Fix CRC-less RetroArch live activation

[Darkaxt]

Summary

• treat a unique CRC-less RetroArch basename match as a discovery candidate
• reopen and SHA-verify the exact granted ROM source before live activation
• bind CRC-backed and basename-discovered authority to distinct session epochs
• preserve fail-closed CRC mismatch and ambiguous-match behavior
• prepare RC78 hotfix 5 for protected signing and Thor validation

Verification

• RomSessionResolverTest: 10/10
• SessionEpochGateTest: 8/8
• GuideActivationGateTest: 6/6
• release/governance Node suite: 85/85
• Android debug Kotlin compilation passed

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T22:06:22.267449Z	e547397	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e547397e53

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep CRC-less basename matches non-authoritative

When RetroArch is running a different ROM with the same normalized basename and system—such as an alternate hack or an unindexed copy outside the selected SAF tree—this promotes the indexed entry from Unverified to an activation candidate. activate() only hashes that indexed source against its own previously stored SHA-256; it never compares evidence from the content actually running in RetroArch, yet it subsequently marks the session verified and enables catalog, battle-memory, and save readers for a potentially different memory layout. Keep CRC-less matches non-authoritative unless the running content can be cryptographically or path-wise bound to the candidate source.

Useful? React with 👍 / 👎.