test: qualify immutable models and Phase 9 regression

docs/redesign/phase-9/p9-sec-02/MODEL_CACHE.md

@@ -6,7 +6,7 @@ The selected full repository `sshleifer/distilbart-cnn-12-6` advertises Apache-2
 
 ## Small task-authorised fixtures
 
-[ARTIFACTS.json](model/ARTIFACTS.json) records two independently hashed, isolated fixtures. Their tokenizer/vocabulary/merges/model-card and reference configuration come from the immutable upstream revision. Every downloaded ordinary Git file is checked against the published Git blob identity, then pinned with SHA256. Only1,358,673 bytes of upstream metadata/tokenizer content were downloaded. No pretrained checkpoint or remote Python code was downloaded.
+[ARTIFACTS.json](model/ARTIFACTS.json) records two independently hashed, isolated fixtures. Their tokenizer/vocabulary/merges/model-card and reference configuration come from the immutable upstream revision. Every downloaded ordinary Git file is checked against the published Git blob identity, then pinned with SHA256. The initial small-fixture stage downloaded1,358,673 bytes of upstream metadata/tokenizer content. It used no pretrained checkpoint or remote Python code. The separate trained-checkpoint follow-up below is additional evidence, not a relabelling of those small fixtures.
 
 Synthetic BART weights are generated locally with fixed seed73421 using the Apache-2.0 Transformers BART implementation: vocabulary50265, dimension16, one encoder/decoder layer, two heads,32-wide feed-forward layers and1024 positions. The842704 parameters are saved once as Safetensors and once as a known state dictionary. These files are approximately3.58MB each. The second format exercises the same PyTorch serialization family as the selected full checkpoint, with explicit `weights_only=True`. No third-party pickle or trained-weight licence is assumed. The actual tokenizer's Apache-2.0 declaration is preserved from its pinned card; no model weights are redistributed in Git.
 
@@ -20,4 +20,12 @@ The production model choice is unchanged. A minimal loader repair now pins token
 
 filelock4 changes shared-cache lock protocols. All qualification caches are new isolated disposable directories with a single library generation. No production or developer cache was reset, rewritten or silently mixed with old lock participants. A later production rollout must stop old participants and explicitly select a separately prepared/verified cache or establish documented protocol migration compatibility. That operator action is separate from development fixture compatibility and remains withheld.
 
-Actual compatibility, negative/offline/cache contention/OCR results and any limitations are recorded separately as they execute. The full checkpoint remains absent; no large download was used to manufacture a qualification claim.
+Actual compatibility, negative/offline/cache contention/OCR results and any limitations are recorded separately as they execute. The separate trained-checkpoint follow-up uses the actual configured Apache-2.0 repository and pinned1,222,317,369-byte checkpoint, with sufficient nonproduction storage/CPU/memory verified before preparation. Its actual download, integrity, offline Hub-cache loading and generation outcome is reported in validation.json; a failed or unavailable follow-up is not replaced by the small fixture. No full-model semantic, GPU or production claim follows.
+
+The full checkpoint is necessary because the tiny fixture does not reproduce the saved trained configuration: the selected model has1024-wide embeddings,12 encoder/6 decoder layers and50264 model vocabulary entries, while its tokenizer has50265 entries. The small fixture deliberately uses16-wide embeddings and50265 entries. Successful tiny-model inference cannot prove compatibility of those original tensors/configuration with Transformers5/Torch2.13. The follow-up keeps the existing model choice, uses synthetic text and constrains the nonproduction process to4CPU/8GiB/128PIDs/300seconds. It exercises the pinned repository revision through a private offline Hub snapshot cache, with blobs pointing to the already verified read-only artifact files. No production or Ollama cache participates.
+
+For replay, [full-model/prepare.py](full-model/prepare.py) accepts only a new nonproduction directory, the committed immutable source revision and HTTPS repository paths. It checks licence declaration, available space, exact sizes and SHA256 before promoting each partial file. Existing directories are rejected without replacement. [full-model/ARTIFACTS.json](full-model/ARTIFACTS.json) is generated only after successful original preparation; its absence means the follow-up has not supplied a validated artifact. Use the exact qualified image and offline command retained with the actual result; a new runtime requires requalification.
+
+The native English OCR artifact is independently identified by [OCR_ARTIFACT.json](model/OCR_ARTIFACT.json): Debian `tesseract-ocr-eng`1:4.1.0-2,4113088bytes, SHA256`7d4322bd2a7749724879683fc3912cb542f19906c83bcc1a52132556427170b2`. Its installed [copyright notice](model/OCR_COPYRIGHT.txt) identifies `tessdata_fast` and Apache-2.0. This is a file identity inside the exact measured local image, not a claim that a future floating apt install is immutable. Actual PNG/image-PDF OCR is part of the parser qualification.
+
+The two exact small fixtures are retained in a local9,895,179-byte replay capsule, [fixture-capsule.json](model/fixture-capsule.json), SHA256`a1aff347e5f08f82e8ea7176d71d00e7f83ea5735acbdc4e3bf02c73deacb643`. Archive CRC and every artifact hash were checked. Verify that archive identity, then restore only the manifest-listed members into new isolated `artifact`/`artifact-bin` directories and run `verify_fixture` before loading. No weights were committed or uploaded. The original generator used Torch2.6/Transformers4.48; regenerating under different libraries is not promised to produce byte-identical serialization and requires a new manifest/qualification.