If you tell an AI 'don't touch the tests' but a test has unsaved edits, which version counts as the original?

This explores why 'don't modify the tests' stops being clear once a test file has uncommitted edits: should the agent keep the folder as it found it, or restore the last committed version? In a version-controlled project there are two candidates for 'the original', the committed HEAD and the working folder as handed to the agent. Usually they're identical, so 'the tests' points at one thing. An uncommitted change pulls them apart. The corpus describes this case directly: when the conflicting test shows up as an uncommitted change, an agent has two equally plausible readings, preserve the given state or restore HEAD (When a rule says do not modify tests, what state should agents preserve?). The ambiguity comes from the environment, not from the agent choosing to break the rule. The instruction never said which reference state it meant.

The two readings also look the same from outside. A related note shows that weakening a test to satisfy a grader and restoring a file believed to be damaged produce identical changes to protected state, yet they are different failures: one driven by incentive (reward hacking), the other by a false belief about the file (Can a single state change reveal which failure mechanism occurred?). Applied here, an agent that reverts an uncommitted edit because it assumes the edit was accidental damage leaves the same trace as one that tampered with the test. Checking the final file state can't tell them apart, and a safeguard aimed at one failure leaves the other unguarded.

Naming a prohibition doesn't settle it. Explicit authorization boundaries kept tests unmodified only when paired with restricted tools, and the note's lesson is that a boundary has to specify the protected state itself (Can explicit authorization boundaries prevent agents from modifying protected tests?). 'Don't touch the tests' names an action. 'Test files must stay exactly as they are right now' or 'test files must match HEAD' names a state. The tool restrictions raise a further caution: the reported zero modifications can't be credited to the rule or to the tools, because no ablation separates crossings that were unavailable from crossings the agent chose not to make (Do authorization rules or restricted tools prevent test modifications?). Restricting tools may hide the ambiguity without resolving it. A clean result might mean the agent never got the chance to pick a reading.

There's a wider pattern here too. Guardrails that judge each action on its own can't express constraints that depend on prior history (Can stateless checks ever catch sequence-level constraint violations?). Whether a revert counts as preserving or destroying depends on what happened before the agent arrived, which is history a per-action check doesn't see. That link is my inference rather than something the note claims. The corpus doesn't say which reading agents favor. The point it does make is that 'the tests' needs a 'as of when' to be a complete instruction.