Record native refresh timing and selection retest evidence

docs/AUTOMATIC-INDEXING.md

@@ -88,11 +88,13 @@ Release tests including actual inotify create/update/rename/delete, and the
 updated real Google mixed-media regression in 67.95 seconds. Native Linux
 interaction evidence is in
 [LINUX-DESKTOP-VALIDATION.md](LINUX-DESKTOP-VALIDATION.md). Actual watcher-driven
-UI change/create/rename/delete passed on `657de3d`; timing and selection issues
-found during those interactions require separate fixes and retesting.
+UI change/create/rename/delete passed on `657de3d`. The `8b993b2` native UI retest
+confirmed independent refresh clocks, restoration of temporarily hidden
+selection, and retention of explicit user choices. A 4.164-second final refresh
+sample during background updates remains recorded; this is not a warm p95 pass.
 
 macOS native watcher execution, root disappearance/reappearance on
-real removable/network storage, native UI refresh interaction, representative
+real removable/network storage, Windows/macOS native UI refresh interaction, representative
 large-corpus contention and power-loss behavior remain open. Full reconciliation
 still holds a write transaction during extraction and can contend with semantic
 writes; targeted batches reduce that work but do not establish a universal

docs/LINUX-DESKTOP-VALIDATION.md

@@ -165,3 +165,57 @@ advanced to another valid result and stayed there when the replaced passage
 returned. After deleting the only orbital file, three unrelated semantic
 neighbors remained: deleted-source suppression worked, but no-relevant-match
 calibration remains a separate search-quality gate.
+
+## Watcher UI corrections: `8b993b2`
+
+A fresh native embedded Release build paired this committed snapshot with
+`index-Bi37oidC.js`. Cargo completed successfully in 2m 40s with one build job.
+Executable SHA-256:
+`981dc04fb1e57e4c48bd1a12d64ec300ca73e7696d76aad25cd8153b780c8132`.
+Frontend SHA-256:
+`ee3b297dff382f2f14a87a88e345f1deb8dae0f77f6d70e0444d916b3cf197de`.
+Build log: native `desktop-postfix-8b993b2-build.log`. An earlier command failed
+before Cargo because the inherited Windows PATH contained spaces; the corrected
+command used an explicit Linux-only PATH.
+
+The executed post-fix session used separate XDG cache/config/data directories
+in addition to isolated Rust settings/index. Performance details started
+unchecked, confirming that prior WebKit preferences were not reused. It reused
+the verified private namespace, CPU software Xvfb and explicit native worker
+helper paths; no physical GPU or installer resource discovery was tested.
+
+Actual native UI checks, without a manual Reindex action:
+
+1. The remembered query `cancel the supplier partnership` found the supplier
+   passage. One basic sample showed 93 ms native / 296 ms displayed.
+2. After enabling Performance details, waiting more than 30 seconds, and changing
+   `sixty` to `seven` with identical size and mtime, the preview updated and
+   returned to the supplier selection. The copied report identified
+   `trigger: filesystem_refresh`; its preserved `original_input` measured
+   first response 20 ms and final response 140 ms. The independent refresh
+   measured first response 31 ms and final response 4,164 ms, with 1.9 ms native
+   search. The final displayed time includes actual background indexing/readiness
+   and retry scheduling; it is not the idle interval or native inference cost.
+   This corrects the earlier idle-clock defect without proving a warm p95 target.
+3. Moved the selected supplier file out of the indexed fixture. The UI showed
+   two files and temporarily selected `retry.rs`. Restoring the same supplier
+   path brought the selection and preview back automatically.
+4. Repeated the removal, explicitly clicked `Garden notes.txt` while the supplier
+   was absent, then restored the supplier. The UI retained the explicit garden
+   selection despite the supplier becoming the first result again.
+
+The copied timing JSON contains neither remembered query text nor source paths.
+Local ignored evidence: `.searchi/qa/linux-postfix-timing-refresh.json`,
+`linux-postfix-{update-ready,absent,restored,override-selected,override-restored2}.png`,
+`linux-postfix-cpu-audit.json`, and `linux-postfix-mutations.jsonl`. Native
+`desktop-qa-postfix` retains the owned session logs and complete fixture. One
+capture caught a transient black rectangle over a hovered row; a fresh capture
+after moving the pointer away was clean. This isolated software-display check
+does not close native visual/accessibility or physical-desktop gates.
+
+The CPU audit found no GPU descriptors or provider mappings in the app, WebKit,
+Xvfb or Google worker. The worker used `libggml-cpu-zen4.so`, one thread and zero
+process swap; their private `/dev/dxg` was the null device (1:3). Owned shutdown
+ended the app group with SIGTERM and Xvfb with status zero. Subsequent process
+inspection found no remaining app/worker/WebKit/Xvfb/DBus/clipboard helpers,
+and the outer `/dev/dxg` remained the real device (hex a:102).

docs/ROADMAP.md

@@ -44,7 +44,9 @@ Status: implementation started; no production release yet. Windows VM tests use
     periodic verification and CPU-tested Windows/Linux create/update/rename/delete.
   - [x] Durable same-stat media hint invalidation, guarded metadata writes and
     real Google reindex/reuse regression; owned decoder scratch avoids feedback.
-  - [ ] Native macOS events, actual watcher-driven UI refresh and representative storage
+  - [x] Native Linux watcher-driven UI refresh, independent refresh timing,
+    temporary selection restoration and explicit selection override.
+  - [ ] Native macOS events, Windows/macOS watcher-driven UI refresh and representative storage
     failure/contention checks; see [automatic indexing](AUTOMATIC-INDEXING.md).
 
 ## 4. Media