End-to-end encryption and protocol-stack heterogeneity reduce path observability, yet operators still require early, payload-agnostic decisions at line rate under strict constraints: fixed memory, constant per-packet cost, and bounded latency. We propose an end-to-end framework in which the Network Interface Card (NIC) leverages symmetric Receive-Side Scaling (RSS) to provide multi-queue demultiplexing. On the fast path, a minimal observation updates a fixed-memory multi-tier sketch coarse filter and preserves compact short sequences for candidate flows; an arrival-driven scan further guarantees an upper bound on decision latency. On the slow path, we extract an 8-dimensional short-window feature set and apply a lightweight classifier. Experiments demonstrate strong early decidability and effectiveness in open scenarios, and a prototype achieves near line-rate throughput under saturated 10 GbE stress tests with zero drops and no backpressure.