Harden worker IPC and recoverable runtime staging

docs/SEMANTIC.md

@@ -20,6 +20,12 @@ under the opt-in minilm-proof feature and tools/semantic-proof/HISTORICAL.md.
 The persistent native helper uses bounded NDJSON over stdin/stdout. It has no
 HTTP server or download code. Rust verifies the text model's length and SHA256
 before starting it. Setup provisions assets; search never downloads them.
+Each request has one 180-second IPC deadline across pipe writing and response
+reading. Single-slot queues bound pending work. A stalled write or response
+kills/reaps the helper and joins both IPC threads; only transport failures
+qualify for a bounded CPU restart. Malformed/oversized responses remain
+protocol errors. Cleanup assumes the shipped helper spawns no descendants
+holding its pipe handles, matching the native implementation.
 
 Production device mode is auto, with available compiled acceleration and CPU
 fallback. Model/context initialization and returned inference/nonfinite-output