Measure semantic activation refresh independently from download and idle time

docs/LINUX-DESKTOP-VALIDATION.md

@@ -272,3 +272,63 @@ All owned test and benchmark handles ended successfully. Subsequent process
 inspection found no surviving Google workers, Cargo or Rust compiler processes.
 Native desktop packaging with this new worker, actual GPU, macOS and
 representative performance remain open.
+
+## Genuine first-use media download: `9aae3f8`
+
+Native embedded Release build passed in 2m 52s, using matching
+`index-STH19o-O.js`. Executable SHA-256:
+`229312e05629555956c659a83d56fa3dcc9e8830736a062c9208ce704ce11fa6`;
+frontend SHA-256:
+`dc3ee20bc7bb3eda347c142ee9fab3e10b8d17037402d21c5cc6de1a5f0dd967`.
+The isolated resource override used the normal Linux query-role worker
+`b52d50a1e676bd4bf64124daff1c4ce83d86a8bde01e4eaf09838cbb24a4c28f`.
+
+The fresh owned `desktop-qa-earlytext` directory isolated XDG cache/config/data,
+settings, index, decoded scratch and model cache. Initially only the verified
+309,855,456-byte backbone was present, hardlinked from the verified native cache.
+A fixture contained three document/code files and a small BMP. The app's
+HTTPS_PROXY/HTTP_PROXY pointed only its own process environment to an owned
+loopback CONNECT proxy at `127.0.0.1:18943`, throttled to 4 MiB/s. The proxy
+forwarded opaque TLS to real Hugging Face/CDN HTTPS; there was no TLS interception,
+production URL override or global network change.
+
+Actual native UI evidence:
+
+- While the genuine projector download was incomplete (202,664,870-byte partial,
+  no installed projector), generation 1 contained three text chunks. The UI
+  reported text search ready and media preparation in progress. The first
+  actual remembered input found the supplier passage: one basic observation of
+  **84 ms native / 293 ms displayed**. This is not cold startup or warm p95.
+- Closing owned proxy tunnels and rejecting further CONNECT attempts caused
+  three download attempts to fail and removed the partial file. Generation 1
+  and query worker PID 397 remained usable. Expanded model details showed
+  media setup failure, text availability and an actual Retry model setup button.
+- Restoring proxy forwarding and clicking that UI button restarted the genuine
+  pinned download. A separate cached debug rerun during retry measured
+  **2.0 ms native / 44 ms first / 138 ms final displayed**; it is not the first
+  user input. Its copied timing report contained no query text or source paths.
+- Verified full projector installation produced the exact 554,821,024 bytes and
+  SHA-256 `c4a8a52691ecef40618438928bdf9e68379b854e24166f292592353db0aab64f`.
+  Generation 2 contained four chunks, including image content. The retained
+  CPU query worker stayed PID 397 through failure, retry and promotion. Explicit
+  selection of `retry.rs` remained selected when the image entered ahead of it.
+
+This interaction uncovered a separate semantic-activation timing defect:
+full-media promotion reused the prior search measurement and displayed
+**SHOWN 143,928 ms** despite an 8.0 ms native search. The copied report retained
+`trigger: user_search` and the old three-chunk context. This value includes
+media download/idle time and must not be presented as fresh search latency.
+Watcher refresh timing was already corrected; semantic readiness/activation
+needs the equivalent independent refresh measurement and another native retest.
+
+Local ignored evidence: `.searchi/qa/linux-earlytext-*.png`,
+`linux-earlytext-{retry-search,promotion-search}.json`, `linux-earlytext-states.jsonl`
+and `linux-earlytext-cpu-audit.json`. Native `desktop-qa-earlytext` retains proxy
+events, logs and fixture data. The owned proxy helper is
+`.searchi/linux-validation/opaque_proxy.py`. The private GPU-masked software
+display audit found no GPU providers or descriptors; the query worker used Zen4
+CPU, one thread and zero swap. Both owned UI/proxy handles ended successfully,
+Xvfb exited zero, and process inspection found no surviving app, worker, WebKit,
+DBus, clipboard, display or proxy helpers. Outer `/dev/dxg` remained real.
+Physical desktop, installed resource discovery, representative relevance,
+first-install cold storage, p95, GPU and macOS gates remain open.