Prepare text search during media setup and retain query sessions through promotion

docs/EARLY-TEXT-SETUP.md

@@ -0,0 +1,70 @@
+# Text readiness during media setup
+
+The desktop can prepare the real Google query session as soon as the pinned
+309,855,456-byte backbone is verified. The 554,821,024-byte media projector
+continues downloading independently. Verification events follow exact SHA checks
+and atomic installation; byte-count progress never substitutes for verification.
+The complete model bundle still requires both artifacts.
+
+The UI distinguishes warmed search, text/model readiness, media/model readiness
+and indexing admission. A media-download error remains visible with a retry
+action while the retained text query session stays usable. Worker capability
+alone does not establish that the media projector is installed.
+
+## Index coverage and promotion
+
+Initial text indexing can run during projector download after query preparation.
+Text-only status counts text passages, rather than repeatedly treating every
+unindexed media file as a reason to rebuild. The automatic attempt key includes
+requested coverage, so completed media setup can trigger full promotion.
+
+A retained reader selects a compatible active publication inside the same SQL
+read snapshot. Prepared-graph lookup uses that publication's actual fingerprint.
+The query model and task-specific vector LRU remain loaded through promotion.
+Model, dimensions and text-window identity remain strict.
+
+Text tasks use a validated component policy shared by new text-only/full-media
+generations. Cross-coverage donors are admitted only from the current active
+generation after bounded metadata checks; the existing exact-policy donor
+lookup across completed generations remains available. Media donors still
+require the exact media generation policy. Completed chunks, exact extraction
+bytes and persisted ranges must pass the existing provenance checks.
+Historical text-only or custom-media text tasks using the previous
+whole-generation policy can need a one-time re-encode; their lexical and
+semantic readability is preserved.
+
+Early setup never downgrades an existing compatible full media generation,
+including a stale one during projector repair. The final decision is made under
+the index build lock; a stale UI status snapshot cannot bypass it. Updates resume
+after media setup is ready. Explicit CLI text-only builds retain their behavior.
+
+## Actual validation
+
+Windows VM tests force CPU. The genuine Google `early_text_google_cpu` regression
+passed in **42.94 seconds** with the verified normal worker, two text sources and
+one real image. It opened and warmed the reader before the first publication,
+then verified early remembered-text retrieval and citations, prepared ANN handoff,
+full image promotion with **zero document re-encodes**, identical text-vector
+bytes and retained query-cache calls. A changed source was suppressed, and the
+guarded text builder preserved the full generation. This is a correctness fixture,
+not a cold-download, first-input, p95 or representative-library performance result.
+
+Seven additional service control tests cover coverage, mutation, strict identity,
+donor reuse and publication admission; they do not produce semantic-quality
+evidence. Desktop state tests cover early text admission, media failure and full
+index preservation. Frontend tests cover coverage promotion, retry visibility,
+legacy status and incompatible-generation readiness.
+
+The final Windows CPU workspace run passed **137 tests**, with **24 explicitly
+ignored** integration/resource checks. Desktop Rust passed **32 tests**, frontend
+passed **51**, and both strict all-target Clippy checks, formatting and the
+frontend production build passed. The actual Google integration above was run
+separately; ignored entries in the default suite are not execution evidence.
+
+Native UI interaction during a genuine delayed HTTPS media download, failure,
+retry and promotion remains to be executed. The prepared Linux QA plan uses only
+an owned loopback CONNECT proxy and isolated app environment; it does not change
+the product's pinned download URL or verification. Native Windows/macOS, GPU,
+large libraries and actual first-input measurements remain open. Document indexing
+still needs to finish a publishable generation; earlier model readiness does not
+make a large folder's content instantaneously available.

docs/ROADMAP.md

@@ -193,8 +193,12 @@ Audit and measured priorities: [EMBEDDINGGEMMA2-AUDIT.md](EMBEDDINGGEMMA2-AUDIT.
     downloading; preserve verified assets and honest media setup status.
     - [x] Typed backbone/projector verification callbacks with full-pair setup
       semantics preserved; 16 asset tests passed, including gated media download.
-    - [ ] Integrate explicit text/media coverage, retained query readiness and
-      media retry status across engine/desktop; verify actual first use.
+    - [x] Integrate explicit text/media coverage, retained query readiness and
+      media retry status across engine/desktop; genuine CPU promotion reuses
+      identical document vectors with zero document re-encodes.
+      See [early text setup](EARLY-TEXT-SETUP.md).
+    - [ ] Verify native first use during genuine delayed media download,
+      failure/retry and promotion; record actual first-input timing separately.
 - [ ] Buffered bounded media IPC and linear UTF-8 source-window offset processing.
 - [ ] Evaluate 256d MRL and content-specific vision budgets on independent data.
 - [ ] Validate GPU precision, synchronization-aware timings, parity and fallback