4.3 KiB
Bounded native media previews
Structural tests passed; published Windows 0.1.2 still uses the earlier asset protocol. Native playback and other OS checks remain open.
The replacement searchi-media protocol uses random opaque capabilities instead
of returning filesystem paths. The registry retains at most sixteen grants;
older addresses expire as new previews are prepared. At most two requests are
admitted before scheduling work. Audio/video responses use bounded 1-MiB byte
ranges instead of allocating an entire recording. Images retain a 64-MiB input
limit and format-specific pixel ceilings. Ordinary opening/revealing uses the
separate index-validated native opener.
Each grant is bound to an opened file, canonical path, size, timestamp, platform file identity and durable indexed media-change revision. Requests revalidate these properties and reject expired, deleted, replaced or invalidated sources. The frontend accepts only 32 lowercase hexadecimal capability identifiers. Arbitrary paths, remote URLs, query strings and traversal are not preview grants. The generic Tauri asset protocol is disabled in the new configuration. Index-change notifications also advance the preview selection identity, so a same-path image/recording reloads rather than retaining previously decoded media. Failed native preview preparation and image/audio/video loading now offer an explicit Retry preview button. It invalidates the old request revision and cannot restart a selection that has since changed. There is no automatic retry loop. The added regression passed with all 60 frontend tests, formatting and the production frontend build.
This does not hash every recording on every request. A same-size/mtime in-place write may remain undetected until a filesystem hint or byte-verifying rescan advances the indexed revision. Source reads and filesystem/index changes are not one atomic transaction. Do not claim complete byte freshness or native playback compatibility from these structural checks.
Required validation includes capability eviction, missing/unindexed/replaced files, durable same-stat invalidation, byte-range edge cases, large recordings, request admission, MIME behavior, native image/audio/video playback and seeking, and preview reload after index changes. Record executed checks before closing the corresponding roadmap item.
Windows CPU validation: all 45 native tests passed, including nine actual temporary-file/protocol cases covering 8-MiB no-range recordings with 1-MiB responses, full HEAD metadata, seek byte equality, grant eviction, admission, invalid paths, deletion, unindexed files, same-size/time replacement identity, durable same-stat hint invalidation and actual renamed PNG format/MIME. All 59 frontend tests passed, including opaque-token rejection and same-path index-refresh invalidation. Format checking and production frontend build passed. These checks do not prove WebView playback or macOS/Linux protocol behavior. The locked native suite, strict all-target Clippy and Rust formatting checks passed after the final native edits. No model inference or GPU test was needed for these protocol regressions.
Linux CPU structural validation
Ubuntu 24.04 WSL compiled the immutable 370db7e Git snapshot with the locked
dependencies and SEARCHI_FORCE_CPU=1. All nine preview tests passed in 0.73 s;
the complete native desktop suite then passed 45/45 in 2.78 s, with no skips.
The native source tree remains identical to that snapshot; subsequent commits
changed frontend retry behavior only. Compilation took 8m 18s after missing
locked dependencies were fetched. An initial offline attempt could not resolve
the uncached Single-Instance plugin; it was not a product test failure.
Retained logs and SHA-256:
/home/karl/.cache/searchi-validation/preview-linux-370db7e-online.log:850ea891adb3fdce2735801d1c9ce5e4712f2ff9fbc4013cec6cfd9698fb7594./home/karl/.cache/searchi-validation/desktop-linux-370db7e-tests.log:019479389b90cc74b02fbc15ecb7fb1cc99ea6c9b28edae240caeca3473d2f5b.
The existing vendored GLib code emitted 34 compiler warnings. This was a debug Rust test build, not strict Linux Clippy, a packaged desktop launch, WebKit playback, GPU inference or macOS validation. No model inference was executed. Native custom-protocol playback and seeking remain open on all release systems.