- Shipped
- August 6, 2026 at 8:46 PM UTC
- Author
- Kamo
- Commit
- f666d49
The certificate carries the package, the frozen version, the subject, the moment and address of execution, the attestation wording verbatim and both digests the WORM row carries — so the artifact and the ledger row can be checked against each other with no database in the room. Every string is sanitised to WinAnsi first. PDFBox's Standard-14 fonts encode WinAnsi only and showText THROWS on anything else; package titles, member names and authored wording are free text, so a Japanese title or a curly apostrophe pasted out of Word would otherwise be the reason a member's package could not be filed. Unencodable characters are substituted visibly, never dropped. Everything paginates: HR authors clauses of any length and a forty-document onboarding pack is ordinary. The merge refuses a gap. mergePdfs skips an unconvertible document and prepends a report of what it left out — right for an ad-hoc export, wrong here, because a package that quietly omits one document still looks like the executed instrument. Order is the order manifestSha256 hashed, so reordering would produce an artifact the attestation cannot vouch for.