Specify coordinated worker resource and parent lifetime contract

docs/EXTRACTION-ISOLATION.md

@@ -77,3 +77,26 @@ preservation, version/hash/location/size failures and truncated frames. Strict
 all-target Clippy, Rust formatting and diff checks passed. Product extraction
 defaults and code/text parsing are unchanged. No separate worker was launched;
 process isolation and resource ceilings remain open.
+
+## Worker and parent implementation contract
+
+The next slice adds a separate `searchi-extract-worker` binary and a shared-core
+parent adapter. Neither changes indexing defaults until integration and packaging
+are complete. The adapter owns the child and three bounded I/O tasks; its total
+deadline covers input writes, response/diagnostic reads and process exit. Cancel,
+timeout, resource failure and malformed protocol remain distinct failures.
+
+Windows uses a parent-owned Job Object with a 512-MiB process commitment limit
+and kill-on-close. The parent assigns the job before writing input. The worker
+reads only the four-byte frame prefix before checking current job membership and
+limits, then admits the header/payload. Prefix arrival synchronizes job setup
+without allowing document parsing first. It fails closed when protection is
+missing. Unix applies address-space and CPU limits before input; actual macOS
+semantics still require evidence. The proposed wall deadline is at most 30 s.
+
+The worker handles one request and no path arguments. Extra arguments/input,
+wrong framing or an unprotected Windows launch fail explicitly. Successful
+parsing or structured parser rejection must produce one bounded, flushed frame;
+the parent independently checks EOF and exit status. None of these limits is a
+filesystem/network sandbox or proof that every malicious parser input is safe.
+The helper does not add arbitrary file reads or writes to its application API.