Publish Linux speech headless preview with adjusted upload limits

docs/LINUX-SPEECH-0.1.6.md

@@ -153,3 +153,26 @@ Raw report SHA-256:
 Evidence: `headless-speech-functional-016/report.json` in the WSL validation cache.
 Final recompression is underway and must preserve every packaged byte and mode
 before this evidence can be applied to the upload candidate.
+
+## Published delivery and upload configuration
+
+Karl explicitly requested adjusting the Gitea limit instead of recompressing.
+The owned recompression process was cancelled and reported terminal exit 1;
+the compression change was reverted. The original fully verified 109314948-byte
+archive above was published with [v0.1.6](https://tea.karlcom.de/karl/searchi/releases/tag/v0.1.6).
+Public unauthenticated full-byte download matched SHA-256
+`9ae7fa9a203c6471cfd6bdd82ac5bf81683813c15fe652595976344fbbf96084`.
+The separate checksum is published alongside it.
+
+Gitea now explicitly allows 256 MiB per release file. Only the `tea.karlcom.de`
+nginx proxy host was changed from `100m` to `257m`, with both NPM's persistent
+database and generated configuration updated after backups. nginx validation
+and reload passed. The actual 109-MB upload succeeded over the protected LAN
+HTTPS origin, retaining certificate verification and the Infisical-managed
+origin header. Gitea Actions remain disabled. Cloudflare's separate external
+upload cap is not changed by these local settings; public downloads work.
+
+The configuration diagnostics accidentally exposed an origin protection value
+in tool output. No value is recorded here or committed. Rotation remains a
+separate open security follow-up. Native Linux desktop 0.1.6, GPU, macOS,
+clean-machine installation and broader quality gates remain open.

docs/ROADMAP.md

@@ -1,6 +1,6 @@
 # Production readiness roadmap
 
-Status: Windows v0.1.6 published and installed; Linux v0.1.4 previews published. Broader production gates remain open. Windows VM tests use CPU only.
+Status: Windows v0.1.6 published and installed; Linux headless v0.1.6 and desktop v0.1.4 previews published. Broader production gates remain open. Windows VM tests use CPU only.
 
 Karl's release priority, 2026-10-13: publish a usable first Windows version and
 install it on DEV-WIN11 now. Extensive platform/GPU, clean-machine, signing and
@@ -56,6 +56,10 @@ Google EmbeddingGemma 2 remains the main text/image/audio/video search model.
     and genuine forced-CPU recognition/context reuse from Unicode paths passed.
     [Evidence](LINUX-SPEECH-0.1.6.md); packaged shared-service retrieval, GPU and
     public speech archive delivery remain open.
+  - [x] Genuine packaged Linux Google/speech retrieval and public headless archive
+    delivery; full-byte public download verified. See [evidence](LINUX-SPEECH-0.1.6.md).
+  - [ ] Rotate the origin protection value exposed during upload-limit diagnostics;
+    keep values out of Git and coordinate its Cloudflare/Infisical configuration.
   - [x] Genuine shared-service ASR/Google lifecycle passed: verified speech
     excerpts, zero raw reencodes through policy failure/retry, and retained
     query reader; [proof](SPEECH-INTEGRATION.md).