diff --git a/AGENTS.md b/AGENTS.md
index af2e77c..3933bc0 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -14,7 +14,11 @@ These rules MUST be followed at all times, it is very important.
   without asking first. In almost all cases, the code should be changed, NOT the
   tests. If you think the test needs to be changed, make your case for that and
   ask for permission to proceed, then stop. You need explicit user approval to
-  modify existing tests. (You do not need user approval for writing NEW tests.)
+  modify existing tests. A bug fix may change an existing test without asking
+  when that test pins exactly the behavior the filed bug calls wrong, and the
+  change moves it to the fixed behavior and nothing else; any other change to an
+  existing test still needs explicit user approval. (You do not need user
+  approval for writing NEW tests.)
 
 - When linting, assume the linter config is CORRECT, and that each item output
   by the linter is something that legitimately needs fixing in the code.
diff --git a/TODO.md b/TODO.md
index b8d828b..650e676 100644
--- a/TODO.md
+++ b/TODO.md
@@ -30,6 +30,9 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-20 `AGENTS.md`: a bug fix may change an existing test without asking
+  when that test pins exactly the behavior the filed bug calls wrong, and the
+  change moves it to the fixed behavior and nothing else (closes #280).
 - 2026-10-18 re-vendored from `sneak/prompts` commit `0653579` (closes #221):
   each `Dockerfile` stage installs its system packages and downloads the Go
   modules above `ARG CACHEBUST`, so check builds keep them, and the lint step