Report pins a branch drops and modules it leaves unsealed, without refusing either

.github/workflows/ci.yml

@@ -148,6 +148,7 @@ jobs:
       - run: python3 scripts/bank_statement_import.test.py
       - run: python3 scripts/sanitise-bbox-capture.test.py
       - run: python3 scripts/merge-gate.test.py
+      - run: python3 scripts/surface_coverage_report.test.py
 
   tally-portable:
     name: Tally portable core

docs/module-decomposition.md

@@ -57,8 +57,10 @@ reconcile to the pinned `agent_desktop_journal.rs`.
 
 **The gate will not tell you when a split leaves code unsealed.** A moved
 module's parent changes hash, the reseal succeeds, and the extracted file is
-outside the seal with every check green. Check the new files against the rule
-above yourself.
+outside the seal with every check green. `scripts/reseal.sh` prints a report
+that catches the common case -- a new module declared directly by a pinned one
+-- but not a new module under an unpinned parent or deeper descendants, so check
+the new files against the rule above yourself.
 
 **Capacity is not free, and that is deliberate.** `MAX_SURFACE_FILES` is set to
 the exact pin count, so any branch adding a pin raises

docs/release-process.md

@@ -112,6 +112,29 @@ new digest was computed from disk, and the `rehash-surface` that follows
 re-reads every pin, including the new one, before the second seal. Never stop
 after that first seal.
 
+#### What the reseal reports after it succeeds
+
+A successful `scripts/reseal.sh` (not `--verify`) prints a surface coverage
+report from `scripts/surface_coverage_report.py`. It never fails the reseal.
+Against the merge-base with `origin/master` (override with
+`SURFACE_REPORT_BASE`) it lists two things the gate cannot see: a pin that was
+dropped, and a module declared directly by a pinned module and newly left
+unpinned. Modules left unpinned before the branch are not reprinted, test-only
+modules are only counted, and feature-gated ones are labelled.
+
+**A clean report is not evidence that nothing left the seal.** It does not see
+code moved between files that already existed; a new module declared by an
+*unpinned* module, even one carved out of a pinned file (a new file under an
+unpinned `db/mod.rs`, say); deeper descendants of a pinned module; a pinned
+file that stops being compiled; a test-only or feature-gated module becoming
+production; or a new crate root. The script's docstring keeps the full list.
+The merge driver (`scripts/reseal-merge-driver.mjs`) calls the tool directly and
+does not print the report; run `scripts/reseal.sh` after resolving.
+
+Read it, then pin each listed file that decides what Bridge posts or lets leave
+the machine, and leave the rest; see the comment on `MAX_SURFACE_FILES` for the
+rule and bridge#416 for the reasoning.
+
 #### When the surface itself conflicts in a merge or rebase
 
 The surface and the matrix are **generated artifacts**. Never hand-merge them.

docs/tally/compatibility/compatibility-matrix.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "bridge_commit_sha": "be1c20cc3fd66fa1ece196505c69f26e555e4b8e",
-  "compatibility_surface_sha256": "17dcd4722234ab278f55d130b00151b71ae797f6a1a7cf18246f08ab82f21915",
+  "compatibility_surface_sha256": "d8735ad48170a115c0504ec053ca1669e72c539c621aadfe196228c3921435b4",
   "claims": [
     {
       "claim_id": "erp9-6-6-3-windows-education-xml-one-company",

docs/tally/compatibility/compatibility-surface.json

@@ -3,7 +3,7 @@
   "files": [
     {
       "path": ".github/workflows/ci.yml",
-      "sha256": "c986297046d65dc1d218583410e693c9d017e1d72e3891d667012c8474db2ed1"
+      "sha256": "4a116d6db823d8e01ae1f7232e9ddbb845aeb4a0f581cb463983724f6d5c017b"
     },
     {
       "path": ".github/workflows/dependency-security-scheduled.yml",
@@ -954,5 +954,5 @@
       "sha256": "a8ac2714fecf51947f2822c8c46d7ce2e8602c732780ff60566a7771f0836f9a"
     }
   ],
-  "manifest_sha256": "17dcd4722234ab278f55d130b00151b71ae797f6a1a7cf18246f08ab82f21915"
+  "manifest_sha256": "d8735ad48170a115c0504ec053ca1669e72c539c621aadfe196228c3921435b4"
 }

scripts/reseal.sh

@@ -198,3 +198,8 @@ pins_changed="no"
 [ "$MODE" = "pins-changed" ] && pins_changed="yes"
 reseal_into "$SURFACE" "$MATRIX" "$pins_changed"
 echo "reseal.sh: compatibility surface and matrix resealed"
+
+# Report-only, never fails the reseal: pins this branch dropped, and modules
+# newly left unpinned directly under a pinned one, since origin/master -- two
+# things the gate cannot see. Much else is not checked; see the script (#416).
+python3 "$SCRIPT_DIR/surface_coverage_report.py" --root "$PIN_ROOT" --surface "$SURFACE" || true