# Android name search

Search uses the shared `MobilePasswordPage` search rules in `crates/storage`.
Queries are trimmed, Unicode-lowercased, and matched as literal substrings of the
canonical entry path, including its folders and filename without `.gpg`.
This is lowercase matching, not locale collation or Unicode normalization. `/`
is the canonical separator; backslashes and regex characters remain literal.
Ordinary dot-prefixed entries are searchable; `.extensions` is excluded by the
shared password-store rules. No entry is read or decrypted to search its name.

The private-runtime API supplies typed rows with canonical folder context and
an object revision. Opening a result validates its identifier and current
revision in Rust under the private-runtime lock, then returns the same directory
navigation and structured viewer model used by Passwords. Deleted/replaced
objects clear selection and expose the existing stale-selection recovery.
No Kotlin matching, traversal, path splitting, or identity reconstruction occurs.

The Search destination is injected into `ShellViewModel`. Its repository exposes
StateFlow query/loading/results/error state and debounces typing by 250 ms.
Every query, refresh, cancellation, and manual clear invalidates pending work;
uncancellable native completions cannot publish an older query. Keyboard Search
refreshes immediately. Results are lazy, retain canonical location labels, and
expose accessible labelled click actions. Empty, loading, cancelled, error/retry,
and clear states work in compact and expanded windows.

Only the current query is retained in memory across rotation/window changes and
returning to the destination. It is not written to SavedStateHandle, disk, logs,
analytics, or history. Under this policy names remain available while the store
is locked, but manual lock clears query/results synchronously and a new process
starts empty. Decrypted entry values still follow the stricter background
revocation and native-cover policy documented in presentation-security.md.
Result lists clear when Search stops and reload on resume, incorporating external
repository changes without reusing the old objects.

Rust fixtures cover Unicode/case behavior, literal separators, duplicate names,
shared-rule equivalence, invalid ciphertext, stale replacement/deletion,
repository refresh, invalid identifiers, and 5,000 entries. Coroutine tests cover
debounce, cancelled/uncancellable work, latest-query wins, retry, empty input,
and metadata clearing. Android UI tests exercise canonical location/action
semantics, keyboard Search, compact/expanded layouts, and empty/error recovery;
native facade instrumentation connects real Rust search to the existing viewer.

Validation passed for all four required Rust workspace gates and the complete
Android debug/release/AAB, unit, lint, formatting, architecture, package and
dependency gates. App/core/bridge instrumentation, native-load checks and five
cold starts passed on ARM64 API 26/4 KB, API 37/4 KB and strict API 37/16 KB.
Computer use in the existing Android Studio embedded emulator exercised the
public result fixture and the live Rust-backed Search destination. Native
ViewModel instrumentation verifies query survival through actual recreation,
serialized saved-state exclusion, and synchronous manual-lock clearing.
Accessibility semantics/actions were tested; spoken TalkBack output was not
claimed. ARMv7 build/package checks passed; no suitable ARMv7 emulator image is
available. Physical devices are excluded from this milestone's validation scope.