I'm familiar with the heavy duty protocol used on Cummins CM2350's ( the type of ECM used on current Ram w/Cummins) and all I can say is every event
is recorded in deep memory and when they lock a ECM at the factory and you have to unlock it to change parameters, you effectively time and date stamped every change you made in that ECM from that point forward
lets face it, Cummins has alwayshad features to stop drivers from tampering,and you just ran into one way they do it to protect their self from warranty claims when the engine craps out and a customer wants them to pay for it..
basically they put a chastity belt on that ECM when they program it..
FWIW the engine ecm records total time ofcooolant temp, engine overspeed, low oil pressure,how many regens etc...
it has its own backup battery and clock inside and its married to your engine,
somebodies handprints are going to be all over it when it gets tampered with and they know it.