Examine the record, not just the conclusion.

It is a synthetic example — not a customer case.

In the sample you find: `root_cause` (in synthesis outputs), `verdict_text`, `verdict_status`, `signal_ids`, `disclaimer`, `disclosure`, `provenance_unverified`, `public_sample_sha256`, and, in the integrity reading, also `evidence_pack_sha256`.

`public_sample_sha256` lets you check whether the public file matches the reference bytes. That is artifact integrity verification, not content truth, not legal proof, not a certified signature.

A record is not left on every run or after every stop. Control Validation leaves the observation of that control, not the same document as a Review. `evidence_pack_sha256` is not the public fingerprint and is not recomputed from the redacted JSON.