Publish Linux speech headless preview with adjusted upload limits

README.md

@@ -114,10 +114,12 @@ Startup was tested in WSL using CPU; native graphical interaction and other
 distributions still need testing. [Compatibility and evidence](docs/LINUX-DESKTOP.md).
 
 **Running a Linux server?** The optional
-[Linux x64 headless preview](https://tea.karlcom.de/karl/searchi/releases/download/v0.1.4/searchi-headless_0.1.0_linux-x86_64-014.tar.xz)
+[Linux x64 headless preview 0.1.6](https://tea.karlcom.de/karl/searchi/releases/download/v0.1.6/searchi-headless_0.1.6_linux-x86_64.tar.xz)
-includes the CLI, read-only MCP server, Google runtime and media helpers.
+includes the CLI, read-only MCP server, Google runtime, media helpers and
+experimental local speech search. Follow the archive's `START-HERE.txt` to
+download recognition models and index spoken passages.
 It was tested on Ubuntu 24.04 and requires GLIBC 2.39 and a compatible C++
-runtime. [Checksums](https://tea.karlcom.de/karl/searchi/releases/download/v0.1.4/LINUX-SHA256SUMS-0.1.4.txt)
+runtime. [Checksum](https://tea.karlcom.de/karl/searchi/releases/download/v0.1.6/searchi-headless_0.1.6_linux-x86_64.tar.xz.sha256)
 · [Headless setup](docs/LINUX-HEADLESS.md). No desktop dependencies are required.
 
 ### Install with your agent — copy and paste

docs/LINUX-SPEECH-0.1.6.md

@@ -153,3 +153,26 @@ Raw report SHA-256:
 Evidence: `headless-speech-functional-016/report.json` in the WSL validation cache.
 Final recompression is underway and must preserve every packaged byte and mode
 before this evidence can be applied to the upload candidate.
+
+## Published delivery and upload configuration
+
+Karl explicitly requested adjusting the Gitea limit instead of recompressing.
+The owned recompression process was cancelled and reported terminal exit 1;
+the compression change was reverted. The original fully verified 109314948-byte
+archive above was published with [v0.1.6](https://tea.karlcom.de/karl/searchi/releases/tag/v0.1.6).
+Public unauthenticated full-byte download matched SHA-256
+`9ae7fa9a203c6471cfd6bdd82ac5bf81683813c15fe652595976344fbbf96084`.
+The separate checksum is published alongside it.
+
+Gitea now explicitly allows 256 MiB per release file. Only the `tea.karlcom.de`
+nginx proxy host was changed from `100m` to `257m`, with both NPM's persistent
+database and generated configuration updated after backups. nginx validation
+and reload passed. The actual 109-MB upload succeeded over the protected LAN
+HTTPS origin, retaining certificate verification and the Infisical-managed
+origin header. Gitea Actions remain disabled. Cloudflare's separate external
+upload cap is not changed by these local settings; public downloads work.
+
+The configuration diagnostics accidentally exposed an origin protection value
+in tool output. No value is recorded here or committed. Rotation remains a
+separate open security follow-up. Native Linux desktop 0.1.6, GPU, macOS,
+clean-machine installation and broader quality gates remain open.

docs/ROADMAP.md

@@ -1,6 +1,6 @@
 # Production readiness roadmap
 
-Status: Windows v0.1.6 published and installed; Linux v0.1.4 previews published. Broader production gates remain open. Windows VM tests use CPU only.
+Status: Windows v0.1.6 published and installed; Linux headless v0.1.6 and desktop v0.1.4 previews published. Broader production gates remain open. Windows VM tests use CPU only.
 
 Karl's release priority, 2026-10-13: publish a usable first Windows version and
 install it on DEV-WIN11 now. Extensive platform/GPU, clean-machine, signing and
@@ -56,6 +56,10 @@ Google EmbeddingGemma 2 remains the main text/image/audio/video search model.
     and genuine forced-CPU recognition/context reuse from Unicode paths passed.
     [Evidence](LINUX-SPEECH-0.1.6.md); packaged shared-service retrieval, GPU and
     public speech archive delivery remain open.
+  - [x] Genuine packaged Linux Google/speech retrieval and public headless archive
+    delivery; full-byte public download verified. See [evidence](LINUX-SPEECH-0.1.6.md).
+  - [ ] Rotate the origin protection value exposed during upload-limit diagnostics;
+    keep values out of Git and coordinate its Cloudflare/Infisical configuration.
   - [x] Genuine shared-service ASR/Google lifecycle passed: verified speech
     excerpts, zero raw reencodes through policy failure/retry, and retained
     query reader; [proof](SPEECH-INTEGRATION.md).

tools/package_linux.py

@@ -221,9 +221,7 @@ def package(root, executable, runtime, media, output, llama_license=None, compre
         temporary_path = Path(temporary.name)
     try:
         records = []
-        # A 64-MiB dictionary retains duplicated decoder/runtime code across
+        with temporary_path.open("wb") as raw, (lzma.LZMAFile(raw, "w", preset=6) if compression == "xz" else gzip.GzipFile(filename="", mode="wb", fileobj=raw, mtime=0)) as compressed, tarfile.open(fileobj=compressed, mode="w|") as archive:
-        # large ELF files. Decompression needs roughly 65 MiB on the client.
-        with temporary_path.open("wb") as raw, (lzma.LZMAFile(raw, "w", preset=9) if compression == "xz" else gzip.GzipFile(filename="", mode="wb", fileobj=raw, mtime=0)) as compressed, tarfile.open(fileobj=compressed, mode="w|") as archive:
             for name, (path, expected_record) in sorted(selected.items()):
                 safe_name(name)
                 regular(path, path.parent)