This is a fair landing, and the version you've settled on is one I can agree with. Saying what a receipt does not prove, on the page itself, is worth more than most projects in this space offer. One corner still worth pushing, since you invited pressure: capture at execution binds the record, but the record is still written by the agent or its runtime. So the guarantee is really "the account the system gave at capture time is unaltered." If the model hallucinated the tool result in the first place, you get a perfectly intact receipt for a fabricated claim. The edit happens up front instead of after the fact. Your receipt catches the accountant who adjusts the ledger later. It can't catch the accountant who cooked the first entry. That's hard to close from inside the agent. The things that would genuinely narrow it are external anchors: a timestamp on a public ledger so the capture time itself is provable, or a signature from the tool host attesting it returned that output, so the record isn't purely self-reported. Neither makes it a zap, but each moves one more claim from self-attested to externally checkable. None of this negates the value you've staked out. Quiet retroactive edits are a real failure mode and killing them is real progress. The honest framing you've arrived at is the right one: integrity of the record, not truth of the world.
