Harden worker IPC and recoverable runtime staging

docs/VALIDATION.md

@@ -7,6 +7,39 @@ and `SEARCHI_FORCE_CPU=1`.
 
 ## Current integration checkpoint (2026-10-12)
 
+The reliability checkpoint passes 93 workspace tests on Windows and 93 on
+native Linux (Ubuntu 24.04 under WSL); each explicitly ignores 11 optional
+integration tests. Linux uses its native Rust toolchain and an isolated ext4
+build cache. This verifies headless core portability, not a Linux desktop,
+Linux native Google worker, GPU or installer. Windows desktop passes 17 tests;
+strict workspace and desktop Clippy checks pass. Five genuine Google model
+integration tests pass in forced-CPU mode.
+
+Worker IPC now applies one deadline across sending and receiving, with bounded
+queues and owned writer/reader threads. Transport failures terminate and reap
+the worker; eligible GPU transport failures retry on CPU. Invalid protocol
+responses remain errors. Fifteen semantic unit tests pass, including a blocked
+pipe and disconnected writer; one optional integration test is ignored.
+
+Resource staging passes 24 tests on Windows (one symlink-permission skip) and
+23 on Linux (two Windows-only skips). Locking, recovery, rollback preservation,
+link rejection and concurrent edits before the final swap are covered. Actual
+automatic-backend staging also succeeds. These are process-failure checks;
+power-loss durability and concurrent arbitrary writes after the final check
+remain release gates.
+
+The latest unsigned Windows archive launches outside the checkout with an
+embedded frontend at `http://tauri.localhost/`, isolated data, one real indexed
+document and a ready Google CPU semantic generation. The archive is
+145,217,175 bytes, SHA-256
+`fb454a9dbf258f51044796ab24a5942a8f90804d0824ca0e2dc5f59b7847ec3b`.
+Native accessibility confirms startup and status only. Input and screenshot
+capture remain denied by the environment; native interaction, appearance,
+clean-machine installation and GPU behavior are unverified. Release builds
+without the embedded-frontend feature now fail explicitly.
+
+The following package-dispatch evidence predates this reliability checkpoint:
+
 The normal Windows x64 package now includes baseline and optimized CPU DLLs
 with CPU/OS feature checks, plus the Vulkan backend. Shared DLLs use a common
 MSVC CRT: a first `/MT` prototype crashed because model file handles crossed