searchi/docs/NATIVE-FINAL-VALIDATION.md

# Final native interaction and reinstall validation

Renewed bounded goal, 2026-10-14: verify Windows/Linux interaction and the
Windows uninstall/reinstall path, alongside a modest media relevance improvement.
No intermediate release or push is permitted. This report distinguishes actual
native observations from process, source and automated frontend checks.

Current installed correction is 0.1.9. Its package checks below supersede the
0.1.8 startup-writer delivery; earlier sections retain their historical evidence.
Earlier local candidates are retained as historical prechecks and were not
published. Final native capture/input remains unavailable; process startup,
accessibility observation and software screenshots do not replace that gate.

## Native access inventory

The approved Computer Use `@oai/sky` client initialized successfully. Unlike the
previous handoff, native Windows screenshot and accessibility capture are now
available. `list_windows` initially omitted the hidden resident application.
The existing CPU-only local launcher brought its existing window forward;
the returned native window was then captured through the approved API.

Observed installed Windows 0.1.7: process 29000 responding; native searchi
window, dark theme, Add folder, filters, settings, query field and readable
empty-state interface. Its accessibility tree reports zero files and
“Google model ready. Index a folder to search by meaning.” CPU status is visible.
This is actual native observation, not a search or keyboard interaction pass.

The capture also showed an unrelated foreground Windows Security firewall
permission dialog for Electron. No input was attempted while it blocked the
workspace. The Computer Use guidance explicitly says: “Do not act on security
or privacy permission requests.” The human must dismiss that unrelated prompt
before dependent native interaction continues. The agent did not change any
security setting or bypass the prompt.

Ubuntu 24.04 WSL starts successfully and advertises `DISPLAY=:0` and
`WAYLAND_DISPLAY=wayland-0`. Both WSLg X11 and Wayland sockets exist. Existing
relocated Linux desktop validation binaries remain available. The current
approved UI API only targets Windows applications; no Linux input/capture API
has been exposed. WSLg availability alone does not prove native Linux input.

## Windows reinstall test procedure

User authorized uninstalling/reinstalling the Windows dev installation. Root
agent coordinates execution after backing up the existing user state.

1. Preserve external settings/index/model cache and local CPU wrapper/startup
   shortcuts; save installer and installed file hashes.
2. Stop only searchi and its owned workers; wait for process exit.
3. Run installed `C:/Users/karl/Applications/searchi/uninstall.exe` silently.
   Record exit code and verify executable/resources and installer registration
   are removed. Record any remaining owned directory or shortcut separately.
4. Confirm external user settings/index/model cache survive unchanged.
5. Install the verified normal hardware-detecting package to the same location.
   Record exit code, registration, installed executable/runtime hashes and
   bundled extraction/media/speech resource verification.
6. Start with an isolated empty test profile under CPU-only VM flags to exercise
   fresh settings/index creation. Existing downloaded assets may be reused;
   this must not be described as a fresh operating-system or first-download test.
7. Restore the user profile and CPU launcher/startup shortcuts. Leave the final
   installed application running and accessible.

## Executed uninstall/reinstall checks

Root executed the existing verified Windows 0.1.7 uninstall and reinstall.
Both processes returned exit code zero. The installed main executable was absent
after uninstall; external settings/index/model assets survived. Reinstall restored
the executable with its expected hash. Raw local records are
`.searchi/qa/final-uninstall.json` and `.searchi/qa/final-reinstall.json`;
the preserved state is in `.searchi/qa/windows-final-reinstall-backup`.

An actual new empty profile at `.searchi/qa/fresh-reinstall-profile` was launched
without seeded settings or a copied model cache, using forced CPU inference and
software WebView flags. The approved native API returned its searchi window.
Initial monitor capture failed with `CreateForMonitor` error `0x80070057`; fresh
window selection and the single documented retry succeeded. The native
accessibility observation showed zero files and “Preparing Google semantic
search on your device…” with CPU status. This establishes installed empty-profile
startup, not completed model downloading or search readiness. No user interaction
was attempted while the unrelated security permission prompt remained pending.

This is uninstall/reinstall on the existing dev OS, not a newly installed Windows
system. Final updated package validation and model setup remain separate checks.

## Native Windows search interaction

After a fresh approved capture showed that the unrelated permission dialog was
gone, native input was used on the isolated profile. Add folder opened the inline
folder controls. Entering the owned `.searchi/qa/native-final-corpus` directory
and clicking Index folder indexed three files with two extracted text documents.
The app displayed its indexing progress while keeping keyword search available.

Setting the query to `supplier agreement` returned the correct document and
line-one passage. The native screenshot showed highlighted query words in the
result, filename and preview. The compact Why this result detail stayed collapsed.
Observed tiny-fixture timing was search 40 ms / shown 293 ms; this is one native
functional observation, not a latency benchmark. Ctrl+K visibly selected the
query text, confirming actual keyboard focus behavior.

The next `type_text` operation failed to activate the captured window. After
refreshing the same returned window, monitor capture failed again with
`0x80070057`; input stopped rather than proceeding blindly. No semantic-query,
global-hotkey, tray or Enter-open success is inferred from those partial checks.
Read-only accessibility recovery subsequently succeeded and confirmed selected
query text. The single accessibility input retry returned `GetCursorPos failed:
Access denied (0x80070005)`. Native input is therefore currently blocked by the
interactive-session permission state; no shell input or capture workaround was
attempted.

## Native acceptance checklist

- [x] Native Windows screenshot/accessibility capture of the installed app.
- [x] Native Add folder/index action, keyword query, highlighted passage preview
  and Ctrl+K query selection on the isolated owned corpus.
- [ ] Search query typing, arrow selection, passage/media preview and Enter open.
- [ ] Settings/theme/transparency interaction and readable preview.
- [ ] Escape and title-bar close hide; Ctrl+Shift+Space restores query focus.
- [ ] Tray Show/Quit and background/login startup behavior.
- [x] Existing Windows 0.1.7 uninstall/reinstall and fresh empty-profile startup.
- [ ] Final updated package uninstall/reinstall and completed fresh-profile setup.
- [ ] Native Linux keyboard/search/preview interaction through a supported UI API.

Unchecked items are pending, not implied by compilation or unit tests.

## Whole-disk permission handling

The shared scanner now skips specifically permission-denied scopes, directory
walk entries and file reads/metadata/publication checks, increments its skipped
count and retains existing records in the affected subtree. It does not update
their source fingerprints or certify their freshness. Other filesystem failures
still abort and roll back reconciliation. Exact path boundaries protect sibling
directories from accidental preservation, including a whole-root special case.

Two focused helper regressions cover preserved content/subtree boundaries and
classification of other I/O failures. Windows core unit checks passed 27 tests
with one separately built-worker test ignored, using serial execution. The first
concurrent run hit an existing extraction-worker deadline; the serial rerun
passed that test. Strict core library Clippy passed. These are structural checks;
no personal folders or operating-system ACLs were modified to fabricate a denied
directory fixture.

## Final Linux 0.1.8 local package

The exact final uncommitted workspace source plus both new Rust modules and the
built frontend were frozen into a 668-file snapshot before building. Snapshot
SHA-256: `bf864935e2f630d56836246e6c6a217f1d7313f4498c4fc19c3bac4d6296996d`.
Current extraction helper was rebuilt and its source provenance staged. Normal
GPU-capable Google and speech runtimes were verified; speech adds 29 resource
records. Native desktop release compilation passed on Ubuntu 24.04 WSL in
3m47s; the known vendored GLib lifetime warnings remain dependency warnings.

The initial local Debian precheck package was
`.searchi/packages/searchi_0.1.8_amd64.deb`, 177,695,882 bytes, SHA-256
`39bc495e65d7ab8c1592636b76aeade25de9fa56d5b139fc6f479fbcb9de0ee6`.
No intermediate package was published. Raw build records:
`.searchi/qa/linux-final-018-build.json` and its build log.

The extracted package started on real WSLg X11 display `:0`, with CPU inference,
Mesa software rendering and an owned isolated profile. Automatic disk indexing
was explicitly disabled for this bounded test. `ldd` reported no missing desktop
dependencies; packaged speech resource verification passed. Its bundled genuine
Google worker was observed with `--device cpu --role query --threads 1`, and the
desktop remained alive. The approved Windows API returned the WSLg-hosted native
window titled `searchi (Ubuntu-24.04)`, proving it can be selected as a target.
Raw startup record: `.searchi/qa/linux-final-018-startup.json`.

Compilation, loader checks and target inventory do not by themselves establish
Linux keyboard or preview interaction. Those checks remain separate.
The approved WSLg capture attempt failed with the same `CreateForMonitor`
`0x80070057` error as the Windows final candidate. Read-only accessibility exposed
only the remote-desktop host pane, not Linux application controls. No input was
attempted; the owned CPU startup process group is terminated by the test script.

Current Linux desktop unit tests passed 54/54 in 6.33 seconds, including native
Linux filesystem create/update/rename/delete watcher behavior, application catalog
parsing and automatic-indexing guards. The release tests use `custom-protocol`;
an initial invocation without that required feature correctly failed compilation
and was corrected without source changes. Raw successful log:
`.searchi/qa/linux-final-018-unit-custom.log`. No Linux build/test process remains.

### Earlier local package after safety and visual QA corrections

Before final packaging, credential/cache exclusions were added to automatic
disk indexing. Actual UI QA also corrected a preview selector that incorrectly
stacked document previews. The final Linux source uses the safe snapshot
`9f48db1ae11272d51f2e832b0d08de2f850e6e2d456960fcf7435857c46a5eee`
plus recorded exact frontend/module deltas in
`.searchi/qa/linux-final-018-safe-final-delta.json`. The unchanged extraction
helper and normal runtimes were reused only after current provenance validation.

Final cached Linux desktop compilation passed in 1m44s. The extracted final
Debian payload passed extraction provenance, all 29 speech resource records and
loader checks with no missing dependencies. The accepted package at
`.searchi/packages/searchi_0.1.8_amd64.deb` is **177,696,356 bytes**, SHA-256
`cd69092b0b41403c4731e5e94a251067bc32e6a0b9f4338bc51bac0e8e2e85b0`.
Desktop executable SHA-256:
`d630e369c8823a3dfede5b8dad48a8c7d7dd196700743b0bac8418d6f23a5021`.
This earlier local package was preserved as an ignored precheck fixture and
was not published. Final report:
`.searchi/qa/linux-final-018-safe-final-build.json`. Native input was not retried
after its recorded capture/permission failure. No owned Linux process remains.

### Accepted final Linux package

The final frozen source includes application launching, first-use indexing and
watcher cache exclusions, hybrid relevance handling, the new regression tests
and current frontend appearance controls. Base snapshot has 677 files; the final
frontend/brand source archive SHA-256 is
`5650523467ed470355cd1bdb1faaf463bc551610e35ec741a542e228c4879fa8`.
The last icon reading-plate delta is recorded separately in
`.searchi/qa/linux-final-018-closed-icons-delta.json`. The final ELF was explicitly
checked to contain the latest `assets/index-D4fzQWUH.css` asset.

Final native Linux desktop tests passed **56/56**, with zero ignored tests, in
4.61 seconds. Native release build and bundling passed. The extracted package
passed current extraction provenance, normal speech runtime verification (29
records), and loader resolution without missing dependencies. No further native
UI input was attempted after the existing environment errors.

The accepted `.searchi/packages/searchi_0.1.8_amd64.deb` is **177,694,032 bytes**,
SHA-256 `7ab0a3789028f2a974bbca7fc29220a4ee9327d08388370e20ed610688c13bb9`.
Desktop executable SHA-256:
`268d2632682d57917595e2f0f3062ff885a58e4eb5ea3ebe0f54e3c988eb2383`.
Previous local candidates were preserved as ignored evidence, not published.
Raw successful build/test log and report:
`.searchi/qa/linux-final-018-closed-build.log` and
`.searchi/qa/linux-final-018-closed-build.json`. All owned Linux processes finished.

The **accepted final package bytes** (`7ab0a378…c13bb9`) were subsequently
extracted again and actually launched on WSLg `:0` from a new owned profile,
with automatic indexing disabled and CPU/software rendering enforced. Loader
resolution and all 29 packaged speech records passed. The exact bundled Google
worker was observed with `--device cpu --role query --threads 1` and the desktop
was alive. The bounded smoke exited zero and terminated its owned process group.
This is actual final-package startup evidence, not inferred from the earlier
candidate or a compilation. No UI input or inference benchmark was performed.
Raw report: `.searchi/qa/linux-final-018-closed-startup.json`.

### Final package with indexing/startup database-lock fix

Actual Windows startup exposed an interaction between whole-disk indexing and
semantic database preparation. The final shared service now prepares semantic
storage before watchers start, opens current-schema storage without a write
transaction, and treats only a busy optional lexical warmup as deferrable. The
current service source/tests plus formatted desktop startup were captured in
`.searchi/qa/linux-final-018-lockfix-source-delta.json` and rebuilt locally.

Linux desktop tests again passed **56/56**, zero ignored, in 4.08 seconds.
Release compilation, final frontend asset presence, extraction provenance,
normal speech runtime verification (29 records), and loader resolution passed.
The preceding packages above are preserved local prechecks, not release artifacts.

**Accepted current package:** `.searchi/packages/searchi_0.1.8_amd64.deb`,
177,702,404 bytes, SHA-256
`d0fd15c4aa4ec0d7320b507a3bc4afa1ebb14bdffa39c3b5cd076df66ede997c`.
Desktop executable SHA-256:
`e4938a0a557dbe910431f69e51c2ea4a36451df80b6971aede1ad198b82deb7b`.
Actual startup of these exact extracted bytes passed on WSLg with an isolated
profile, automatic indexing disabled and CPU/software rendering enforced. Its
bundled Google process ran `--device cpu --role query --threads 1`; the desktop
was alive. The smoke exited zero and terminated the owned process group.
No UI retry or inference benchmark was performed.

Final evidence: `.searchi/qa/linux-final-018-lockfix-build.json`, matching build
log, and `.searchi/qa/linux-final-018-lockfix-startup.json`. All owned Linux
build/test/startup processes have finished. No package was published here.

## Linux 0.1.9 graded-result package validation

The renewed semantic-evidence change was frozen with current tracked and
nonignored new source, tests, fixtures/policy and built frontend: 685 files,
source HEAD `a8ba594d0e7e6ba15c3ebb38c48aab8a6a8258ea` plus documented
uncommitted changes. Source archive SHA-256:
`c6fa2f6ec66a153318907ce5f3eb6ba820ece3d059247989260be073750dde32`.
Raw per-file manifest: `.searchi/qa/linux-final-019-source.json`.

CLI/extraction release compilation, desktop release compilation and **56 Linux
desktop tests** passed (zero ignored, 5.55 seconds). Current extraction provenance,
normal Google/speech runtimes and loader resolution were verified. No GPU
execution was performed; the packages retain normal hardware detection and
CPU fallback.

| Artifact | Bytes | SHA-256 |
| --- | ---: | --- |
| `searchi_0.1.9_amd64.deb` | 177,702,778 | `8865da4994cc0e120c7962ffe04e25bd9535042ce9dc21c26306302efc57d3dc` |
| `searchi-headless_0.1.9_linux-x86_64.tar.xz` | 110,104,160 | `f02bf5350c7b23dfecbcd58125cf9d505fb6d40044a849ad770851ed90026f08` |

Actual startup of the extracted final Debian bytes passed on WSLg `:0` with an
isolated profile, automatic indexing disabled and CPU/software rendering. Its
bundled Google worker ran `--device cpu --role query --threads 1`; the desktop
was alive. All 29 speech records and desktop dependencies were verified, and the
owned process group was terminated. No UI interaction retry was attempted.

The headless archive was extracted with all **60 package records** verified.
Genuine CPU CLI and MCP searches used an existing owned one-source speech index,
without reindexing or new fixture tuning. A known spoken-topic query returned one
main match; an absent spaceship query returned zero main matches and one related
suggestion. CLI/MCP match kinds agreed, MCP emitted explicit evidence and counts,
and the genuine Google worker reported query role, 512-token context and one CPU
thread. This tiny package boundary proof is not independent quality validation,
an absence guarantee or a performance benchmark.

Raw evidence: `.searchi/qa/linux-final-019-build.json`, matching build log,
`.searchi/qa/linux-final-019-headless-build.json`,
`.searchi/qa/linux-final-019-startup.json` and
`.searchi/qa/linux-final-019-headless-smoke.json`. All owned processes finished;
no public release or push was performed by this validation agent.

## Final startup writer correction

The preceding local 0.1.8 packages remained unpublished prechecks. An actual
Windows start with automatic whole-drive discovery exposed `database is locked`
during semantic query preparation. The current semantic store had unnecessarily
requested an immediate writer transaction on every open. Its optional lexical
statistics warmup could request the same writer while discovery was running.

The final source prepares core/semantic storage before starting the watcher.
Complete current semantic schemas reopen without a migration write; legacy
additions still repair atomically and unsupported versions are rejected. Query
warmup tolerates only typed SQLite busy/locked errors from the optional lexical
cache, then still executes genuine model inference and ANN preparation. Other
cache errors remain errors. No model, ranking or extraction helper changed.

Focused WAL-writer, legacy-schema, future-version and error propagation checks
passed. Final service unit checks passed 49 tests with two explicit ignored
fixtures; strict all-target Clippy passed. A genuine Google CPU query session
opened, warmed and retrieved the supplier agreement with an owned WAL writer
held throughout, in 13.32 seconds. This is functional contention evidence,
not a foreground latency benchmark or simulated embedding result.

Before packaging, the corrected Windows release executable was tested with an
absent application profile and automatic indexing enabled. It exposed 27 Desktop
files including the owned validation text, database quick-check returned `ok`,
semantic schema was 9, and the actual normal worker remained resident with CPU,
query role and one thread. The returned native accessibility tree showed the
compact launcher without the earlier schema-lock error. The owned fresh-profile
processes were stopped. Raw evidence: `.searchi/qa/lean-final-runtime-smoke/`.

A native query input attempt on that returned window still failed at
`GetCursorPos` with access denied `0x80070005`. No input success, final hotkey/
tray interaction or native glass pixels are inferred from that attempt. Twelve
actual-built CSS composition checks separately passed; they are not native
compositor validation. Final installer hashes and installed-start verification
are recorded below.

### Corrected Windows installer and installed startup

The final Windows installer is 101,832,696 bytes, SHA-256
`6dd415aeb8f7c4d357383f44eab099dcc1c945ef01427ff305999b3b1f616b0c`.
Installation exited zero; installed executable SHA-256
`ab7eb3826b713be0f815f27415d2f9d0e9528029cdeee948d8e96cf557d96465`
matches the extracted installer exactly. Current extraction provenance passed.
Settings bytes were unchanged and a consistent SQLite backup was retained.
The VM-only CPU launcher and desktop/login shortcuts were restored.

The actual installed package was launched with the original profile. Database
quick-check returned `ok`, semantic schema was 9 and 27 early files, including
the owned validation marker, remained searchable at the data layer. Its normal
Google query worker was observed on CPU with query role and one thread, alongside
bounded background workers. The app is left running for Karl; device discovery
continues in the background. No final native input pass is claimed.
Receipts: `.searchi/qa/lean-final-fixed-install/result.json` and `index-check.json`.

## Windows input access boundary

The current native input failure is `GetCursorPos` returning `0x80070005`
(access denied), not a filesystem or build approval rejection. Microsoft
documents that [GetCursorPos](https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getcursorpos)
requires `WINSTA_READATTRIBUTES` on the window station and the current input
desktop. Broad workspace access does not establish those conditions for the
native automation helper. The precise failing permission/desktop condition
has not been independently established. No security settings were bypassed
and no unchanged failed input attempt was repeated for 0.1.9.

The remaining manual Windows check is: press Ctrl+Shift+Space, type a query,
navigate main results, expand/collapse Related suggestions, open the selected
source, hide/show through Escape and the tray, and inspect the native glass
opacity setting. Linux native graphical interaction remains a separate check.
Actual CPU retrieval and software-rendered frontend checks do not replace
these open integration checks.

## Windows 0.1.9 installed correction

The normal Windows installer is 101,821,254 bytes, SHA-256
`ebdec4de6501b6f1cf35cb19ffb7e10adebdab039bffe6bd04ccc39f70d63272`.
Installation exited zero; installed executable SHA-256
`7079d7dff83138601f7f87153f7cec1032ccd9debd9c19f8810bc4c36efdd17a`
matches the extracted installer. Current extraction-helper provenance passed.
Settings bytes were preserved, a consistent SQLite backup was saved, and the
VM CPU launcher and desktop/login shortcuts were restored. Retained-index
`quick_check` returned `ok`; this is not a fresh full-discovery qualification.

The installed app responds and its normal Google worker is resident with CPU,
query role and one thread. The packaged Windows CLI using that installed worker
searched the existing real-Google document/media fixture: one main supplier PDF
and six related suggestions, with the mountain still accessible as related.
This is functional package evidence, not the blind quality benchmark. A genuine
Windows CLI/MCP test separately passed document/code queries and cited source
reads. Windows desktop checks passed 56 tests (one explicitly ignored); Linux
desktop checks passed 56. Workspace strict all-target Clippy and formatting
passed, as did 66 frontend tests and the actual UI capture checks.

Receipts: `.searchi/qa/evidence-019-install/`,
`.searchi/qa/evidence-019-windows-real-mcp.log` and the Linux 0.1.9 receipts above.
The installed app is left running. Native input remains unchecked.