See exactly how the state turns an identifier into the SHA-256 hash it matches against — the same engine PrivacyClock uses, validated against all 14 CPPA test vectors.