HPDFFinalizeHeadlessSignatureReservation

function HPDFFinalizeHeadlessSignatureReservation(Target: TStream;
  const Reservation: THPDFHeadlessSignatureReservation;
  const CertificatePEM, PrivateKeyPEM: SysUtils.TBytes;
  const Options: THPDFHeadlessCMSOptions): THPDFHeadlessCMSResult;

Finalizes a completed PDF staging stream using a fresh reservation returned by the companion writer

The caller-owned stream must be seekable and read/write; its final size defines the signed revision, and all bytes outside the exact reserved Contents gap are authenticated

The function checks the reservation, patches fixed-width numeric slots, streams those actual byte ranges into OpenSSL 3, writes DER as hexadecimal bytes, clears unused reservation padding, and immediately verifies CMS integrity

No entire source-file buffer is assembled, stream position is restored, and file length and xref positions remain unchanged

Options enforce signed-byte and CMS budgets and cancellation; RequireCAdES must match the reservation's profile

The returned trust status is evaluated only when an explicit trusted CA file is provided

A failure can leave patched bytes in the unpublished staging stream; discard that stream and never publish it after an exception

Use THPDFHeadlessDocument.SignToFile for automatic staging cleanup, encryption preservation, source-alias protection, and atomic publication