Ship portable CPU dispatch and verified shared runtime dependencies

docs/BUILDING.md

@@ -135,10 +135,17 @@ The generated `.searchi/packages/searchi-windows.zip` contains the desktop,
 matching-architecture Google worker, FFmpeg/FFprobe and notices. It excludes
 model caches, local settings and indexes. `PACKAGE.json` records SHA-256 for
 each included file. Extract the entire archive before launching `searchi.exe`.
-First launch uses normal verified model setup. WebView2 and the applicable
-Microsoft C++ runtime remain Windows prerequisites. The Windows archive includes
+First launch uses normal verified model setup. WebView2 remains a Windows
+prerequisite. The normal x64 archive ships unchanged Microsoft release CRT
+DLLs with their redistribution notice; Visual Studio is not required to run it.
+The Windows archive includes baseline and optimized CPU modules, selected
+using CPU and OS capabilities, and
 the verified Vulkan loader DLL and its license; GPU availability is detected at
 runtime, with CPU fallback. The SDK is used only to compile the app.
+All runtime DLLs are listed by size and SHA-256 in `runtime-libraries.json`.
+Staging and packaging reject missing or changed listed dependencies before
+replacing output. CPU-only VM smoke tests can also omit optimized modules to
+exercise the packaged baseline; this does not certify older physical hardware.
 
 This is an unsigned development archive, not a production installer. Native
 launch, clean-machine dependencies, upgrades and signatures must still be

docs/ROADMAP.md

@@ -57,6 +57,11 @@ Status: implementation started; no production release yet. Windows VM tests use
   provenance; universal CPU/Vulkan worker and embedded-frontend desktop built.
 - [x] Real Windows archive integrity, packaged decoder startup and auto-mode
   CPU inference with a controlled no-GPU-provider registry; Google CPU parity.
+- [x] Normal Windows x64 archive includes baseline/optimized CPU dispatch,
+  OS AVX-state guards, shared app-local MSVC CRT and hashed DLL inventory;
+  real optimized and baseline-only package inference passes in the CPU VM.
+- [ ] Verify CPU dispatch on older physical CPUs and a clean Windows machine;
+  dependency inspection and baseline execution on a modern VM are insufficient.
 - [ ] Actual missing/incompatible GPU drivers, precision, device loss and memory
   pressure on release hardware; native GUI and clean-machine archive launch.
 - [x] Windows desktop archive packager includes explicit runtime/helper files

docs/SEMANTIC.md

@@ -28,8 +28,13 @@ retry of that request. WorkerInfo and responses report the actual device.
 **Windows VM tests remain CPU only**, via SEARCHI_FORCE_CPU=1 and Device::Cpu.
 GPU execution/failure recovery has not been exercised here.
 
-The Windows worker links a static MSVC CRT and static llama libraries, without
-an external OpenMP runtime. Production CMake supports cpu, auto, metal, vulkan,
+The normal Windows x64 worker ships shared llama libraries and baseline plus
+optimized CPU modules. Selection checks CPU features and OS support for AVX
+register state; it loads packaged backends from the executable directory.
+Shared libraries use a common MSVC CRT because model file handles cross DLL
+boundaries. The unchanged release CRT files are packaged alongside the worker.
+Internal static CPU builds retain a static CRT. Neither profile requires an
+external OpenMP runtime. Production CMake supports cpu, auto, metal, vulkan,
 and cuda; CPU builds force GPU flags off. Runtime/provider parity and packaging
 on other operating systems remain independent release checks.
 

docs/VALIDATION.md

@@ -7,6 +7,35 @@ and `SEARCHI_FORCE_CPU=1`.
 
 ## Current integration checkpoint (2026-10-12)
 
+The normal Windows x64 package now includes baseline and optimized CPU DLLs
+with CPU/OS feature checks, plus the Vulkan backend. Shared DLLs use a common
+MSVC CRT: a first `/MT` prototype crashed because model file handles crossed
+separate CRT instances; the corrected `/MD` package passes real-model startup.
+All 25 runtime DLLs and the worker have their non-Windows PE imports satisfied
+by packaged files. Windows system UCRT/WinRT and WebView2 remain platform
+requirements. This is dependency inspection, not clean-machine certification.
+
+Both extracted-archive tests passed: automatic CPU dispatch selected
+`ggml-cpu-cascadelake.dll`, and removing optimized modules from the temporary
+extraction selected `ggml-cpu-x64.dll`. Both produced genuine normalized 768d
+Google code vectors, started FFprobe, verified all 39 listed files, and confirmed
+the Vulkan module was not loaded. The unsigned archive is 145,196,878 bytes;
+its digest is recorded in [dispatch evidence](evidence/windows-package-cpu-dispatch.json)
+and [baseline evidence](evidence/windows-package-cpu-baseline.json).
+Recorded startup/query/exit times are diagnostic smoke samples, not comparable
+benchmarks: cache state and concurrent checks differ. Baseline inference on
+this modern VM does not certify older physical CPUs or operating systems.
+Three builder, five staging and eleven archive regression tests passed.
+Two real Google code tests and two text-reference/tail/debug parity tests also
+passed using the new shared worker in forced-CPU mode. Text reference cosine
+similarities range from 0.99983106 to 0.99993036; debug/normal query cosine is
+1.00000000. These verify runtime equivalence, not broad retrieval quality.
+The genuine Google media parity test also passed on this shared CPU runtime:
+image budgets 280/140/70 and the speech fixture all meet the 0.999 reference
+cosine threshold. Image/audio quality limitations and GPU gates remain open.
+
+The following evidence describes the earlier static worker checkpoint:
+
 The Windows-x64 universal worker built with CPU and Vulkan enabled, using the
 pinned official LunarG 1.4.363.0 SDK (download hash and publisher signature
 verified). Copy-only installation and later provenance/swap validation ran in

docs/evidence/windows-package-cpu-baseline.json

@@ -0,0 +1,15 @@
+{
+  "architecture": "x86_64",
+  "verified_files": 39,
+  "cpu_backend_module": "ggml-cpu-x64.dll",
+  "vulkan_module_loaded": false,
+  "baseline_only": true,
+  "archive_sha256": "0e35c10ec48d4f3380915528a16529eb694418fb72717acd5cb81e2d9da46332",
+  "worker_requested_device": "auto",
+  "worker_actual_device": "cpu",
+  "no_gpu_condition": "GGML_DISABLE_VULKAN=1 only in child; SEARCHI_FORCE_CPU absent",
+  "worker_startup_query_and_exit_ms": 7931.76289999974,
+  "query_dimensions": 768,
+  "decoder": "ffprobe version n9.0.2-27-g7e93014c5b-20261012 Copyright (c) 2007-2026 the FFmpeg developers",
+  "scope": "Real packaged worker default-mode CPU fallback with disabled provider; no GPU, native UI or clean-machine certification"
+}

docs/evidence/windows-package-cpu-dispatch.json

@@ -0,0 +1,15 @@
+{
+  "architecture": "x86_64",
+  "verified_files": 39,
+  "cpu_backend_module": "ggml-cpu-cascadelake.dll",
+  "vulkan_module_loaded": false,
+  "baseline_only": false,
+  "archive_sha256": "0e35c10ec48d4f3380915528a16529eb694418fb72717acd5cb81e2d9da46332",
+  "worker_requested_device": "auto",
+  "worker_actual_device": "cpu",
+  "no_gpu_condition": "GGML_DISABLE_VULKAN=1 only in child; SEARCHI_FORCE_CPU absent",
+  "worker_startup_query_and_exit_ms": 19626.68719998328,
+  "query_dimensions": 768,
+  "decoder": "ffprobe version n9.0.2-27-g7e93014c5b-20261012 Copyright (c) 2007-2026 the FFmpeg developers",
+  "scope": "Real packaged worker default-mode CPU fallback with disabled provider; no GPU, native UI or clean-machine certification"
+}