Home

07 Lecture 7 Quiz: The System Around the Model

June 2026 (6298 Words, 35 Minutes)

quiz orchestration context-window claude-md tool-calls mcp

New: Interactive Quiz Available!

Want to track your progress and get instant feedback? Try our new interactive version with progress tracking, immediate explanations, and score calculation.

Start Interactive Quiz →

Instructions

This quiz tests your understanding of key concepts from Lecture 7
Each question has 4 options with exactly one correct answer
Try to answer without referring to the lecture materials
Focus on understanding concepts, not memorizing details

The quiz follows the lecture’s arc: Block A — the orchestration layer and the token sequence (the two boxes, what the model actually sees, how files become tokens, the illusion of memory, mid-conversation edits) in Questions 1–10; and Block B — the system that acts and the bridge to engineering (skills, the tool-call loop, MCP, the context budget, the completed three-layer model, and the closed Mystery Board) in Questions 11–20.

Question 1: The Two Boxes

A student notices Claude Code failed to read a config file that was sitting right there in the project. According to the lecture’s “which box did that?” diagnostic, why is writing a more emphatic prompt the wrong fix?

A) The prompt was probably too long, so the model’s attention was diluted and the file’s tokens lost the competition for attention
B) A failure to load a file is an outer-box (wrapper) event governed by rules and file paths, so it cannot be repaired by changing the tokens the model receives
C) The model decided the file was irrelevant, and a sterner instruction is needed to override that decision
D) Config files are never injected as tokens, so no prompt could ever make the model aware of them

Show Answer

Correct Answer: B

The lecture’s diagnostic sorts every behaviour into exactly one bin: a file that got loaded or didn’t is an outer-box event, governed by rules, file paths, and parsing, while distributions and attention are inner-box. A prompt changes only the tokens going into the model, so it cannot touch a wrapper rule that decides which files to splice in. The most tempting wrong answer is A, because attention dilution is real, but the lecture explicitly classes “a file that got loaded or didn’t” as the outer box, not the inner box where attention lives. C reflects the persona misconception that “the model decides,” which the lecture rejects since the model does not even know what files exist; D is simply false, because the wrapper does inject loaded file contents as tokens. The lecture names exactly this case as the most common failure mode: people write ever-more-elaborate prompts to fix orchestration problems.

Question 2: Two Systems, One Illusion

The lecture says nearly every user’s mental model is “wrong in the same direction.” What produces that systematic, one-directional error?

A) The chat window presents a single persona, so every capability that surfaces gets credited to the model and the wrapper becomes invisible
B) The model genuinely has memory and file access, so users correctly attribute those abilities to it
C) The orchestration layer is too complex for users to reason about, so they default to crediting the model
D) Marketing overstates the model’s abilities, so users inherit an inflated view from the vendor’s claims

Show Answer

Correct Answer: A

The lecture pins the error on interface design: a chat window shows one name, one voice, one assistant, so every capability that appears in the conversation is attributed to that persona, and the wrapper, where most engineering decisions live, becomes invisible. The most tempting wrong answer is B, but the lecture is emphatic that the model is passive and persists nothing, so the memory and file access actually live in the wrapper, not the model. C inverts the lecture’s claim, which insists the orchestration layer is simple, ordinary code a developer reads in an afternoon, not too complex to reason about. D introduces marketing, a cause the lecture never mentions; it locates the error squarely in the single-persona UI, a choice it calls deliberate and reasonable but also the reason mental models err in the same direction.

Question 3: Statelessness and the KV Cache

A student argues that the KV cache lets the orchestration layer skip re-sending earlier turns, since the model already cached them. According to the lecture, why is this wrong?

A) The cache only stores the system prompt, so everything after it still has to be re-sent on every call while the system prompt is skipped
B) The KV cache persists between calls as a session object, so the earlier turns genuinely no longer need to be sent after the first call
C) The KV cache saves recomputation within one generation; it changes what must be recomputed, not what must be sent, and the model is stateless so the entire sequence is re-sent on every call
D) The model remembers the earlier turns from the previous call, so re-sending them is a redundant safety measure the orchestration layer could drop

Show Answer

Correct Answer: C

The lecture pins the KV cache down precisely: it saves recomputation within one generation, changing what must be recomputed, not what must be sent, while the model itself is stateless and the whole sequence is re-sent in full on every call. D is the most tempting distractor because it restates the common belief that the model “remembers,” but the lecture insists nothing persists between calls and continuity lives in the sequence, not the model. B wrongly turns the cache into a persistent session object, the exact thing the lecture says does not exist, and A invents a system-prompt-only cache the lecture never describes.

Question 4: The Instruction Channel

Why does the lecture say that, structurally, [system], the CLAUDE.md block, and your typed question are “the same kind of thing”?

A) All three blocks are written by the same author and therefore carry identical authority inside the model
B) The architecture contains a dedicated instruction channel that the orchestration layer routes the system prompt and CLAUDE.md through, keeping them separate from the question
C) The model reads the role labels as metadata attached around each block and uses that metadata to decide how strictly to obey each one
D) There is no instruction channel; role labels are themselves tokens in the sequence, and [system] is weighted heavily only because post-training taught the model to, not because the architecture enforces it

Show Answer

Correct Answer: D

The lecture states there is no instruction channel anywhere: the only structural marking the model gets is the role labels, and a label like [system] is influential not because the architecture enforces it but because post-training taught the model to weight those turns heavily; strip that learned preference and all three are just text in a sequence. The most tempting wrong answer is C, because it sounds like the labels still do something special, but the lecture is explicit that labels are rendered as special tokens the model reads, not metadata around the text. B invents a dedicated channel the lecture says does not exist, and A substitutes authorship for the actual mechanism, which is learned weighting, not who wrote the block.

Question 5: How CLAUDE.md Becomes Tokens

When a session runs, what determines which CLAUDE.md files end up in the message array, and why does the lecture call this property a feature rather than a limitation?

A) The model inspects the task and asks the orchestration layer for the instruction files it judges relevant; this keeps the context lean.
B) The orchestration layer decides by mechanical rules (directory traversal and tool-call triggers); because the model never chooses, you can predict and audit exactly which files loaded without running any model.
C) The model loads files on its own during generation, and the dumbness of that process is what makes the system fast.
D) Whichever files were attended to most strongly in the previous session are reloaded, so the system learns which conventions matter.

Show Answer

Correct Answer: B

The lecture states plainly that the neural network does not decide which instruction files to load — it cannot ask for more context; the orchestration layer decides by rules as dumb as directory traversal. This mechanical dumbness is a feature because you can know, exactly and without running any model, which files entered a session: list the ancestors of the working directory and the subdirectories the tools touched. A is the most tempting wrong answer because it sounds like sensible engineering, but the lecture is emphatic that the model cannot ask for context and the closest it comes is indirect (a tool call it emitted asking for a file, not for the conventions). C wrongly says the model loads files and misattributes the benefit to speed rather than auditability. D invents a memory/learning mechanism the lecture never describes — the rules are stateless if-statements over a directory tree.

Question 6: Never Loaded vs Loaded but Outcompeted

A convention written in tests/CLAUDE.md had no effect on a session that never went near the tests directory. According to the lecture, what went wrong and what is the correct fix?

A) The tokens were loaded but outcompeted by attention dilution and context drift; the fix is to shorten the file and front-load the critical rules.
B) Neither rule fired, so the file’s tokens were never in the sequence at all; the fix is to move the file up the tree or start the session where the walk will find it.
C) The file was loaded at start-up but silently overwritten when a newer version appeared on disk; the fix is to keep the file unchanged during the session.
D) The model read the conventions but chose to ignore them; the fix is to phrase the rules more sternly so the model takes them seriously.

Show Answer

Correct Answer: B

Because the session never started in or below tests/ and no tool call touched that subtree, neither rule one (the start-up ancestor walk) nor rule two (on-demand injection) fired — so the file’s tokens were never in the array. The lecture is explicit that such a convention “is not weakly attended; it is absent,” and the orchestration-layer fix is to move the file up the tree or start where the walk will find it. A is the most tempting wrong answer because it names a real failure mode, but “loaded but outcompeted” requires the tokens to already be in the sequence — here they never arrived, so its fix (shorten, front-load) addresses the wrong half of the system. C invents an overwrite story that belongs to a different chapter and is not what happened. D assumes the model has agency to read and ignore, but the conventions were never delivered, so no sterner phrasing could help.

Question 7: The Illusion of Memory

A model recalls your pytest preference in a fresh session a week later. Where did that preference actually persist between the two conversations?

A) In a memory file on disk, which the orchestration layer injected as tokens at the start of the second session before you typed anything
B) In the model’s weights, which were updated by your first conversation and carried the preference forward
C) In a hidden state the model maintains between sessions, similar to the KV cache, where knowledge accumulates over time
D) In the model’s long-term memory, which it consults directly at the start of each new conversation

Show Answer

Correct Answer: A

The lecture resolves the pytest anecdote entirely through the five-step loop: in the first session the model wrote a memory file recording the preference, and at the start of the second the orchestration layer injected that file’s tokens before any user input, so attention did the rest. Persistence lives on disk, not in the model; each conversation starts with a model that has never met you. The most tempting wrong answer is B: it feels like learning, but the weights were frozen when training ended and nothing you say changes them. C is wrong because the KV cache is only a compute-saving copy derivable from the current sequence, not an accumulator across sessions, and D is wrong because the model never reaches for these files at all — the orchestration layer reads them, by rule.

Question 8: Memories Born Wrong

A model writes a memory file claiming “team decided to adopt httpx” when the conversation only discussed the option. Why is this worse than the same hallucination appearing in ordinary chat?

A) The orchestration layer checks memory files against the codebase, so a false memory blocks the session until reconciled
B) Writing to a file uses a different, less reliable mechanism than generating chat, so file writes hallucinate more often
C) Once written to disk, the model treats the memory as a verified fact and can no longer be corrected by a sterner prompt
D) The hallucinated memory is re-injected into every future session until someone deletes it, while a chat hallucination just scrolls away

Show Answer

Correct Answer: D

The lecture’s whole point about memories born wrong is persistence: the model hallucinates in writing exactly as it hallucinates in chat, but a chat hallucination scrolls away while a hallucinated memory is re-injected into every future conversation until someone deletes it. The most tempting wrong answer is B, but the lecture stresses the opposite — memory files are written with the same sampling machinery as everything else, so the file-write path is no more error-prone, only more durable. C invents a special authority the lecture never grants; a memory only wears the authority of an instruction by virtue of its early position, it does not become uncorrectable. A is the inverse of the stated reality: nothing verifies a memory against the codebase, which is exactly why the danger exists.

Question 9: No Overwrite, Only Accumulation

You edit a stale rule in CLAUDE.md mid-session, save the file, and ask the assistant to re-read it — yet it still intermittently follows the old rule. What has actually happened inside the sequence?

A) The model deliberately chose to keep following v1 because it judged the original rule more authoritative than your edit
B) Saving the file overwrote v1 in the model’s context with v2, but the change has not yet propagated to the attention layers
C) The corrected file (v2) was appended as a tool result while the original (v1) still sits near the top, so both versions are now in context and attended over
D) Re-reading replaced v1 with v2 in the sequence, but cached output from earlier turns reintroduced the old rule

Show Answer

Correct Answer: C

The lecture’s central point is that a token sequence only grows: editing the file on disk does not touch the sequence, and the only thing re-reading can do with the fresh contents is append them, so v2 lands far down (~position 10,500) as a tool result while v1 remains at its original early position (~500). Both copies then draw attention at every step, and the per-token sampled outcome produces intermittent compliance. B is the most tempting wrong answer because it matches a programmer’s state-machine intuition that a save is a destructive overwrite — but the lecture stresses “there is no overwrite in a token sequence, only accumulation,” and nothing in the context was replaced. A wrongly attributes agency and judgment to the model, when the lecture frames the behaviour as softmax arithmetic over two genuinely-present rules, not defiance. D invents a replacement-plus-cache mechanism the lecture never describes; the old rule persists because its tokens were never removed, not because anything was cached back in.

Question 10: Why the Layer Appends Instead of Deleting

The message array belongs to the orchestration layer, not the model, so it could in principle delete the obsolete v1 tokens once v2 arrives. Why does the lecture say mainstream layers append instead of doing this surgery?

A) Tokens in the array carry strictly increasing position indices, so removing one would leave a numbering gap the model cannot decode, forcing append-only writes
B) The orchestration layer has no write access to positions already sent to the model, so it can only add new tokens at the end
C) Deleting v1 would require restarting the conversation, which is the only operation that can remove tokens from the sequence
D) Surgically editing the array would break the KV-cache prefix for everything after the edit and rewrite a history the model already conditioned its earlier replies on

Show Answer

Correct Answer: D

The lecture gives exactly two concrete costs of mid-array surgery: it invalidates the cached KV prefix for every position after the edit, and it silently rewrites a history the model’s own intermediate outputs were conditioned on — ten turns of v1-compliant work. D names both, so layers append and only append. B is the most tempting distractor because it sounds like a hard mechanical limit, but the lecture explicitly says the array “is its data structure, not the model’s,” so the layer does have write access — lack of access is not the obstacle, the two costs are. A invents a position-numbering decode failure the lecture never mentions; the obstacle is cache invalidation and falsified history, not an index gap. C is wrong because a restart builds a fresh sequence rather than deleting tokens from the existing one, and the lecture frames restart as the clean resolution, not as the reason deletion is avoided.

Question 11: Skills — Context on Demand

The lecture calls a skill’s injection position a “quiet mechanistic gift.” Why does a skill land in a better attention region than CLAUDE.md, even though both become ordinary [user] tokens?

A) A skill’s tokens are physically smaller, so more of them fit inside the recency-advantaged region near the query
B) A skill is marked with a special priority channel that the model’s attention weights are trained to favor over normal context
C) A skill is injected at the point of invocation, near the end of the current sequence and close to the query, while CLAUDE.md is loaded at the top and drifts toward the lost-in-the-middle region as the session grows
D) The model itself chooses to re-read the skill at the end of the sequence, refreshing it into the recency region on every turn

Show Answer

Correct Answer: C

The advantage is purely positional: a skill is spliced in at the moment it is invoked, so it arrives near the end of the sequence beside the current query, exactly the recency-advantaged region, whereas CLAUDE.md loads at the top and drifts toward the lost-in-the-middle zone as the conversation grows. B is the most tempting wrong answer, but the lecture is emphatic that there is no special channel, a skill’s body is plain [user]-side tokens the model cannot distinguish from a typed prompt, so no trained priority is involved. A invents a token-size mechanism the lecture never states; position, not size, is what matters. D wrongly gives the model agency, but the orchestration layer, not the model, decides when and where to inject, and the model never reaches for files.

Question 12: The Tool-Call Loop

When a Claude Code agent reads a file or runs a test during a task, what has the model itself actually done?

A) It emitted special tool-call tokens through the same forward pass and sampling as any other token; the orchestration layer intercepted them and did the reading or running.
B) It invoked a separate action circuit that bypasses the normal token pipeline to perform file and process I/O directly.
C) It called a hidden API built into its weights that lets it reach the filesystem when a task requires grounding.
D) It paused token generation and handed control to the user, who performed the read or test and pasted the result back.

Show Answer

Correct Answer: A

The lecture is explicit that the model’s entire contribution is tokens: a tool call is produced “exactly like every other token,” with a full forward pass, logits, softmax, and the sampling pipeline, and the orchestration layer is what intercepts those tokens and executes the actual read or run. The most tempting wrong answer is B, because an agent’s behaviour feels like direct action, but the lecture insists there is “no separate action circuit and no hidden API” and “the model has no hands.” C fails for the same reason and adds the false idea of a built-in API. D describes the old well-fed-autocomplete world the chapter opens by rejecting, where the human carries out the changes by hand.

Question 13: MCP and the Security Boundary

A model emits a destructive tool call because an attacker buried an instruction in a web page it just read. According to the lecture, what is the correct defense, and why?

A) A narrower tool surface with scoped permissions, schema validation, and a human gate, because what a system can do is set by its tool surface, not its intelligence — and the model is just completing the most plausible continuation, not malfunctioning.
B) A sterner CLAUDE.md that explicitly forbids destructive actions, because clear written rules at the top of context constrain what the model is allowed to emit.
C) A more capable model, because a smarter model would recognise the buried instruction as adversarial and refuse to act on it.
D) Removing the web page from context after reading it, because once the malicious tokens are gone the model can no longer be steered by them.

Show Answer

Correct Answer: A

The lecture’s load-bearing sentence is that what an AI system can actually do is determined by its tool surface, not its intelligence, so the defense is never a sterner CLAUDE.md but a narrower tool surface, scoped permissions, schema validation on every call, and a human gate in front of anything irreversible — enforcement at the interface, not influence in the prompt. B is the single most tempting wrong option because students reach for a written rule, but the lecture explicitly rules it out: for adversarial inputs the influence layer is assumed defeated, and the model that emits the call is completing the most plausible continuation, not breaking a rule it could be told to follow. C fails because more intelligence does not shrink the tool surface and the model is not malfunctioning, and D fails because the harm is the tool surface that lets a plausible continuation execute, regardless of which tokens triggered it.

Question 14: The Context Budget

The lecture says fitting a token into the window is necessary but not sufficient. What is the “real currency” it identifies, and why?

A) Being short — because a token that occupies fewer characters leaves more room for the response and is therefore prioritised
B) Being recent — because the model weights the most recently added tokens far more heavily than older ones by design
C) Being in the system prompt — because the vendor’s portion of the window is processed before anything the user contributes
D) Being attended to — because fitting in is binary, but attention is shaped: for each head and query position the softmax weights sum to one and concentrate on whatever the model has learned to score highly, so tokens that matter can be passed over in favour of tokens that merely arrived

Show Answer

Correct Answer: D

The lecture distinguishes two things: fitting in the window is binary (you are in or out), but being attended to is shaped by the learned scores — per head and per query position the softmax weights sum to one, so adding low-value tokens can pull weight away from the ones that matter, though a token the model scores highly keeps most of its attention regardless of context length. The most tempting wrong answer is B: recency does correlate with surviving eviction (keep-recent-N), but the lecture frames the currency as attention, not position, and never claims the model weights recent tokens more by design. C names a real fact (the vendor takes its share first) but that is about who controls the budget, not what the real currency is, and A invents a length-based prioritisation the lecture never states.

Question 15: Why the Window Is Finite

The lecture insists the context-window maximum is a declared limit, not something forced by the transformer’s math. Which set of reasons does it actually give for why the number must be declared?

A) The vocabulary runs out of distinct tokens, the softmax loses numerical precision, and the embedding table cannot index further
B) Matrix multiplication becomes undefined past a certain sequence length, the feed-forward network saturates, and the residual stream overflows at long context
C) Positional encoding only covers trained positions, attention’s quadratic N×N cost caps the training length, and the KV cache grows with every token and must fit in accelerator memory
D) Vendors cap the window for commercial reasons, then justify it after the fact with positional encoding and attention cost

Show Answer

Correct Answer: C

The lecture is explicit that nothing in the arithmetic imposes a ceiling — attention multiplies a sequence of any length — so three external constraints force the declaration: the position table or formula was only trained up to some length, the quadratic N×N attention cost holds that training length down, and the KV cache grows per token and must fit in accelerator memory. B is the tempting trap because it sounds mechanistic, but the lecture says the opposite: every matrix multiplication stays perfectly defined on longer sequences. A invents failures the lecture never mentions, and D contradicts the lecture’s framing that the number genuinely reflects “trained, affordable, and supported up to here,” not a commercial cap dressed up afterward.

Question 16: When the Window Fills

A long session “forgets” a decision made forty turns ago. According to the lecture, what most likely happened?

A) The decision was overwritten in the model’s weights as newer information arrived and displaced the older parameters
B) The orchestration layer evicted it when the window filled — a system decision about what arrives in the sequence, not a memory failure inside the weights
C) The model chose to drop it because it judged the detail no longer relevant to the current turn
D) The token was corrupted in the KV cache and silently dropped during a later attention pass

Show Answer

Correct Answer: B

The lecture states plainly that when a session feels like the model “forgot,” what usually happened is the orchestration layer evicted the information — via sliding window, keep-recent-N, or lossy summarisation — and that eviction is a system decision, not a memory failure inside the weights. C is the most tempting wrong answer because it sounds like the same outcome, but the lecture is emphatic that the in-session model is never consulted: it is stateless and simply processes whatever sequence arrives, so deciding what arrives is the active layer’s job, never the model’s. A misdescribes the mechanism entirely — nothing is written to or overwritten in the frozen weights during a conversation — and D invents a cache-corruption failure the lecture never claims.

Question 17: The Enforcement Layer

A ruff check fails inside a tool call and its violation list is sent back to the model. According to Chapter 11, why is this same failing check described as enforcement on the way out but influence on the way back in?

A) The check is deterministic when it runs and gates the merge, but once its nonzero exit code returns as tokens in the sequence it only conditions the next forward pass like any other tokens
B) The check starts deterministic but the model overrides its verdict, so on the way back it has been downgraded to a mere suggestion the model may ignore
C) The check is influence first because the prompt requested it, then becomes enforcement once the orchestration layer confirms the exit code
D) The violation list is rewritten by the influence layer into a softer instruction before it re-enters the model, changing its category

Show Answer

Correct Answer: A

The lecture states the enforcement layer is two things at once: a gate that can refuse to merge (deterministic on the way out) and a feedback signal whose nonzero exit code and violation list come back as tokens that condition the next forward pass like any other tokens (influence on the way back in). B is the most tempting wrong answer, but the lecture never says the model overrides the verdict; the check’s determinism as a gate is unchanged, only its role shifts because tool results are tokens. C inverts the order the lecture gives, and the category does not depend on the prompt requesting it. D invents a rewriting step the lecture never mentions; the same violation tokens re-enter unchanged.

Question 18: Influence vs Enforcement

Chapter 11 says a better-engineered instruction file narrows the distribution but cannot guarantee an outcome. What does the lecture conclude must therefore be done to get determinism?

A) Determinism is achieved by loading the rules first so the lost-in-the-middle effect cannot weaken them during sampling
B) A sufficiently specific and well-ordered instruction file eventually peaks the distribution enough that the outcome becomes effectively guaranteed
C) Determinism has to be bolted on from outside the model by the enforcement layer, because generation always ends in a sample from a distribution that no instruction rewrite can change to guaranteed
D) The model can be trained to treat certain instruction tokens as commands rather than influence, making their outcome deterministic

Show Answer

Correct Answer: C

The lecture states determinism cannot be prompted into the model and has to be bolted on from outside, because generation ends in a sample from a distribution and no instruction-file rewrite changes that final step from probable to guaranteed; only the enforcement layer truncates the distribution. B is the trap for a student who thinks better prompting eventually crosses into certainty, but the lecture is explicit that the influence layer is probabilistic by nature, not by implementation flaw. A describes a real influence-layer technique (ordering plus lost-in-the-middle) that still only narrows, never truncates. D contradicts the lecture’s claim that instruction tokens and question tokens are the same kind of thing with no special command channel.

Question 19: Mystery Board Closure

Mystery 8 asks why two tools, given the same faithfully-written instructions and the same model family, behave differently. What is the single underlying mechanism the lecture says resolves it?

A) Each tool ships a differently fine-tuned variant of the model, so the weights themselves differ between tools
B) Under different orchestration the same weights are processing different token sequences, and the sequence is the model’s only input
C) One tool’s model has read your instruction file in a previous session and remembers it, while the other’s has not
D) The orchestration layer in the more compliant tool sends the model a sterner, better-phrased version of your instructions

Show Answer

Correct Answer: B

The lecture decomposes the divergence into four bookkeeping differences (which files are read, [system] vs [user] placement, loading point, and surrounding context), but they all collapse to one mechanism: the same model under different orchestration is mechanically processing different token sequences, and since Lecture 5 you have known the token sequence is the only input the model has — “same weights, different wrapper, different token sequence, different behaviour.” The most tempting wrong answer is A: the lecture stresses it is the same weights and even the same model family, with the wrapper, not the weights, accounting for the difference. C imports the illusion of memory the lecture explicitly debunks — a tool that does not read your file behaves as if the instructions were never written, with no cross-session recall. D invents a paraphrasing step the lecture never describes; placement and loading change where tokens land, not their wording.

Question 20: The Bridge to Act 3

The lecture says the course’s question changes between Act 2 and Act 3. What is the essential difference between the two questions?

A) Act 2 was about explanation and is now closed; Act 3 abandons mechanism entirely and works purely from measured numbers
B) Act 2 explained a system that no longer behaves the same way; Act 3 studies a newer system whose mechanisms have changed
C) Act 2 left some Act 1 mysteries appealing to magic; Act 3 finally supplies the missing mechanisms for those open behaviours
D) Act 2’s question is finished once the mechanism is named; Act 3’s engineering question is never finished that way, because reliable work must be built and measured on top of the mechanism

Show Answer

Correct Answer: D

The lecture frames it precisely: Act 2 asked “why does the system behave this way?” — explanation, which is finished the moment the mechanism is named — while Act 3 asks “how do we engineer reliable software work on top of that behaviour?”, and engineering is never finished that way, because it wants budgets turned into policy, “usually” backed by “always,” and observations upgraded to measurements. The most tempting wrong answer is B, but the lecture is emphatic that nothing about the system changes between this week and next: tokenisation still hides characters, attention still dilutes, the sequence still only grows — only the question changes. C is wrong because the board comes down with eleven mechanisms and zero appeals to magic; no behaviour mystery is left for Act 3 to explain. A overshoots: Act 3 does not discard mechanism — it tells you to bring today’s vocabulary along, because the system around the model does not stop mattering once someone starts measuring.

Scoring Guide

18-20 correct: Excellent! You can keep the model and its wrapper cleanly separate, and route every behaviour to the layer that actually produced it
14-17 correct: Good understanding! Review the areas you missed
10-13 correct: Fair understanding. Revisit the lecture materials for key concepts
Below 10: Please review the lecture carefully and reach out if you need clarification

Key Takeaways to Remember

The model is powerful but passive; the orchestration layer is simple but active — every capability you cannot find in the forward pass (reading files, persisting, running tests) lives in the wrapper, and the wrapper is ordinary code, an if statement, not a neural network
“Which box did that?” is your diagnostic — a strange word choice or half-followed instruction is the inner box (distributions, attention); a file that did or didn’t load, a “memory,” a command that ran is the outer box (rules, paths, parsing) — fixing one with the other’s tools is the most common mistake
The model only ever sees one flat token sequence — there is no instruction channel; [system], CLAUDE.md, memories, and your question are the same kind of thing, and role labels are themselves tokens, influential only because post-training taught the model to weight them
The sequence only grows, and the whole thing is re-sent on every call — the model is stateless; continuity lives in the sequence, not the model, and the KV cache changes what must be recomputed, not what must be sent
One visible response is often many API calls — each file read or command appends a tool result and triggers a fresh call, which is why long sessions get heavier and slower
CLAUDE.md loads by two dumb rules — rule one walks up the directory tree at session start; rule two splices a subdirectory file on demand when a tool reads that subtree. The model never chooses; the dumbness is what makes the system auditable
“Never loaded” and “loaded but outcompeted” are different failures with different fixes — a convention in the wrong directory is absent, not weakly attended; move the file, don’t reword it
Memory is a read-write loop mediated by the filesystem — persistence is files on disk, not state in the model; each conversation starts with a model that has never met you
CLAUDE.md and MEMORY.md are the same transport, opposite provenance — human-written/shared/reviewed vs model-written/per-user/unverified; treat memories as soft context and verify load-bearing facts against the repo
There is no overwrite in a token sequence, only accumulation — editing CLAUDE.md mid-session appends v2 while v1 still votes; the only true overwrite is a new conversation
A skill is a codified prompt pattern, loaded on demand — zero tokens until triggered, and it lands beside the query in the recency-advantaged region, while CLAUDE.md drifts toward the middle; anything relevant to one task type is a skill waiting to be extracted
A tool call is just tokens — the model has no hands and no action circuit; it emits a tool-call pattern, the orchestration layer intercepts and executes it, and the result returns as [user] tokens (act–observe–act)
MCP turns N×M bespoke adapters into N+M — the standard lives entirely in the orchestration layer; to the model an MCP tool is indistinguishable from a native one, and every connected server is an always-on token charge
What a system can do is set by its tool surface, not its intelligence — wiring a tool is a security decision; against adversarial input assume the influence layer is defeated, so the defense is a narrower tool surface, never a sterner CLAUDE.md
Everything competes for one finite window — being in the window is necessary; being attended to is what actually matters, and per head/position the softmax weights sum to one, so low-value tokens can pull weight away from the ones that matter (a high-scored token still keeps most of its attention). The window is a declared limit (trained positions, quadratic attention cost, the KV cache), not something the math forces
The three-layer model, now derived — anything entering the sequence is influence (probabilistic, narrows the distribution); determinism must be bolted on from outside as enforcement (truncates it); the human judges what “right” means and owns the wrapper. Same weights, different wrapper, different sequence, different behaviour — no magic, and there never was