cutoff
UEFI settings
System prompt
Loadable kernel modules
Skills / instruction files
/etc , sysctl.conf
Rules files, memory, versioned skills
RAM / reboot
Context window / new session
Table 1: The operator’s mapping: layers of a machine a systems engineer already runs, and their counterparts in the LLM stack.
Figure 2: The hierarchy of controls. Prefer the strongest layer that can hold a given guarantee; spend the probabilistic budget only on what cannot be typed or tested. A guarantee held only in prose is unenforced.
Figure 3: The write-back path. The loop is closed only when step 5 completes: an artifact that the next cold boot will load. Steps 1–4 without step 5 are a conversation.