# Final native interaction and reinstall validation Renewed bounded goal, 2026-10-14: verify Windows/Linux interaction and the Windows uninstall/reinstall path, alongside a modest media relevance improvement. No intermediate release or push is permitted. This report distinguishes actual native observations from process, source and automated frontend checks. Current delivery is 0.1.8. See the final startup-writer correction and corrected Windows/Linux package sections below for authoritative hashes and checks. Earlier local candidates are retained as historical prechecks and were not published. Final native capture/input remains unavailable; process startup, accessibility observation and software screenshots do not replace that gate. ## Native access inventory The approved Computer Use `@oai/sky` client initialized successfully. Unlike the previous handoff, native Windows screenshot and accessibility capture are now available. `list_windows` initially omitted the hidden resident application. The existing CPU-only local launcher brought its existing window forward; the returned native window was then captured through the approved API. Observed installed Windows 0.1.7: process 29000 responding; native searchi window, dark theme, Add folder, filters, settings, query field and readable empty-state interface. Its accessibility tree reports zero files and “Google model ready. Index a folder to search by meaning.” CPU status is visible. This is actual native observation, not a search or keyboard interaction pass. The capture also showed an unrelated foreground Windows Security firewall permission dialog for Electron. No input was attempted while it blocked the workspace. The Computer Use guidance explicitly says: “Do not act on security or privacy permission requests.” The human must dismiss that unrelated prompt before dependent native interaction continues. The agent did not change any security setting or bypass the prompt. Ubuntu 24.04 WSL starts successfully and advertises `DISPLAY=:0` and `WAYLAND_DISPLAY=wayland-0`. Both WSLg X11 and Wayland sockets exist. Existing relocated Linux desktop validation binaries remain available. The current approved UI API only targets Windows applications; no Linux input/capture API has been exposed. WSLg availability alone does not prove native Linux input. ## Windows reinstall test procedure User authorized uninstalling/reinstalling the Windows dev installation. Root agent coordinates execution after backing up the existing user state. 1. Preserve external settings/index/model cache and local CPU wrapper/startup shortcuts; save installer and installed file hashes. 2. Stop only searchi and its owned workers; wait for process exit. 3. Run installed `C:/Users/karl/Applications/searchi/uninstall.exe` silently. Record exit code and verify executable/resources and installer registration are removed. Record any remaining owned directory or shortcut separately. 4. Confirm external user settings/index/model cache survive unchanged. 5. Install the verified normal hardware-detecting package to the same location. Record exit code, registration, installed executable/runtime hashes and bundled extraction/media/speech resource verification. 6. Start with an isolated empty test profile under CPU-only VM flags to exercise fresh settings/index creation. Existing downloaded assets may be reused; this must not be described as a fresh operating-system or first-download test. 7. Restore the user profile and CPU launcher/startup shortcuts. Leave the final installed application running and accessible. ## Executed uninstall/reinstall checks Root executed the existing verified Windows 0.1.7 uninstall and reinstall. Both processes returned exit code zero. The installed main executable was absent after uninstall; external settings/index/model assets survived. Reinstall restored the executable with its expected hash. Raw local records are `.searchi/qa/final-uninstall.json` and `.searchi/qa/final-reinstall.json`; the preserved state is in `.searchi/qa/windows-final-reinstall-backup`. An actual new empty profile at `.searchi/qa/fresh-reinstall-profile` was launched without seeded settings or a copied model cache, using forced CPU inference and software WebView flags. The approved native API returned its searchi window. Initial monitor capture failed with `CreateForMonitor` error `0x80070057`; fresh window selection and the single documented retry succeeded. The native accessibility observation showed zero files and “Preparing Google semantic search on your device…” with CPU status. This establishes installed empty-profile startup, not completed model downloading or search readiness. No user interaction was attempted while the unrelated security permission prompt remained pending. This is uninstall/reinstall on the existing dev OS, not a newly installed Windows system. Final updated package validation and model setup remain separate checks. ## Native Windows search interaction After a fresh approved capture showed that the unrelated permission dialog was gone, native input was used on the isolated profile. Add folder opened the inline folder controls. Entering the owned `.searchi/qa/native-final-corpus` directory and clicking Index folder indexed three files with two extracted text documents. The app displayed its indexing progress while keeping keyword search available. Setting the query to `supplier agreement` returned the correct document and line-one passage. The native screenshot showed highlighted query words in the result, filename and preview. The compact Why this result detail stayed collapsed. Observed tiny-fixture timing was search 40 ms / shown 293 ms; this is one native functional observation, not a latency benchmark. Ctrl+K visibly selected the query text, confirming actual keyboard focus behavior. The next `type_text` operation failed to activate the captured window. After refreshing the same returned window, monitor capture failed again with `0x80070057`; input stopped rather than proceeding blindly. No semantic-query, global-hotkey, tray or Enter-open success is inferred from those partial checks. Read-only accessibility recovery subsequently succeeded and confirmed selected query text. The single accessibility input retry returned `GetCursorPos failed: Access denied (0x80070005)`. Native input is therefore currently blocked by the interactive-session permission state; no shell input or capture workaround was attempted. ## Native acceptance checklist - [x] Native Windows screenshot/accessibility capture of the installed app. - [x] Native Add folder/index action, keyword query, highlighted passage preview and Ctrl+K query selection on the isolated owned corpus. - [ ] Search query typing, arrow selection, passage/media preview and Enter open. - [ ] Settings/theme/transparency interaction and readable preview. - [ ] Escape and title-bar close hide; Ctrl+Shift+Space restores query focus. - [ ] Tray Show/Quit and background/login startup behavior. - [x] Existing Windows 0.1.7 uninstall/reinstall and fresh empty-profile startup. - [ ] Final updated package uninstall/reinstall and completed fresh-profile setup. - [ ] Native Linux keyboard/search/preview interaction through a supported UI API. Unchecked items are pending, not implied by compilation or unit tests. ## Whole-disk permission handling The shared scanner now skips specifically permission-denied scopes, directory walk entries and file reads/metadata/publication checks, increments its skipped count and retains existing records in the affected subtree. It does not update their source fingerprints or certify their freshness. Other filesystem failures still abort and roll back reconciliation. Exact path boundaries protect sibling directories from accidental preservation, including a whole-root special case. Two focused helper regressions cover preserved content/subtree boundaries and classification of other I/O failures. Windows core unit checks passed 27 tests with one separately built-worker test ignored, using serial execution. The first concurrent run hit an existing extraction-worker deadline; the serial rerun passed that test. Strict core library Clippy passed. These are structural checks; no personal folders or operating-system ACLs were modified to fabricate a denied directory fixture. ## Final Linux 0.1.8 local package The exact final uncommitted workspace source plus both new Rust modules and the built frontend were frozen into a 668-file snapshot before building. Snapshot SHA-256: `bf864935e2f630d56836246e6c6a217f1d7313f4498c4fc19c3bac4d6296996d`. Current extraction helper was rebuilt and its source provenance staged. Normal GPU-capable Google and speech runtimes were verified; speech adds 29 resource records. Native desktop release compilation passed on Ubuntu 24.04 WSL in 3m47s; the known vendored GLib lifetime warnings remain dependency warnings. The initial local Debian precheck package was `.searchi/packages/searchi_0.1.8_amd64.deb`, 177,695,882 bytes, SHA-256 `39bc495e65d7ab8c1592636b76aeade25de9fa56d5b139fc6f479fbcb9de0ee6`. No intermediate package was published. Raw build records: `.searchi/qa/linux-final-018-build.json` and its build log. The extracted package started on real WSLg X11 display `:0`, with CPU inference, Mesa software rendering and an owned isolated profile. Automatic disk indexing was explicitly disabled for this bounded test. `ldd` reported no missing desktop dependencies; packaged speech resource verification passed. Its bundled genuine Google worker was observed with `--device cpu --role query --threads 1`, and the desktop remained alive. The approved Windows API returned the WSLg-hosted native window titled `searchi (Ubuntu-24.04)`, proving it can be selected as a target. Raw startup record: `.searchi/qa/linux-final-018-startup.json`. Compilation, loader checks and target inventory do not by themselves establish Linux keyboard or preview interaction. Those checks remain separate. The approved WSLg capture attempt failed with the same `CreateForMonitor` `0x80070057` error as the Windows final candidate. Read-only accessibility exposed only the remote-desktop host pane, not Linux application controls. No input was attempted; the owned CPU startup process group is terminated by the test script. Current Linux desktop unit tests passed 54/54 in 6.33 seconds, including native Linux filesystem create/update/rename/delete watcher behavior, application catalog parsing and automatic-indexing guards. The release tests use `custom-protocol`; an initial invocation without that required feature correctly failed compilation and was corrected without source changes. Raw successful log: `.searchi/qa/linux-final-018-unit-custom.log`. No Linux build/test process remains. ### Earlier local package after safety and visual QA corrections Before final packaging, credential/cache exclusions were added to automatic disk indexing. Actual UI QA also corrected a preview selector that incorrectly stacked document previews. The final Linux source uses the safe snapshot `9f48db1ae11272d51f2e832b0d08de2f850e6e2d456960fcf7435857c46a5eee` plus recorded exact frontend/module deltas in `.searchi/qa/linux-final-018-safe-final-delta.json`. The unchanged extraction helper and normal runtimes were reused only after current provenance validation. Final cached Linux desktop compilation passed in 1m44s. The extracted final Debian payload passed extraction provenance, all 29 speech resource records and loader checks with no missing dependencies. The accepted package at `.searchi/packages/searchi_0.1.8_amd64.deb` is **177,696,356 bytes**, SHA-256 `cd69092b0b41403c4731e5e94a251067bc32e6a0b9f4338bc51bac0e8e2e85b0`. Desktop executable SHA-256: `d630e369c8823a3dfede5b8dad48a8c7d7dd196700743b0bac8418d6f23a5021`. This earlier local package was preserved as an ignored precheck fixture and was not published. Final report: `.searchi/qa/linux-final-018-safe-final-build.json`. Native input was not retried after its recorded capture/permission failure. No owned Linux process remains. ### Accepted final Linux package The final frozen source includes application launching, first-use indexing and watcher cache exclusions, hybrid relevance handling, the new regression tests and current frontend appearance controls. Base snapshot has 677 files; the final frontend/brand source archive SHA-256 is `5650523467ed470355cd1bdb1faaf463bc551610e35ec741a542e228c4879fa8`. The last icon reading-plate delta is recorded separately in `.searchi/qa/linux-final-018-closed-icons-delta.json`. The final ELF was explicitly checked to contain the latest `assets/index-D4fzQWUH.css` asset. Final native Linux desktop tests passed **56/56**, with zero ignored tests, in 4.61 seconds. Native release build and bundling passed. The extracted package passed current extraction provenance, normal speech runtime verification (29 records), and loader resolution without missing dependencies. No further native UI input was attempted after the existing environment errors. The accepted `.searchi/packages/searchi_0.1.8_amd64.deb` is **177,694,032 bytes**, SHA-256 `7ab0a3789028f2a974bbca7fc29220a4ee9327d08388370e20ed610688c13bb9`. Desktop executable SHA-256: `268d2632682d57917595e2f0f3062ff885a58e4eb5ea3ebe0f54e3c988eb2383`. Previous local candidates were preserved as ignored evidence, not published. Raw successful build/test log and report: `.searchi/qa/linux-final-018-closed-build.log` and `.searchi/qa/linux-final-018-closed-build.json`. All owned Linux processes finished. The **accepted final package bytes** (`7ab0a378…c13bb9`) were subsequently extracted again and actually launched on WSLg `:0` from a new owned profile, with automatic indexing disabled and CPU/software rendering enforced. Loader resolution and all 29 packaged speech records passed. The exact bundled Google worker was observed with `--device cpu --role query --threads 1` and the desktop was alive. The bounded smoke exited zero and terminated its owned process group. This is actual final-package startup evidence, not inferred from the earlier candidate or a compilation. No UI input or inference benchmark was performed. Raw report: `.searchi/qa/linux-final-018-closed-startup.json`. ### Final package with indexing/startup database-lock fix Actual Windows startup exposed an interaction between whole-disk indexing and semantic database preparation. The final shared service now prepares semantic storage before watchers start, opens current-schema storage without a write transaction, and treats only a busy optional lexical warmup as deferrable. The current service source/tests plus formatted desktop startup were captured in `.searchi/qa/linux-final-018-lockfix-source-delta.json` and rebuilt locally. Linux desktop tests again passed **56/56**, zero ignored, in 4.08 seconds. Release compilation, final frontend asset presence, extraction provenance, normal speech runtime verification (29 records), and loader resolution passed. The preceding packages above are preserved local prechecks, not release artifacts. **Accepted current package:** `.searchi/packages/searchi_0.1.8_amd64.deb`, 177,702,404 bytes, SHA-256 `d0fd15c4aa4ec0d7320b507a3bc4afa1ebb14bdffa39c3b5cd076df66ede997c`. Desktop executable SHA-256: `e4938a0a557dbe910431f69e51c2ea4a36451df80b6971aede1ad198b82deb7b`. Actual startup of these exact extracted bytes passed on WSLg with an isolated profile, automatic indexing disabled and CPU/software rendering enforced. Its bundled Google process ran `--device cpu --role query --threads 1`; the desktop was alive. The smoke exited zero and terminated the owned process group. No UI retry or inference benchmark was performed. Final evidence: `.searchi/qa/linux-final-018-lockfix-build.json`, matching build log, and `.searchi/qa/linux-final-018-lockfix-startup.json`. All owned Linux build/test/startup processes have finished. No package was published here. ## Final startup writer correction The preceding local 0.1.8 packages remained unpublished prechecks. An actual Windows start with automatic whole-drive discovery exposed `database is locked` during semantic query preparation. The current semantic store had unnecessarily requested an immediate writer transaction on every open. Its optional lexical statistics warmup could request the same writer while discovery was running. The final source prepares core/semantic storage before starting the watcher. Complete current semantic schemas reopen without a migration write; legacy additions still repair atomically and unsupported versions are rejected. Query warmup tolerates only typed SQLite busy/locked errors from the optional lexical cache, then still executes genuine model inference and ANN preparation. Other cache errors remain errors. No model, ranking or extraction helper changed. Focused WAL-writer, legacy-schema, future-version and error propagation checks passed. Final service unit checks passed 49 tests with two explicit ignored fixtures; strict all-target Clippy passed. A genuine Google CPU query session opened, warmed and retrieved the supplier agreement with an owned WAL writer held throughout, in 13.32 seconds. This is functional contention evidence, not a foreground latency benchmark or simulated embedding result. Before packaging, the corrected Windows release executable was tested with an absent application profile and automatic indexing enabled. It exposed 27 Desktop files including the owned validation text, database quick-check returned `ok`, semantic schema was 9, and the actual normal worker remained resident with CPU, query role and one thread. The returned native accessibility tree showed the compact launcher without the earlier schema-lock error. The owned fresh-profile processes were stopped. Raw evidence: `.searchi/qa/lean-final-runtime-smoke/`. A native query input attempt on that returned window still failed at `GetCursorPos` with access denied `0x80070005`. No input success, final hotkey/ tray interaction or native glass pixels are inferred from that attempt. Twelve actual-built CSS composition checks separately passed; they are not native compositor validation. Final installer hashes and installed-start verification are recorded below. ### Corrected Windows installer and installed startup The final Windows installer is 101,832,696 bytes, SHA-256 `6dd415aeb8f7c4d357383f44eab099dcc1c945ef01427ff305999b3b1f616b0c`. Installation exited zero; installed executable SHA-256 `ab7eb3826b713be0f815f27415d2f9d0e9528029cdeee948d8e96cf557d96465` matches the extracted installer exactly. Current extraction provenance passed. Settings bytes were unchanged and a consistent SQLite backup was retained. The VM-only CPU launcher and desktop/login shortcuts were restored. The actual installed package was launched with the original profile. Database quick-check returned `ok`, semantic schema was 9 and 27 early files, including the owned validation marker, remained searchable at the data layer. Its normal Google query worker was observed on CPU with query role and one thread, alongside bounded background workers. The app is left running for Karl; device discovery continues in the background. No final native input pass is claimed. Receipts: `.searchi/qa/lean-final-fixed-install/result.json` and `index-check.json`.