Updating a TinyML intrusion detector can change its decisions even when an authentic artifact is correctly installed: preprocessing, numerical representation, learned parameters, and the operating threshold jointly define the deployed function. We formalize this release as a pipeline contract and distinguish authenticated installation, decision agreement with a named reference, and detection quality. Signed pipeline packages and journaled release selection implement the contract on an ESP32-S3 and two ESP32-C3 boards. Evaluation combines chronological TON_IoT scenarios, a separate CICIoT2023 release experiment, host–device numerical checks, and installation experiments. Retaining an earlier threshold changed 15% of the floating-point MLP’s decisions. Export rules exact in real arithmetic still changed implemented decisions (9.3% for a threshold-folded logistic-regression export in one scenario), and targeted boundary inputs revealed host–device discrepancies absent on ordinary traffic. Alternative quantization improved the tested operating point while changing the reference integer release. Signed packages of 448–1588 bytes, up to 800 times smaller than the application image, reduced on-device installation processing about 40-fold on S3 and 14–16-fold on C3 relative to raw and compressed full-image delivery. During package installation, 185 of 188 rail-confirmed physical supply interruptions returned an expected release, with no unexpected or mixed release observed. These results support treating the complete pipeline as the unit of deployment and validating its decisions against an explicit reference.