searchi/docs/NATIVE-FINAL-VALIDATION.md

Final native interaction and reinstall validation

Renewed bounded goal, 2026-10-14: verify Windows/Linux interaction and the Windows uninstall/reinstall path, alongside a modest media relevance improvement. No intermediate release or push is permitted. This report distinguishes actual native observations from process, source and automated frontend checks.

Current installed correction is 0.1.9. Its package checks below supersede the 0.1.8 startup-writer delivery; earlier sections retain their historical evidence. Earlier local candidates are retained as historical prechecks and were not published. Final native capture/input remains unavailable; process startup, accessibility observation and software screenshots do not replace that gate.

Native access inventory

The approved Computer Use @oai/sky client initialized successfully. Unlike the previous handoff, native Windows screenshot and accessibility capture are now available. list_windows initially omitted the hidden resident application. The existing CPU-only local launcher brought its existing window forward; the returned native window was then captured through the approved API.

Observed installed Windows 0.1.7: process 29000 responding; native searchi window, dark theme, Add folder, filters, settings, query field and readable empty-state interface. Its accessibility tree reports zero files and “Google model ready. Index a folder to search by meaning.” CPU status is visible. This is actual native observation, not a search or keyboard interaction pass.

The capture also showed an unrelated foreground Windows Security firewall permission dialog for Electron. No input was attempted while it blocked the workspace. The Computer Use guidance explicitly says: “Do not act on security or privacy permission requests.” The human must dismiss that unrelated prompt before dependent native interaction continues. The agent did not change any security setting or bypass the prompt.

Ubuntu 24.04 WSL starts successfully and advertises DISPLAY=:0 and WAYLAND_DISPLAY=wayland-0. Both WSLg X11 and Wayland sockets exist. Existing relocated Linux desktop validation binaries remain available. The current approved UI API only targets Windows applications; no Linux input/capture API has been exposed. WSLg availability alone does not prove native Linux input.

Windows reinstall test procedure

User authorized uninstalling/reinstalling the Windows dev installation. Root agent coordinates execution after backing up the existing user state.

1. Preserve external settings/index/model cache and local CPU wrapper/startup shortcuts; save installer and installed file hashes.
2. Stop only searchi and its owned workers; wait for process exit.
3. Run installed C:/Users/karl/Applications/searchi/uninstall.exe silently. Record exit code and verify executable/resources and installer registration are removed. Record any remaining owned directory or shortcut separately.
4. Confirm external user settings/index/model cache survive unchanged.
5. Install the verified normal hardware-detecting package to the same location. Record exit code, registration, installed executable/runtime hashes and bundled extraction/media/speech resource verification.
6. Start with an isolated empty test profile under CPU-only VM flags to exercise fresh settings/index creation. Existing downloaded assets may be reused; this must not be described as a fresh operating-system or first-download test.
7. Restore the user profile and CPU launcher/startup shortcuts. Leave the final installed application running and accessible.

Executed uninstall/reinstall checks

Root executed the existing verified Windows 0.1.7 uninstall and reinstall. Both processes returned exit code zero. The installed main executable was absent after uninstall; external settings/index/model assets survived. Reinstall restored the executable with its expected hash. Raw local records are .searchi/qa/final-uninstall.json and .searchi/qa/final-reinstall.json; the preserved state is in .searchi/qa/windows-final-reinstall-backup.

An actual new empty profile at .searchi/qa/fresh-reinstall-profile was launched without seeded settings or a copied model cache, using forced CPU inference and software WebView flags. The approved native API returned its searchi window. Initial monitor capture failed with CreateForMonitor error 0x80070057; fresh window selection and the single documented retry succeeded. The native accessibility observation showed zero files and “Preparing Google semantic search on your device…” with CPU status. This establishes installed empty-profile startup, not completed model downloading or search readiness. No user interaction was attempted while the unrelated security permission prompt remained pending.

This is uninstall/reinstall on the existing dev OS, not a newly installed Windows system. Final updated package validation and model setup remain separate checks.

Native Windows search interaction

After a fresh approved capture showed that the unrelated permission dialog was gone, native input was used on the isolated profile. Add folder opened the inline folder controls. Entering the owned .searchi/qa/native-final-corpus directory and clicking Index folder indexed three files with two extracted text documents. The app displayed its indexing progress while keeping keyword search available.

Setting the query to supplier agreement returned the correct document and line-one passage. The native screenshot showed highlighted query words in the result, filename and preview. The compact Why this result detail stayed collapsed. Observed tiny-fixture timing was search 40 ms / shown 293 ms; this is one native functional observation, not a latency benchmark. Ctrl+K visibly selected the query text, confirming actual keyboard focus behavior.

The next type_text operation failed to activate the captured window. After refreshing the same returned window, monitor capture failed again with 0x80070057; input stopped rather than proceeding blindly. No semantic-query, global-hotkey, tray or Enter-open success is inferred from those partial checks. Read-only accessibility recovery subsequently succeeded and confirmed selected query text. The single accessibility input retry returned GetCursorPos failed: Access denied (0x80070005). Native input is therefore currently blocked by the interactive-session permission state; no shell input or capture workaround was attempted.

Native acceptance checklist

• Native Windows screenshot/accessibility capture of the installed app.
• Native Add folder/index action, keyword query, highlighted passage preview and Ctrl+K query selection on the isolated owned corpus.
• Search query typing, arrow selection, passage/media preview and Enter open.
• Settings/theme/transparency interaction and readable preview.
• Escape and title-bar close hide; Ctrl+Shift+Space restores query focus.
• Tray Show/Quit and background/login startup behavior.
• Existing Windows 0.1.7 uninstall/reinstall and fresh empty-profile startup.
• Final updated package uninstall/reinstall and completed fresh-profile setup.
• Native Linux keyboard/search/preview interaction through a supported UI API.

Unchecked items are pending, not implied by compilation or unit tests.

Whole-disk permission handling

The shared scanner now skips specifically permission-denied scopes, directory walk entries and file reads/metadata/publication checks, increments its skipped count and retains existing records in the affected subtree. It does not update their source fingerprints or certify their freshness. Other filesystem failures still abort and roll back reconciliation. Exact path boundaries protect sibling directories from accidental preservation, including a whole-root special case.

Two focused helper regressions cover preserved content/subtree boundaries and classification of other I/O failures. Windows core unit checks passed 27 tests with one separately built-worker test ignored, using serial execution. The first concurrent run hit an existing extraction-worker deadline; the serial rerun passed that test. Strict core library Clippy passed. These are structural checks; no personal folders or operating-system ACLs were modified to fabricate a denied directory fixture.

Final Linux 0.1.8 local package

The exact final uncommitted workspace source plus both new Rust modules and the built frontend were frozen into a 668-file snapshot before building. Snapshot SHA-256: bf864935e2f630d56836246e6c6a217f1d7313f4498c4fc19c3bac4d6296996d. Current extraction helper was rebuilt and its source provenance staged. Normal GPU-capable Google and speech runtimes were verified; speech adds 29 resource records. Native desktop release compilation passed on Ubuntu 24.04 WSL in 3m47s; the known vendored GLib lifetime warnings remain dependency warnings.

The initial local Debian precheck package was .searchi/packages/searchi_0.1.8_amd64.deb, 177,695,882 bytes, SHA-256 39bc495e65d7ab8c1592636b76aeade25de9fa56d5b139fc6f479fbcb9de0ee6. No intermediate package was published. Raw build records: .searchi/qa/linux-final-018-build.json and its build log.

The extracted package started on real WSLg X11 display :0, with CPU inference, Mesa software rendering and an owned isolated profile. Automatic disk indexing was explicitly disabled for this bounded test. ldd reported no missing desktop dependencies; packaged speech resource verification passed. Its bundled genuine Google worker was observed with --device cpu --role query --threads 1, and the desktop remained alive. The approved Windows API returned the WSLg-hosted native window titled searchi (Ubuntu-24.04), proving it can be selected as a target. Raw startup record: .searchi/qa/linux-final-018-startup.json.

Compilation, loader checks and target inventory do not by themselves establish Linux keyboard or preview interaction. Those checks remain separate. The approved WSLg capture attempt failed with the same CreateForMonitor 0x80070057 error as the Windows final candidate. Read-only accessibility exposed only the remote-desktop host pane, not Linux application controls. No input was attempted; the owned CPU startup process group is terminated by the test script.

Current Linux desktop unit tests passed 54/54 in 6.33 seconds, including native Linux filesystem create/update/rename/delete watcher behavior, application catalog parsing and automatic-indexing guards. The release tests use custom-protocol; an initial invocation without that required feature correctly failed compilation and was corrected without source changes. Raw successful log: .searchi/qa/linux-final-018-unit-custom.log. No Linux build/test process remains.

Earlier local package after safety and visual QA corrections

Before final packaging, credential/cache exclusions were added to automatic disk indexing. Actual UI QA also corrected a preview selector that incorrectly stacked document previews. The final Linux source uses the safe snapshot 9f48db1ae11272d51f2e832b0d08de2f850e6e2d456960fcf7435857c46a5eee plus recorded exact frontend/module deltas in .searchi/qa/linux-final-018-safe-final-delta.json. The unchanged extraction helper and normal runtimes were reused only after current provenance validation.

Final cached Linux desktop compilation passed in 1m44s. The extracted final Debian payload passed extraction provenance, all 29 speech resource records and loader checks with no missing dependencies. The accepted package at .searchi/packages/searchi_0.1.8_amd64.deb is 177,696,356 bytes, SHA-256 cd69092b0b41403c4731e5e94a251067bc32e6a0b9f4338bc51bac0e8e2e85b0. Desktop executable SHA-256: d630e369c8823a3dfede5b8dad48a8c7d7dd196700743b0bac8418d6f23a5021. This earlier local package was preserved as an ignored precheck fixture and was not published. Final report: .searchi/qa/linux-final-018-safe-final-build.json. Native input was not retried after its recorded capture/permission failure. No owned Linux process remains.

Accepted final Linux package

The final frozen source includes application launching, first-use indexing and watcher cache exclusions, hybrid relevance handling, the new regression tests and current frontend appearance controls. Base snapshot has 677 files; the final frontend/brand source archive SHA-256 is 5650523467ed470355cd1bdb1faaf463bc551610e35ec741a542e228c4879fa8. The last icon reading-plate delta is recorded separately in .searchi/qa/linux-final-018-closed-icons-delta.json. The final ELF was explicitly checked to contain the latest assets/index-D4fzQWUH.css asset.

Final native Linux desktop tests passed 56/56, with zero ignored tests, in 4.61 seconds. Native release build and bundling passed. The extracted package passed current extraction provenance, normal speech runtime verification (29 records), and loader resolution without missing dependencies. No further native UI input was attempted after the existing environment errors.

The accepted .searchi/packages/searchi_0.1.8_amd64.deb is 177,694,032 bytes, SHA-256 7ab0a3789028f2a974bbca7fc29220a4ee9327d08388370e20ed610688c13bb9. Desktop executable SHA-256: 268d2632682d57917595e2f0f3062ff885a58e4eb5ea3ebe0f54e3c988eb2383. Previous local candidates were preserved as ignored evidence, not published. Raw successful build/test log and report: .searchi/qa/linux-final-018-closed-build.log and .searchi/qa/linux-final-018-closed-build.json. All owned Linux processes finished.

The accepted final package bytes (7ab0a378…c13bb9) were subsequently extracted again and actually launched on WSLg :0 from a new owned profile, with automatic indexing disabled and CPU/software rendering enforced. Loader resolution and all 29 packaged speech records passed. The exact bundled Google worker was observed with --device cpu --role query --threads 1 and the desktop was alive. The bounded smoke exited zero and terminated its owned process group. This is actual final-package startup evidence, not inferred from the earlier candidate or a compilation. No UI input or inference benchmark was performed. Raw report: .searchi/qa/linux-final-018-closed-startup.json.

Final package with indexing/startup database-lock fix

Actual Windows startup exposed an interaction between whole-disk indexing and semantic database preparation. The final shared service now prepares semantic storage before watchers start, opens current-schema storage without a write transaction, and treats only a busy optional lexical warmup as deferrable. The current service source/tests plus formatted desktop startup were captured in .searchi/qa/linux-final-018-lockfix-source-delta.json and rebuilt locally.

Linux desktop tests again passed 56/56, zero ignored, in 4.08 seconds. Release compilation, final frontend asset presence, extraction provenance, normal speech runtime verification (29 records), and loader resolution passed. The preceding packages above are preserved local prechecks, not release artifacts.

Accepted current package: .searchi/packages/searchi_0.1.8_amd64.deb, 177,702,404 bytes, SHA-256 d0fd15c4aa4ec0d7320b507a3bc4afa1ebb14bdffa39c3b5cd076df66ede997c. Desktop executable SHA-256: e4938a0a557dbe910431f69e51c2ea4a36451df80b6971aede1ad198b82deb7b. Actual startup of these exact extracted bytes passed on WSLg with an isolated profile, automatic indexing disabled and CPU/software rendering enforced. Its bundled Google process ran --device cpu --role query --threads 1; the desktop was alive. The smoke exited zero and terminated the owned process group. No UI retry or inference benchmark was performed.

Final evidence: .searchi/qa/linux-final-018-lockfix-build.json, matching build log, and .searchi/qa/linux-final-018-lockfix-startup.json. All owned Linux build/test/startup processes have finished. No package was published here.

Linux 0.1.9 graded-result package validation

The renewed semantic-evidence change was frozen with current tracked and nonignored new source, tests, fixtures/policy and built frontend: 685 files, source HEAD a8ba594d0e7e6ba15c3ebb38c48aab8a6a8258ea plus documented uncommitted changes. Source archive SHA-256: c6fa2f6ec66a153318907ce5f3eb6ba820ece3d059247989260be073750dde32. Raw per-file manifest: .searchi/qa/linux-final-019-source.json.

CLI/extraction release compilation, desktop release compilation and 56 Linux desktop tests passed (zero ignored, 5.55 seconds). Current extraction provenance, normal Google/speech runtimes and loader resolution were verified. No GPU execution was performed; the packages retain normal hardware detection and CPU fallback.

Artifact	Bytes	SHA-256
searchi_0.1.9_amd64.deb	177,702,778	8865da4994cc0e120c7962ffe04e25bd9535042ce9dc21c26306302efc57d3dc
searchi-headless_0.1.9_linux-x86_64.tar.xz	110,104,160	f02bf5350c7b23dfecbcd58125cf9d505fb6d40044a849ad770851ed90026f08

Actual startup of the extracted final Debian bytes passed on WSLg :0 with an isolated profile, automatic indexing disabled and CPU/software rendering. Its bundled Google worker ran --device cpu --role query --threads 1; the desktop was alive. All 29 speech records and desktop dependencies were verified, and the owned process group was terminated. No UI interaction retry was attempted.

The headless archive was extracted with all 60 package records verified. Genuine CPU CLI and MCP searches used an existing owned one-source speech index, without reindexing or new fixture tuning. A known spoken-topic query returned one main match; an absent spaceship query returned zero main matches and one related suggestion. CLI/MCP match kinds agreed, MCP emitted explicit evidence and counts, and the genuine Google worker reported query role, 512-token context and one CPU thread. This tiny package boundary proof is not independent quality validation, an absence guarantee or a performance benchmark.

Raw evidence: .searchi/qa/linux-final-019-build.json, matching build log, .searchi/qa/linux-final-019-headless-build.json, .searchi/qa/linux-final-019-startup.json and .searchi/qa/linux-final-019-headless-smoke.json. All owned processes finished; no public release or push was performed by this validation agent.

Final startup writer correction

The preceding local 0.1.8 packages remained unpublished prechecks. An actual Windows start with automatic whole-drive discovery exposed database is locked during semantic query preparation. The current semantic store had unnecessarily requested an immediate writer transaction on every open. Its optional lexical statistics warmup could request the same writer while discovery was running.

The final source prepares core/semantic storage before starting the watcher. Complete current semantic schemas reopen without a migration write; legacy additions still repair atomically and unsupported versions are rejected. Query warmup tolerates only typed SQLite busy/locked errors from the optional lexical cache, then still executes genuine model inference and ANN preparation. Other cache errors remain errors. No model, ranking or extraction helper changed.

Focused WAL-writer, legacy-schema, future-version and error propagation checks passed. Final service unit checks passed 49 tests with two explicit ignored fixtures; strict all-target Clippy passed. A genuine Google CPU query session opened, warmed and retrieved the supplier agreement with an owned WAL writer held throughout, in 13.32 seconds. This is functional contention evidence, not a foreground latency benchmark or simulated embedding result.

Before packaging, the corrected Windows release executable was tested with an absent application profile and automatic indexing enabled. It exposed 27 Desktop files including the owned validation text, database quick-check returned ok, semantic schema was 9, and the actual normal worker remained resident with CPU, query role and one thread. The returned native accessibility tree showed the compact launcher without the earlier schema-lock error. The owned fresh-profile processes were stopped. Raw evidence: .searchi/qa/lean-final-runtime-smoke/.

A native query input attempt on that returned window still failed at GetCursorPos with access denied 0x80070005. No input success, final hotkey/ tray interaction or native glass pixels are inferred from that attempt. Twelve actual-built CSS composition checks separately passed; they are not native compositor validation. Final installer hashes and installed-start verification are recorded below.

Corrected Windows installer and installed startup

The final Windows installer is 101,832,696 bytes, SHA-256 6dd415aeb8f7c4d357383f44eab099dcc1c945ef01427ff305999b3b1f616b0c. Installation exited zero; installed executable SHA-256 ab7eb3826b713be0f815f27415d2f9d0e9528029cdeee948d8e96cf557d96465 matches the extracted installer exactly. Current extraction provenance passed. Settings bytes were unchanged and a consistent SQLite backup was retained. The VM-only CPU launcher and desktop/login shortcuts were restored.

The actual installed package was launched with the original profile. Database quick-check returned ok, semantic schema was 9 and 27 early files, including the owned validation marker, remained searchable at the data layer. Its normal Google query worker was observed on CPU with query role and one thread, alongside bounded background workers. The app is left running for Karl; device discovery continues in the background. No final native input pass is claimed. Receipts: .searchi/qa/lean-final-fixed-install/result.json and index-check.json.

Windows input access boundary

The current native input failure is GetCursorPos returning 0x80070005 (access denied), not a filesystem or build approval rejection. Microsoft documents that GetCursorPos requires WINSTA_READATTRIBUTES on the window station and the current input desktop. Broad workspace access does not establish those conditions for the native automation helper. The precise failing permission/desktop condition has not been independently established. No security settings were bypassed and no unchanged failed input attempt was repeated for 0.1.9.

The remaining manual Windows check is: press Ctrl+Shift+Space, type a query, navigate main results, expand/collapse Related suggestions, open the selected source, hide/show through Escape and the tray, and inspect the native glass opacity setting. Linux native graphical interaction remains a separate check. Actual CPU retrieval and software-rendered frontend checks do not replace these open integration checks.

Windows 0.1.9 installed correction

The normal Windows installer is 101,821,254 bytes, SHA-256 ebdec4de6501b6f1cf35cb19ffb7e10adebdab039bffe6bd04ccc39f70d63272. Installation exited zero; installed executable SHA-256 7079d7dff83138601f7f87153f7cec1032ccd9debd9c19f8810bc4c36efdd17a matches the extracted installer. Current extraction-helper provenance passed. Settings bytes were preserved, a consistent SQLite backup was saved, and the VM CPU launcher and desktop/login shortcuts were restored. Retained-index quick_check returned ok; this is not a fresh full-discovery qualification.

The installed app responds and its normal Google worker is resident with CPU, query role and one thread. The packaged Windows CLI using that installed worker searched the existing real-Google document/media fixture: one main supplier PDF and six related suggestions, with the mountain still accessible as related. This is functional package evidence, not the blind quality benchmark. A genuine Windows CLI/MCP test separately passed document/code queries and cited source reads. Windows desktop checks passed 56 tests (one explicitly ignored); Linux desktop checks passed 56. Workspace strict all-target Clippy and formatting passed, as did 66 frontend tests and the actual UI capture checks.

Receipts: .searchi/qa/evidence-019-install/, .searchi/qa/evidence-019-windows-real-mcp.log and the Linux 0.1.9 receipts above. The installed app is left running. Native input remains unchecked.