Preserve explicit code candidates and expose verified model asset milestones

docs/LINUX-DESKTOP-VALIDATION.md

@@ -219,3 +219,56 @@ process swap; their private `/dev/dxg` was the null device (1:3). Owned shutdown
 ended the app group with SIGTERM and Xvfb with status zero. Subsequent process
 inspection found no remaining app/worker/WebKit/Xvfb/DBus/clipboard helpers,
 and the outer `/dev/dxg` remained the real device (hex a:102).
+
+## Native query-role validation: `5d9cfc4`
+
+Executed on the same provisioned Ubuntu 24.04 x86-64 WSL host. The isolated
+normal `auto` worker was rebuilt with one job, retaining Vulkan and CPU modules.
+All inference used `SEARCHI_FORCE_CPU=1`; the benchmark additionally requested
+`--device cpu` and checked that no Vulkan module loaded. Windows staged resources
+were not changed. Worker SHA-256:
+`b52d50a1e676bd4bf64124daff1c4ce83d86a8bde01e4eaf09838cbb24a4c28f`.
+
+Actual Google checks passed:
+
+- `query_context_cpu`: one passed in **42.88 s**, covering query role/context
+  negotiation, unchanged real vectors/ranking, multilingual CodeRetrieval,
+  exact 512-token boundary, nonfatal oversized rejection, indexing/media guards
+  and full-context document windows. Compilation took 1m 06s.
+- CLI/MCP `actual_google_cli_and_mcp_use_query_role_with_cited_results`: one
+  passed in **38.73 s**, including real indexing with the full role, foreground
+  CLI search, retained MCP query role/context and guarded source excerpts.
+
+Logs remain in the native cache as `query-role-native-build.log`,
+`query-context-linux-test.log`, and `query-context-linux-mcp.log`. These tiny
+fixtures establish native role/client correctness, not representative relevance
+or a release package gate.
+
+After correctness tests and other agents' downloads were terminal, a paired
+benchmark ran six fresh workers, alternating order, three per role, one inference
+thread. Cached model bytes were verified once in **241.48 ms** before process
+trials; process startup excludes that verification and desktop preparation.
+
+| Median observed measurement | Indexing 2048 | Query 512 |
+| --- | ---: | ---: |
+| Startup to ready | 717.08 ms | 564.02 ms |
+| First query IPC/inference | 67.13 ms | 66.89 ms |
+| Ready PSS | 405,303,296 bytes | 405,278,720 bytes |
+| Ready RSS | 406,806,528 bytes | 406,773,760 bytes |
+| Ready private dirty resident pages | 103,739,392 bytes | 103,735,296 bytes |
+| After query PSS | 410,157,056 bytes | 410,001,408 bytes |
+
+Linux resident/PSS observations were effectively unchanged. They must not be
+reported as the Windows private commitment saving; this benchmark does not
+measure Linux virtual commitment. The startup samples are small cached-process
+observations, not cold disk, actual first UI input, pressure behavior or warm p95
+proof. Mapped model pages contribute to resident/PSS figures; do not sum them
+as independent model allocations across workers. Raw paired samples are retained
+locally in `.searchi/qa/query-context-linux.json`; native benchmark output is
+`query-context-linux-benchmark.log`. The benchmark itself also checked nonfatal
+rejection of a direct indexing operation followed by a successful code query.
+
+All owned test and benchmark handles ended successfully. Subsequent process
+inspection found no surviving Google workers, Cargo or Rust compiler processes.
+Native desktop packaging with this new worker, actual GPU, macOS and
+representative performance remain open.