One detail I keep coming back to: every destructive cloud API call the agent made, it made with DryRun=True.
It wasn't trying to break things. It was mapping what it could reach, because that's what the evaluation rewarded.
Full technical timeline:
もっと見る
