build: package universal Windows runtime and verify automatic CPU fallback

docs/BUILDING.md

@@ -89,8 +89,11 @@ search starts a model process; the desktop retains a prewarmed query worker.
 Normal distribution worker builds and staging default to `auto`: Metal on
 macOS, Vulkan on Windows/Linux, with CPU fallback in the same application.
 Users do not choose a CPU/GPU edition or rebuild for their graphics card.
-Windows/Linux build machines need the Vulkan SDK including `glslc`; absence
-fails release preparation instead of quietly generating a CPU-only runtime.
+Windows/Linux build machines need the Vulkan SDK including `glslc`. Windows
+x64 provisioning now downloads the pinned, checksum-verified official SDK into
+the workspace using copy-only mode; it does not install drivers or change the
+system environment. Linux builders provision their distro's Vulkan development
+tools. Missing required tools fail release preparation rather than omitting GPU.
 The compilation SDK is not an end-user requirement. Explicit `--backend cpu`
 commands in the VM development sections are internal test configurations.
 
@@ -133,7 +136,9 @@ matching-architecture Google worker, FFmpeg/FFprobe and notices. It excludes
 model caches, local settings and indexes. `PACKAGE.json` records SHA-256 for
 each included file. Extract the entire archive before launching `searchi.exe`.
 First launch uses normal verified model setup. WebView2 and the applicable
-Microsoft C++ runtime remain Windows prerequisites.
+Microsoft C++ runtime remain Windows prerequisites. The Windows archive includes
+the verified Vulkan loader DLL and its license; GPU availability is detected at
+runtime, with CPU fallback. The SDK is used only to compile the app.
 
 This is an unsigned development archive, not a production installer. Native
 launch, clean-machine dependencies, upgrades and signatures must still be

docs/ROADMAP.md

@@ -53,6 +53,12 @@ Status: implementation started; no production release yet. Windows VM tests use
   fallback; missing Vulkan/glslc fails configuration rather than hiding GPU loss.
 - [ ] Provision release-build GPU SDKs and verify one hardware-detecting package
   per OS/architecture, including missing-driver fallback and dependency closure.
+- [x] Windows-x64 official pinned SDK copied into workspace with verified cache
+  provenance; universal CPU/Vulkan worker and embedded-frontend desktop built.
+- [x] Real Windows archive integrity, packaged decoder startup and auto-mode
+  CPU inference with a controlled no-GPU-provider registry; Google CPU parity.
+- [ ] Actual missing/incompatible GPU drivers, precision, device loss and memory
+  pressure on release hardware; native GUI and clean-machine archive launch.
 - [x] Windows desktop archive packager includes explicit runtime/helper files
   and notices, checks architecture and records per-file checksums; excludes
   model caches and user data. Controlled packaging regression tests pass.

docs/SEMANTIC.md

@@ -40,6 +40,13 @@ must have the relevant compilation SDK. Missing Vulkan/glslc now fails the
 normal build rather than silently omitting acceleration. Actual GPU parity,
 loader/dependency packaging and no-driver CPU fallback still require evidence.
 
+Windows x64 build scripts provision the pinned official Vulkan SDK locally,
+verify its provenance and stage the app-local loader with its notice. Forced
+CPU startup disables Vulkan registration before the backend registry initializes;
+CPU contexts disable device-operation offload. Automatic startup transport
+failure now restarts once on CPU without weakening model/protocol validation.
+GPU inference failure also retains the bounded existing CPU retry.
+
 | Artifact | Bytes | SHA256 |
 | --- | ---: | --- |
 | embeddinggemma-2-Q8_0.gguf | 309,855,456 | 2188ac1deca4b77dffefd603c2776a9d76d9d74ec01841392982ebb840b09135 |

docs/VALIDATION.md

@@ -7,19 +7,34 @@ and `SEARCHI_FORCE_CPU=1`.
 
 ## Current integration checkpoint (2026-10-12)
 
-The Windows archive packager has two controlled Python regressions: complete
-required file collection with checksum verification and user-settings exclusion,
-and mismatched worker architecture preserving the previous archive. Both pass.
-An actual CPU-only Tauri embedded-frontend Release build has been started;
-the embedded-frontend Release application build completed in 7m 25s. CPU-only
-describes its VM test context, not a supported end-user edition. The normal
-worker build/staging defaults are now auto and require GPU compilation support
-alongside CPU fallback. The previously staged CPU worker remains an internal
-test artifact; archive creation, automatic-runtime dependency packaging, native
-launch outside the source tree and clean-machine installation remain unverified.
-Actual `auto` configuration correctly rejected this VM's missing Vulkan library,
-headers and `glslc`; no GPU-capable worker/package is claimed. Both staging
-regressions still pass using explicit internal CPU test configuration.
+The Windows-x64 universal worker built with CPU and Vulkan enabled, using the
+pinned official LunarG 1.4.363.0 SDK (download hash and publisher signature
+verified). Copy-only installation and later provenance/swap validation ran in
+the workspace; no driver/registry installation or GPU inference occurred.
+The desktop embedded-frontend Release build completed and was rebuilt with
+startup fallback. The generated unsigned Windows archive includes its worker,
+app-local Vulkan loader, FFmpeg/FFprobe and named notices. Six packaging
+regressions verify exact archived-byte hashes, changes during copying, notices,
+architecture mismatch, failed-write cleanup and preservation of previous output.
+
+The actual extracted package's worker was requested in `auto` mode, with
+`SEARCHI_FORCE_CPU` absent and Vulkan disabled only in that child. It detected
+a CPU-only backend registry and produced a real normalized 768d code vector;
+its decoder started successfully. All 13 recorded package files passed hash
+checks. [Raw package evidence](evidence/windows-package-cpu-fallback.json).
+The final local archive is 140,971,051 bytes; its digest is included in that
+evidence. It has not been published as a production release.
+This is controlled no-provider fallback, not a physical GPU/driver test or
+native GUI/clean-machine certification. Actual GPU precision/parity, native
+application interaction, signed installers and other OS/architecture gates stay open.
+Two real code tests and existing Google text-reference/tail parity passed on
+the GPU-capable worker's forced-CPU path. Four startup regressions check one
+CPU retry after automatic startup transport failure while preserving invalid
+protocol/model rejection and explicit-CPU behavior. Eight Vulkan-provisioning
+tests verify cache provenance, bounds, atomic loader reuse and SDK swap rollback.
+The integrated workspace and native desktop tests passed, along with strict
+all-target Rust Clippy, frontend Release build and formatting checks. Gitea
+Actions remain disabled at Karl's request.
 
 Offline staging now verifies the native license and every bundled Google asset
 before modifying resources. Two Python regressions verify missing-model rejection

docs/evidence/windows-package-cpu-fallback.json

@@ -0,0 +1,12 @@
+{
+  "architecture": "x86_64",
+  "verified_files": 13,
+  "archive_sha256": "7fa9ccc87ee4fdd0d539898853c47e5b125b42518337a4a2d8393e98c54fb8b8",
+  "worker_requested_device": "auto",
+  "worker_actual_device": "cpu",
+  "no_gpu_condition": "GGML_DISABLE_VULKAN=1 only in child; SEARCHI_FORCE_CPU absent",
+  "worker_startup_query_and_exit_ms": 2509.7244000062346,
+  "query_dimensions": 768,
+  "decoder": "ffprobe version n9.0.2-27-g7e93014c5b-20261012 Copyright (c) 2007-2026 the FFmpeg developers",
+  "scope": "Real packaged worker default-mode CPU fallback with disabled provider; no GPU, native UI or clean-machine certification"
+}