proof from an old agent run: the mock passed, the held-out trace failed. now i log the exact tool-call diff beside run.md before trusting a green demo.