Use isolated document extraction in shared indexing and desktop reconciliation

docs/EXTRACTION-ISOLATION.md

@@ -126,6 +126,27 @@ the initially ignored actual-worker core test then passed explicitly, giving
 60 executed checks. Strict all-target Clippy passed for both crates. No GPU or
 model inference was used. Windows Job configuration/verification is exercised,
 but adversarial memory-exhaustion behavior and native Unix limits remain open.
-Default indexing still uses the earlier in-process parser; worker discovery,
-post-parser source validation, production adapter activation and required
-release staging are the next steps. No published installer contains this helper.
+## Shared indexing adapter
+
+Current source uses the helper for PDF/DOCX by default. Headless clients discover
+it beside their executable; desktop indexing explicitly selects the bundle
+resource directory, including watcher reconciliation. An internal environment
+override supports validation. The in-process adapter is an explicit test API,
+never a failure fallback. Missing or failed helpers leave filenames searchable,
+record an extraction error, clear obsolete passages and retry on later rescans.
+
+After parsing, bounded rereading checks the original byte digest and metadata
+before publication. Cancellation rolls back reconciliation. Six document tests
+passed, including genuine PDF extraction through the normal worker adapter.
+A controlled subprocess test also passed mutation with identical size/restored
+mtime during parsing and cancellation during parsing; both preserve the old
+index through rollback. Strict core Clippy and formatting passed. An earlier
+full-core run hit a two-second parent fixture timeout; that broader run is not
+claimed green by these focused results.
+
+Required helper build/staging and release packaging remain open. No published
+installer contains this helper. Do not publish current source without it.
+
+Desktop integration validation: 46 native tests passed on Windows with CPU-only
+settings. The desktop lockfile now records the shared process adapter dependencies.
+This checks compiled integration, not installed helper discovery or native UI interaction.