AI Agent Audit Log Best Practices: Immutable vs Tamper-Evident, and Deterministic Replay

The three words used for audit-log integrity are not equivalent, and only one describes something achievable. What tamper-evident actually guarantees, where it stops, and the three questions to ask a vendor instead — plus pre-execution Ed25519 receipts, hash-chained, with deterministic replay.