searchi/docs/VALIDATION.md

Validation evidence

Development host: Windows VM, x86_64 MSVC, stable Rust 1.99.0. All local inference, FFmpeg decoding and WebView tests use CPU only. UI launches set WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS='--disable-gpu --disable-accelerated-video-decode' and SEARCHI_FORCE_CPU=1.

Current integration checkpoint (2026-10-12)

• Native desktop: 9/9 tests passed, including structured trace/basic responses. Post-generation cached query warmup is implemented but its interactive first-query gate remains open. Frontend: 31/31 tests passed, TypeScript/Vite production build and formatting passed. Preview policy tests cover fractional timestamp seeking, image labels, one active/latest pending request, stale replies and Escape.
• Semantic adapter: 8 default tests passed; the explicit 48 MP resource test remains opt-in. Strict targeted all-target Clippy and formatting passed. Protocol bounds, invalid vectors, artifact size/checksum mismatch, old-worker capability defaults and oversized JPEG rejection are covered.
• The CPU native helper rebuilt and staged successfully with genuine Google MTMD image/audio support. Its handshake reports media_supported:true; older text workers default false rather than claiming media readiness.
• Actual Google CPU media parity passed separately in 52.85 seconds: screenshot 280 cosine 0.99994194, photo 140: 0.99974583, frame 70: 0.99921928 and speech: 0.99983318 against pinned MIT DigUp vectors. All exceed the 0.999 gate. This verifies runtime parity, not broad retrieval quality.
• The release resource test encodes/decodes an actual 8000x6000 JPEG with EXIF rotation and verifies region colors after scaled decoding/resizing. Decode plus resize took 176–220 ms. A sampled whole-test peak was 146.86 MiB, including source fixture generation; it is not decoder-only RSS or neural quality.
• The independent production media pipeline has run on 20 real assets/65 frozen queries using actual Google inference, FFmpeg, metadata, persistence and HNSW. It encoded 20/20 files with no failures in the recorded 30-second-window run. Broad file recall is promising; precise speech timestamps, music confusion and no-answer behavior remain failed quality gates. Preserve the earlier direct harness failure separately. Raw results and limitations.
• Actual document seed regression passed 24/24 semantic/hybrid queries. This is a small synthetic regression, not a production relevance corpus.
• The explicit 100,000-vector release ANN diagnostic passed 98.5% recall@10, HNSW p95 1.37 ms and warm service p95 6.40 ms with zero warm passage hashes. Vectors are synthetic index benchmark data, never production embeddings.
• The fixed one-million-file first-input report records 40 inputs below 50 ms in that run: recorded benchmark. These measurements do not establish every query or concurrent-indexing goal.

The integrated CPU workspace checkpoint passed 62 default tests (8 assets, 6 CLI, 23 core, 4 media, 8 semantic, 13 service), with 10 explicit opt-in tests ignored. Workspace and native all-target Clippy passed with warnings denied. The later semantic CPU-restart counter change passed workspace Clippy and the actual CPU query diagnostics test. Earlier aggregate counts are historical.

The updated pinned C++ helper compiled in an independent CPU build directory and was staged for desktop resources without interrupting media evaluation. Actual Google query diagnostics passed separately in 18.09 seconds including model initialization and two queries: 13 tokens, tokenization 149 us, batch preparation 22 us, inference 112914 us, pooling/normalization 17 us. Rust worker wait/response decode measured 113960 us. Debug/normal embedding cosine was 0.99999999. These are one diagnostic sample under VM contention, not production latency evidence. See performance boundaries and raw overhead samples.

Native UI and platform limits

The branded launcher launched natively. Accessibility inspection showed real controls and a warmed Google CPU worker. Native screenshots, input automation and complete image/audio/video playback interactions remain blocked by Windows access/capture errors recorded in design QA. Passing pure preview policy tests does not establish real WebView codec playback or visual fidelity. Default-application opening is not exact timestamp navigation.

Windows x86-64 verified decoder provisioning/staging has executed. Manifest entries for Linux and ARM64 are configuration, not evidence of native execution. A vetted macOS decoder package remains missing. Linux/macOS worker/desktop execution, production GPU parity/fallback, installer signing, upgrade/rollback, licenses/source distribution, large libraries and calibrated absence handling remain unexecuted release gates. FFmpeg subprocess memory is not sandbox-capped; bounded outputs/timeouts are not an absolute RSS guarantee.

Gitea needs matching registered runners. GitHub workflows are supplied for mirroring; they do not run merely because code is pushed to Gitea. The current workflow checks do not automatically certify downloaded Google assets or the separately built worker. CI configuration is not remote job evidence.

README capture evidence (2026-10-12)

The README now includes four visually inspected browser captures of the production frontend over a real, retained Google CPU engine: light/dark PDF search, image search and granular performance details. The independent capture backend passed three tests and strict Clippy. Live capture assertions verified the first PDF result and page 2, its notice clause, loaded photo pixels, and actual worker inference counters. All captures use an owned headless browser with CPU flags and licensed/generated fixture content; no recorded responses are replayed. These checks supplement native desktop QA, which remains open. Literal highlights are checked in result snippets and the actual preview text. The small match explanation is closed by default and can be opened to inspect the real page location. Media placeholder text receives no invented word marks. Reproduction, runtime/query/image evidence.

Historical evidence

Initial engine/CLI checks covered retrieval, persistence, filesystem changes, exclusions/filters, migration, concurrent readers, PDF pages, DOCX paragraphs, corrupt replacement, encrypted PDF errors and bounded compressed input. The first actual Google text adapter matched five pinned reference vectors above 0.999, including multilingual queries and long-document window coverage.

The rejected MiniLM/ONNX experiment achieved 5/6 top-1 on its six-query fixture; it is retained under the opt-in historical proof only and is not a production fallback. Historical experiment. Repository metadata/avatar updates were read back successfully. Historical foundation/default test totals changed as implementation expanded and must not be presented as the current aggregate.

Reproduction commands and exact interfaces are in BUILDING.md, SEMANTIC.md, and MEDIA-QUALITY.md.