Measure semantic activation refresh independently from download and idle time

docs/EARLY-TEXT-SETUP.md

@@ -61,9 +61,14 @@ passed **51**, and both strict all-target Clippy checks, formatting and the
 frontend production build passed. The actual Google integration above was run
 separately; ignored entries in the default suite are not execution evidence.
 
-Native UI interaction during a genuine delayed HTTPS media download, failure,
-retry and promotion remains to be executed. The prepared Linux QA plan uses only
-an owned loopback CONNECT proxy and isolated app environment; it does not change
+Native Linux UI interaction during a genuine delayed HTTPS media download,
+failure, retry and full promotion passed on `9aae3f8`, retaining the query worker
+and explicit selection. Its actual first unseen query reported 84 ms native and
+293 ms through the DOM update on four fixture files. A later cached debug request
+is a separate sample. The test exposed a semantic-activation clock defect;
+the frontend now starts an independent refresh measurement, but a focused native
+retest remains pending. See [native evidence](LINUX-DESKTOP-VALIDATION.md).
+The owned loopback CONNECT proxy and isolated app environment do not change
 the product's pinned download URL or verification. Native Windows/macOS, GPU,
 large libraries and actual first-input measurements remain open. Document indexing
 still needs to finish a publishable generation; earlier model readiness does not

docs/LINUX-DESKTOP-VALIDATION.md

@@ -272,3 +272,63 @@ All owned test and benchmark handles ended successfully. Subsequent process
 inspection found no surviving Google workers, Cargo or Rust compiler processes.
 Native desktop packaging with this new worker, actual GPU, macOS and
 representative performance remain open.
+
+## Genuine first-use media download: `9aae3f8`
+
+Native embedded Release build passed in 2m 52s, using matching
+`index-STH19o-O.js`. Executable SHA-256:
+`229312e05629555956c659a83d56fa3dcc9e8830736a062c9208ce704ce11fa6`;
+frontend SHA-256:
+`dc3ee20bc7bb3eda347c142ee9fab3e10b8d17037402d21c5cc6de1a5f0dd967`.
+The isolated resource override used the normal Linux query-role worker
+`b52d50a1e676bd4bf64124daff1c4ce83d86a8bde01e4eaf09838cbb24a4c28f`.
+
+The fresh owned `desktop-qa-earlytext` directory isolated XDG cache/config/data,
+settings, index, decoded scratch and model cache. Initially only the verified
+309,855,456-byte backbone was present, hardlinked from the verified native cache.
+A fixture contained three document/code files and a small BMP. The app's
+HTTPS_PROXY/HTTP_PROXY pointed only its own process environment to an owned
+loopback CONNECT proxy at `127.0.0.1:18943`, throttled to 4 MiB/s. The proxy
+forwarded opaque TLS to real Hugging Face/CDN HTTPS; there was no TLS interception,
+production URL override or global network change.
+
+Actual native UI evidence:
+
+- While the genuine projector download was incomplete (202,664,870-byte partial,
+  no installed projector), generation 1 contained three text chunks. The UI
+  reported text search ready and media preparation in progress. The first
+  actual remembered input found the supplier passage: one basic observation of
+  **84 ms native / 293 ms displayed**. This is not cold startup or warm p95.
+- Closing owned proxy tunnels and rejecting further CONNECT attempts caused
+  three download attempts to fail and removed the partial file. Generation 1
+  and query worker PID 397 remained usable. Expanded model details showed
+  media setup failure, text availability and an actual Retry model setup button.
+- Restoring proxy forwarding and clicking that UI button restarted the genuine
+  pinned download. A separate cached debug rerun during retry measured
+  **2.0 ms native / 44 ms first / 138 ms final displayed**; it is not the first
+  user input. Its copied timing report contained no query text or source paths.
+- Verified full projector installation produced the exact 554,821,024 bytes and
+  SHA-256 `c4a8a52691ecef40618438928bdf9e68379b854e24166f292592353db0aab64f`.
+  Generation 2 contained four chunks, including image content. The retained
+  CPU query worker stayed PID 397 through failure, retry and promotion. Explicit
+  selection of `retry.rs` remained selected when the image entered ahead of it.
+
+This interaction uncovered a separate semantic-activation timing defect:
+full-media promotion reused the prior search measurement and displayed
+**SHOWN 143,928 ms** despite an 8.0 ms native search. The copied report retained
+`trigger: user_search` and the old three-chunk context. This value includes
+media download/idle time and must not be presented as fresh search latency.
+Watcher refresh timing was already corrected; semantic readiness/activation
+needs the equivalent independent refresh measurement and another native retest.
+
+Local ignored evidence: `.searchi/qa/linux-earlytext-*.png`,
+`linux-earlytext-{retry-search,promotion-search}.json`, `linux-earlytext-states.jsonl`
+and `linux-earlytext-cpu-audit.json`. Native `desktop-qa-earlytext` retains proxy
+events, logs and fixture data. The owned proxy helper is
+`.searchi/linux-validation/opaque_proxy.py`. The private GPU-masked software
+display audit found no GPU providers or descriptors; the query worker used Zen4
+CPU, one thread and zero swap. Both owned UI/proxy handles ended successfully,
+Xvfb exited zero, and process inspection found no surviving app, worker, WebKit,
+DBus, clipboard, display or proxy helpers. Outer `/dev/dxg` remained real.
+Physical desktop, installed resource discovery, representative relevance,
+first-install cold storage, p95, GPU and macOS gates remain open.

docs/PERFORMANCE.md

@@ -83,13 +83,17 @@ model loading must not be silently included in a warm-query claim.
 
 ## Reproducible performance validation
 
-Automatic filesystem refreshes start a new frontend measurement at the refresh
-event. `trigger: "filesystem_refresh"` distinguishes them from user searches;
+Automatic filesystem and semantic-readiness/publication refreshes start a new
+frontend measurement at the refresh event. `trigger: "filesystem_refresh"` or
+`"semantic_activation"` distinguishes them from user searches;
 `SHOWN` and `latest_displayed_ms` exclude time spent idle before that event.
 `original_input` retains a fixed-size snapshot of the original debounce and
 display timings. Refreshes do not replay previous attempts or append ancestor
 traces. A refresh before the first response leaves that original response timing
 null rather than inventing a first-input measurement.
+The refreshed context captures current generation/readiness/chunk counts rather
+than retaining the pre-publication context. Semantic activation also invalidates
+older queued responses and reruns the progressive lanes with the current filters.
 
 Record build profile, CPU/device and thread budget, VM/host resources, corpus and
 active generation, filters, cold/warm state, concurrent indexing and setup costs.