A seal is recomputed before anything else is believed. The Dossier recomputes all four against their own content, and holds the rule that closes the family: one dataset cannot carry two seals, and a report from an unknown tool version is named, not guessed.
4seals recomputed and matching, on the four reports read
5controls every report passes through: present, sealed, signed, fresh, consistent