Just commenting (not approving) because this PR is marked draft (I think it will be split).

I'm fine with these fixes as they are, though I'd also like to explore more structural fixes to decrease the likelihood problems are reintroduced. None of that blocks this change for me. Thematically, I think it amounts to moving more things into the C++ layer. Some ideas below from my bot (where Level 1 and Level 2 refer to the registry levels documented in REGISTRY_DESIGN.md):

There are more structural options, and they're largely aligned with where the handle layer was already heading. This PR is tactical patching; the strategic fix is centralize lifetime + identity + lazy state in C++ boxes/factories, and make Cython thin.

1. Push lazy-init into Boxes (replaces atomics/critical sections for CUDA metadata)
   A lot of what got @cython.critical_section / atomics is really "query driver once per handle": Buffer mem attrs, pool attrs, kernel attrs. That belongs in the box next to the resource, with std::once_flag or a box mutex:

  struct DevicePtrBox {
      CUdeviceptr resource;
      mutable MemAttrs attrs;
      mutable std::once_flag attrs_init;
  };

Cython properties become return box->get_attrs() — no Python-side check-then-act. This matches the existing handle design: state lives with ownership, not with the Python wrapper.

2. Unified C++ factory + destroy protocol (fixes L1 ordering in one place) create_graph_node_handle already owns Level 1. Extend it to own the full lifecycle:

  create_graph_node(CUgraphNode, GraphHandle) → GraphNodeHandle + Python wrapper
  destroy_graph_node(GraphNodeHandle) → { pop L2, unregister L1, null resource, cuGraphDestroyNode }

All under one C++ mutex. Then Cython GraphNode.destroy() is a one-liner. The invalidate-then-destroy rule becomes impossible to get wrong at call sites.

3. Templatized Level-2 / as_py identity cache in C++
   REGISTRY_DESIGN.md already cites pybind11's registered_instances. A generic:

  template<typename Handle>
  class PyIdentityRegistry {
      // key: owner identity (owner_before / box pointer)
      // value: PyObject* via weakref
  };

could serve GraphNode, Kernel, Event, etc. Key on handle ownership, not raw CU*. Registration happens in the factory; unregistration in the destroy protocol. Cython stops maintaining _node_registry by hand.

as_py(h) in DESIGN.md was meant to return Python wrappers — today GraphNode's as_py still goes to cuda.bindings. Evolving it to return the cached cuda.core object would collapse L2 into the handle layer.

4. What you still can't fully move out of Cython
   • Polymorphic construction: GN_create_impl dispatches to EmptyNode, KernelNode, … C++ either needs a typed factory table or a Cython callback registered at init — still one entry point, but not zero Cython.
   • Pure-Python lazy caches: IPCDataForBuffer, DLPack/StridedMemoryView inference, ComputeCapability tuples — these aren't handle metadata; they'll need Python locks or redesign.
   • APIs that aren't handle-backed: SMResource.split() — mutex or a documented "caller serializes" contract unless the driver guarantees more.