Five cartridge hashes matched no file the collection holds. A .ctg is
not a dump: convert-ctg builds it from the .dat descriptor in the
repository and the pre-0.174 MAME images scripts/setup fetches, so the
question was not which dump is right but what the pinned source
produces.
Built at the pinned commit and replayed through the canonical recipe,
three of them reproduce the held file bit for bit: cf7+.ctg,
ti-pcard.ctg and Gram Kracker.ctg. The declared values reproduce
nothing, so the declarations were the error.
TI-994A.ctg and ti-disk.ctg are what Recalbox pins by md5, and v0.16.0
builds something else. Two legitimate versions: the primary stays
Recalbox's, the v0.16.0 output joins .variants/ under its hash prefix,
and the declaration points at what it describes. All five now resolve
sha1_exact.
Abdessamad Derraz