Hash chain: Each entry is computed as SHA-3-256(seq | dit_id | event_type | data + prev_hash). The Merkle root anchors all tenant hashes at each append. All entries are Ed25519 signed with the platform signing key. Modifying any historical entry invalidates all subsequent hashes and the Merkle root.