Handle pre-epoch file timestamps consistently and record Rust audit

docs/ROADMAP.md

@@ -1,6 +1,6 @@
 # Production readiness roadmap
 
-Status: initial Windows v0.1.0 published and installed; broader production gates remain open. Windows VM tests use CPU only.
+Status: Windows v0.1.3 and Linux previews published; initial Windows v0.1.0 installed. Broader production gates remain open. Windows VM tests use CPU only.
 
 Karl's release priority, 2026-10-13: publish a usable first Windows version and
 install it on DEV-WIN11 now. Extensive platform/GPU, clean-machine, signing and
@@ -335,4 +335,15 @@ build was inferred from that lookup; macOS execution gates remain unchecked.
 
 - [x] Current native Linux desktop release compilation and local loader closure on Ubuntu WSL; [evidence](LINUX-DESKTOP.md).
 - [x] Linux desktop relocated normal resource discovery and CPU query-worker startup under an owned software-display test; no native UI interaction claim.
-- [ ] Linux desktop graphical interaction and distribution packaging.
+- [x] Publish Ubuntu 24.04 x86-64 Debian desktop preview; verify public bytes and extracted package CPU startup. See [evidence](LINUX-DESKTOP.md).
+- [ ] Linux desktop graphical interaction and broader distribution compatibility.
+
+## Rust audit and goal review, 2026-10-13
+
+- [x] Audit core/service and desktop/CLI Rust boundaries; avoid unnecessary naming/module churn.
+- [x] Correct valid pre-1970 filesystem timestamps across indexing, source eligibility and previews. Changed crates passed 100 tests (six ignored), desktop 47; strict Clippy and formatting passed. See [audit](RUST-AUDIT.md).
+- [ ] Include the timestamp correction in the next packaged update; published v0.1.3 artifacts precede it.
+
+Initial Windows delivery is complete. Native interaction/upgrade, actual GPU,
+macOS execution and independent media-quality work remain real follow-up; the
+full production goal remains active. Preserve the detailed unchecked gates above.

docs/RUST-AUDIT.md

@@ -0,0 +1,60 @@
+# Rust audit and completion review — 2026-10-13
+
+Reviewed the shared indexing/media/semantic service boundaries and the desktop,
+CLI/MCP, setup and optional AI orchestration with two independent Rust reviewers.
+The review found no reason to add a broad naming or module-splitting project.
+Existing adapters isolate native processes and desktop concerns from retrieval;
+long but linear command/setup flows do not need additional indirection merely
+because of their length. This is a targeted review, not proof of zero defects.
+
+## Corrected issue
+
+A valid file modification time before 1970 aborted folder scanning. Other source
+eligibility and preview checks also assumed nonnegative Unix timestamps.
+The shared `searchi_media::unix_time_ns` now performs checked signed conversion,
+including the minimum signed storage boundary. Indexing, signatures, excerpts,
+media identity, semantic parent validation and preview identity use that policy.
+Negative sizes remain invalid. No schema migration or dependency was added.
+
+Regression coverage checks archived documents, unchanged rescans, excerpts,
+media eligibility and stale-preview revocation followed by successful reindexing.
+The semantic eligibility fixture uses synthetic geometry to test filtering;
+it does not claim model-quality validation.
+
+Windows CPU-only results for the final changes:
+
+- Core, media and service: 100 tests passed, six explicit integration tests ignored.
+- Desktop: all 47 tests passed, including the new pre-epoch preview regression.
+- Strict all-target Clippy passed for the changed crates and desktop.
+- Workspace and desktop formatting and Git whitespace checks passed.
+
+The first preview-test assertion expected 404; the protocol correctly returns
+410 for an expired capability. The test expectation was corrected; protocol
+behavior was preserved. Windows filesystem timestamp precision is 100 ns;
+exact storage boundaries are tested through the conversion helper.
+
+## Deferred under YAGNI
+
+Desktop setup could resolve `resource_dir()` once instead of repeatedly. This
+does not justify changing working orchestration during this audit. No generic
+service framework, speculative cache or cosmetic function-renaming sweep was added.
+
+## Goal review
+
+The initial usable Windows release is delivered. Windows desktop 0.1.3,
+Windows CLI/MCP and Ubuntu headless packages are published and byte-verified.
+An Ubuntu 24.04 desktop Debian preview now also has verified packaged CPU startup.
+The timestamp correction is in source; those 0.1.3 artifacts precede this fix.
+
+The full cross-platform production goal remains open. Concrete follow-up is:
+
+1. Include this fix in the next packaged update; refresh extraction provenance.
+2. Check real Windows interaction, preview playback/seek and installed upgrades.
+3. Validate physical GPU use and fallback, and execute a native macOS build.
+4. Improve media relevance using independently reviewed real files and queries;
+   the current experimental quality evidence is not sufficient for broad claims.
+5. Retain clean-machine, signing and large-library checks as later release gates.
+
+These follow-ups do not justify withholding the already published preview.
+Gitea Actions remain disabled at Karl's request. See ROADMAP.md for detailed
+evidence and unchecked gates; this audit does not silently close them.