_layer() used tarfile.open(mode="w:gz"), which stamps wall-clock seconds into the gzip header MTIME, so test_determinism's three _registry() builds could straddle a second boundary and produce different layer digests. Fix by mirroring the production construction in scripts/repack_cuda_runtime.py: an explicit gzip.GzipFile(mtime=LAYER_GZIP_MTIME) wrapping tarfile.open(mode="w"). Member bytes are unchanged because both paths default to PAX. Add injected-clock regression tests for the layer helper, _registry() stability, and full-repack determinism, plus a falsification test that reproduces the former w:gz path and proves it drifts. This is a test-fixture change only; no production behavior or artifact bytes change.