Record native Linux desktop and automatic update validation

docs/LINUX-DESKTOP-VALIDATION.md

@@ -0,0 +1,167 @@
+# Native Linux desktop validation
+
+Executed 2026-10-13 on Ubuntu 24.04 x86-64 in WSL inside the CPU-only Windows VM.
+This is native Linux compilation and an isolated virtual-display interaction
+check, not a Linux installer, physical desktop, GPU, or clean-machine certificate.
+
+![Native Linux searchi showing a real Google CPU supplier-agreement result](screenshots/native-linux-657de3d.png)
+
+Actual embedded desktop at `657de3d`, with a three-file fixture and real Google
+embeddings. The unrelated lower results illustrate the relevance gate that
+remains open. The displayed times are single observations, not percentiles.
+
+## Source and build
+
+- Baseline `6b78c8b`: embedded-frontend Release build passed in 25m 49s.
+- Validated snapshot `99748bd`: embedded-frontend Release build passed in 4m 17s
+  after refreshing copied source mtimes. An earlier attempt reused stale Cargo
+  path-dependency artifacts because Git archive preserved old mtimes; it failed
+  with missing new service exports. The corrected build recompiled all shared
+  searchi crates. No Rust implementation change was needed for this failure.
+- Frontend `index-DUwy7lJE.js`, SHA-256
+  `614562a0804df91452d9d6be0210b543dd035ff7defe99e779cc448488026132`.
+- Executable SHA-256
+  `c08b208d1cc3225d9c6a9a7581920eb5cf4fd9105a5620bd2dc57eaac33d671a`.
+- Rust/Cargo 1.99.0; two logical CPUs, 2.8 GiB memory and 1 GiB swap;
+  Cargo jobs limited to one. WebKitGTK 4.1 development package
+  `2.52.6-0ubuntu0.24.04.1`, GTK 3 `3.24.41-4ubuntu1.3`.
+- Normal verified Linux CPU/Vulkan worker and pinned Linux FFmpeg resources were
+  staged in an isolated ext4 source tree. Windows resources were not modified.
+  `ldd` found no missing executable libraries on this provisioned Ubuntu host.
+
+The build uses `cargo build --manifest-path apps/desktop/src-tauri/Cargo.toml
+--release --features custom-protocol --locked -j1`. Build logs are retained under
+`/home/karl/.cache/searchi-validation/desktop-{baseline,final-99748bd}-build.log`.
+
+## Strict CPU rendering and inference
+
+The initial Xvfb attempt failed because WSLg's `/tmp/.X11-unix` socket directory
+was not writable. The working session verified a distinct mount namespace,
+made mounts private, and bound a QA-owned socket directory inside that namespace.
+It masked `/dev/dxg` with `/dev/null` and masked `/dev/dri` if present. It changed
+no persistent WSLg mounts or user configuration. The app ran as karl, with an
+owned session/process group and separate settings/index directories.
+
+Xvfb disabled GLX; the app used `GDK_BACKEND=x11`,
+`LIBGL_ALWAYS_SOFTWARE=1`, `GALLIUM_DRIVER=llvmpipe`,
+`MESA_LOADER_DRIVER_OVERRIDE=llvmpipe`, `WEBKIT_DISABLE_DMABUF_RENDERER=1`,
+`WEBKIT_DISABLE_COMPOSITING_MODE=1`, and `SEARCHI_FORCE_CPU=1`.
+Model setup reused verified cached Google assets. Explicit worker/media helper
+overrides were used, so this session does not prove installed resource discovery.
+Process inspection of Xvfb, the app, WebKit processes, and the Google worker found
+no GPU device descriptors or Vulkan/D3D provider mappings; their `/dev/dxg` was
+the null device (major 1, minor 3).
+
+## Actual UI interactions
+
+On the `99748bd` snapshot, the native embedded app:
+
+- Rendered the branded light theme and reported Google CPU readiness.
+- Opened its folder form and an actual GTK Browse dialog. Synthetic per-key path
+  entry in GTK produced completion/tree-model warnings; cancel worked. Pasting
+  the absolute fixture path in the app's folder form successfully indexed three
+  real document/code files, then automatically built three Google segments.
+- Searched `cancel the supplier partnership` and placed the supplier agreement
+  first, with its real termination passage and literal match highlights.
+- Preserved a collapsed `Why this result?` detail; expanding it showed a concise
+  explanation and reopening/collapsing did not change the selected passage.
+- Accepted Ctrl+K and arrow navigation, changing the selected result and preview
+  to `retry.rs`, then back to the agreement.
+- Applied an `rs` extension restriction and returned only the source file.
+- Enabled Performance details, showed granular local traces, and copied a
+  12,917-byte timing report. Inspection found no source paths or remembered query
+  text in the copied JSON.
+
+Captures came directly from pinned FFmpeg X11 capture, including fresh
+1080-by-760 app-area captures with `-draw_mouse 0`; no screenshot pixels were
+edited. Raw captures and timing/GPU audits are local ignored QA evidence in
+`.searchi/qa/linux-native-*.png` and the native `desktop-qa-99748bd` directory.
+The remembered search displayed a basic backend sample of 236 ms and displayed
+response sample of 474 ms. A separate debug `retry` query showed 4,371 ms backend
+and 4,564 ms final displayed response. These single samples are not startup,
+first-input, paint, large-corpus, or warm p95 benchmarks.
+
+## Independent scheduling regression
+
+The actual Google `budget_google_cpu` test passed on Linux in 129.60s, using
+the normal verified worker with CPU forced: total budget 2, foreground query
+thread 1, indexing thread 1, query sample 142.015 ms, admission sample 0.444 ms,
+six background document encoder calls. This proves the tested concurrent
+admission contract; it does not establish scale or native UI latency targets.
+Log: `/home/karl/.cache/searchi-validation/budget-google-linux-99748bd.log`.
+
+## Remaining scope
+
+The `99748bd` interaction evidence excludes the later watcher milestone.
+Installer/resource discovery, window-manager chrome, theme/contrast/accessibility
+coverage, media previews, physical GPU fallback/recovery, clean-machine ABI,
+upgrades/signing, macOS, and large-corpus performance remain separate gates.
+
+## Watcher milestone: `657de3d`
+
+The isolated source was refreshed from the committed snapshot and paired with
+the matching `index-64het56E.js` frontend. Source mtimes were refreshed before
+Cargo invocation. Executed checks:
+
+- Workspace: **124 passed, 19 ignored**, zero failures; native compilation took
+  2m 25s. Ignored actual-model tests are not counted as executed here.
+- Desktop Release unit tests: **28 passed**, including actual Linux inotify
+  create/update/rename/delete, bounded-event retry/overflow and shutdown tests;
+  compilation took 1m 49s and test execution 1.74s.
+- Actual Google mixed-media reuse regression: **one passed in 67.95s**, including
+  same-stat media invalidation, revision tokens and reused vector publication.
+  Normal verified worker, real models and pinned FFmpeg helpers; CPU forced.
+- Fresh embedded-frontend Release executable built in 1m 49s; SHA-256
+  `746571a151cea5151b0ed9feef87db98f41cb62512a6bc9eb7b7b6404dd015a5`.
+
+Logs are retained as `workspace-linux-657de3d.log`,
+`desktop-tests-linux-657de3d.log`, `media-google-linux-657de3d.log`, and
+`desktop-final-657de3d-build.log` under the native validation cache.
+
+The current native UI used a fresh settings/index directory and the same
+verified private CPU display setup. Captures targeted the actual X11 window ID,
+whose inspected geometry was x=0, y=0, width=1080, height=760. Its worker loaded
+`libggml-cpu-zen4.so`, one inference thread, zero process swap; no GPU mappings
+or descriptors were observed. After initial indexing, WSL reported 539 MiB
+used, 2.3 GiB available and zero swap. No validation compiler or independent
+model test was running during the following UI samples.
+
+The first remembered query had inherited the previously enabled Performance
+details preference from WebKit local storage; `SEARCHI_DATA_DIR` isolates Rust
+settings/index, not that WebKit preference. Its debug sample was 70.852765 ms
+native, 68.644667 ms query embedding, 67.261 ms worker inference, 13 tokens and
+a query-vector cache miss. First displayed response was 70 ms; final displayed
+response was 273 ms. After disabling Performance details, the distinct query
+`end the supplier agreement` showed 89 ms native / 300 ms displayed. These
+different-query samples do not establish normal/debug overhead or p95. The
+earlier 4.371s sample remains valid evidence, with no inferred cause.
+
+Actual UI filesystem lifecycle checks required no manual Reindex action:
+
+1. Changed `sixty` to `seven` while preserving exact file size and mtime. The
+   live passage updated automatically; active generation moved 1 to 2, retaining
+   three chunks. Recorded SHA-256 values differed despite matching metadata.
+2. Created `orbit.txt`. The app counted four files and immediately showed its
+   actual `orbital` keyword passage while Google indexing was working: a single
+   sample of 1.2 ms backend / 88 ms displayed. Generation 3 contained four chunks.
+3. Renamed it to `satellite.txt`. The UI preview and indexed path changed, the
+   old path disappeared, and generation 4 retained four chunks.
+4. Deleted it. The path disappeared from both UI and index; generation 5 returned
+   to three chunks.
+
+Raw mutation snapshots are in native `desktop-qa-657de3d/watch-mutations.jsonl`;
+UI captures are local `.searchi/qa/linux-current-*.png`. The copied debug report
+is `.searchi/qa/linux-current-timing-remembered-debug.json`.
+Both UI sessions ended through their owned cleanup path: the app process group
+terminated, Xvfb exited successfully, and subsequent process inspection found no
+remaining app/WebKit/worker/Xvfb/DBus/clipboard helpers. The outer `/dev/dxg`
+remained the real device after private namespace teardown.
+
+The interactions also exposed two unresolved product observations. Background
+filesystem refreshes displayed `SHOWN 83537 MS` / `SHOWN 108592 MS` despite
+roughly 1–2 ms backend samples, including idle time since the original input;
+these are not fresh search latency measurements. During replacement, selection
+advanced to another valid result and stayed there when the replaced passage
+returned. After deleting the only orbital file, three unrelated semantic
+neighbors remained: deleted-source suppression worked, but no-relevant-match
+calibration remains a separate search-quality gate.