verify.sh: add [5/5] reseal-prev advisory sub-check (seal-state vs PR diff). Closes #1136

[gHashTag]

Summary

Extend the advisory scripts/verify.sh umbrella (#1124 / #1127, then #1134) with a 5th
sub-check, [5/5] reseal-prev, that ties the NMSE seal state to the CURRENT PR DIFF, and
update the make help text. Advisory only -- always exits 0, never reseals, never blocks.

Motivation

Sub-check [1/5] already reports the ABSOLUTE seal state (fresh / stale / unsealed), but on
its own that is noisy: the seal is frequently stale on master for reasons unrelated to a
given PR, so a contributor cannot tell whether THEIR change needs a reseal. The only question
that actually matters before a push is: "does this PR touch the sealed compiler, and if so,
is the seal current?"

[5/5] answers exactly that by combining [1/5]'s seal verdict with a diff of the PR:

• diff does NOT touch bootstrap/src/compiler.rs -> seal state is irrelevant to this PR; any
  pre-existing staleness is unrelated. Reports OK.
• diff DOES touch compiler.rs AND the seal is fresh -> OK.
• diff DOES touch compiler.rs AND the seal is stale/unsealed -> prints a REMINDER: IF the
  edit changed numerics, reseal explicitly (make seal); IF it did not (an allow(), a
  comment, a test), the existing seal state is fine. It is explicitly a reminder, NOT a
  verdict on whether the edit is numeric -- the script never inspects semantics.

Guarantees (consistent with #1127 / #1134)

• Always exits 0. It is a preview/reminder, not a gate; the four required CI checks
  remain the real gate.
• Best-effort: reuses [1/5]'s seal exit code and diffs the local base ref
  (origin/master, falling back to master); only as fresh as the last git fetch.
• Skips automatically outside a git work tree or when no base ref is found.
• VERIFY_SKIP_RESEAL=1 disables just this sub-check; the other skip flags
  (VERIFY_SKIP_TEST, VERIFY_SKIP_GATES) are unchanged.

Files

• scripts/verify.sh: add [5/5] reseal-prev, renumber [1/4..4/4] -> [1/5..4/5], refresh
  the header sub-check list and usage block.
• Makefile: update make help to mention reseal-preview and the VERIFY_SKIP_RESEAL flag.

Verification

• bash -n scripts/verify.sh clean; make verify runs all 5 sub-checks and exits 0.
• On a clean tree [5/5] reports OK (compiler.rs not in diff).
• With a committed compiler.rs edit and a stale seal, [5/5] prints the REMINDER and
  still exits 0.
• VERIFY_SKIP_RESEAL=1 correctly skips [5/5].

L6 gf16 SSOT untouched; catalog stays 83; no gen/ edits; ASCII-only added lines; no quality
claim added.

[github-actions]

📓 NotebookLM Notebook linked to this PR

• Notebook ID: b83263109fb055dc
• URL: https://notebooklm.google.com/notebook/b83263109fb055dc

This notebook contains session context, decisions, and artifacts for this work.

[github-actions]

PR Dashboard

Generated at: 2026-06-14 17:50:05 UTC

• verify.sh: add [5/5] reseal-prev advisory sub-check (seal-state vs PR diff). Closes #1136 #1139 verify.sh: add [5/5] reseal-prev advisory sub-check (seal-state vs PR diff). Closes #1136 | Created: 2026-06-14 | Updated: 2026-06-14 | 10 failing / 15 total
• fix(gen): untrack stale gen/numeric catalog artifacts (committed gen drifts 77 vs SSOT 83) -- Closes #1120 #1128 fix(gen): untrack stale gen/numeric catalog artifacts (committed gen drifts 77 vs SSOT 83) -- Closes #1120 | Created: 2026-06-14 | Updated: 2026-06-14 | 0 failing / 21 total

Summary

Status	Count
Total Open PRs	2
PRs with Failing Checks	0
PRs with All Checks Green	2
READY	1
FAILING	0
PENDING	0

Seal Status

• ⚠️ STALE -- sha256(compiler.rs)=8c6db9fe77c2 != manifest seal=49e55df6d444.
  The committed NMSE numbers were certified against an older compiler.rs.
  Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).