The lock screen

It shows the manifest root hash, a SHA-256 over every source file in sha256sum format, which should match what you computed with sha256sum MANIFEST.lock. A published release hash will be a third to compare; nothing has been released yet. See VERIFICATION.md.

If verification fails, the wallet will not load. The refusal comes first, above the hash, naming the failed check and the file, and unlock is disabled. Only a status this screen recognises counts as a pass; anything else fails. A check with nothing to check here is not applicable: it does not block, is not counted as passed, and is named in the verdict. A device that reports no checks, or none that passed, has verified nothing and is refused.

What the hash does not prove. The software you are looking at reports these values. They catch an accident or a crude substitution, not an attacker who replaced the code that draws them: see the tier model in Building a device.

After unlocking, they are under More then Check this device. Check before signing something large, after the device has been out of your sight, or when asked to prove it is the device you built.