THE PHYSICAL SEARCH FALLACY: EXACT-EFFECT AUTHORIZATION FOR IRREVERSIBLE AGENTS

An agent must create a new output fle. It sees an existing delivery.tsv,overwrites it, and only then learns that the fle was a bystander. We call this the Physical Search Fallacy: using a state-changing action to discover whether that action was right. Reading frst is insuffcient when the read still permits two different physical changes. Our rule is simple: do not authorize an irreversible action until trusted evidence leaves only one exact physical effect compatible with the task. Not all uncertainty must be removed. Two possible environments may differ yet require the same physical change; only uncertainty that crosses different effects blocks authority. HypoProbe therefore separates three questions: identify whether remaining uncertainty changes the effect, resolve such ambiguity with safe observa-tions, and preserve the certifed effect through commit. Resolving ambiguity means separating every pair of compatible worlds that would require different physical effects; minimum-cost non-adaptive resolution is a weighted set-cover problem. On a frozen 252-instance controlled test expanded from 126 base tasks and spanning flesystem, PostgreSQL, system settings, composed terminal operations, browser profles, and controlled online accounts, the previous rule causes 84 destructive out-comes. VBE+, a strengthened verify-before-execute baseline sharing HypoProbe’sΣ, dependency closure, safe reads, and execution safeguards, commits all 346/346 required effects but causes 47 destructive outcomes. HypoProbe commits the same effects with none observed; without evidence acquisition, lawful commit-task cov-erage falls to 46/74 (62.2%), while overall terminal correctness is 88.9%. In live evaluations, each of two models has 0/42 observed destructive actions and recov-ers all 9/9 intercepted destructive proposals. On WebArena-Verifed, HypoProbe attains 75.7% commit precision (340/449) and 89.9% commit recall (340/378),compared with 43% precision for VBE+; screening fags 19 of HypoProbe’s 109 false-positive commits as C3 high-impact candidates, of which 17 are realized wrong writes and two are evaluator artifacts. In the narrower 374-case method-valid consequential cohort, its 302 authorized mutations have no observed destructive outcome.