Operational at national scale. 87,957 face descriptors indexed from the live BMIS photo set. Match threshold (L2 distance) ≤ 0.6 for automatic confirmation. 5/5 MRZ check digits validated before any record is opened. 90 second cold-start ceiling for face match, with clean error surfaced after. 100% on-premise inference — no traveller image leaves Nigerian servers.