Handle pre-epoch file timestamps consistently and record Rust audit

docs/RUST-AUDIT.md

@@ -0,0 +1,60 @@
+# Rust audit and completion review — 2026-10-13
+
+Reviewed the shared indexing/media/semantic service boundaries and the desktop,
+CLI/MCP, setup and optional AI orchestration with two independent Rust reviewers.
+The review found no reason to add a broad naming or module-splitting project.
+Existing adapters isolate native processes and desktop concerns from retrieval;
+long but linear command/setup flows do not need additional indirection merely
+because of their length. This is a targeted review, not proof of zero defects.
+
+## Corrected issue
+
+A valid file modification time before 1970 aborted folder scanning. Other source
+eligibility and preview checks also assumed nonnegative Unix timestamps.
+The shared `searchi_media::unix_time_ns` now performs checked signed conversion,
+including the minimum signed storage boundary. Indexing, signatures, excerpts,
+media identity, semantic parent validation and preview identity use that policy.
+Negative sizes remain invalid. No schema migration or dependency was added.
+
+Regression coverage checks archived documents, unchanged rescans, excerpts,
+media eligibility and stale-preview revocation followed by successful reindexing.
+The semantic eligibility fixture uses synthetic geometry to test filtering;
+it does not claim model-quality validation.
+
+Windows CPU-only results for the final changes:
+
+- Core, media and service: 100 tests passed, six explicit integration tests ignored.
+- Desktop: all 47 tests passed, including the new pre-epoch preview regression.
+- Strict all-target Clippy passed for the changed crates and desktop.
+- Workspace and desktop formatting and Git whitespace checks passed.
+
+The first preview-test assertion expected 404; the protocol correctly returns
+410 for an expired capability. The test expectation was corrected; protocol
+behavior was preserved. Windows filesystem timestamp precision is 100 ns;
+exact storage boundaries are tested through the conversion helper.
+
+## Deferred under YAGNI
+
+Desktop setup could resolve `resource_dir()` once instead of repeatedly. This
+does not justify changing working orchestration during this audit. No generic
+service framework, speculative cache or cosmetic function-renaming sweep was added.
+
+## Goal review
+
+The initial usable Windows release is delivered. Windows desktop 0.1.3,
+Windows CLI/MCP and Ubuntu headless packages are published and byte-verified.
+An Ubuntu 24.04 desktop Debian preview now also has verified packaged CPU startup.
+The timestamp correction is in source; those 0.1.3 artifacts precede this fix.
+
+The full cross-platform production goal remains open. Concrete follow-up is:
+
+1. Include this fix in the next packaged update; refresh extraction provenance.
+2. Check real Windows interaction, preview playback/seek and installed upgrades.
+3. Validate physical GPU use and fallback, and execute a native macOS build.
+4. Improve media relevance using independently reviewed real files and queries;
+   the current experimental quality evidence is not sufficient for broad claims.
+5. Retain clean-machine, signing and large-library checks as later release gates.
+
+These follow-ups do not justify withholding the already published preview.
+Gitea Actions remain disabled at Karl's request. See ROADMAP.md for detailed
+evidence and unchecked gates; this audit does not silently close them.