Evidence supports one stage for one output. A valid record includes the profile ID and version, the exact output SHA-256, evidence hashes for passing stages, findings and a report hash.
Evidence is stale when its artifact hash, profile, rules, renderer, app version, fonts or required environment no longer match. A screenshot or report from an earlier output is not evidence for the current result.
Store the receipt, losses, diagnostics, verification report, policy version, source hash, output hash and release decision together. Keep document bytes out of logs and CI reports.
The SDK and managed results keep the verification object as is. They never upgrade unchecked states.