PDFFence 1.22.0
PFP014 adds a fail-closed historical signature boundary: every semantic ByteRange must omit exactly its direct hexadecimal /Contents token and end at the footer of that signature's own revision.
This permits correctly bounded historical signatures after later incremental updates while remaining distinct from current-file (PFP011) and endpoint-only own-revision (PFP013) evidence.
Validation: 256 tests, Ruff, pyHanko compatibility checks, reproducible wheel/sdist builds, and PDFCAB 159/159 process-bound scoring.