Harden worker IPC and recoverable runtime staging

docs/BUILDING.md

@@ -35,8 +35,13 @@ cargo test -p searchi-service --test google_cpu -- --ignored --nocapture
 cargo test -p searchi-service --lib google_cpu_preserves -- --ignored --nocapture
 ```
 
-The worker is statically linked with the MSVC CRT on Windows. Staging copies
-it and the llama.cpp license into the desktop resources directory. Add
+The explicit internal CPU worker uses the static MSVC CRT on Windows; normal
+auto builds use the shared runtime described below. Staging verifies a complete
+candidate resource directory, then swaps it into place under a process lock.
+Its recovery journal restores an interrupted swap on the next invocation;
+failed restoration retains the previous backup. Existing unrelated fonts and
+media resources are preserved. Fault-injected process interruption is tested;
+power-loss durability is not certified. Add
 `--bundle-model` to staging for an offline model bundle after downloading;
 otherwise desktop setup provisions verified models on first launch. Search
 itself performs no network inference or downloads. The worker now uses the verified media projector for genuine image/audio embeddings. The FFmpeg script stages verified standalone decoders and their notices.
@@ -59,25 +64,55 @@ supports `--backend auto|metal|vulkan|cuda` builds with CPU fallback; do not
 exercise those acceleration backends in this VM. Their execution and failure
 recovery require validation on the corresponding release hardware.
 
+### Isolated native desktop validation
+
+Set `SEARCHI_DATA_DIR` to an absolute directory to isolate the desktop's
+settings and index for release QA or portable use. Normal launches use the OS
+app-data directory. Invalid overrides fail startup instead of falling back to
+the user's regular data. Model downloads still use the configured model
+directory or managed cache, so isolated tests should also configure a verified
+fixture model directory in their own settings.
+
+```powershell
+$env:SEARCHI_DATA_DIR = 'C:\searchi-qa-data'
+$env:SEARCHI_FORCE_CPU = '1'
+$env:WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS = '--disable-gpu --disable-accelerated-video-decode'
+```
+
+Extract and launch the entire Release archive outside the source checkout.
+Direct Cargo release builds must embed the frontend:
+
+```powershell
+cargo build --manifest-path apps/desktop/src-tauri/Cargo.toml --release --features custom-protocol --locked
+```
+
+The crate rejects Release compilation without this feature; the Tauri build
+CLI enables it automatically. A development-server URL is not a release gate.
+Record native window interaction separately from process startup, browser
+screenshots and worker inference; those are different release gates.
+
 ## Headless Linux Google search
 
 These are the current script and CLI interfaces, not evidence of an executed
-Linux release. On a native Linux build host, run from the repository root:
+Linux release. On a native Linux build host with Vulkan development libraries
+and `glslc`, run from the repository root:
 
 ```sh
-python3 tools/embeddinggemma2/build_runtime.py --backend cpu --jobs 2
+python3 tools/embeddinggemma2/build_runtime.py --backend auto --jobs 2
 python3 tools/embeddinggemma2/download.py
 python3 tools/media-runtime/provision.py
-export SEARCHI_FORCE_CPU=1
 cargo build --release -p searchi-cli --locked
 ./target/release/searchi index --db searchi.sqlite --root /path/to/documents
-./target/release/searchi embed --db searchi.sqlite --model-dir .searchi/models/embeddinggemma2 --embedding-worker .searchi/runtime/cpu/searchi-gemma-worker --ffmpeg .searchi/media-runtime/bin/ffmpeg --ffprobe .searchi/media-runtime/bin/ffprobe --cpu-threads 1
-./target/release/searchi search --db searchi.sqlite 'supplier cancellation terms' --model-dir .searchi/models/embeddinggemma2 --embedding-worker .searchi/runtime/cpu/searchi-gemma-worker --cpu-threads 1
+./target/release/searchi embed --db searchi.sqlite --model-dir .searchi/models/embeddinggemma2 --embedding-worker .searchi/runtime/auto/searchi-gemma-worker --ffmpeg .searchi/media-runtime/bin/ffmpeg --ffprobe .searchi/media-runtime/bin/ffprobe --cpu-threads 1
+./target/release/searchi search --db searchi.sqlite 'supplier cancellation terms' --model-dir .searchi/models/embeddinggemma2 --embedding-worker .searchi/runtime/auto/searchi-gemma-worker --cpu-threads 1
 ```
 
 `embed` builds document, image, video and audio/music vectors by default. Use
 `--text-only` explicitly to omit media. Default media indexing needs paired
 FFmpeg/FFprobe paths or packaged helpers beside the installed CLI.
+This normal worker detects usable acceleration and falls back to CPU. Internal
+CPU-only model tests may use `--backend cpu` and `SEARCHI_FORCE_CPU=1`; those
+test artifacts are not a separate distribution edition.
 
 `searchi setup --model-dir PATH` is an alternative verified model-provisioning
 command. It provisions model assets, not the native worker. Package the worker