Stage and require verified extraction helper in Windows release packages

docs/BUILDING.md

@@ -27,6 +27,7 @@ python -m pip install cmake
 python tools/embeddinggemma2/build_runtime.py --backend cpu --jobs 2
 python tools/embeddinggemma2/stage_runtime.py --backend cpu
 python tools/media-runtime/provision.py --stage
+python tools/stage_extraction_worker.py
 python tools/embeddinggemma2/download.py
 $env:SEARCHI_FORCE_CPU = '1'
 $env:SEARCHI_GEMMA_MODEL_DIR = (Resolve-Path .searchi/models/embeddinggemma2).Path
@@ -297,3 +298,9 @@ Windows and Linux x86-64 startup and CPU decoding have executed here;
 other architectures and macOS decoder packaging remain gates.
 See [media runtime provenance](../tools/media-runtime/README.md) and
 [measured media limitations](MEDIA-QUALITY.md).
+
+PDF/DOCX indexing requires the bundled `searchi-extract-worker`. Build and stage
+it with `python tools/stage_extraction_worker.py` before desktop development or
+release packaging. Release builds reject a missing helper. Headless deployments
+place the platform helper beside the CLI executable. Parser failure retains
+filename search and exposes an extraction error; there is no in-process fallback.

docs/EXTRACTION-ISOLATION.md

@@ -150,3 +150,24 @@ installer contains this helper. Do not publish current source without it.
 Desktop integration validation: 46 native tests passed on Windows with CPU-only
 settings. The desktop lockfile now records the shared process adapter dependencies.
 This checks compiled integration, not installed helper discovery or native UI interaction.
+
+The optimized Windows helper built successfully and was copied into an owned
+validation directory outside `target`. The normal-adapter genuine PDF test
+passed against that relocated release helper (one test, 1.11 s). Its SHA-256 is
+`983156ddb96de1b4fb307564c1b882ffb75300e05f03f705ee8e2e668ff96ae1`.
+This is helper relocation evidence, not a finished installer check.
+
+## Windows release staging
+
+`tools/stage_extraction_worker.py` performs a locked optimized Cargo build,
+compares bounded core/worker/media build inputs before and after it, and stages
+only the helper and `extraction-worker.json`. Binary hash, size, architecture
+and source provenance are verified. Unrelated runtime resources are retained.
+Windows archive packaging requires the verified pair before output replacement;
+release desktop builds run the same verification before bundling.
+
+The real Windows build/stage/verification passed. Twenty-two tooling tests
+passed normally and under Python `-O`, including missing, stale, tampered and
+architecture-mismatched helpers plus failed builds and preserved unrelated files.
+Linux headless packaging and native macOS helper staging remain open. A complete
+updated Windows archive/installer has not yet been verified or published.