Add resource-checked extraction worker and bounded parent process owner

docs/EXTRACTION-ISOLATION.md

@@ -43,8 +43,10 @@ Source files and SQLite are not one atomic transaction. Preserve semantic and
 agent excerpt provenance checks and clear old passages on parser rejection.
 
 - [x] Buffer API and typed protocol with independent limits and genuine fixtures.
-- [ ] Headless Rust helper with no GUI dependencies or arbitrary path access.
-- [ ] Parent process deadlines, cancellation, resource setup and kill/reap tests.
+- [x] Headless Rust helper with no GUI dependencies or arbitrary path arguments
+  (Windows execution tested; native Unix resource verification remains open).
+- [x] Parent process deadlines, cancellation, resource setup and kill/reap tests
+  on Windows; native Unix execution remains open.
 - [ ] Shared-engine document adapter, explicit failures and post-parser guards.
 - [ ] Normal helper discovery and required release staging on all target systems.
 - [ ] Relocated Windows/WSL packages and actual parser fixtures through the helper.
@@ -100,3 +102,30 @@ parsing or structured parser rejection must produce one bounded, flushed frame;
 the parent independently checks EOF and exit status. None of these limits is a
 filesystem/network sandbox or proof that every malicious parser input is safe.
 The helper does not add arbitrary file reads or writes to its application API.
+
+## Windows worker and process-owner evidence
+
+The new workspace binary and `searchi-core::extraction_process` now work
+together. Three real worker subprocess tests cover DOCX parsing, corrupt PDF
+rejection, malformed/trailing input, wrong version/hash, excessive header,
+unknown arguments and missing Windows Job protection. Two further tests execute
+the actual helper through the shared parent adapter, checking paragraph text,
+source position, exact digest and parser-rejection/cancellation distinction.
+
+Four controlled child-process cases exercise crash, oversized/trailing output,
+excess stderr, blocked input, missing response, timeout and cancellation.
+The stderr case has a valid response, so an unrelated missing-frame failure
+cannot mask the stderr budget. Per-test helper compiler activity is serialized
+to avoid contaminating two-second test deadlines; product deadlines were not
+relaxed. Owned temporary fixtures are cleaned after process/thread cleanup.
+Unix cleanup defers reaping until all I/O events, avoiding use of a reaped
+leader's process-group identifier. Native Unix execution still needs validation.
+
+The final combined Windows CPU run passed 59 tests (54 core and 5 worker);
+the initially ignored actual-worker core test then passed explicitly, giving
+60 executed checks. Strict all-target Clippy passed for both crates. No GPU or
+model inference was used. Windows Job configuration/verification is exercised,
+but adversarial memory-exhaustion behavior and native Unix limits remain open.
+Default indexing still uses the earlier in-process parser; worker discovery,
+post-parser source validation, production adapter activation and required
+release staging are the next steps. No published installer contains this helper.