diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 62a7815..774c338 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,6 +40,29 @@ jobs:
         toolchain: [stable, "1.85"]
     steps:
       - uses: actions/checkout@v4
+
+      # Seam gate (slice-4 §7 #3 / PORT_PLAN phasing):
+      #
+      # `loop_driver.rs` and `rtc_session.rs` are the hot-path media seam
+      # preserved from slice-3. They MUST remain byte-identical across
+      # slice-4 so the reflex wrapper can be added without touching the
+      # core poll loop. If a legitimate change is needed, update the pinned
+      # blob hashes below in the same PR — loud and reviewable by design.
+      - name: Seam gate — loop_driver + rtc_session byte-identical to slice-3
+        run: |
+          EXPECTED_LOOP_DRIVER='744bf314edf7f4925c8bb3bd0f5176dbc88f8113'
+          EXPECTED_RTC_SESSION='a4c9f2ae64e56c08e1990956391514929535b526'
+          GOT_LOOP_DRIVER=$(git hash-object crates/rutster-media/src/loop_driver.rs)
+          GOT_RTC_SESSION=$(git hash-object crates/rutster-media/src/rtc_session.rs)
+          if [ "$GOT_LOOP_DRIVER" != "$EXPECTED_LOOP_DRIVER" ]; then
+            echo "::error::loop_driver.rs blob mismatch: $GOT_LOOP_DRIVER != $EXPECTED_LOOP_DRIVER"
+            exit 1
+          fi
+          if [ "$GOT_RTC_SESSION" != "$EXPECTED_RTC_SESSION" ]; then
+            echo "::error::rtc_session.rs blob mismatch: $GOT_RTC_SESSION != $EXPECTED_RTC_SESSION"
+            exit 1
+          fi
+
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ matrix.toolchain }}