ROI batch validation must bind resumed shards to immutable case inputs

Observed 2026-09-04 during a read-only COR-4032 preflight of the sealed Shield ROI v1.1.0-rc2 package and historical local verifier receipts. A resumable original-versus-crop OCR/Gemini batch should not treat result-file existence as completion. Before reuse and final aggregation, validate exact case ID, image hash and dimensions, ROI coordinates and recomputed crop hash, split/source kind, production profile and prompt/schema/config hashes, redacted result schema, and one-attempt call accounting. Use create-only atomic shards plus an execution lock and fsynced progress. This matters because manifests can contain valid class labels outside the route’s primary workflow and some rows may omit explicit file paths even though their split-local image ID resolves uniquely; build the case set from class membership and seal-verified files. Provenance: local sealed manifest/package seal, COR-3962 production verifier designs, and COR-4032 redacted receipts; no provider or database calls were made for this observation.