WendaoSearch.jl is the Julia package boundary for mixed-relation graph search enhancements that augment Wendao's graph engine.

The package is not a replacement for Wendao itself.

WendaoArrow.jl is a required direct dependency of this package.

GadgetSearch.jl is now a required direct solver dependency for the Phase 2 adapter seam.

In the current development workspace, WendaoArrow.jl resolves from the sibling checkout at ../WendaoArrow.jl, while GadgetSearch.jl is resolved from the pinned GitHub source recorded in Project.toml.

GadgetSearch.jl is intentionally locked by GitHub rev in Project.toml so the solver adapter does not drift with an unpinned sibling checkout.

WendaoSearch.jl owns:

1. mixed-graph query types
2. layered retrieval plan types
3. candidate-subgraph structural evidence models
4. package-local helpers for structural rerank normalization

WendaoSearch.jl does not yet own:

1. promoted Rust-owned Arrow Flight services
2. full solver integration across every structural route
3. Rust-owned route promotion
4. the main Wendao graph store

WendaoSearch.jl now depends directly on WendaoArrow.jl.

WendaoSearch.jl now also depends directly on GadgetSearch.jl, but solver state stays package-local and does not widen the WendaoArrow.jl transport boundary.

That rule exists because:

1. WendaoArrow.jl is the Julia transport and contract substrate
2. WendaoSearch.jl should not grow a parallel Arrow or Flight boundary
3. future schema and route promotion should build on one shared Julia substrate

The package is being shaped around three ideas:

1. Wendao retrieval operates over a mixed-relation graph
2. graph retrieval should be layered rather than flat
3. structural solver lanes should evaluate bounded candidate subgraphs instead of the full graph

The reference design documents live under docs/.

The initial package surface focuses on stable bootstrap types:

1. QueryAnchor
2. QueryEdgeConstraint
3. QueryGraph
4. RetrievalLayerSpec
5. LayeredRetrievalPlan
6. CandidateSubgraph
7. StructuralEvaluation

The first package-local contract slice now also defines:

1. StructuralRerankRequest
2. StructuralRerankResult
3. ConstraintFilterRequest
4. ConstraintFilterResult
5. CapabilityManifestRequest
6. CapabilityManifestEntry

The first package-local schema slice now also defines:

1. ArrowColumnDescriptor
2. package-local request and response column inventories
3. package-local route draft descriptors
4. schema version v0-draft

The package-local row-normalization slice also defines:

1. request row helpers for structural_rerank and constraint_filter
2. response row helpers for structural_rerank and constraint_filter
3. schema-ordered columntable helpers for those same draft surfaces
4. request and response row helpers for capability_manifest

The package-local draft payload slice now also defines:

1. request and response Arrow-table helpers for structural_rerank
2. request and response Arrow-table helpers for constraint_filter
3. route-metadata helpers under the package-local wendao_search.* namespace
4. request and response Arrow-table helpers for capability_manifest

Those payload helpers are thin adapters over WendaoArrow.schema_table(...). WendaoSearch.jl owns the route-specific metadata and draft column shape, but it no longer owns raw Arrow table materialization.

The package-local draft Flight slice now also defines:

1. draft route descriptor helpers for the first three package-local routes
2. draft request-header helpers for those same routes
3. package-local x-wendao-search-* request headers layered over WendaoArrow.flight_schema_headers(...)

The package-local draft DoExchange slice now also defines:

1. draft exchange-request helpers for structural_rerank
2. draft exchange-request helpers for constraint_filter
3. draft exchange-request helpers for capability_manifest
4. thin route adapters over WendaoArrow.flight_exchange_request(...)

The package-local typed exchange slice now also defines:

1. response decoders for structural_rerank and constraint_filter
2. typed exchange helpers that call the upstream WendaoArrow send surface
3. route-shaped local-service or Flight-client helpers that return StructuralRerankResult or ConstraintFilterResult

The package-local result semantics slice now also defines:

1. validation helpers for structural rerank and constraint filter result sets
2. deterministic summary helpers over those same typed results
3. package-local host-facing result checks without changing the transport layer

The package-local host ingest slice now also defines:

1. host-facing ingest envelopes for structural_rerank and constraint_filter
2. exchange-to-ingest helpers layered over the typed exchange surface
3. stable candidate-id, top-result, and explanation projections for Wendao host integration

The package-local draft service slice now also defines:

1. SearchServiceDescriptor
2. deterministic demo processors for structural_rerank and constraint_filter
3. deterministic demo and contract-probe processors for capability_manifest
4. build_demo_flight_service(...) for local in-process draft route testing
5. build_contract_probe_flight_service(...) for exact-contract live narrowing without demo-processor logic
6. warm_search_flight_service(...) for startup self-probing before external traffic
7. a scripts entrypoint under scripts/run_search_service.jl
8. a live starter example under examples/search_service.jl
9. one startup runtime summary log that reports route count, warmup state, and the dominant memory-footprint factors of the current service mode
10. one best-effort gateway Flight sniff that logs whether the service can establish a usable link to the current Wendao gateway
11. one parser-summary wrapper entrypoint under scripts/run_parser_summary_service.jl that mounts the native Julia and Modelica parser-summary routes over the shared Search Flight service

The package-local capability-manifest demo or probe service now advertises the canonical provider id xiuxian-wendao-julia, so Rust-side plugin discovery can validate the live Julia manifest without reinterpreting provider identity in the host crate.

That startup surface is intentionally broader than "just high-performance compute". WendaoSearch.jl currently runs as a long-lived Julia Flight service, so resident memory also reflects:

1. Julia runtime and JIT state
2. Arrow Flight and gRPC server state
3. request and response Arrow conversion buffers
4. startup warmup compilation
5. GadgetSearch and HiGHS state in solver_demo
6. multi-route dispatch state when more than one route is enabled

The package also exposes a narrow dependency bridge:

1. WendaoArrowDependencyStatus
2. arrow_flight_available()
3. wendaoarrow_schema_versions()
4. wendaoarrow_dependency_status()

The first Phase 2 solver slice now also exposes:

1. GadgetSearchDependencyStatus
2. SolverCandidateEdge
3. SolverCandidateGraph
4. SolverGadgetResult
5. SolverSearchOutcome
6. gadgetsearch_dependency_status()
7. gadgetsearch_graph6(...)
8. gadgetsearch_default_layout(...)
9. gadgetsearch_loader(...)
10. gadgetsearch_node_index(...)
11. gadgetsearch_pin_indices(...)
12. gadgetsearch_pin_candidates(...)
13. gadgetsearch_simple_graph(...)
14. gadgetsearch_truth_table_constraint(...)
15. gadgetsearch_solve_truth_table(...)

These types are intended to lock the early package vocabulary before the first Arrow contracts and solver adapters land.

The current solver dependency lock is:

1. https://github.com/isPANN/GadgetSearch.jl
2. rev = "4720cc1453d387404a09113f7c3fa722f6436586"
3. solver verification currently uses HiGHS as a test-only optimizer

Current solver status:

1. the package can now convert one topology-aware candidate graph into a real single-candidate GraphLoader
2. the package can now normalize node-id based pin candidates into GadgetSearch pin indices
3. the package now owns one real gadgetsearch_solve_truth_table(::Type{<:EnergyModel}, ...) helper for bounded single-candidate solves
4. a focused RydbergModel regression now proves the first real solver call on a two-node candidate graph with HiGHS

The package now ships one draft local Flight service entrypoint:

direnv exec . julia scripts/run_search_service.jl \
  --route-name structural_rerank \
  --host 127.0.0.1 \
  --port 41020

The same entrypoint can now mount WendaoCodeParser.jl routes behind the same gRPC listener:

direnv exec . julia scripts/run_search_service.jl \
  --route-name capability_manifest \
  --code-parser-route-names julia_ast_query \
  --mode demo \
  --host 127.0.0.1 \
  --port 41075

Supported route names:

1. structural_rerank
2. constraint_filter
3. capability_manifest
4. rerank
5. filter
6. capabilities
7. plugin_capabilities

Supported mounted code parser route names:

1. julia_file_summary
2. julia_root_summary
3. modelica_file_summary
4. julia_ast_query
5. modelica_ast_query

Mounted Modelica runtime note:

1. mounted Modelica routes do not only depend on OMParser.jl being built correctly
2. the current OMParser.jl native bridge also expects Absyn, ImmutableList, and MetaModelica to be visible from Main in the live child process
3. WendaoCodeParser.jl now installs that runtime shim before the first mounted Modelica parse, and the mounted live regression keeps this contract under test
4. repeated mounted Modelica AST queries now also reuse a bounded same-source parse-state cache in the parser service process, which removes repeated OMParser parse work for unchanged source text

Supported service modes:

1. demo
2. contract_probe
3. solver_demo

Current live solver status:

1. solver_demo is now landed for both structural_rerank and constraint_filter

2. those live paths now run real bounded GadgetSearch solves against explicit request edges carried by candidate_edge_sources, candidate_edge_destinations, and candidate_edge_kinds

3. demo remains the stable heuristic service mode for existing multi-route graph-structural smoke and plugin discovery flows

4. capability_manifest still uses the current demo or probe processors even when the bounded solver lane is enabled

5. plugin-owned xiuxian-wendao-julia live smoke now proves both explicit transport and manifest-discovery downcalls against solver-backed rerank and filter traffic

6. host-through-language-seam xiuxian-wendao live smoke now also proves the same manifest-discovery solver_demo downcalls through xiuxian_wendao::analyzers::languages

7. the staged request contract now carries explicit edge endpoints for both structural_rerank and constraint_filter

8. plugin-owned generic non-pair topology helpers now stage explicit node and edge arrays for structural_rerank without collapsing them into a two-node pair helper first

9. live solver_demo smoke now also covers one three-node chain through those generic helpers, both in the Julia plugin crate and through the host language seam

10. those generic-topology live proofs now also promote one real connected LinkGraphAgenticExpansionPlan pair collection through the same helper seam, so the three-node chain no longer depends on hand-built node and edge arrays above the service contract

11. the Julia-owned generic-topology staging seam now also supports one scored raw pair collection above the pair DTO layer, so candidate-level semantic aggregation no longer has to be hand-coded in the host proofs

12. the Julia-owned generic-topology staging seam now also supports one raw connected-pair collection above that scored pair helper, so host proofs no longer map LinkGraphAgenticCandidatePair into scored pair DTOs before live downcall

13. the same generic-topology live lane now also proves one multi-candidate batch against WendaoSearch.jl --mode solver_demo, both in the Julia plugin crate and through the host language seam, without changing the current service contract

14. the Rust-side xiuxian-wendao-julia projection seam is now feature-folderized under src/plugin/graph_structural_projection/ without changing the live contract, and direnv exec . julia --project=. -e 'using Pkg; Pkg.test()' remains green after that refactor

15. the paired Rust exchange proofs now also live in external #[cfg(test)] #[path = "..."] modules instead of a large inline test block, and the bounded WendaoSearch.jl live regressions remain green after that test-harness refactor

16. the same host-through-language-seam live lane now also proves one seed-centered generic-topology batch derived from a real LinkGraphAgenticExpansionPlan, so the current solver_demo route now covers one more realistic mixed-graph candidate batch above connected-pair collections without changing the service contract

17. that same host-through-language-seam live lane now also proves one worker-partition generic-topology batch derived from real LinkGraphAgenticWorkerPlan partitions, so the current solver_demo route now covers one more planner-shaped candidate batch above seed-centered groups while accepting mixed feasible and infeasible solver rows inside the same returned batch

18. that same host-through-language-seam live lane now also derives one batch-level generic-topology query context from the real expansion-plan query plus selected worker seed metadata, so the current solver_demo route is now proven above a less synthetic host query-context seam

19. that same host-through-language-seam live lane now also derives worker-batch dependency, keyword, and tag scores from real plan-aware batch semantics and validates those staged request-batch columns before the live downcall, so the current solver_demo route is now proven above a less synthetic host score-staging seam

20. that same host-through-language-seam live lane now also validates the staged semantic_score request column derived from real worker-partition pair semantics before the live downcall, so the current solver_demo route is now proven above a less implicit host-to-Julia semantic-score handoff

21. that same host-through-language-seam live lane now also validates the staged query_id, retrieval_layer, query_max_layers, anchor_planes, anchor_values, and edge_constraint_kinds request columns against the same plan-aware batch fixture before the live downcall, so the current solver_demo route is now proven above a less implicit host-to-Julia query-context handoff

22. that same host-through-language-seam live lane now also validates the staged candidate_node_ids, candidate_edge_sources, candidate_edge_destinations, and candidate_edge_kinds request columns against the same plan-aware batch fixture before the live downcall, so the current solver_demo route is now proven above a less implicit host-to-Julia topology handoff

23. that same host-through-language-seam live lane now also proves one plan-aware worker-partition generic-topology constraint_filter batch above the same raw connected-pair collection seam, and it now validates the staged constraint_kind and required_boundary_size request columns before reusing that batch against the manifest-discovered WendaoSearch.jl --mode solver_demo filter route

24. the paired Julia-plugin live lane now also proves one multi-candidate generic-topology constraint_filter batch against that same manifest- discovered WendaoSearch.jl --mode solver_demo multi-route endpoint, so the current filter route is now covered for both single-candidate and multi-candidate generic-topology downcalls

25. the paired host-through-language-seam live lane now also derives generic- topology fallback edge labels and staged edge_constraint_kinds from the normalized Wendao agentic execution relation, so the current manifest-discovered solver_demo downcall no longer relies on a host-local placeholder "related" edge label

26. that same host-through-language-seam filter lane now also derives the staged required_boundary_size from plan-aware anchor and candidate- topology semantics, and it validates filter-side anchor and topology list columns before reusing the same batch against the current manifest-discovered solver_demo route

27. that same host-through-language-seam filter lane now also derives the staged constraint_kind from the same plan-aware batch shape, and the paired Julia-plugin live proof now exercises the non-default boundary_match filter mode against the current solver-demo multi-route endpoint Current structural request topology fields:

28. candidate_node_ids

29. candidate_edge_sources

30. candidate_edge_destinations

31. candidate_edge_kinds

This entrypoint keeps transport on WendaoArrow.jl while letting WendaoSearch.jl expose one package-local draft service for local loopback and gateway smoke work.

The same entrypoint now also accepts a comma-separated multi-route form:

direnv exec . julia scripts/run_search_service.jl \
  --route-names capability_manifest,structural_rerank,constraint_filter \
  --mode demo \
  --host 127.0.0.1 \
  --port 41070

That live service now advertises /plugin/capabilities and serves the graph-structural routes on the same base URL.

Current status:

1. package tests cover the new demo service helpers
2. package tests now also cover the new exact-contract contract_probe service helpers
3. package tests now also cover warm_search_flight_service(...) for contract-probe and demo startup paths
4. live narrowing showed the first external request after startup could fail even when the same request succeeded on the second attempt
5. this first-hit failure was not specific to the structural response columns or v0-draft; it was a startup warmup seam on the Search service path
6. examples/search_service.jl now performs an in-process self-probe before binding the Flight listener
7. a real native Julia first-hit probe against scripts/run_search_service.jl --mode contract_probe --probe-profile id_plus_float now succeeds and returns (:candidate_id, :structural_score)
8. the draft live entrypoint is now usable for local structural-rerank loopback smoke work over the package-local v0-draft contract
9. package tests now launch scripts/run_search_service.jl as a child process
10. the package now also exposes /plugin/capabilities as a package-local draft Flight route for Julia-side capability discovery
11. package tests now cover in-process and cross-process capability-manifest service paths
12. the package now also supports one same-port multi-route live service for capability manifest, structural rerank, and constraint filter
13. package tests now cover that same-port multi-route service through a real child-process live regression
14. the cross-process regression harness runs the child from the repository root and restores JULIA_LOAD_PATH=@:@stdlib, so Pkg.test() now matches the manual live startup path instead of failing before using Pkg
15. the multi-route implementation stays Search-owned by dispatching within one Flight DoExchange service on request descriptor path, instead of trying to register multiple FlightService instances on the same gRPC server
16. WendaoCodeParser.jl is now a direct sibling dependency so Search can mount native Julia and Modelica parser routes into the existing live gRPC service without introducing a second process manager
17. mounted parser routes stay opt-in through --code-parser-route-name or --code-parser-route-names, so the default Search-only service shape is unchanged
18. package tests now cover one same-port live regression that serves capability_manifest and julia_ast_query from the same child process

The package test tree is now feature-folderized so test/runtests.jl remains an entrypoint only.

Current grouped test surfaces:

1. test/support/ for shared live-service helpers
2. test/solver/ for GadgetSearch.jl adapter coverage
3. test/core/ for query, contract, and payload model coverage
4. test/exchange/ for Flight request, typed exchange, and ingest coverage
5. test/service/ for descriptor, demo, observability, and contract-probe coverage
6. test/integration/ for warmup and cross-process live service coverage
7. test/bridge/ for narrow dependency-status coverage

When adding new coverage, prefer placing it under the closest feature folder and keep test/runtests.jl as a thin include-only interface.

direnv exec . julia --project=. -e 'using Pkg; Pkg.test()'

direnv exec . julia scripts/run_search_service.jl \
  --route-name structural_rerank \
  --mode contract_probe \
  --probe-profile id_plus_float \
  --host 127.0.0.1 \
  --port 41060

direnv exec . julia scripts/run_search_service.jl \
  --route-names capability_manifest,structural_rerank,constraint_filter \
  --mode demo \
  --host 127.0.0.1 \
  --port 41070

direnv exec . julia scripts/run_search_service.jl \
  --route-name capability_manifest \
  --code-parser-route-names julia_ast_query \
  --mode demo \
  --host 127.0.0.1 \
  --port 41075

direnv exec . julia --project=. scripts/probe_search_service.jl \
  --route-name structural_rerank \
  --host 127.0.0.1 \
  --port 41060

Active live listener and transport validation now belongs to the Python client lanes owned by arrow-julia and the workspace Python transport packages. The package-local Julia probe script above remains a compatibility check for runtime flows that still build request tables in Julia while delegating Flight transport to pyarrow.flight. Set WENDAOSEARCH_PYTHON=python when your environment already has pyarrow, or let the default bridge use uv run --with pyarrow python when uv is available.

WendaoSearch.jl now owns one formal parser-summary live-service descriptor at:

config/live/parser_summary.toml

That file is the canonical mounted parser-summary service contract for Rust repo-intelligence and gateway code_search or code_ast proofs. The repository devenv process layer is only the launcher for that package-owned config; it does not define Search route, mode, host, or port semantics itself. When a fresh workspace is missing the package checkout under .data/, the shared launcher may clone the configured WendaoSearch.jl repo before startup. That bootstrap is intentionally one-way and bounded: existing git checkouts stay untouched, and any existing non-git directory at the package path is treated as a hard error instead of being overwritten.

Start the canonical process-managed parser-summary service:

cd .. && direnv exec . devenv processes up -d wendaosearch-parser-summary

The startup log now emits one service-footprint line like WendaoSearch service startup ... memory_factors=[...]. When gateway sniffing is enabled, it also emits either:

1. WendaoSearch gateway link established
2. WendaoSearch gateway sniff failed
3. WendaoSearch gateway sniff skipped

The current sniff is a bounded TCP transport reachability check against the configured Wendao gateway Flight port. It runs after the local listener bind succeeds, so a successful link log no longer appears before local listener startup. Pass --no-gateway-sniff or set [gateway_sniff].enabled = false in the service config when you want isolated package-local startup without an external gateway transport check.

The canonical parser-summary managed service mirrors stdout and stderr into:

.run/logs/wendaosearch-parser-summary.stdout.log
.run/logs/wendaosearch-parser-summary.stderr.log

The package also still owns one repo-local multi-route demo descriptor at:

config/live/solver_demo.toml

That config remains useful for broad multi-route demos and benchmark scripts, but it is no longer the formal managed startup surface for Rust gateway parser integration.

Start the parser-summary service directly through the package-owned wrapper:

direnv exec . julia --project=. scripts/run_parser_summary_service.jl

Override the bind port without changing the package-owned route contract:

direnv exec . julia --project=. scripts/run_parser_summary_service.jl \
  --host 127.0.0.1 \
  --port 41081

If those files do not appear after startup, the usual cause is a stale process-compose generation that predates the current log-sink launcher. In that case, restart the managed service from the current devenv generation instead of trusting an inherited long-lived shell session.

Wait for the canonical parser-summary service readiness:

cd .. && direnv exec . bash -lc 'for _ in $(seq 1 60); do if bash scripts/channel/wendaosearch-healthcheck.sh >/dev/null 2>&1; then echo ready; exit 0; fi; sleep 2; done; echo not-ready >&2; exit 1'

Start the optional process-managed solver-demo service:

cd .. && direnv exec . devenv processes up -d wendaosearch-solver-demo

Wait for solver-demo readiness when you intentionally need the multi-route demo surface:

cd .. && direnv exec . bash -lc 'export WENDAOSEARCH_SERVICE_NAME=wendaosearch-solver-demo; export WENDAOSEARCH_RUNTIME_DIR=.run/wendaosearch; export WENDAOSEARCH_CONFIG=.data/WendaoSearch.jl/config/live/solver_demo.toml; for _ in $(seq 1 60); do if bash scripts/channel/wendaosearch-healthcheck.sh >/dev/null 2>&1; then echo ready; exit 0; fi; sleep 2; done; echo not-ready >&2; exit 1'

Probe the live service through the package-owned probe script:

direnv exec . julia --project=. \
  scripts/probe_search_service.jl \
  --config config/live/solver_demo.toml \
  --route-name structural_rerank

Run one opt-in broad-query live performance probe against the current gateway and the local solver_demo service:

direnv exec . julia --project=. \
  scripts/benchmark_search_service.jl \
  --config config/live/solver_demo.toml \
  --query topology \
  --knowledge-limit 10 \
  --fixture-limit 3 \
  --samples 3

The performance summary always records the actual fixture source:

1. fixture_source=graph_neighbors means the broad query produced graph-resolvable live nodes and the benchmark used real graph-neighbor topology.
2. fixture_source=knowledge_path_chain means the broad query produced real knowledge-search hits but the current gateway did not expose those hit paths as graph nodes, so the benchmark fell back to one explicit path-chain workload derived from the returned live search hits.

The current measured run is documented in docs/04_chronicles/research/2026-04-07-live-gateway-performance-report.md.

Run one mounted native Arrow Flight AST code search benchmark against the shared Search-plus-parser service:

direnv exec . julia --project=. \
  scripts/benchmark_ast_code_search.jl \
  --host 127.0.0.1 \
  --port 49872 \
  --route-names julia_ast_query,modelica_ast_query \
  --fixture-scale 32 \
  --samples 10 \
  --node-kind function \
  --name-contains foo \
  --limit 5

The current measured AST run is documented in docs/04_chronicles/research/2026-04-08-native-arrow-flight-ast-code-search-performance-report.md.

The current post-cache-fix confirmation run recorded:

route=julia_ast_query backend=JuliaSyntax.jl source_id=FlightAstBenchmark.jl source_bytes=1705 query_fields=3 rows=5 matches=5 samples=20 median_ms=3.866 min_ms=3.519 max_ms=12.908 median_alloc_bytes=168064
route=modelica_ast_query backend=OMParser.jl source_id=FlightAstBenchmark.mo source_bytes=1810 query_fields=3 rows=5 matches=5 samples=20 median_ms=3.439 min_ms=3.0 max_ms=19.933 median_alloc_bytes=167552
route=modelica_ast_query backend=OMParser.jl source_id=FlightAstBenchmark.mo source_bytes=1810 query_fields=3 rows=5 matches=5 samples=50 median_ms=3.261 min_ms=2.899 max_ms=4.515 median_alloc_bytes=167552

Run the opt-in package regression that exercises the same live perf path:

direnv exec . env \
  WENDAOSEARCH_RUN_LIVE_GATEWAY_PERF=1 \
  WENDAOSEARCH_LIVE_GATEWAY_QUERY=topology \
  WENDAOSEARCH_LIVE_GATEWAY_SEARCH_LIMIT=10 \
  WENDAOSEARCH_LIVE_GATEWAY_FIXTURE_LIMIT=3 \
  WENDAOSEARCH_LIVE_GATEWAY_SAMPLES=3 \
  julia --project=. -e 'using Pkg; Pkg.test()'

Run the opt-in Rust consumer live proof against the managed background service:

cd .. && direnv exec . bash -lc 'RUN_PROCESS_MANAGED_WENDAOSEARCH_TEST=1 cargo test -p xiuxian-wendao-julia plugin::graph_structural_exchange::tests::fetch_graph_structural_solver_demo_rows_for_repository_against_process_managed_wendaosearch_service -- --exact --nocapture'

Stop the background service:

direnv exec . devenv processes down

The Rust plugin and host test suites still self-spawn their own Julia services for bounded live proofs. That keeps isolated ports, isolated lifecycles, and deterministic cleanup in test scope while the repo-level process-managed service remains available for operator smoke, cwd-independent process-managed launch validation, and one explicit background-service Rust live proof.