fix: a sealed_from chain expands to the template it ultimately names (audit semantic F-06/F-07)

[sinkog]

A template entry may itself be sealed from another template. Go expanded the chain; Rust resolved exactly one level — and because a sealed_from node declares no shape of its own, the node then defaulted to object and materialized as {}.

Two different objects from one schema:

go:   values: from-inner
      origin: [{sealed: {template: $inner, path: $.leaf}}, schema]

rust: values: {}
      origin: [{sealed: {template: $outer, path: $.mid}}]

The corpus had no nested template — vectors 003 and 004 cover a single level — so neither runner could see it, and the divergence sat behind a claim that the two implementations check each other.

What the expansion also settles

The origin names the innermost template and path — the place the value actually came from — not the mount point where the chain was entered.

Go answered that question by implementation and nothing wrote it down. The vector pins it now; SPEC §5 should say it (audit semantic F-06).

The bound

64 levels in both. Go had it; Rust had none, which was harmless only because it did not recurse at all. Recursing without a bound would turn a chain of templates referring to each other into an unbounded loop over caller-supplied input (audit semantic F-07).

Measured: a 200-level chain now returns template expansion exceeded the maximum depth rather than running.

Both implementations produce byte-identical output for the new vector. 38 vectors.

A note on the gate from #21

Adding this vector made docs/en/architecture.md's "37 vectors" false, and make ci refused before anything else ran.

That is exactly the class of defect the status-claims gate was written for — caught on the commit that created it, rather than by an audit months later.

---

make ci passes. 17 of 37 audit findings closed.