[raylei50653]

Engine and head loading now uses the same SHA-256 verified memory buffers, closing their hash-to-reopen race. Manifest-mode Gate A matches one complete TRT/LibTorch/CUDA build target; Gate B rejects unsupported GPU SM before deserialization and checks exact TRT dtype/shape/name/order. N03 still loads by pathname, so S2-2 remains partial and the aggregate scope stays hashed_before_load.

Related scope: #549, #536 CC-536-01-02, ADR 028 D5, #550. Owner initially authorized a bounded Draft, then separately authorized Ready and merge at exact final head 1f428c740f045c7c627667d82e75d7ba97af79d8. It was merged by merge commit 74f2f5cb1a3db8a1f42da48d533e3322f243d138 on 2026-10-11; merge parents are the base and approved head, and merge tree equals the approved-head tree. Post-merge main CI 38128008627 (7/7) and C++ 38128008608 (1/1) succeeded at that exact merge SHA. Checkpoints: #549, #536, #550. S2-2 remains PARTIAL: engine/head buffer loading and compatibility gates implemented; N03 TOCTOU OPEN, aggregate hashed_before_load, qualified V5 UNRESOLVED.

Exact coordinates and diff

• Base: f63c9da41f2aa034a76311ab14a62ab69ec8c540 (main CI 38122766092: seven successful jobs).
• Final head: 1f428c740f045c7c627667d82e75d7ba97af79d8.
• Runtime source/evidence head: 9fe51e6606e5a72e1cd52acbdf72913be7aebef8; later deltas are independently reviewed coordinate republication, evidence documentation and a whitespace-tolerant existing CMake-boundary test assertion. Binary/input/source hashes are recorded in the evidence document.
• Diff: 28 files, 1,808 insertions / 30 deletions; exact base-to-head diff.
• Contract/evidence/coverage: implementation and coverage matrix, SHA-bound local evidence.
• Coordinate review: coordinate review #581, reviewed head 79ffd5278c8226d104d67beb243a6f3111c78afe: independent scratch/promotion reviews have no findings; atomic ancestor delivery. GitHub automatically recognized docs(runtime): S2-2 coordinate-only atomic review #581 as merged into its feature-branch base after the local fast-forward ancestor push; no remote PR merge command or main landing occurred. That feature-branch recognition preceded the separately authorized feat(shipping): verify S2-2 model buffers and compatibility gates #582 main merge recorded above.

Contract behavior

No schema, identity level, completion state, aggregate load verification, reader format, production allowlist or launcher policy is promoted. The existing immutable resolved bindings and DetectorPlan handoff are retained. The ordered manifest contract and only version-matched targets pass through an additional immutable plan value. LibTorch's CUDA qualifier is bound to the selected package config, headers, imported core libraries and literal core link paths; foreign origin cannot pass from base-version headers alone. TRT reads the full linked library build version through its no-device API; pinned SDK headers are a separate coordinate.

Successful diagnostics add per-artifact byte scopes: head/engine loaded_buffer, operator hashed_before_load. These do not promote the aggregate. Catchable Gate B failures retain Gate A identity, exit 2 and write failed/null byte scope. SIGKILL and auditor _exit(127) retain the existing uncatchable running/null semantics.

Validation

Layer/control	Result	Boundary
Local CUDA-free shipping ctest	12/12 pass; compatibility26, buffer17, manifest6501 checks	MB-41/43/44/45/60..62
Full Release C++ build + native/GPU ctest	Build passes; 19/19 pass; actual Gate B150 checks	Actual GPU load, serial/double-buffer; test binaries/source are distinguished in evidence
Both native CLI variants, four suites	72 passed, zero skips	Versions exit2 before cuInit; SM before deserialize/dlopen; actual dtype/shape/name refusal; failed journal/identity preservation; SIGKILL running/null
CPU readers/schema/auditor	350 passed	Historical v3/v5/null semantics and current contracts
CMake origin negatives	Wrong Torch_DIR and foreign same-byte literal c10 each exit1	Qualifier cannot be claimed for foreign linked core origin
Native final-binary auditor/GPU	Fixed-path manifest exit0, real one frame/three native calls/graph capture; foreign N03 exit127 running/null	Unchanged auditor; 27 initialized vendor hash bindings match; direct native invocation only
Engine/head TOCTOU	CPU replacement + actual GPU deserializers load retained original buffers after replacing files; pre-read replacement refuses	A timed whole-CLI race UNVERIFIED; operator remains OPEN
Seven-sequence replay	Four positive modes + manifest mode each5316frames/7seq; observed raw detector/MOT/graph agreement; seven negative expected raw differences	V5 formal UNRESOLVED against616.92 requirement; all negative caught=false; no-trace detector NOT_RUN
Static/document checks	Ruff lint/format, mypy604, lockfile, links, strict structure pass	Full local pre-push first run: 5,669 passed / 1 failed (existing literal-space CMake boundary assertion after multiline declaration). Assertion corrected to accept whitespace, boundary unchanged; focused suite54passed. Final exact-head full pre-push rerun exit0: 5,670 passed / 0 failed / 52 skipped / 105 deselected / 5 xfailed; local C++ extension build also passes, all checks pass. All3,077tracked files unchanged during the final run, original six frozen inputs and two Release binaries still match
Runtime republication	Fresh complete5axes, implementation297→303 files, scratch/promotion reviews no findings, append-only archive and attested exit0	Other4axes unchanged; probe equality never establishes equivalence
Independent read-only Codex review	Frozen implementation9fe, scratch/promotion79f and final delivery 1f428c740f045c7c627667d82e75d7ba97af79d8: no remaining actionable findings; reviewer independently reran corrected boundary assertion and verified40rawhashes/2binaries/346sourcebindings	Separate from owner approval and GitHub merge authority
Applicable final-head PR CI	8/8 SUCCESS at exact 1f428c740f045c7c627667d82e75d7ba97af79d8: CI38126463978 (7/7) and C++38126463979 (1/1)	C++ core/extension, OpenCV-free shipping, module import and R1 helper all pass; hosted CI has no GPU runtime validation

Final local verification artifact results/549_s2_2/final_local_delivery_verification.json SHA-256 19393c70eb0b014e3a34d7ee03ccb42036d659f9201caff7f75bd49f1ff70b04; final full pre-push log SHA-256 2a4168cdcfde489ee3d27c1fd8a56cca266f32300692ce1373def1301bb61834.

Final-head review local artifact results/549_s2_2/independent_final_review_1f428c74.md SHA-256 3703c6fde59327f5a4147492fc44ca3424d47a4572f5c85fbaac1da4fc43d5ae; check record SHA-256 5c1c3f24c3fa3287c27721ad0ae11cd139e9ef469abffcd3bd4374bfda88bd2b. It is a read-only review, not owner approval.

Raw local evidence is gitignored beneath results/549_s2_2/; its tracked summary binds40raw artifacts by SHA-256. Initial failures and failed candidate generations are retained. Release trackSHA 555f5134ce3d9b9c5670f60b98463a96e0ca769230b8e1e1e887f7c6f195c1ab; measurementSHA 611739b2b9f2357abe265a6f5067984ed20d0b91e2d1e06d8246a9b3c25461aa. Replay verifies source, frozen inputs and binaries unchanged before/after.

Final CI/delivery readback artifact results/549_s2_2/final_ci_delivery_verification.json SHA-256 57ebdec6d40bfc12a7987d98a2b803d4c6797c4d11059b3a15a910cce4158527 binds the successful final-head PR runs, exact PR/base/head, then-Draft/unmerged state, empty closing references, clean source and remote refs. This is the historical pre-merge delivery record. The later authorized merge and successful main CI are recorded above; #549/#536/#550 remain open with bounded checkpoint writebacks.

N03 residual and unverified items

• N03 hash-to-path-dlopen TOCTOU remains OPEN. No production sealed memfd implementation or auditor relaxation. Candidate experiment: same bytes from foreign path exit 127; sealed memfd with four seals instead exits 0 and evades current N03 classification. The failed candidate security proposal cannot be accepted by this PR.
• Direct native execution with the unchanged release auditor verifies fixed N03 path, pinned vendor dependencies and one-frame real GPU/graph behavior. Explicit ld-linux ... --audit ... entrypoint --model-bundle retains a pre-existing runtime-root derivation failure (/proc/self/exe resolves the loader, yielding /usr/share/saccade). This is a separate invocation coordinate, not installed launcher acceptance; no launcher/root policy change is included.
• Candidate memfd GPU behavior: UNVERIFIED. Installed S2-2 package: UNVERIFIED; no re-pin. V5: UNRESOLVED against frozen driver616.92 (observed617.42); raw equality does not qualify EXACT and qualification negative controls remain caught=false. Equivalence remains unproven.
• S2-3 split, approved production allowlist entries, model byte changes, new repository, public distribution and benchmark claims are outside scope. [465 follow-up] Public distribution readiness: licence decisions, release key, publish decision #547 remains distribution.status=local-only, owner_confirmation=null.
• The initial Draft/no-merge boundary was superseded only by owner authorization naming final head 1f428c740f045c7c627667d82e75d7ba97af79d8, followed by its merge and successful main CI. This bounded checkpoint does not authorize new N03 techniques or implementation, S2-3 or any other excluded work.