fix: verify complete offline assets before replacing staged runtime

docs/ROADMAP.md

@@ -49,6 +49,9 @@ Status: implementation started; no production release yet. Windows VM tests use
 - [ ] Isolated extraction workers with timeouts and resource ceilings.
 
 ## 5. Release gates
+- [x] Preflight native license and the complete offline Google model pair before
+  modifying staged resources; corrupted/missing assets preserve existing worker.
+- [ ] Atomic resource staging and interrupted-copy recovery for release bundles.
 - [x] Shared monotonic Basic/Debug search metrics, granular bounded engine traces,
   actual worker query diagnostics, and headless JSON performance output.
 - [ ] Verify detailed performance UI interaction on native desktop platforms;

docs/VALIDATION.md

@@ -7,6 +7,12 @@ and `SEARCHI_FORCE_CPU=1`.
 
 ## Current integration checkpoint (2026-10-12)
 
+Offline staging now verifies the native license and every bundled Google asset
+before modifying resources. Two Python regressions verify missing-model rejection
+and same-size corruption in the second model leaving the existing staged worker
+untouched. Actual CPU worker staging passed. This preflight does not prove atomic
+recovery from interruptions during the subsequent copies; that gate remains open.
+
 Gitea Actions were disabled for **karl/searchi** at Karl's explicit request;
 the API read-back confirmed `has_actions:false`. Fifteen old stuck runs and
 the subsequent repair run were cancelled. Diagnosis found unavailable native