Evidence chain for MLPS-style and supply-chain audits: policy, completed jobs, frozen reports, shares and exceptions—and why scanning never equals certification.