The part that stands out is where the record comes from. You already covered the spoofed-transcript problem in the METR piece you linked, and the fix here is almost incidental: because the session and the trace are written by the control plane and the gateway from calls that actually crossed the wire, there's no self-narrated tool call for the agent to fake in the first place. It never gets a pen for that log. That's a stronger property than "logs survive termination," worth calling out on its own, since plenty of "audit trail" setups still treat the agent's own function-call record as ground truth and just ship it somewhere durable. That survives a kill. It doesn't survive a lie.