Prevent duplicate desktop model sessions and record calibration evidence

docs/RELEVANCE-CALIBRATION.md

@@ -14,8 +14,9 @@ an exploratory topic query, so these absence labels require concrete artifacts.
 The source inventory and blinded review have been completed. Independent AI
 review agreed with all expected file sets; the final labels are frozen in
 `fixture.json` with hashes and a UTC timestamp in `fixture.lock.json`.
-No retrieval run, threshold selection or ranking change has occurred. Agent
-agreement will not be described as human review.
+The calibration-only baseline has run with genuine Google CPU inference.
+No threshold selection or ranking change has occurred. Agent agreement will
+not be described as human review.
 
 The first independent agent review detected Windows-1252 mojibake in the
 authored German requests and ambiguity in the wildcard-comparator request.
@@ -46,3 +47,32 @@ why instead of altering this diagnostic silently.
 
 This small corpus does not close independent human relevance, media abstention,
 music discrimination, speech localisation or production-scale quality gates.
+
+## Recorded CPU baseline, 2026-10-13
+
+The shared-engine runner completed all 24 calibration requests plus six code
+intent requests repeated under Code scope. Held-out requests were not evaluated.
+All 14 frozen sources remained available as distractors.
+
+| Scope | Positive requests | Lexical top-1 | Semantic / hybrid top-1 | Absent requests returning semantic / hybrid neighbours |
+| --- | --- | --- | --- | --- |
+| All files | 16 | 1/16 | 16/16 | 8/8 |
+| Additional Code scope requests | 4 | 0/4 | 4/4 | 2/2 |
+
+The additional code rows repeat intents; they are not independent observations.
+Lexical search returned no results for the absent requests. Semantic similarity
+still retrieves related neighbours when the requested source is absent. This
+baseline therefore supports useful positive retrieval, but does not establish
+reliable abstention or justify a cutoff chosen without further calibration.
+
+Ignored raw evidence: `.searchi/qa/calibration-v2-baseline.json`, SHA-256
+`56f42c523527dd748918bb8f17be6bd7818158227e692fccaf387d915f9d0a94`.
+The report records completion, calibration split and `held_out_evaluated: false`.
+Frozen fixture SHA-256:
+`000047fd17accd315b6138093bbdc9f353cd877b4bf1958fbe336e4a6b10cd2e`.
+
+This ordered debug diagnostic used one CPU thread and the normal worker
+`c01cb3ec13cfca722ee768e8350e1399a8b9a4d14a24a35adc3473a5cfc82a73`.
+Lexical indexing took 19.9823 ms, semantic indexing 74,545.518 ms and retained
+query-session startup 7,433.3914 ms. These are diagnostic setup measurements,
+not native first-search latency or warm production p95.

docs/ROADMAP.md

@@ -1,6 +1,6 @@
 # Production readiness roadmap
 
-Status: implementation started; no production release yet. Windows VM tests use CPU only.
+Status: initial Windows v0.1.0 published and installed; broader production gates remain open. Windows VM tests use CPU only.
 
 Karl's release priority, 2026-10-13: publish a usable first Windows version and
 install it on DEV-WIN11 now. Extensive platform/GPU, clean-machine, signing and
@@ -43,6 +43,9 @@ release. Keep their evidence and unchecked production gates intact.
   see [incremental semantic design](INCREMENTAL-SEMANTIC.md).
 
 ## 3. Desktop
+- [x] Official single-instance transport with isolated explicit profiles;
+  Windows CPU duplicate launch exits without a second query worker.
+  See [launch evidence](SINGLE-INSTANCE.md); visual focus and other OS checks remain open.
 - [x] Persisted solid/glass/frosted appearance and bounded background tint;
   opaque reading surfaces, serialized settings updates and high-contrast fallback.
 - [ ] Verify native glass visually on Windows 11 22H2+; macOS/Linux currently
@@ -250,7 +253,9 @@ Completion requires recorded evidence; targets are not measured results.
       after independent AI review; verify exact Git-preserved source/label bytes.
     - [x] Add a shared-engine calibration-only runner retaining raw cosine,
       lexical provenance, hybrid ranks and atomic incomplete evidence.
-    - [ ] Execute calibration, freeze the proposed relevance policy, then
+    - [x] Execute the frozen calibration-only baseline with genuine Google CPU
+      inference; preserve raw results and leave held-out requests unevaluated.
+    - [ ] Freeze the proposed relevance policy, then
       evaluate held-out queries without tuning against their results.
   - [x] Explicit English/German code intent vetoes exclusive audio routing;
     actual Google CPU regression preserves code among qualifying audio candidates.

docs/SINGLE-INSTANCE.md

@@ -0,0 +1,56 @@
+# Desktop launch behavior
+
+Launching searchi again shows, restores and focuses the existing main window,
+then focuses its search field through the existing `focus-search` event. It does
+not interpret arguments, open supplied files, or start another index/model session.
+
+The [official Tauri single-instance plugin](https://v2.tauri.app/plugin/single-instance/)
+is registered first, before other plugins and application setup. Its native
+transport provides duplicate detection; searchi does not maintain its own mutex.
+
+Normal launches retain `dev.searchi.desktop`. An explicit absolute
+`SEARCHI_DATA_DIR` creates an isolated desktop profile. Before plugin setup,
+searchi resolves its canonical existing ancestor and any missing suffix without
+creating the directory, then appends a SHA-256 of its native path
+bytes to the runtime identifier. Windows uses UTF-16 units; Unix uses raw path
+bytes. The identifier does not disclose the profile path. This also isolates
+identifier-derived WebView/app-data locations. Same canonical profiles converge;
+different profiles can run concurrently. This override is a developer/portable
+profile mechanism, not a command-line search interface.
+
+The plugin owns its Windows mutex, Linux D-Bus registration, or macOS socket.
+Independent Linux D-Bus sessions have independent instances. Snap/Flatpak need
+the upstream-documented D-Bus permissions; those packages remain unvalidated.
+The previously published v0.1.0 application predates this change and cannot be
+retroactively notified by the plugin.
+
+## Validation
+
+- Unit checks cover unchanged normal identity, rejected relative profiles,
+  Unicode profile paths, canonical aliases, stable/different identities and
+  absence of readable paths in identifiers.
+- Native duplicate-launch behavior and window restoration require a running
+  desktop; platform evidence is recorded separately from unit checks.
+- Windows VM inference tests must force CPU. No native macOS/Linux duplicate
+  launch or GPU claim is implied by the implementation.
+
+### Windows VM evidence, 2026-10-13
+
+- Desktop tests: 35 passed. Final strengthened profile tests: 2 passed.
+  Strict desktop all-target Clippy and formatting passed.
+- Owned custom-protocol debug executable SHA-256
+  `93a22d5949fc0837f23e8455497b11333499bf41a5650b3f88493d5142de627f`.
+- Fresh isolated profile A launched as PID 10624 using the normal bundled
+  worker SHA-256 `c01cb3ec13cfca722ee768e8350e1399a8b9a4d14a24a35adc3473a5cfc82a73`.
+  Its genuine Google CPU query worker PID 14520 remained identical before and
+  after duplicate PID 19240 exited successfully with code 0. The worker command
+  retained `--threads 1 --device cpu --role query`.
+- Concurrent distinct profile B PID 12096 remained alive alongside profile A.
+  Profile B deliberately used an unavailable worker to avoid another inference
+  model; this proves desktop profile isolation, not semantic readiness there.
+- Only owned test process trees were terminated afterward. Installed user app
+  PID 7716 remained alive and was never upgraded, focused or terminated by the
+  test. Raw local evidence: `.searchi/qa/single-instance/normal-result.json` and
+  `isolation-result.json` (ignored).
+- This is process/lifecycle evidence. Native visual focus, restoration of a
+  minimized window and frontend search-field focus remain unverified.