Record native refresh timing and selection retest evidence

docs/LINUX-DESKTOP-VALIDATION.md

@@ -165,3 +165,57 @@ advanced to another valid result and stayed there when the replaced passage
 returned. After deleting the only orbital file, three unrelated semantic
 neighbors remained: deleted-source suppression worked, but no-relevant-match
 calibration remains a separate search-quality gate.
+
+## Watcher UI corrections: `8b993b2`
+
+A fresh native embedded Release build paired this committed snapshot with
+`index-Bi37oidC.js`. Cargo completed successfully in 2m 40s with one build job.
+Executable SHA-256:
+`981dc04fb1e57e4c48bd1a12d64ec300ca73e7696d76aad25cd8153b780c8132`.
+Frontend SHA-256:
+`ee3b297dff382f2f14a87a88e345f1deb8dae0f77f6d70e0444d916b3cf197de`.
+Build log: native `desktop-postfix-8b993b2-build.log`. An earlier command failed
+before Cargo because the inherited Windows PATH contained spaces; the corrected
+command used an explicit Linux-only PATH.
+
+The executed post-fix session used separate XDG cache/config/data directories
+in addition to isolated Rust settings/index. Performance details started
+unchecked, confirming that prior WebKit preferences were not reused. It reused
+the verified private namespace, CPU software Xvfb and explicit native worker
+helper paths; no physical GPU or installer resource discovery was tested.
+
+Actual native UI checks, without a manual Reindex action:
+
+1. The remembered query `cancel the supplier partnership` found the supplier
+   passage. One basic sample showed 93 ms native / 296 ms displayed.
+2. After enabling Performance details, waiting more than 30 seconds, and changing
+   `sixty` to `seven` with identical size and mtime, the preview updated and
+   returned to the supplier selection. The copied report identified
+   `trigger: filesystem_refresh`; its preserved `original_input` measured
+   first response 20 ms and final response 140 ms. The independent refresh
+   measured first response 31 ms and final response 4,164 ms, with 1.9 ms native
+   search. The final displayed time includes actual background indexing/readiness
+   and retry scheduling; it is not the idle interval or native inference cost.
+   This corrects the earlier idle-clock defect without proving a warm p95 target.
+3. Moved the selected supplier file out of the indexed fixture. The UI showed
+   two files and temporarily selected `retry.rs`. Restoring the same supplier
+   path brought the selection and preview back automatically.
+4. Repeated the removal, explicitly clicked `Garden notes.txt` while the supplier
+   was absent, then restored the supplier. The UI retained the explicit garden
+   selection despite the supplier becoming the first result again.
+
+The copied timing JSON contains neither remembered query text nor source paths.
+Local ignored evidence: `.searchi/qa/linux-postfix-timing-refresh.json`,
+`linux-postfix-{update-ready,absent,restored,override-selected,override-restored2}.png`,
+`linux-postfix-cpu-audit.json`, and `linux-postfix-mutations.jsonl`. Native
+`desktop-qa-postfix` retains the owned session logs and complete fixture. One
+capture caught a transient black rectangle over a hovered row; a fresh capture
+after moving the pointer away was clean. This isolated software-display check
+does not close native visual/accessibility or physical-desktop gates.
+
+The CPU audit found no GPU descriptors or provider mappings in the app, WebKit,
+Xvfb or Google worker. The worker used `libggml-cpu-zen4.so`, one thread and zero
+process swap; their private `/dev/dxg` was the null device (1:3). Owned shutdown
+ended the app group with SIGTERM and Xvfb with status zero. Subsequent process
+inspection found no remaining app/worker/WebKit/Xvfb/DBus/clipboard helpers,
+and the outer `/dev/dxg` remained the real device (hex a:102).