if (actual !== entry.sha256) {

problems.push(

protected file changed: ${path} (expected ${entry.sha256.slice(0, 12)}, got ${actual.slice(0, 12)})

)

}

}

The guarantee is split in two. A manifest cannot hash itself without a bootstrap, so the nine pinned files are protected by the build, and the manifest holding their hashes is protected by a request in `.github/CODEOWNERS` , which asks for the owner's review rather than requiring it. ** The build catches a protected file changing alone. The owner is asked to see the change that arrives with an updated hash beside it. ** Two different guarantees, and only the first is mechanical.

### 2.…