They generated artifacts from Draft and the review copy does not match

The customer reviewed v1, then someone generated again from Draft. The files do not match the PDF they signed. What happened?

Draft is still editable. A numbered version is the frozen snapshot. Generation should run from the version they reviewed, not from Draft that moved afterwards. Freeze again if the process changed, and label the artifacts with that version. I would not treat a Draft generation as the signed spec.