Use native Python command for Linux release verification and refresh rollout status

docs/EXTRACTION-ISOLATION.md

@@ -1,8 +1,8 @@
 # Document parser isolation
 
-Status: implementation started; current PDF/DOCX parsing still runs in the
-indexing process. Existing byte/output limits do not establish parser memory,
-CPU or crash isolation. This work does not delay the published Windows preview.
+Status: PDF/DOCX process isolation is included in Windows 0.1.3 and the updated
+Linux headless archive. Actual Windows/WSL parser checks passed. Native macOS
+and adversarial resource-exhaustion checks remain open.
 
 ## Required execution boundary
 
@@ -36,20 +36,19 @@ bindings over inventing a new process manager.
 ## Publication and rollout
 
 Current reconciliation holds a SQLite transaction across discovery, reads,
-parsing and writes. The current source-stat check is immediately after reading,
-before parsing. Add a post-worker source/revision check before inserting the
-result; retain the original parser-input digest, not a substituted later hash.
+parsing and writes. Source checks run after reading and again after document parsing, before
+inserting results, preserving the original parser-input digest.
 Source files and SQLite are not one atomic transaction. Preserve semantic and
 agent excerpt provenance checks and clear old passages on parser rejection.
 
 - [x] Buffer API and typed protocol with independent limits and genuine fixtures.
 - [x] Headless Rust helper with no GUI dependencies or arbitrary path arguments
-  (Windows execution tested; native Unix resource verification remains open).
+  (Windows and Ubuntu WSL execution tested; macOS resource semantics remain open).
 - [x] Parent process deadlines, cancellation, resource setup and kill/reap tests
-  on Windows; native Unix execution remains open.
-- [ ] Shared-engine document adapter, explicit failures and post-parser guards.
+  on Windows; actual Unix worker round trips also passed.
+- [x] Shared-engine document adapter, explicit failures and post-parser guards.
 - [ ] Normal helper discovery and required release staging on all target systems.
-- [ ] Relocated Windows/WSL packages and actual parser fixtures through the helper.
+- [x] Relocated Windows/WSL packages and actual parser fixtures through the helper.
 - [ ] Record startup/throughput/memory costs before considering persistent workers.
 - [ ] Validate remaining macOS and representative corrupt/large-source behavior.
 
@@ -144,8 +143,8 @@ index through rollback. Strict core Clippy and formatting passed. An earlier
 full-core run hit a two-second parent fixture timeout; that broader run is not
 claimed green by these focused results.
 
-Required helper build/staging and release packaging remain open. No published
-installer contains this helper. Do not publish current source without it.
+Required helper staging is implemented for Windows/Linux and included in their
+published packages. macOS staging remains open.
 
 Desktop integration validation: 46 native tests passed on Windows with CPU-only
 settings. The desktop lockfile now records the shared process adapter dependencies.
@@ -169,15 +168,15 @@ release desktop builds run the same verification before bundling.
 The real Windows build/stage/verification passed. Twenty-two tooling tests
 passed normally and under Python `-O`, including missing, stale, tampered and
 architecture-mismatched helpers plus failed builds and preserved unrelated files.
-Linux headless packaging and native macOS helper staging remain open. A complete
-updated Windows archive/installer has not yet been verified or published.
+Windows and Linux headless packaging are now verified and published. Native
+macOS helper staging remains open.
 
 Updated optimized desktop build passed with the required helper verification.
 The Windows archive built successfully; all 41 size/hash records matched
 its actual entries. The helper extracted from that archive passed genuine PDF
 indexing through the normal adapter (1.76 s). Archive SHA-256:
 `760259bbf07ed076857f0e47c0b536eb352e4d00973701bfe115d95f41989daf`.
-This archive is local evidence; a new installer has not been published.
+This local archive check preceded publication of the verified Windows 0.1.3 installer.
 
 ## Linux headless consistency
 
@@ -191,5 +190,5 @@ integration tests under Ubuntu WSL, CPU only: real DOCX, corrupt PDF, exact
 source digest, cancellation distinction and malformed protocol rejection.
 Unix resource setup executed; adversarial exhaustion was not tested. The initial
 WSL nested-virtualization warning did not prevent the terminal passing Cargo run.
-The public Linux archive remains the earlier release; updated archive build and
-relocated index checks remain open.
+The updated public Linux archive passed relocated PDF/DOCX indexing and genuine
+Google CPU search; see [package evidence](LINUX-HEADLESS.md).