const VERITY_FLAG: u32 = 0x0010_0000;
A sealed inode cannot be replaced with an unsealed generated file.