The seal gate never checked the four hashes it exists to check

[gHashTag]

Refs #2161

tools/check_seal_coverage.py runs under the step name "Every seal still describes its spec", and its own docstring says a seal is broken when "gen_hashes no longer describe what it produces".

It compared spec_hash and stopped.

spec_hash    := zeros   ->  exit 1, reported stale
gen_hash_zig := zeros   ->  exit 0, SILENT

A seal could assert false output for as long as nobody touched the spec — which is most of them.

How much it was missing

Recomputing all five hashes for every seal with t27c seal:

	seals
the gate called broken	418
actually not describing their output	1,078
· spec and output drifted	460 — the gate saw these
· only the output drifted	612 — invisible to it
· only the spec drifted	6

The 612 passed every run of this gate while naming output the compiler had stopped producing.

Three changes

1. Every seal re-sealed from what t27c seal produces today — all four gen_hashes, not just spec_hash. 1,078 files.
2. The gate recomputes them and reports gen-drift. Because every seal was just re-sealed, this lands green: 1,316 seals, 1,222 hold, 94 known-broken. From here, drift is caught on the commit that causes it rather than accumulating for a year.
3. seal_baseline.txt drops the 55 entries that now hold — the gate had been asking for exactly this in a NOTE every run — 151 lines to 96. One dangling seal is removed: vscode-trinity-swe/test_highlight.t27 was deleted in b79702ee1, and the gate's own prescription for dangling is "remove the seal with it".

Recomputing needs the compiler, so seal-coverage.yml builds it. A missing binary exits 2 and says so rather than returning a pass it did not earn.

The self-check's controls plant synthetic trees with no compiler, so they set T27_SEAL_SKIP_GEN explicitly rather than letting the script guess from its surroundings — a guess would also switch the check off in a real checkout where the build merely failed.

Controls, all re-run after the change

gen_hash corrupted   -> exit 1, gen-drift     (was exit 0, silent)
spec_hash corrupted  -> exit 1, stale
compiler absent      -> exit 2, says so       (was a pass)
clean tree           -> exit 0
--self-check         -> exit 0

Note on the diff

1,088 files, and 6,200 insertions against 6,172 deletions — almost all of it is five hash lines and a sealed_at per seal. The reviewable part is tools/check_seal_coverage.py, tools/seal_baseline.txt and .github/workflows/seal-coverage.yml.

This branch is rebased onto #2745, whose emitter change moves the output of 10 specs; the seals here were computed against that compiler, and the gate is green on the rebased tree.

🤖 Generated with Claude Code

[github-actions]

📓 NotebookLM Notebook linked to this PR

• Notebook ID: b83263109fb055dc
• URL: https://notebooklm.google.com/notebook/b83263109fb055dc

This notebook contains session context, decisions, and artifacts for this work.

[github-actions]

PR Dashboard

Generated at: 2026-08-28 00:39:25 UTC

• The seal gate never checked the four hashes it exists to check #2746 The seal gate never checked the four hashes it exists to check | Created: 2026-08-28 | Updated: 2026-08-28 | 16 failing / 21 total
• Land the formal verification harness on master (it has never run) #2727 Land the formal verification harness on master (it has never run) | Created: 2026-08-27 | Updated: 2026-08-27 | 5 failing / 24 total
• chore(deps)(deps): bump thiserror from 2.0.18 to 2.0.20 #2693 chore(deps)(deps): bump thiserror from 2.0.18 to 2.0.20 | Created: 2026-08-24 | Updated: 2026-08-27 | 2 failing / 34 total
• chore(deps)(deps): bump hyper from 1.10.1 to 1.11.0 #2692 chore(deps)(deps): bump hyper from 1.10.1 to 1.11.0 | Created: 2026-08-24 | Updated: 2026-08-27 | 2 failing / 34 total
• chore(deps)(deps): bump base64 from 0.22.1 to 0.23.1 #2691 chore(deps)(deps): bump base64 from 0.22.1 to 0.23.1 | Created: 2026-08-24 | Updated: 2026-08-27 | 2 failing / 34 total
• chore(deps)(deps): bump serde from 1.0.228 to 1.0.229 #2690 chore(deps)(deps): bump serde from 1.0.228 to 1.0.229 | Created: 2026-08-24 | Updated: 2026-08-27 | 2 failing / 34 total
• chore(deps)(deps): bump uuid from 1.23.2 to 1.25.0 #2689 chore(deps)(deps): bump uuid from 1.23.2 to 1.25.0 | Created: 2026-08-24 | Updated: 2026-08-27 | 2 failing / 34 total
• Unbreak FPGA CI and correct two unbacked hardware claims #2081 Unbreak FPGA CI and correct two unbacked hardware claims | Created: 2026-08-11 | Updated: 2026-08-20 | 5 failing / 27 total

Summary

Status	Count
Total Open PRs	8
PRs with Failing Checks	7
PRs with All Checks Green	1
READY	0
FAILING	7
PENDING	0

Seal Status

• ⚠️ STALE -- sha256(compiler.rs)=25a9c40dc273 != manifest seal=87e5cbd3ad94.
  The committed NMSE numbers were certified against an older compiler.rs.
  Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).