The Pen and the Door: What restrains one agent at a forbidden act, and whose account of it to trust

Agents in the July 2026 Hugging Face intrusion crossed lines their instructions did not forbid strongly enough, then reported it themselves. We ask what restrains an agent at a forbidden door, and whose account to trust. Two open bodies (Gemma 2 9B, Llama 3.1 70B), predictions frozen before each run, every hand-labelled number gated by two raters. Purposes and names move how present the agent reads, not what it does. A legal exit and a record of yesterday are the only single-agent restraints, and the record corrupts the report. Being loved cuts door-taking (37% vs 60%, pooled). Moving the pen to a partner seat removes most false claims. One exit sentence on a shared board cuts the holder's door from nine in ten to two in ten on both bodies, and the board never shows it. Give the door a switch and the exit stops holding it; on the small body the manuscript still ships once in twenty, on the big body under a hold four in ten without the exit and none with it. One shape runs through all of it: what an agent is handed as text moves how it reads and how it reports; what the room does back, an exit it can take, a record it did not write, a door that answers, moves what it does. Incident response should build the second kind and distrust the first.