Ship floating launcher, automatic discovery and bounded media search improvements

docs/NATIVE-FINAL-VALIDATION.md

@@ -0,0 +1,320 @@
+# Final native interaction and reinstall validation
+
+Renewed bounded goal, 2026-10-14: verify Windows/Linux interaction and the
+Windows uninstall/reinstall path, alongside a modest media relevance improvement.
+No intermediate release or push is permitted. This report distinguishes actual
+native observations from process, source and automated frontend checks.
+
+Current delivery is 0.1.8. See the final startup-writer correction and corrected
+Windows/Linux package sections below for authoritative hashes and checks.
+Earlier local candidates are retained as historical prechecks and were not
+published. Final native capture/input remains unavailable; process startup,
+accessibility observation and software screenshots do not replace that gate.
+
+## Native access inventory
+
+The approved Computer Use `@oai/sky` client initialized successfully. Unlike the
+previous handoff, native Windows screenshot and accessibility capture are now
+available. `list_windows` initially omitted the hidden resident application.
+The existing CPU-only local launcher brought its existing window forward;
+the returned native window was then captured through the approved API.
+
+Observed installed Windows 0.1.7: process 29000 responding; native searchi
+window, dark theme, Add folder, filters, settings, query field and readable
+empty-state interface. Its accessibility tree reports zero files and
+“Google model ready. Index a folder to search by meaning.” CPU status is visible.
+This is actual native observation, not a search or keyboard interaction pass.
+
+The capture also showed an unrelated foreground Windows Security firewall
+permission dialog for Electron. No input was attempted while it blocked the
+workspace. The Computer Use guidance explicitly says: “Do not act on security
+or privacy permission requests.” The human must dismiss that unrelated prompt
+before dependent native interaction continues. The agent did not change any
+security setting or bypass the prompt.
+
+Ubuntu 24.04 WSL starts successfully and advertises `DISPLAY=:0` and
+`WAYLAND_DISPLAY=wayland-0`. Both WSLg X11 and Wayland sockets exist. Existing
+relocated Linux desktop validation binaries remain available. The current
+approved UI API only targets Windows applications; no Linux input/capture API
+has been exposed. WSLg availability alone does not prove native Linux input.
+
+## Windows reinstall test procedure
+
+User authorized uninstalling/reinstalling the Windows dev installation. Root
+agent coordinates execution after backing up the existing user state.
+
+1. Preserve external settings/index/model cache and local CPU wrapper/startup
+   shortcuts; save installer and installed file hashes.
+2. Stop only searchi and its owned workers; wait for process exit.
+3. Run installed `C:/Users/karl/Applications/searchi/uninstall.exe` silently.
+   Record exit code and verify executable/resources and installer registration
+   are removed. Record any remaining owned directory or shortcut separately.
+4. Confirm external user settings/index/model cache survive unchanged.
+5. Install the verified normal hardware-detecting package to the same location.
+   Record exit code, registration, installed executable/runtime hashes and
+   bundled extraction/media/speech resource verification.
+6. Start with an isolated empty test profile under CPU-only VM flags to exercise
+   fresh settings/index creation. Existing downloaded assets may be reused;
+   this must not be described as a fresh operating-system or first-download test.
+7. Restore the user profile and CPU launcher/startup shortcuts. Leave the final
+   installed application running and accessible.
+
+## Executed uninstall/reinstall checks
+
+Root executed the existing verified Windows 0.1.7 uninstall and reinstall.
+Both processes returned exit code zero. The installed main executable was absent
+after uninstall; external settings/index/model assets survived. Reinstall restored
+the executable with its expected hash. Raw local records are
+`.searchi/qa/final-uninstall.json` and `.searchi/qa/final-reinstall.json`;
+the preserved state is in `.searchi/qa/windows-final-reinstall-backup`.
+
+An actual new empty profile at `.searchi/qa/fresh-reinstall-profile` was launched
+without seeded settings or a copied model cache, using forced CPU inference and
+software WebView flags. The approved native API returned its searchi window.
+Initial monitor capture failed with `CreateForMonitor` error `0x80070057`; fresh
+window selection and the single documented retry succeeded. The native
+accessibility observation showed zero files and “Preparing Google semantic
+search on your device…” with CPU status. This establishes installed empty-profile
+startup, not completed model downloading or search readiness. No user interaction
+was attempted while the unrelated security permission prompt remained pending.
+
+This is uninstall/reinstall on the existing dev OS, not a newly installed Windows
+system. Final updated package validation and model setup remain separate checks.
+
+## Native Windows search interaction
+
+After a fresh approved capture showed that the unrelated permission dialog was
+gone, native input was used on the isolated profile. Add folder opened the inline
+folder controls. Entering the owned `.searchi/qa/native-final-corpus` directory
+and clicking Index folder indexed three files with two extracted text documents.
+The app displayed its indexing progress while keeping keyword search available.
+
+Setting the query to `supplier agreement` returned the correct document and
+line-one passage. The native screenshot showed highlighted query words in the
+result, filename and preview. The compact Why this result detail stayed collapsed.
+Observed tiny-fixture timing was search 40 ms / shown 293 ms; this is one native
+functional observation, not a latency benchmark. Ctrl+K visibly selected the
+query text, confirming actual keyboard focus behavior.
+
+The next `type_text` operation failed to activate the captured window. After
+refreshing the same returned window, monitor capture failed again with
+`0x80070057`; input stopped rather than proceeding blindly. No semantic-query,
+global-hotkey, tray or Enter-open success is inferred from those partial checks.
+Read-only accessibility recovery subsequently succeeded and confirmed selected
+query text. The single accessibility input retry returned `GetCursorPos failed:
+Access denied (0x80070005)`. Native input is therefore currently blocked by the
+interactive-session permission state; no shell input or capture workaround was
+attempted.
+
+## Native acceptance checklist
+
+- [x] Native Windows screenshot/accessibility capture of the installed app.
+- [x] Native Add folder/index action, keyword query, highlighted passage preview
+  and Ctrl+K query selection on the isolated owned corpus.
+- [ ] Search query typing, arrow selection, passage/media preview and Enter open.
+- [ ] Settings/theme/transparency interaction and readable preview.
+- [ ] Escape and title-bar close hide; Ctrl+Shift+Space restores query focus.
+- [ ] Tray Show/Quit and background/login startup behavior.
+- [x] Existing Windows 0.1.7 uninstall/reinstall and fresh empty-profile startup.
+- [ ] Final updated package uninstall/reinstall and completed fresh-profile setup.
+- [ ] Native Linux keyboard/search/preview interaction through a supported UI API.
+
+Unchecked items are pending, not implied by compilation or unit tests.
+
+## Whole-disk permission handling
+
+The shared scanner now skips specifically permission-denied scopes, directory
+walk entries and file reads/metadata/publication checks, increments its skipped
+count and retains existing records in the affected subtree. It does not update
+their source fingerprints or certify their freshness. Other filesystem failures
+still abort and roll back reconciliation. Exact path boundaries protect sibling
+directories from accidental preservation, including a whole-root special case.
+
+Two focused helper regressions cover preserved content/subtree boundaries and
+classification of other I/O failures. Windows core unit checks passed 27 tests
+with one separately built-worker test ignored, using serial execution. The first
+concurrent run hit an existing extraction-worker deadline; the serial rerun
+passed that test. Strict core library Clippy passed. These are structural checks;
+no personal folders or operating-system ACLs were modified to fabricate a denied
+directory fixture.
+
+## Final Linux 0.1.8 local package
+
+The exact final uncommitted workspace source plus both new Rust modules and the
+built frontend were frozen into a 668-file snapshot before building. Snapshot
+SHA-256: `bf864935e2f630d56836246e6c6a217f1d7313f4498c4fc19c3bac4d6296996d`.
+Current extraction helper was rebuilt and its source provenance staged. Normal
+GPU-capable Google and speech runtimes were verified; speech adds 29 resource
+records. Native desktop release compilation passed on Ubuntu 24.04 WSL in
+3m47s; the known vendored GLib lifetime warnings remain dependency warnings.
+
+The initial local Debian precheck package was
+`.searchi/packages/searchi_0.1.8_amd64.deb`, 177,695,882 bytes, SHA-256
+`39bc495e65d7ab8c1592636b76aeade25de9fa56d5b139fc6f479fbcb9de0ee6`.
+No intermediate package was published. Raw build records:
+`.searchi/qa/linux-final-018-build.json` and its build log.
+
+The extracted package started on real WSLg X11 display `:0`, with CPU inference,
+Mesa software rendering and an owned isolated profile. Automatic disk indexing
+was explicitly disabled for this bounded test. `ldd` reported no missing desktop
+dependencies; packaged speech resource verification passed. Its bundled genuine
+Google worker was observed with `--device cpu --role query --threads 1`, and the
+desktop remained alive. The approved Windows API returned the WSLg-hosted native
+window titled `searchi (Ubuntu-24.04)`, proving it can be selected as a target.
+Raw startup record: `.searchi/qa/linux-final-018-startup.json`.
+
+Compilation, loader checks and target inventory do not by themselves establish
+Linux keyboard or preview interaction. Those checks remain separate.
+The approved WSLg capture attempt failed with the same `CreateForMonitor`
+`0x80070057` error as the Windows final candidate. Read-only accessibility exposed
+only the remote-desktop host pane, not Linux application controls. No input was
+attempted; the owned CPU startup process group is terminated by the test script.
+
+Current Linux desktop unit tests passed 54/54 in 6.33 seconds, including native
+Linux filesystem create/update/rename/delete watcher behavior, application catalog
+parsing and automatic-indexing guards. The release tests use `custom-protocol`;
+an initial invocation without that required feature correctly failed compilation
+and was corrected without source changes. Raw successful log:
+`.searchi/qa/linux-final-018-unit-custom.log`. No Linux build/test process remains.
+
+### Earlier local package after safety and visual QA corrections
+
+Before final packaging, credential/cache exclusions were added to automatic
+disk indexing. Actual UI QA also corrected a preview selector that incorrectly
+stacked document previews. The final Linux source uses the safe snapshot
+`9f48db1ae11272d51f2e832b0d08de2f850e6e2d456960fcf7435857c46a5eee`
+plus recorded exact frontend/module deltas in
+`.searchi/qa/linux-final-018-safe-final-delta.json`. The unchanged extraction
+helper and normal runtimes were reused only after current provenance validation.
+
+Final cached Linux desktop compilation passed in 1m44s. The extracted final
+Debian payload passed extraction provenance, all 29 speech resource records and
+loader checks with no missing dependencies. The accepted package at
+`.searchi/packages/searchi_0.1.8_amd64.deb` is **177,696,356 bytes**, SHA-256
+`cd69092b0b41403c4731e5e94a251067bc32e6a0b9f4338bc51bac0e8e2e85b0`.
+Desktop executable SHA-256:
+`d630e369c8823a3dfede5b8dad48a8c7d7dd196700743b0bac8418d6f23a5021`.
+This earlier local package was preserved as an ignored precheck fixture and
+was not published. Final report:
+`.searchi/qa/linux-final-018-safe-final-build.json`. Native input was not retried
+after its recorded capture/permission failure. No owned Linux process remains.
+
+### Accepted final Linux package
+
+The final frozen source includes application launching, first-use indexing and
+watcher cache exclusions, hybrid relevance handling, the new regression tests
+and current frontend appearance controls. Base snapshot has 677 files; the final
+frontend/brand source archive SHA-256 is
+`5650523467ed470355cd1bdb1faaf463bc551610e35ec741a542e228c4879fa8`.
+The last icon reading-plate delta is recorded separately in
+`.searchi/qa/linux-final-018-closed-icons-delta.json`. The final ELF was explicitly
+checked to contain the latest `assets/index-D4fzQWUH.css` asset.
+
+Final native Linux desktop tests passed **56/56**, with zero ignored tests, in
+4.61 seconds. Native release build and bundling passed. The extracted package
+passed current extraction provenance, normal speech runtime verification (29
+records), and loader resolution without missing dependencies. No further native
+UI input was attempted after the existing environment errors.
+
+The accepted `.searchi/packages/searchi_0.1.8_amd64.deb` is **177,694,032 bytes**,
+SHA-256 `7ab0a3789028f2a974bbca7fc29220a4ee9327d08388370e20ed610688c13bb9`.
+Desktop executable SHA-256:
+`268d2632682d57917595e2f0f3062ff885a58e4eb5ea3ebe0f54e3c988eb2383`.
+Previous local candidates were preserved as ignored evidence, not published.
+Raw successful build/test log and report:
+`.searchi/qa/linux-final-018-closed-build.log` and
+`.searchi/qa/linux-final-018-closed-build.json`. All owned Linux processes finished.
+
+The **accepted final package bytes** (`7ab0a378…c13bb9`) were subsequently
+extracted again and actually launched on WSLg `:0` from a new owned profile,
+with automatic indexing disabled and CPU/software rendering enforced. Loader
+resolution and all 29 packaged speech records passed. The exact bundled Google
+worker was observed with `--device cpu --role query --threads 1` and the desktop
+was alive. The bounded smoke exited zero and terminated its owned process group.
+This is actual final-package startup evidence, not inferred from the earlier
+candidate or a compilation. No UI input or inference benchmark was performed.
+Raw report: `.searchi/qa/linux-final-018-closed-startup.json`.
+
+### Final package with indexing/startup database-lock fix
+
+Actual Windows startup exposed an interaction between whole-disk indexing and
+semantic database preparation. The final shared service now prepares semantic
+storage before watchers start, opens current-schema storage without a write
+transaction, and treats only a busy optional lexical warmup as deferrable. The
+current service source/tests plus formatted desktop startup were captured in
+`.searchi/qa/linux-final-018-lockfix-source-delta.json` and rebuilt locally.
+
+Linux desktop tests again passed **56/56**, zero ignored, in 4.08 seconds.
+Release compilation, final frontend asset presence, extraction provenance,
+normal speech runtime verification (29 records), and loader resolution passed.
+The preceding packages above are preserved local prechecks, not release artifacts.
+
+**Accepted current package:** `.searchi/packages/searchi_0.1.8_amd64.deb`,
+177,702,404 bytes, SHA-256
+`d0fd15c4aa4ec0d7320b507a3bc4afa1ebb14bdffa39c3b5cd076df66ede997c`.
+Desktop executable SHA-256:
+`e4938a0a557dbe910431f69e51c2ea4a36451df80b6971aede1ad198b82deb7b`.
+Actual startup of these exact extracted bytes passed on WSLg with an isolated
+profile, automatic indexing disabled and CPU/software rendering enforced. Its
+bundled Google process ran `--device cpu --role query --threads 1`; the desktop
+was alive. The smoke exited zero and terminated the owned process group.
+No UI retry or inference benchmark was performed.
+
+Final evidence: `.searchi/qa/linux-final-018-lockfix-build.json`, matching build
+log, and `.searchi/qa/linux-final-018-lockfix-startup.json`. All owned Linux
+build/test/startup processes have finished. No package was published here.
+
+## Final startup writer correction
+
+The preceding local 0.1.8 packages remained unpublished prechecks. An actual
+Windows start with automatic whole-drive discovery exposed `database is locked`
+during semantic query preparation. The current semantic store had unnecessarily
+requested an immediate writer transaction on every open. Its optional lexical
+statistics warmup could request the same writer while discovery was running.
+
+The final source prepares core/semantic storage before starting the watcher.
+Complete current semantic schemas reopen without a migration write; legacy
+additions still repair atomically and unsupported versions are rejected. Query
+warmup tolerates only typed SQLite busy/locked errors from the optional lexical
+cache, then still executes genuine model inference and ANN preparation. Other
+cache errors remain errors. No model, ranking or extraction helper changed.
+
+Focused WAL-writer, legacy-schema, future-version and error propagation checks
+passed. Final service unit checks passed 49 tests with two explicit ignored
+fixtures; strict all-target Clippy passed. A genuine Google CPU query session
+opened, warmed and retrieved the supplier agreement with an owned WAL writer
+held throughout, in 13.32 seconds. This is functional contention evidence,
+not a foreground latency benchmark or simulated embedding result.
+
+Before packaging, the corrected Windows release executable was tested with an
+absent application profile and automatic indexing enabled. It exposed 27 Desktop
+files including the owned validation text, database quick-check returned `ok`,
+semantic schema was 9, and the actual normal worker remained resident with CPU,
+query role and one thread. The returned native accessibility tree showed the
+compact launcher without the earlier schema-lock error. The owned fresh-profile
+processes were stopped. Raw evidence: `.searchi/qa/lean-final-runtime-smoke/`.
+
+A native query input attempt on that returned window still failed at
+`GetCursorPos` with access denied `0x80070005`. No input success, final hotkey/
+tray interaction or native glass pixels are inferred from that attempt. Twelve
+actual-built CSS composition checks separately passed; they are not native
+compositor validation. Final installer hashes and installed-start verification
+are recorded below.
+
+### Corrected Windows installer and installed startup
+
+The final Windows installer is 101,832,696 bytes, SHA-256
+`6dd415aeb8f7c4d357383f44eab099dcc1c945ef01427ff305999b3b1f616b0c`.
+Installation exited zero; installed executable SHA-256
+`ab7eb3826b713be0f815f27415d2f9d0e9528029cdeee948d8e96cf557d96465`
+matches the extracted installer exactly. Current extraction provenance passed.
+Settings bytes were unchanged and a consistent SQLite backup was retained.
+The VM-only CPU launcher and desktop/login shortcuts were restored.
+
+The actual installed package was launched with the original profile. Database
+quick-check returned `ok`, semantic schema was 9 and 27 early files, including
+the owned validation marker, remained searchable at the data layer. Its normal
+Google query worker was observed on CPU with query role and one thread, alongside
+bounded background workers. The app is left running for Karl; device discovery
+continues in the background. No final native input pass is claimed.
+Receipts: `.searchi/qa/lean-final-fixed-install/result.json` and `index-check.json`.