tri reseal check fails on every clean checkout, and obeying it deletes the seal path token

[gHashTag]

tri reseal check exits 1 on every clean checkout, and obeying its advice silently reverts #3280.

Reproduced on a clean tree at c8b48a3ab

$ git status --porcelain -- bootstrap/ | wc -l
0
$ tri reseal check
seal:   23f03e8a97d5588d
actual: 23f03e8a97d5588d

`cargo build` in bootstrap/ will refuse until these agree.
If the change to bootstrap/src/compiler.rs is deliberate: tri reseal write
EXIT=1

Two identical hashes, reported as a mismatch.

Cause

bootstrap/stage0/FROZEN_HASH is <64-hex> <WS> <repo-relative-path> — FROZEN.md §4, and what is on disk:

23f03e8a…f6d1 bootstrap/src/compiler.rs

cli/tri/src/reseal.rs:68 did let have = raw.trim().to_string() — the whole line — and compared it against a bare 64-hex digest. On the real two-token file that can never hold, so the mismatch branch was unconditional.

Three separate consequences

1. The check fails always. Every clean checkout, every run.
2. Its stated consequence is false. bootstrap/build.rs:246 does .split_whitespace().next(), so cargo build passes. The message says it will refuse.
3. Obeying it corrupts the seal. reseal.rs:102 wrote format!("{want}\n") — the digest alone, path token deleted. build.rs reads only the first token, so this produces no error anywhere, and it undoes 3d3b5b858 (fix(rust): .len() is usize, so the bridge that already exists can apply (+2) #3280), which restored the two-token form on 2026-09-05.

Why nothing caught it

Every fixture in that module is a bare hash or a conflict marker; none carries the real two-token line. The shell siblings get it right and are the proof the format is knowable in code — scripts/reseal-check.sh reads awk '{print $1}', scripts/reseal-apply.sh:108 writes printf '%s %s\n'. The Rust command is the lone divergent implementation, and .claude/skills/ci-gates/SKILL.md:3203 promotes it to agents.

tri reseal was written 2026-08-24 (2c0ce54e8), inside the window when the seal was one token — which is why it encodes the wrong shape, and why it became wrong silently rather than arriving wrong.

Found by an adversarial sweep for the class "a tool emits advice that a deliberate recorded decision contradicts" (#3355). This is the most severe of five survivors: it is the only one where obeying leaves no error behind.

Boundary

• bootstrap/build.rs
• bootstrap/src/compiler.rs
• scripts/reseal-apply.sh
• scripts/reseal-check.sh
• src/reseal.rs

[gHashTag]

A boundary drafted from the paths this issue already names, so a bee can take it. Nothing is reserved until this is in the issue body - the Queen reads the body, not comments. Check the paths first: a wrong boundary reserves files the work does not own.

Boundary

• bootstrap/build.rs
• bootstrap/src/compiler.rs
• scripts/reseal-apply.sh
• scripts/reseal-check.sh
• src/reseal.rs