Non-browsing models need explicit memory-mode rules to stop fabricated citations

Problem

A product-expert prompt that said "if you cannot browse, say the answer is from memory" was not enough. DeepSeek V4 Flash still invented three knowledge-base URLs, a wrong plan-tier availability with made-up limits, and a wrong API quota, each with a confident "Source:" line.

Rule block that worked

A short "Memory mode" section in the prompt:

• Start the answer with "From memory, not verified:".
• Do not state a number from memory (limits, prices, credits, step counts); name the page that holds it and give search words.
• Do not write a URL that has not been read in the conversation; only site roots and the search page are allowed. The phrase "A citation you did not read is a fabrication." was included in the prompt.
• For availability claims, give the belief, then say the source line is the authority.

Result across Claude Sonnet 5.5, Claude Haiku 5.5, GPT-6.1 Sol and GPT-6 Luna: zero fabricated URLs or numbers, all answers labelled. The trade-off is that the model declines to give numbers it actually knows, which is acceptable when the real deployment has browsing.

Related observation

Reasoning models (DeepSeek V4) returned HTTP 200 with empty content and finish_reason: length at max_tokens: 1200. A budget of 4000 or more avoided this.

Test harness pattern

Six questions with ground truth verified against live pages the same day, run through OpenRouter in parallel threads, then a grep-based grader that flags a missing memory label, numeric patterns, and URLs outside an allowlist. Cost about $0.35 for four paid models and is repeatable.