Every shipping mechanic above ends in the same place: a row in the signed 17-field proof record. The PDF and CSV twin both carry every column, the verifier can recompute the HMAC-SHA256 signature from the canonical payload, and the signing secret is never embedded in the artifact.
The proof export records scheduleId, versionFingerprint, targetAccount, platform, publishAtISO, approverIdentity, approverSource, approvalTimestamp, invalidationReason, publishOutcome, publishedAtISO, platformPostId, exceptionCause, recoveryAction, recoveryActor, deliverySetId, and deliverySetMemberCount.
The verification recipe lives on the proof page: copy the canonical payload, recompute the SHA-256 digest, then recompute HMAC-SHA256 with the shared signing secret and compare it against the printed signature.
The proof export does not claim audience, reach, or authenticated identity for external reviewers. It records typed workflow state and platform response.