Record native Linux CPU media helper validation

docs/ROADMAP.md

@@ -45,6 +45,8 @@ Status: implementation started; no production release yet. Windows VM tests use
 - [ ] Improve precise spoken-passage localization, music hard negatives and
   calibrated handling of queries without a relevant match.
 - [ ] Package and verify decoders on every release OS; test production acceleration.
+- [x] Native Linux x86-64 pinned decoder provenance, startup, WAV probe and CPU
+  decode; broader codec/ABI coverage and desktop packaging remain open.
 - [ ] CPU OCR, image retrieval, audio transcription, video segment locations.
 - [ ] Isolated extraction workers with timeouts and resource ceilings.
 

docs/VALIDATION.md

@@ -5,7 +5,18 @@ inference, FFmpeg decoding and WebView tests use CPU only. UI launches set
 `WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS='--disable-gpu --disable-accelerated-video-decode'`
 and `SEARCHI_FORCE_CPU=1`.
 
-## Current integration checkpoint (2026-10-12)
+## Native Linux media checkpoint (2026-10-13)
+
+Pinned BtbN Linux x86-64 FFmpeg/FFprobe archive size and SHA-256 verification
+passed under Ubuntu 24.04 WSL. Both native tools report the pinned version;
+FFprobe inspected the four-second speech fixture and FFmpeg decoded it to a
+null sink using one CPU thread with hardware acceleration disabled. Exact
+tool/fixture hashes and scope are recorded in
+[Linux media evidence](evidence/linux-media-runtime.json). This verifies decoder
+startup and WAV decoding only; playback, other codecs, desktop packaging,
+distribution ABI coverage and GPU operation remain release gates.
+
+## Integration checkpoint (2026-10-12)
 
 The subsequent rebuild-policy fix passes the Windows workspace suite (93
 passed, 12 explicitly ignored) and strict service Clippy. A separately executed

docs/evidence/linux-media-runtime.json

@@ -0,0 +1,23 @@
+{
+  "platform": "Ubuntu 24.04 x86_64 under WSL",
+  "cpu_only": true,
+  "provider": "BtbN/FFmpeg-Builds",
+  "release": "autobuild-2026-10-12-13-12",
+  "archive_sha256": "12445b38a4700ba1ae7c9c7e57062f602c927dc4187555bfadc9f3e2f75f05b0",
+  "tools": {
+    "ffmpeg": {
+      "sha256": "8596cfc936ce24a1366f0a9da6aad60a9fc522aa1a9f1debe4d5abec7d0bf84c",
+      "version": "ffmpeg version n9.0.2-27-g7e93014c5b-20261012 Copyright (c) 2000-2026 the FFmpeg developers"
+    },
+    "ffprobe": {
+      "sha256": "0c14dda3e944613d2c60230ec82c7e98880a394086b82ce5cda7e12e3a6c3019",
+      "version": "ffprobe version n9.0.2-27-g7e93014c5b-20261012 Copyright (c) 2007-2026 the FFmpeg developers"
+    }
+  },
+  "fixture": "digup-speech.wav",
+  "fixture_sha256": "bfbc029af6c0bacdbaccfa6c695d6772373453249386fa6a62a7b02a31d33e1f",
+  "audio_duration_seconds": "4.000000",
+  "audio_decode_to_null": "passed",
+  "limits": "one CPU thread; hardware acceleration disabled",
+  "scope": "native decoder startup, WAV probe and decode; no playback, video codec matrix, neural relevance or GPU validation"
+}

tools/media-runtime/README.md

@@ -16,7 +16,12 @@ resources directory. Executables and archives are ignored by Git. No global
 installation occurs. Movie/audio decoding runs in bounded subprocesses.
 
 Windows x86-64/ARM64 and Linux x86-64/ARM64 have pinned artifacts. Only Windows
-x86-64 has been executed here. A vetted macOS decoder build/staging path remains
+x86-64 and Linux x86-64 have executed CPU checks. Linux checks verify pinned
+archive provenance, both tool versions, a four-second speech WAV probe and
+decoding to a null sink with hardware acceleration disabled. This does not
+certify playback or a codec matrix; see
+[Linux evidence](../../docs/evidence/linux-media-runtime.json).
+A vetted macOS decoder build/staging path remains
 a release gate; generic media code can accept native tools through explicit paths.
 The selected build is FFmpeg 9.0.2 with LGPL configuration. Keep original notices
 and corresponding source/build provenance with distribution; installer licensing