# G9 -- Decisive verification is a clean rebuild

A byte-match is verified from a clean rebuild (`clean → extract → build`), never from an incremental build; a reverted
configuration needs a re-extract, not just a re-check. A binary whose extraction rewrites the linker script is gated only by
a clean rebuild. A build is verified by its exit code, never by its output file — a failed build leaves the previous binary in
place.
provenance: BFM R22 + R53 + the "linker defect" that was an incremental gate (P31 S52/S71)