# Real-engine screenshot backend

This independent software-test server serves the built desktop frontend and
connects its explicit `?capture=1` adapter to the actual shared Rust engine.
It is not the packaged desktop application or a production HTTP API.

The dedicated corpus contains five generated documents, including a genuine
two-page Supplier Agreement PDF, plus the licensed mountain-lake/night-pier
photos from `fixtures/media/fixture.json` (image03/image05). Photo checksums and
original license attribution are retained there. Tests verify actual PDF page-2
retrieval and unchanged-file reuse. No screenshots/results/vectors are replayed.

Build the frontend, then run this standalone Cargo crate with `--locked`:

```powershell
cargo run --manifest-path tools/desktop-capture/backend/Cargo.toml --locked -- `
  --root .searchi/desktop-capture/corpus `
  --db .searchi/desktop-capture/index.db `
  --models .searchi/models/embeddinggemma2 `
  --worker .searchi/runtime/cpu/Release/searchi-gemma-worker.exe `
  --dist apps/desktop/dist `
  --ffmpeg .searchi/media-runtime/bin/ffmpeg.exe `
  --ffprobe .searchi/media-runtime/bin/ffprobe.exe
```

Indexing, real CPU model inference and prewarming finish before the server
listens on `http://127.0.0.1:1431/?capture=1`. It forces CPU mode and one model
thread. Runtime never downloads anything. Existing matching corpus files are
not rewritten; incompatible files or database roots are rejected.

`GET /capture-info` returns the explicit mode, readiness, a per-process token
and actual worker information. `POST /capture-api/{command}` requires the exact
loopback Host, same-origin Origin and `X-Searchi-Capture-Token`, with a 64 KiB
body cap. Only desktop/status/stats, measured lexical/hybrid search and fixed
indexed-photo preview commands exist. Indexing, file opening, settings and
arbitrary filesystem access are not browser commands. Static assets are
canonicalized beneath the supplied frontend build; media IDs are only `lake`
and `pier`. There are no CORS allowances or remote bindings.

The operator must supply an empty dedicated corpus root and database; the
server must not be pointed at user documents. This intentionally small fixture
demonstrates real behavior, not production-scale performance. Host/Origin/token,
path containment, unrelated-file rejection, PDF extraction and fixture reuse
have CPU tests. The browser runner records actual receipts and screenshot
measurements separately.