Record native Linux desktop and automatic update validation

docs/AUTOMATIC-INDEXING.md

@@ -24,7 +24,8 @@ Scans own separate SQLite connections. They do not hold the foreground search
 mutex during traversal or extraction. A changed scan prepares its reader and
 briefly swaps it into the desktop. UI events refresh counts and the active query,
 reject results from before the change, and request normal semantic indexing.
-The original input/first-response timing survives an automatic query refresh.
+Refresh timing must start at the change event rather than include idle time since
+the original input; native Linux interaction exposed a regression in this clock.
 
 ## Targeted reconciliation
 
@@ -80,7 +81,15 @@ image encode, unchanged hinted image/audio sources reuse vectors, and current
 revision tokens restore eligibility. This is correctness evidence on a tiny
 fixture, not relevance quality or search/indexing throughput evidence.
 
-Linux and macOS native watcher execution, root disappearance/reappearance on
+Current-source native Linux checks also passed: 124 workspace tests, 28 desktop
+Release tests including actual inotify create/update/rename/delete, and the
+updated real Google mixed-media regression in 67.95 seconds. Native Linux
+interaction evidence is in
+[LINUX-DESKTOP-VALIDATION.md](LINUX-DESKTOP-VALIDATION.md). Actual watcher-driven
+UI change/create/rename/delete passed on `657de3d`; timing and selection issues
+found during those interactions require separate fixes and retesting.
+
+macOS native watcher execution, root disappearance/reappearance on
 real removable/network storage, native UI refresh interaction, representative
 large-corpus contention and power-loss behavior remain open. Full reconciliation
 still holds a write transaction during extraction and can contend with semantic

docs/LINUX-DESKTOP-VALIDATION.md

@@ -0,0 +1,167 @@
+# Native Linux desktop validation
+
+Executed 2026-10-13 on Ubuntu 24.04 x86-64 in WSL inside the CPU-only Windows VM.
+This is native Linux compilation and an isolated virtual-display interaction
+check, not a Linux installer, physical desktop, GPU, or clean-machine certificate.
+
+![Native Linux searchi showing a real Google CPU supplier-agreement result](screenshots/native-linux-657de3d.png)
+
+Actual embedded desktop at `657de3d`, with a three-file fixture and real Google
+embeddings. The unrelated lower results illustrate the relevance gate that
+remains open. The displayed times are single observations, not percentiles.
+
+## Source and build
+
+- Baseline `6b78c8b`: embedded-frontend Release build passed in 25m 49s.
+- Validated snapshot `99748bd`: embedded-frontend Release build passed in 4m 17s
+  after refreshing copied source mtimes. An earlier attempt reused stale Cargo
+  path-dependency artifacts because Git archive preserved old mtimes; it failed
+  with missing new service exports. The corrected build recompiled all shared
+  searchi crates. No Rust implementation change was needed for this failure.
+- Frontend `index-DUwy7lJE.js`, SHA-256
+  `614562a0804df91452d9d6be0210b543dd035ff7defe99e779cc448488026132`.
+- Executable SHA-256
+  `c08b208d1cc3225d9c6a9a7581920eb5cf4fd9105a5620bd2dc57eaac33d671a`.
+- Rust/Cargo 1.99.0; two logical CPUs, 2.8 GiB memory and 1 GiB swap;
+  Cargo jobs limited to one. WebKitGTK 4.1 development package
+  `2.52.6-0ubuntu0.24.04.1`, GTK 3 `3.24.41-4ubuntu1.3`.
+- Normal verified Linux CPU/Vulkan worker and pinned Linux FFmpeg resources were
+  staged in an isolated ext4 source tree. Windows resources were not modified.
+  `ldd` found no missing executable libraries on this provisioned Ubuntu host.
+
+The build uses `cargo build --manifest-path apps/desktop/src-tauri/Cargo.toml
+--release --features custom-protocol --locked -j1`. Build logs are retained under
+`/home/karl/.cache/searchi-validation/desktop-{baseline,final-99748bd}-build.log`.
+
+## Strict CPU rendering and inference
+
+The initial Xvfb attempt failed because WSLg's `/tmp/.X11-unix` socket directory
+was not writable. The working session verified a distinct mount namespace,
+made mounts private, and bound a QA-owned socket directory inside that namespace.
+It masked `/dev/dxg` with `/dev/null` and masked `/dev/dri` if present. It changed
+no persistent WSLg mounts or user configuration. The app ran as karl, with an
+owned session/process group and separate settings/index directories.
+
+Xvfb disabled GLX; the app used `GDK_BACKEND=x11`,
+`LIBGL_ALWAYS_SOFTWARE=1`, `GALLIUM_DRIVER=llvmpipe`,
+`MESA_LOADER_DRIVER_OVERRIDE=llvmpipe`, `WEBKIT_DISABLE_DMABUF_RENDERER=1`,
+`WEBKIT_DISABLE_COMPOSITING_MODE=1`, and `SEARCHI_FORCE_CPU=1`.
+Model setup reused verified cached Google assets. Explicit worker/media helper
+overrides were used, so this session does not prove installed resource discovery.
+Process inspection of Xvfb, the app, WebKit processes, and the Google worker found
+no GPU device descriptors or Vulkan/D3D provider mappings; their `/dev/dxg` was
+the null device (major 1, minor 3).
+
+## Actual UI interactions
+
+On the `99748bd` snapshot, the native embedded app:
+
+- Rendered the branded light theme and reported Google CPU readiness.
+- Opened its folder form and an actual GTK Browse dialog. Synthetic per-key path
+  entry in GTK produced completion/tree-model warnings; cancel worked. Pasting
+  the absolute fixture path in the app's folder form successfully indexed three
+  real document/code files, then automatically built three Google segments.
+- Searched `cancel the supplier partnership` and placed the supplier agreement
+  first, with its real termination passage and literal match highlights.
+- Preserved a collapsed `Why this result?` detail; expanding it showed a concise
+  explanation and reopening/collapsing did not change the selected passage.
+- Accepted Ctrl+K and arrow navigation, changing the selected result and preview
+  to `retry.rs`, then back to the agreement.
+- Applied an `rs` extension restriction and returned only the source file.
+- Enabled Performance details, showed granular local traces, and copied a
+  12,917-byte timing report. Inspection found no source paths or remembered query
+  text in the copied JSON.
+
+Captures came directly from pinned FFmpeg X11 capture, including fresh
+1080-by-760 app-area captures with `-draw_mouse 0`; no screenshot pixels were
+edited. Raw captures and timing/GPU audits are local ignored QA evidence in
+`.searchi/qa/linux-native-*.png` and the native `desktop-qa-99748bd` directory.
+The remembered search displayed a basic backend sample of 236 ms and displayed
+response sample of 474 ms. A separate debug `retry` query showed 4,371 ms backend
+and 4,564 ms final displayed response. These single samples are not startup,
+first-input, paint, large-corpus, or warm p95 benchmarks.
+
+## Independent scheduling regression
+
+The actual Google `budget_google_cpu` test passed on Linux in 129.60s, using
+the normal verified worker with CPU forced: total budget 2, foreground query
+thread 1, indexing thread 1, query sample 142.015 ms, admission sample 0.444 ms,
+six background document encoder calls. This proves the tested concurrent
+admission contract; it does not establish scale or native UI latency targets.
+Log: `/home/karl/.cache/searchi-validation/budget-google-linux-99748bd.log`.
+
+## Remaining scope
+
+The `99748bd` interaction evidence excludes the later watcher milestone.
+Installer/resource discovery, window-manager chrome, theme/contrast/accessibility
+coverage, media previews, physical GPU fallback/recovery, clean-machine ABI,
+upgrades/signing, macOS, and large-corpus performance remain separate gates.
+
+## Watcher milestone: `657de3d`
+
+The isolated source was refreshed from the committed snapshot and paired with
+the matching `index-64het56E.js` frontend. Source mtimes were refreshed before
+Cargo invocation. Executed checks:
+
+- Workspace: **124 passed, 19 ignored**, zero failures; native compilation took
+  2m 25s. Ignored actual-model tests are not counted as executed here.
+- Desktop Release unit tests: **28 passed**, including actual Linux inotify
+  create/update/rename/delete, bounded-event retry/overflow and shutdown tests;
+  compilation took 1m 49s and test execution 1.74s.
+- Actual Google mixed-media reuse regression: **one passed in 67.95s**, including
+  same-stat media invalidation, revision tokens and reused vector publication.
+  Normal verified worker, real models and pinned FFmpeg helpers; CPU forced.
+- Fresh embedded-frontend Release executable built in 1m 49s; SHA-256
+  `746571a151cea5151b0ed9feef87db98f41cb62512a6bc9eb7b7b6404dd015a5`.
+
+Logs are retained as `workspace-linux-657de3d.log`,
+`desktop-tests-linux-657de3d.log`, `media-google-linux-657de3d.log`, and
+`desktop-final-657de3d-build.log` under the native validation cache.
+
+The current native UI used a fresh settings/index directory and the same
+verified private CPU display setup. Captures targeted the actual X11 window ID,
+whose inspected geometry was x=0, y=0, width=1080, height=760. Its worker loaded
+`libggml-cpu-zen4.so`, one inference thread, zero process swap; no GPU mappings
+or descriptors were observed. After initial indexing, WSL reported 539 MiB
+used, 2.3 GiB available and zero swap. No validation compiler or independent
+model test was running during the following UI samples.
+
+The first remembered query had inherited the previously enabled Performance
+details preference from WebKit local storage; `SEARCHI_DATA_DIR` isolates Rust
+settings/index, not that WebKit preference. Its debug sample was 70.852765 ms
+native, 68.644667 ms query embedding, 67.261 ms worker inference, 13 tokens and
+a query-vector cache miss. First displayed response was 70 ms; final displayed
+response was 273 ms. After disabling Performance details, the distinct query
+`end the supplier agreement` showed 89 ms native / 300 ms displayed. These
+different-query samples do not establish normal/debug overhead or p95. The
+earlier 4.371s sample remains valid evidence, with no inferred cause.
+
+Actual UI filesystem lifecycle checks required no manual Reindex action:
+
+1. Changed `sixty` to `seven` while preserving exact file size and mtime. The
+   live passage updated automatically; active generation moved 1 to 2, retaining
+   three chunks. Recorded SHA-256 values differed despite matching metadata.
+2. Created `orbit.txt`. The app counted four files and immediately showed its
+   actual `orbital` keyword passage while Google indexing was working: a single
+   sample of 1.2 ms backend / 88 ms displayed. Generation 3 contained four chunks.
+3. Renamed it to `satellite.txt`. The UI preview and indexed path changed, the
+   old path disappeared, and generation 4 retained four chunks.
+4. Deleted it. The path disappeared from both UI and index; generation 5 returned
+   to three chunks.
+
+Raw mutation snapshots are in native `desktop-qa-657de3d/watch-mutations.jsonl`;
+UI captures are local `.searchi/qa/linux-current-*.png`. The copied debug report
+is `.searchi/qa/linux-current-timing-remembered-debug.json`.
+Both UI sessions ended through their owned cleanup path: the app process group
+terminated, Xvfb exited successfully, and subsequent process inspection found no
+remaining app/WebKit/worker/Xvfb/DBus/clipboard helpers. The outer `/dev/dxg`
+remained the real device after private namespace teardown.
+
+The interactions also exposed two unresolved product observations. Background
+filesystem refreshes displayed `SHOWN 83537 MS` / `SHOWN 108592 MS` despite
+roughly 1–2 ms backend samples, including idle time since the original input;
+these are not fresh search latency measurements. During replacement, selection
+advanced to another valid result and stayed there when the replaced passage
+returned. After deleting the only orbital file, three unrelated semantic
+neighbors remained: deleted-source suppression worked, but no-relevant-match
+calibration remains a separate search-quality gate.

docs/ROADMAP.md

@@ -41,10 +41,10 @@ Status: implementation started; no production release yet. Windows VM tests use
 - [ ] Global shortcut, opening/revealing source files, PDF page navigation.
 - [ ] Watchers and reconciliation across Windows, macOS and Linux.
   - [x] Native notification coordinator, bounded targeted reconciliation,
-    periodic verification and CPU-tested Windows create/update/rename/delete.
+    periodic verification and CPU-tested Windows/Linux create/update/rename/delete.
   - [x] Durable same-stat media hint invalidation, guarded metadata writes and
     real Google reindex/reuse regression; owned decoder scratch avoids feedback.
-  - [ ] Native Linux/macOS events, actual UI refresh and representative storage
+  - [ ] Native macOS events, actual watcher-driven UI refresh and representative storage
     failure/contention checks; see [automatic indexing](AUTOMATIC-INDEXING.md).
 
 ## 4. Media