feat: add multimodal search and granular performance diagnostics

docs/BUILDING.md

@@ -22,6 +22,7 @@ The Python CMake package is needed only when CMake is absent from PATH.
 python -m pip install cmake
 python tools/embeddinggemma2/build_runtime.py --backend cpu --jobs 2
 python tools/embeddinggemma2/stage_runtime.py --backend cpu
+python tools/media-runtime/provision.py --stage
 python tools/embeddinggemma2/download.py
 $env:SEARCHI_FORCE_CPU = '1'
 $env:SEARCHI_GEMMA_MODEL_DIR = (Resolve-Path .searchi/models/embeddinggemma2).Path
@@ -38,8 +39,7 @@ The worker is statically linked with the MSVC CRT on Windows. Staging copies
 it and the llama.cpp license into the desktop resources directory. Add
 `--bundle-model` to staging for an offline model bundle after downloading;
 otherwise desktop setup provisions verified models on first launch. Search
-itself performs no network inference or downloads. Media weights are staged
-for future integration; the current worker supports text only.
+itself performs no network inference or downloads. The worker now uses the verified media projector for genuine image/audio embeddings. The FFmpeg script stages verified standalone decoders and their notices.
 
 The desktop is a standalone Cargo workspace and needs separate validation:
 
@@ -50,7 +50,7 @@ npm ci
 npm run format:check
 npm test
 npm run build
-$env:WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS = '--disable-gpu'
+$env:WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS = '--disable-gpu --disable-accelerated-video-decode'
 npm run tauri -- dev
 ```
 
@@ -67,13 +67,18 @@ Linux release. On a native Linux build host, run from the repository root:
 ```sh
 python3 tools/embeddinggemma2/build_runtime.py --backend cpu --jobs 2
 python3 tools/embeddinggemma2/download.py
+python3 tools/media-runtime/provision.py
 export SEARCHI_FORCE_CPU=1
 cargo build --release -p searchi-cli --locked
 ./target/release/searchi index --db searchi.sqlite --root /path/to/documents
-./target/release/searchi embed --db searchi.sqlite --model-dir .searchi/models/embeddinggemma2 --embedding-worker .searchi/runtime/cpu/searchi-gemma-worker --cpu-threads 1
+./target/release/searchi embed --db searchi.sqlite --model-dir .searchi/models/embeddinggemma2 --embedding-worker .searchi/runtime/cpu/searchi-gemma-worker --ffmpeg .searchi/media-runtime/bin/ffmpeg --ffprobe .searchi/media-runtime/bin/ffprobe --cpu-threads 1
 ./target/release/searchi search --db searchi.sqlite 'supplier cancellation terms' --model-dir .searchi/models/embeddinggemma2 --embedding-worker .searchi/runtime/cpu/searchi-gemma-worker --cpu-threads 1
 ```
 
+`embed` builds document, image, video and audio/music vectors by default. Use
+`--text-only` explicitly to omit media. Default media indexing needs paired
+FFmpeg/FFprobe paths or packaged helpers beside the installed CLI.
+
 `searchi setup --model-dir PATH` is an alternative verified model-provisioning
 command. It provisions model assets, not the native worker. Package the worker
 separately and pass its path to headless embedding/search. Each short-lived CLI
@@ -114,5 +119,9 @@ installers, stage the target worker, retain dependency/model notices, verify
 clean-machine launch and setup, run native Google smoke tests, and complete
 upgrade/migration, signatures, and rollback checks. Optional offline bundles
 need both verified model files. See [semantic bounds and evidence](SEMANTIC.md)
-for current text-only, corpus, and performance limitations. Keep signing keys,
-repository tokens, and model credentials outside source control.
+for current corpus, localization, and performance limitations. Keep signing keys,
+repository tokens, and model credentials outside source control.
+FFmpeg provisioning supports manifest-pinned Windows/Linux x86-64 and ARM64 artifacts;
+only Windows x86-64 has executed here. macOS decoder packaging remains a gate.
+See [media runtime provenance](../tools/media-runtime/README.md) and
+[measured media limitations](MEDIA-QUALITY.md).

docs/MEDIA-QUALITY.md

@@ -0,0 +1,99 @@
+# Media search quality
+
+## Evaluation contract
+
+The independent v1 corpus contains **20 real assets and 65 frozen queries**: 12 photos, four videos, two music performances, and two sound effects. Queries include English/German visual memories, visually similar hard negatives, timestamp-sensitive actions, spoken topics, exact artist/title metadata, strict filter constraints, and no-answer cases.
+
+Labels were frozen before media inference with fixture SHA256 `b4e465a0eb9582b826eebd2a20797e1680e4907e336d02d0ef2194e2ba0af393`. Original asset hashes and licenses are recorded in [fixture.json](../fixtures/media/fixture.json) and [provenance](../fixtures/media/README.md). All Windows VM evaluation uses the real Google worker on **CPU, one thread**, with CPU FFmpeg decoding. No simulated embeddings or inferred model captions enter the corpus labels.
+
+The reference environment is Windows 11 Pro in a shared VM exposing four logical CPUs on an AMD Ryzen 7 7800X3D host, approximately 9.93 GiB visible memory. Inference deliberately uses one thread and `SEARCHI_FORCE_CPU=1`. [Recorded environment and worker hash](../fixtures/media/environment.json). Observed worker RAM varied around 0.9–1.2 GB during indexing; these snapshots are not a measured peak-memory guarantee.
+
+The corpus has one assistant annotator. Actual image/video frames were visually inspected; speech timestamps use independently published NASA captions. Human audio listening and blinded second-annotator review remain unexecuted. Existing artist/title tags are retained and checked at the stream level, where Vorbis stores them. English/German pairs refer to the same assets and are correlated, not twice as many independent examples. There is only one spoken-topic video and two music files; category-perfect recall can therefore be easy and must not be extrapolated.
+
+## Results
+
+The first **direct real-model dense reference** completed on CPU with 94/95 candidate encodings. This is an embedding/retrieval diagnostic, not yet the production pipeline. Candidate filtering in that reference is a benchmark constraint; exact metadata was deliberately marked unsupported.
+
+| Category | Queries | File recall@1 | File recall@5 | MRR | Precise timestamp hit@1 |
+|---|---:|---:|---:|---:|---:|
+| Photo memory | 24 | 100% | 100% | 1.000 | — |
+| Video actions | 4 | 100% | 100% | 1.000 | 100% |
+| Video scenes | 6 | 100% | 100% | 1.000 | 100% |
+| Flower temporal states | 4 | 100% | 100% | 1.000 | 75% |
+| Spoken topics in video | 8 | 100% | 100% | 1.000 | **25%** |
+| Music memories | 4 | **50%** | **50%** | 0.500 | — |
+| Sound effects | 4 | 100% | 100% | 1.000 | — |
+
+Across 55 supported positive queries (including one reference extension constraint), recall@1/@5 and MRR were **96.36% / 96.36% / 0.964**. Across 22 temporal queries, segment overlap@1 was **95.45%**, but precise point hits were **68.18%**. [Full recorded summary and failures](../fixtures/media/reference-summary.json), [rankings](../fixtures/media/reference-results.json).
+
+Important failures:
+
+- **Music encoding harness:** the original jazz violin Vorbis decode briefly overshot normalized PCM range. The direct tool sent unclamped floats, and the worker correctly rejected that one candidate. The two associated music misses are an explicit preprocessing failure, not evidence that the model confuses piano with violin. The production decoder clamps its PCM and must be evaluated separately; preserve this failed reference rather than hiding it.
+- **Speech localization:** all eight spoken-topic queries found the right file and an overlapping thirty-second audio segment, but six returned a segment start outside the labelled utterance. Correct-file retrieval therefore does **not** fulfill precise “jump to the bit where somebody mentions a topic.” Shorter local windows or another alignment mechanism need independent evaluation.
+- **Temporal visual distinction:** one red-flower query selected the right clip but the wrong stage of opening.
+- **No-answer behavior:** all six supported absent/negative queries returned nearest neighbors (**100% unsuppressed return rate**). No arbitrary cosine threshold was invented. This exposes missing abstention evidence, not a calibrated confidence score.
+- **Exact metadata:** four identity/no-answer cases remain unsupported in the direct embedding lane. A separate actual FFprobe → guarded Searchi core FTS run passed all three frozen artist/title queries at rank 1 and returned no result for the absent artist: **recall@1/@5 = 100%, MRR = 1.0; absent-artist return rate = 0%**. [Metadata results](../fixtures/media/metadata-summary.json). These are three small lexical identity cases, not proof that hybrid fallback abstains or that all music collections work.
+
+Encoding took **498.66 seconds** for the photo/frame/audio candidates in this CPU-one-thread run. Query p50/p95 were **92.78 / 122.93 ms** after encoding. Runtime reported `google/embeddinggemma-2`, 768 dimensions, CPU, one thread, `b11461-no-logits-v1`. Other concurrent VM work can affect timings; this is not a clean-room hardware benchmark.
+
+### Actual production pipeline: 30-second audio windows
+
+The real shared Searchi service, FFmpeg 9.0.2 decoder, metadata extraction, guarded core index, ANN retrieval and hybrid ranking completed **20/20 files and 118 chunks with zero encoding failures**. This rerun used the fixed decoder's exact sample trimming; the earlier direct harness failure remains recorded separately. Indexing took **668.04 seconds**, and warm query p50/p95 were **92.23 / 113.38 ms**, on one CPU thread. These serial evaluation runs can still share the VM with unrelated work.
+
+Across 58 supported positive queries, actual file recall@1/@5 was **96.55% / 100%**, with **MRR 0.983**. EN recall@1 was 96.77% (31 positives), DE 96.30% (27 positives). Photo memories 24/24, video file retrieval 22/22, sound effects 4/4, artist/title metadata 3/3 and the positive extension filter 1/1 passed at rank 1. Music memories passed **2/4 at rank 1 and 4/4 in the first five**: both violin queries ranked piano first despite successful decoding, an actual music hard-negative confusion.
+
+Temporal point accuracy was **12/22 (54.55%)**; segment overlap was 18/22 (81.82%). Video action/scenery point hits passed 10/10, flower state hits 2/4, and spoken-topic hits **0/8**. Two spoken orange-soil queries surfaced image/video-frame hits instead of audio. Remaining speech starts ranged from 0.539 to 15.777 seconds outside the labelled utterance. The 0/8 strict score does not mean every start is equally unusable; raw distance and wrong-channel failures are retained rather than tuning a tolerance to this test corpus.
+
+All six supported no-answer cases returned results, including the absent artist through semantic fallback. The separate lexical-only metadata absence test passed, but that does **not** establish abstention for the hybrid product. A requested temporal-range negative was explicitly unsupported, rather than silently counted as a pass. [Production summary](../fixtures/media/pipeline-30s-summary.json), [complete actual rankings](../fixtures/media/pipeline-30s-results.json).
+
+### Same-label shorter audio experiment
+
+The same fixed decoder, files, queries and two-second overlap were rerun with ten-second audio windows. All 20 files indexed successfully into **154 chunks**, with zero failures. This is a predeclared policy comparison, not a new production default.
+
+| Metric | 30-second windows | 10-second windows |
+|---|---:|---:|
+| CPU indexing time | 668.04 s | 671.51 s |
+| Actual chunks | 118 | 154 |
+| File recall@1 / @5 | 96.55% / 100% | 96.55% / 100% |
+| MRR | 0.983 | 0.983 |
+| Speech precise point hits | 0/8 | 1/8 |
+| Speech segment overlap | 6/8 | 6/8 |
+| Overall temporal point hits | 12/22 | 13/22 |
+| Worst correct-channel timestamp distance | 15.777 s | 3.777 s |
+| Warm query p50 / p95 | 92.23 / 113.38 ms | 90.65 / 110.42 ms |
+| Music top-1 | 2/4 | 2/4 |
+| No-answer returned results | 6/6 | 6/6 |
+
+Shorter windows improve the worst raw localization distance, but only one strict utterance hit and unchanged wrong-channel failures are insufficient for the original spoken-topic navigation goal. Similar measured cost here does not establish cost equivalence for long recordings; window count, media mix and VM contention differ. The actual hybrid artist/title regression still passes all three identity cases. [Ten-second summary](../fixtures/media/pipeline-10s-summary.json), [complete rankings and policy fingerprint](../fixtures/media/pipeline-10s-results.json).
+
+### Predeclared photo-budget comparison
+
+The same 12 photos and 24 frozen EN/DE memories were encoded at 70, 280 and 1120 tokens. Query embeddings were computed once and shared; no labels or thresholds changed.
+
+| Image tokens | Actual CPU batch encoding time | Recall@1 / @5 | MRR |
+|---|---:|---:|---:|
+| 70 | 47.61 s | 100% / 100% | 1.000 |
+| 280 | 199.65 s | 100% / 100% | 1.000 |
+| 1120 | 1493.32 s | 100% / 100% | 1.000 |
+
+There was no retrieval improvement on this small corpus despite a substantial high-budget cost. The high-budget run overlapped independent native compilation/profiling in the shared CPU VM, so the table is an observed experiment, not a controlled hardware scaling law. A worker RAM snapshot reached approximately 1.5 GB; peak RAM was not instrumented. Equal recall here does not establish equivalent retrieval for small text, dense screenshots or subtle visual distinctions. Keep the existing production policy pending a broader quality/cost corpus; these observations do not justify making 1120 tokens the default. [Budget summary](../fixtures/media/image-budget-summary.json), [actual dimensions, rankings and worker report](../fixtures/media/image-budget-results.json).
+
+Production defaults have not changed as part of these experiments. The current **self-rating is 4/10: experimental media retrieval**. Real visual retrieval is promising, but precise speech timestamps, music hard negatives and abstention remain essential gaps. This rating follows the rubric below rather than extrapolating the small corpus's high file-recall score. The production measurements above precede a subsequent spoken-cue channel-routing improvement; that change has not been rescored against this corpus and must not inherit a better measured score without a new run.
+
+The existing **20-document/24-query synthetic regression** was rerun with the actual Google CPU worker and unchanged fixture SHA256 `3bab37fc0ec9c2e2e40684962b049172b5078358c6487c9033ed8697b8128dd7`:
+
+| Lane | Top-1 | Recall@3 | Recall@10 |
+|---|---:|---:|---:|
+| Filename/keyword | 20.83% | 20.83% | 20.83% |
+| Semantic | 100% | 100% | 100% |
+| Hybrid | 100% | 100% | 100% |
+
+Measured hybrid p95 was **146.83 ms** on this run. [Recorded output](../fixtures/media/document-baseline.json). This remains a synthetic seed, not independent production-quality evidence or a large-corpus performance claim.
+
+## Scoring and release gates
+
+Report recall@1/@5, MRR, language/type breakdowns, segment-overlap hits, precise timestamp point hits, and failure categories. No-answer return rate is distinct from positive recall. Do not invent an arbitrary cosine rejection threshold from these results; calibrate on a separate development set, then validate on held-out negatives.
+
+Self-rating rubric is declared before scores: **1–2/10** broken core retrieval; **3–4/10** experimental retrieval with missing essential capabilities or unvalidated abstention/metadata; **5–6/10** useful limited beta after independent basic retrieval/filter/metadata checks; **7–8/10** strong pilot with high recall and timestamp quality on representative corpora; **9–10/10** requires production release evidence across all operating systems, large representative libraries, calibrated no-answer behavior, and complete lifecycle/security/resource verification. A small diagnostic alone cannot justify a production score.
+
+Remaining gates: broader production metadata/filter enforcement beyond the four positive seed constraints, calibrated no-answer handling, reliable spoken-topic alignment and channel selection, realistic long videos, audio listening review, unseen music/accents, corrupt codec cases, missing files/renames, hardware resource bounds, and native Windows/Linux/macOS validation. The measured production pipeline and explicit failures above establish a reproducible baseline; they do not close these gates.

docs/PERFORMANCE.md

@@ -0,0 +1,158 @@
+# Search performance diagnostics
+
+Search performance must distinguish total request latency from the work inside
+it. The shared Rust schema exposes basic metrics for routine searches and a
+bounded nested trace for deliberate debugging. It uses monotonic `Instant`
+timing, not wall-clock timestamps. No query text, source passages or file paths
+belong in stage names/counters.
+
+## Shared response
+
+`SearchResponse<T>` contains `results: Vec<T>` and `metrics: SearchMetrics`.
+
+| Field | Meaning |
+| --- | --- |
+| total_ms | Elapsed time inside the collector's measured request boundary |
+| result_count | Number of final returned results |
+| trace | null in basic mode; debug spans in begin order |
+| dropped_spans | Spans omitted when the 512-span ceiling or invalid parent is encountered |
+
+A `SearchSpan` has a static `name`, relative `start_ms`, `duration_ms`, optional
+parent index and integer `counters`. Parent indices reference earlier spans in
+the same trace; child timings lie within their parent. Nested durations overlap,
+so summing every span would double-count work. Counters are capped at 32 keys per
+span, with 96-character labels. Missing spans due to the cap are visible through
+`dropped_spans`, never presented as complete instrumentation.
+
+Basic mode retains only the request start Instant and result count; there is no
+per-stage span Vec or diagnostic string allocation. Debug mode captures up to
+512 spans. Scope timings preserve normal closure return values and errors.
+Already-ended or foreign tokens are harmless, and unfinished scopes close at
+collector finish. Closing a parent closes its open descendants for containment.
+
+## Instrumenting the shared engine
+
+```rust
+use searchi_core::metrics::{MetricsMode, TraceCollector};
+let mut trace = TraceCollector::new(MetricsMode::Debug);
+let results = trace.timed("search", None, |trace, parent| {
+    trace.timed("candidate_selection", parent, |trace, token| {
+        trace.counter(token, "candidate_count", candidates.len() as u64);
+        retrieve_candidates(candidates)
+    })
+});
+let metrics = trace.finish(results.len());
+```
+
+This is an API illustration, not a measured benchmark. `begin(name,parent)` /
+`end(token,counters)` supports explicit scopes spanning locks or separate calls;
+`SpanToken` is Copy and exposes its index. `counter` records bounded integer
+counts without source data. `elapsed_ms` reports elapsed request time. Capture
+queue/lock boundaries in the caller, then pass that same collector into the
+shared core/service so stages refer to one origin.
+
+Useful actual boundaries include request admission/reader lock, filter snapshot,
+filename/FTS retrieval, tokenizer/query inference, active ANN load, eligibility
+refresh, filtered HNSW traversal, per-file deduplication, ranking/fusion and
+result assembly. Name only work that is truly measured. Do not label the whole
+worker round trip as pure neural execution or fabricate stage splits from a
+single elapsed number. Model load/warmup and initial eligibility work should be
+reported separately from a retained worker's first foreground and warm queries.
+
+## CLI and desktop integration
+
+The CLI exposes these actual modes:
+
+```sh
+searchi search --db searchi.sqlite contract --json
+searchi search --db searchi.sqlite contract --performance --json
+searchi search --db searchi.sqlite contract --debug-performance --json
+```
+
+Plain `--json` preserves the legacy result array. `--performance --json` emits
+`SearchResponse` with basic metrics; `--debug-performance --json` emits the
+same envelope with detailed spans. Normal terminal output prints results and
+reports elapsed time/count on stderr, including CLI index/session initialization.
+Debug terminal mode also prints the detailed metrics on stderr. Legacy Vec
+interfaces remain wrappers for compatibility. The desktop should use a compact ordinary summary and an optional
+diagnostic view, without confusing score/similarity with elapsed time or confidence.
+
+Both measured GUI commands start the native clock at command entry, include instrumented queue/lock waits, and finish before response serialization. UI timing separately captures input/debounce, lane/retry waits, invoke/round trip and synchronous DOM updates. Display latency ends at the DOM update; actual compositor paint and deferred media preview loading are not measured. Their overlapping boundaries must not be summed. Native metrics exclude frontend delays and post-return paint. A fast Rust request does not
+prove a responsive first foreground interaction. Conversely, pending setup or
+model loading must not be silently included in a warm-query claim.
+
+## Reproducible performance validation
+
+Record build profile, CPU/device and thread budget, VM/host resources, corpus and
+active generation, filters, cold/warm state, concurrent indexing and setup costs.
+Use multiple queries and p50/p95 distributions; retain raw reports. Compare basic
+and debug mode on the same corpus to quantify instrumentation overhead. Debug
+traces guide investigation but are not a substitute for representative benchmarks.
+
+Current recorded filename, actual Google seed and synthetic ANN evidence is in
+[VALIDATION](VALIDATION.md) and [SEMANTIC](SEMANTIC.md). Media quality/timing is in
+[MEDIA-QUALITY](MEDIA-QUALITY.md). Synthetic vectors measure index behavior only;
+real Google inference remains required for product semantic search. Platform,
+large-corpus, concurrent-indexing and GPU performance gates remain independent.
+## Worker round-trip diagnostics
+
+Measured desktop failures return `{message, metrics}` and retain the trace for
+the failed attempt. Busy retries are separate attempts. If an unexpected worker
+task failure loses its collector, elapsed time is retained, the trace is null,
+and a dropped-span marker makes the missing detail explicit. Error messages are
+excluded from the exported timing report.
+
+Embedding IPC spans expose named `*_us` integer counters for request encoding,
+writing, worker wait/response decode, validation, and native tokenization, batch
+preparation, inference and pooling/normalization when genuinely reported. They
+also expose `worker_token_count` and the GPU-to-CPU restart count. Microsecond
+counters are durations, not occurrence counts; their suffix records units.
+
+The native worker clock is not aligned with Rust's collector origin. Native
+stage values remain counters on the IPC span rather than invented positioned
+child spans. Worker wait includes response-reader JSON parsing and scheduling;
+it is not pure inference time. The encompassing round trip and its component
+counters overlap. A fallback/restart may include setup outside the last worker's
+reported neural pass; retain that distinction when diagnosing slow requests.
+
+## Small instrumentation-overhead diagnostic
+
+The deterministic example creates 1,000 local text files, builds/prewarms SQLite,
+then alternates basic/debug order over 24 exact filename queries and 20 repeats.
+Both modes must retrieve the correct file. It records 480 samples per mode,
+outer-call p50/p95/mean and actual debug span counts, excluding fixture setup
+and JSON serialization. It runs no model, media decoder or network.
+
+```powershell
+cargo run --release -p searchi-core --example trace_overhead -- .searchi/trace-overhead.json
+```
+
+This tiny warm lexical corpus measures diagnostic overhead under the current
+VM conditions. It does not certify production search latency or model-query
+tracing overhead. Keep the raw report and profile/device/concurrency caveats;
+repeat on representative corpora and compare instrumentation policies before
+claiming low overhead across every retrieval mode.
+
+Windows CPU release diagnostic, 2026-10-12 (480 samples per mode):
+
+| Mode | Mean | p50 | p95 |
+| --- | --- | --- | --- |
+| Basic | 0.556 ms | 0.440 ms | 0.934 ms |
+| Detailed | 0.968 ms | 0.819 ms | 1.615 ms |
+
+The detailed searches retained 14 spans each. These measurements include the
+search itself and metrics assembly, and exclude fixture setup and JSON encoding.
+Other work in the VM could contend for CPU. [Raw samples and measurement scope](evidence/windows-cpu-trace-overhead.json).
+The recorded Windows x86-64 release run retained 480 raw samples per mode and
+14 actual debug spans per request:
+
+| Mode | Mean | p50 | p95 |
+| --- | ---: | ---: | ---: |
+| Basic | 0.556 ms | 0.440 ms | 0.934 ms |
+| Debug | 0.968 ms | 0.819 ms | 1.615 ms |
+
+[Raw samples and measurement contract](evidence/windows-cpu-trace-overhead.json)
+include the active VM-contention caveat: native photo inference and other work
+may overlap. This is an absolute small-corpus comparison, not an old-baseline
+regression claim or proof of model/media tracing overhead. The extra cost
+supports keeping detailed mode optional rather than claiming it is free.

docs/ROADMAP.md

@@ -38,10 +38,21 @@ Status: implementation started; no production release yet. Windows VM tests use
 - [ ] Watchers and reconciliation across Windows, macOS and Linux.
 
 ## 4. Media
+- [x] Genuine Google image, audio and video embeddings integrated with the shared
+  search service and CPU-tested FFmpeg decoding; music tags and duration filters.
+- [x] Frozen independent media corpus with retrieval, timestamp, negative-query
+  and indexing-cost measurements (see MEDIA-QUALITY.md).
+- [ ] Improve precise spoken-passage localization, music hard negatives and
+  calibrated handling of queries without a relevant match.
+- [ ] Package and verify decoders on every release OS; test production acceleration.
 - [ ] CPU OCR, image retrieval, audio transcription, video segment locations.
 - [ ] Isolated extraction workers with timeouts and resource ceilings.
 
 ## 5. Release gates
+- [x] Shared monotonic Basic/Debug search metrics, granular bounded engine traces,
+  actual worker query diagnostics, and headless JSON performance output.
+- [ ] Verify detailed performance UI interaction on native desktop platforms;
+  repeat overhead measurements on representative libraries and hardware.
 - [ ] Formatting, lint, tests and security/dependency review.
 - [ ] CPU benchmarks: filename p95 <50 ms/1M records; text <150 ms/100K documents; semantic <500 ms on declared hardware.
 - [ ] Measure cold start, indexing throughput, RAM, disk and idle CPU.

docs/SEMANTIC.md

@@ -38,9 +38,7 @@ on other operating systems remain independent release checks.
 | embeddinggemma-2-Q8_0.gguf | 309,855,456 | 2188ac1deca4b77dffefd603c2776a9d76d9d74ec01841392982ebb840b09135 |
 | mmproj-embeddinggemma-2-Q8_0.gguf | 554,821,024 | c4a8a52691ecef40618438928bdf9e68379b854e24166f292592353db0aab64f |
 
-Setup downloads both pinned files. **The current worker implements text**;
-image/audio projection loading and image/audio/video embeddings remain required
-work. Downloaded media weights do not establish functioning multimodal search.
+Setup downloads both pinned files. The native worker implements genuine text, image pixels, and mono 16 kHz audio embeddings through the verified Google projector in the same 768-dimensional query space. The shared service now persists unified document, image, video-frame and soundtrack/audio/music vectors with source locations and metadata. Scoped desktop media previews and an independent retrieval evaluation are implemented; precise localization, broader quality, native playback QA and releases remain gates.
 
 Weights use Apache-2.0; llama.cpp and DigUp use MIT; USearch and NumKong use
 Apache-2.0. Retain notices with distributions. Five DigUp text reference vectors
@@ -64,14 +62,15 @@ HybridSearch is the shared CLI/desktop service:
 HybridSearch::open(db, model_dir, worker_executable, threads)
 HybridSearch::embedding_status(db) // No model/runtime load or network
 service.warmup()                  // Real query inference + ANN cache
-service.index_embeddings()
+service.index_embeddings() // Explicit document-only generation
+service.index_embeddings_with_media(&tools, &MediaLimits::default()) // Unified generation
 service.search(query, limit, &SearchOptions)
 service.search_semantic(query, limit, &SearchOptions) // Diagnostics
 service.worker_info()             // Actual model/runtime/device/threads
 ~~~
 
 Threads are bounded to 1–8; VM tests use one. Document batches contain at most
-eight windows. Request/response budgets are 2/4 MiB, startup has a 120-second
+eight windows. Request/response budgets are 16/4 MiB, startup has a 120-second
 deadline, and each request has a 180-second deadline. Malformed or interrupted
 IPC and invalid embeddings fail explicitly.
 
@@ -177,3 +176,92 @@ The ignored ANN test deliberately requires release mode. Default tests require
 no model/network and cover protocol bounds, invalid vectors, UTF-8 coverage,
 fusion, lifecycle, checksums, pre-top-k filtering, and dirty-path caching.
 Linux/macOS and GPU checks are not inferred from this Windows CPU run.
+
+## Genuine image and audio adapter
+
+`GemmaEmbedder::embed_images(&[&Path])` uses a provisional 280-token image
+budget. `embed_images_with_budget(paths, budget)` supports 70 through 1120
+Google visual tokens, including full-resolution model input. Use
+`embed_images_with_metadata` for encoded dimensions and the chosen budget.
+The aspect-preserving dimensions are multiples of 48; Rust performs bounded
+PNG/JPEG/WebP/BMP decoding, applies EXIF orientation, and bicubic Catmull-Rom
+resizing before sending RGB pixels. No captions or filenames produce vectors.
+Bounds are eight paths per call, one image per inference operation, 64 MiB
+input files, 64 Mi-pixel JPEG sources (scaled decoding above 16 Mi pixels),
+16 Mi-pixel non-JPEG sources, and a 256 MiB decoding-buffer/output ceiling. Decoder dimensions
+and output size are checked before pixel allocation. Tiny/extreme images still
+receive a valid bounded grid. The same API embeds decoded video frame files.
+
+`GemmaEmbedder::embed_audio_pcm(samples)` accepts normalized finite mono 16 kHz
+PCM with 1–480,000 samples, at most 30 seconds, on a little-endian host. It
+encodes actual sound through Google MTMD and the shared mean-pooled text model.
+Callers must segment the entire recording/movie soundtrack and retain actual
+window timestamps; this API never silently truncates audio. It provides no
+transcript. Speech, music, and environmental sounds require independent quality
+evaluation even though all use this genuine encoder.
+
+The projector is size/SHA256 verified on first media use, then loaded lazily in
+the retained native worker. Model initialization and returned inference failures
+share the CPU fallback policy. Native video/FFmpeg spawning is disabled; the
+media adapter owns extraction. Media generations must include
+`GEMMA_MEDIA_FINGERPRINT` and image budget/window policy in their identity.
+Text fingerprints remain unchanged. GPU media inference is untested here.
+
+Actual Windows CPU parity with copied MIT DigUp fixtures passed for screenshot
+280, photo 140, frame 70, and speech: cosine respectively **0.99994194,
+0.99974583, 0.99921928, and 0.99983318**, all exceeding the 0.999 gate. The test
+completed in 58.79 seconds including fresh model/projector startup. This proves
+runtime parity on those inputs, not broad image/audio retrieval quality.
+Run with the model/worker environment above:
+
+~~~powershell
+cargo test -p searchi-semantic --test gemma_media_cpu -- --ignored --nocapture
+~~~
+The large camera JPEG policy, established decoder tradeoffs, EXIF/resource test,
+and memory-bound caveats are documented in [the semantic crate](../crates/searchi-semantic/README.md).
+
+## Unified media indexing and setup
+
+The desktop and default CLI `embed` command use `index_embeddings_with_media`.
+Document-only indexing is an explicit `--text-only` choice. `searchi-media`
+prepares actual image files, movie frames and mono 16 kHz audio windows with
+verified caller-supplied FFmpeg/FFprobe executables. There is no transcription,
+fabricated caption or model-derived filename substitution. Existing stream/file
+artist/title metadata enters guarded keyword indexing.
+
+Default media policy uses image 280/frame 70 visual tokens, 30-second primary
+audio windows with two-second overlap, up to 240 distributed frames plus 120
+scene candidates, up to 600 audio windows, a four-hour/16 GiB file ceiling and
+45-second subprocess deadlines. Coverage includes the audio tail or reports an
+explicit resource error; video sampling spans the movie without guaranteeing
+every transient scene. Media files have stable content identity, persisted
+vectors and sources (`image`, `timestamp_ms`); source changes/deletions suppress
+stale results. Generations include preprocessing/window/sampling fingerprints.
+Per-file decoding failures are reported and persisted rather than silently
+counted as successful media indexing. Other filename/text matches stay useful.
+
+Developer preparation from the repository root:
+
+~~~powershell
+python tools/embeddinggemma2/build_runtime.py --backend cpu --jobs 2
+python tools/embeddinggemma2/stage_runtime.py --backend cpu
+python tools/media-runtime/provision.py --stage
+$env:SEARCHI_FORCE_CPU = '1'
+$env:WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS = '--disable-gpu --disable-accelerated-video-decode'
+~~~
+
+The decoder script verifies a pinned FFmpeg 9.0.2 LGPL artifact and stages tools,
+notices and the manifest without global installation. Only Windows x86-64 has
+been executed; Linux/ARM64 entries require native checks, and macOS decoder
+packaging is still missing. End-user packages must include the worker/decoders;
+Google weights are provisioned automatically and verified locally. Search does
+not perform setup downloads. Headless CLI helper discovery and explicit paths
+are documented in [README](../README.md) and [BUILDING](BUILDING.md).
+
+[Independent media evaluation](MEDIA-QUALITY.md) preserves the frozen corpus,
+actual production pipeline, direct-harness failure, music confusions, speech
+point-localization failures and unsuppressed no-answer results. Strong file
+recall is insufficient for accurate spoken-topic navigation. A ten-second audio
+experiment reduces some distances but does not close that gate; it is not a
+new default. Quality policies must be validated on held-out data rather than
+inventing thresholds from the evaluation corpus.

docs/VALIDATION.md

@@ -1,64 +1,94 @@
 # Validation evidence
 
-Development host: Windows VM, x86_64 MSVC, Rust stable 1.99.0.
-All local tests run on CPU; no GPU provider is configured.
+Development host: Windows VM, x86_64 MSVC, stable Rust 1.99.0. All local
+inference, FFmpeg decoding and WebView tests use CPU only. UI launches set
+`WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS='--disable-gpu --disable-accelerated-video-decode'`
+and `SEARCHI_FORCE_CPU=1`.
 
 ## Current integration checkpoint (2026-10-12)
 
-- `cargo test --workspace --locked`: 41 default tests passed after final core integration. Four asset-dependent
-  or explicit benchmark tests remain opt-in; a default pass does not run them.
-- Native desktop tests: 7 passed with SEARCHI_FORCE_CPU=1 and WebView2 GPU disabled.
-- Frontend: 7 async-state tests passed, Prettier passed, TypeScript/Vite build passed.
-- Genuine Google CPU reference/window test passed separately: five DigUp reference
-  vectors had cosine similarity above 0.999; actual multilingual retrieval and
-  tokenizer tail-window coverage passed. MiniLM evidence below is historical.
-- Repository description/topics were read back after update; the branded avatar
-  upload returned HTTP 204 and the repository API returned its avatar URL.
-- New desktop styling is in progress. `design-qa.md` records the visual gate as
-  blocked because browser bootstrap and native screen capture are unavailable.
-  No visual match or complete UI interaction verification is claimed.
+- Native desktop: **9/9 tests passed**, including structured trace/basic responses.
+  Post-generation cached query warmup is implemented but its interactive first-query gate remains open.
+  Frontend: **18/18 tests passed**, TypeScript/Vite production build and
+  formatting passed. Preview policy tests cover fractional timestamp seeking,
+  image labels, one active/latest pending request, stale replies and Escape.
+- Semantic adapter: **8 default tests passed**; the explicit 48 MP resource test
+  remains opt-in. Strict targeted all-target Clippy and formatting passed.
+  Protocol bounds, invalid vectors, artifact size/checksum mismatch, old-worker
+  capability defaults and oversized JPEG rejection are covered.
+- The CPU native helper rebuilt and staged successfully with genuine Google
+  MTMD image/audio support. Its handshake reports `media_supported:true`;
+  older text workers default false rather than claiming media readiness.
+- Actual Google CPU media parity passed separately in **52.85 seconds**:
+  screenshot 280 cosine 0.99994194, photo 140: 0.99974583, frame 70: 0.99921928 and
+  speech: 0.99983318 against pinned MIT DigUp vectors. All exceed the 0.999 gate.
+  This verifies runtime parity, not broad retrieval quality.
+- The release resource test encodes/decodes an actual 8000x6000 JPEG with EXIF
+  rotation and verifies region colors after scaled decoding/resizing. Decode
+  plus resize took 176–220 ms. A sampled whole-test peak was 146.86 MiB, including
+  source fixture generation; it is not decoder-only RSS or neural quality.
+- The independent production media pipeline has run on 20 real assets/65 frozen
+  queries using actual Google inference, FFmpeg, metadata, persistence and HNSW.
+  It encoded 20/20 files with no failures in the recorded 30-second-window run.
+  Broad file recall is promising; precise speech timestamps, music confusion
+  and no-answer behavior remain failed quality gates. Preserve the earlier
+  direct harness failure separately. [Raw results and limitations](MEDIA-QUALITY.md).
+- Actual document seed regression passed 24/24 semantic/hybrid queries. This is
+  a small synthetic regression, not a production relevance corpus.
+- The explicit 100,000-vector release ANN diagnostic passed 98.5% recall@10,
+  HNSW p95 1.37 ms and warm service p95 6.40 ms with zero warm passage hashes.
+  Vectors are synthetic index benchmark data, never production embeddings.
+- The fixed one-million-file first-input report records 40 inputs below 50 ms in
+  that run: [recorded benchmark](../crates/searchi-core/benchmarks/results/windows-cpu-full-candidate-first-final.json).
+  These measurements do not establish every query or concurrent-indexing goal.
 
-Final UI integration: the branded compact launcher, local Inter/Fluent assets,
-themes and motion implementation passed frontend build, formatting, and seven
-state tests. Native launch succeeded; accessibility text showed real controls
-and a warmed Google CPU worker. UI input and screenshots remain blocked by
-Windows access/capture errors, as recorded in design-qa.md. Workspace formatting
-and strict all-target Clippy passed. The fixed full-corpus first-input report
-is in crates/searchi-core/benchmarks/results/windows-cpu-full-candidate-first-final.json;
-all 40 measured filename inputs were below 50 ms in that run.
+The integrated CPU workspace checkpoint passed **62 default tests** (8 assets, 6 CLI, 23 core, 4 media, 8 semantic, 13 service), with **10 explicit opt-in tests ignored**. Workspace and native all-target Clippy passed with warnings denied. The later semantic CPU-restart counter change passed workspace Clippy and the actual CPU query diagnostics test. Earlier aggregate counts are historical.
 
-The active parallel development branches of work may add tests or change counts
-after this checkpoint. Run the documented checks again after integration.
+The updated pinned C++ helper compiled in an independent CPU build directory and
+was staged for desktop resources without interrupting media evaluation. Actual
+Google query diagnostics passed separately in 18.09 seconds including model
+initialization and two queries: 13 tokens, tokenization 149 us, batch preparation
+22 us, inference 112914 us, pooling/normalization 17 us. Rust worker wait/response
+decode measured 113960 us. Debug/normal embedding cosine was 0.99999999. These
+are one diagnostic sample under VM contention, not production latency evidence.
+See [performance boundaries and raw overhead samples](PERFORMANCE.md).
 
-## Historical foundation evidence
+## Native UI and platform limits
 
-Initial foundation checks (2026-10-12):
-- `cargo test --workspace`: CLI parser/executable checks and engine retrieval,
-  lifecycle, exclusions, filters, migration and concurrent-reader checks passed.
-- `cargo clippy --workspace --all-targets -- -D warnings`: passed.
-- Rust formatting applied; final formatting verification follows integration.
-- Desktop TypeScript/Vite build passed; npm audit reported zero vulnerabilities.
-- Initial Windows desktop native check, embedded app build, strict Clippy and
-  two desktop tests passed (index gate recovery and guarded source opening).
-- Desktop launched with WebView2 `--disable-gpu`. UI automation could not capture
-  the window: `GetCursorPos` access denied, then monitor capture error
-  `0x80070057`. Visual layout and end-to-end UI interactions remain unverified.
-- Real Python CPU ONNX embedding proof completed on 8 documents / 6 queries:
-  5/6 top-1 accuracy, 6/6 recall@3. The strict top-1 quality gate is not met.
-  See `tools/semantic-proof/windows-cpu-result.json` for raw timings and rankings.
-  This tiny fixture is not evidence of large-corpus performance.
-- Native Rust CPU embedding adapter compiled, passed its three unit tests and
-  the explicit local-model smoke test. The smoke reproduced the same 5/6 top-1
-  limitation. Default CI omits this asset-dependent test; it must be executed
-  separately with provisioned local artifacts.
-- Integrated workspace validation: 19 default tests passed; 1 local-model test
-  is opt-in. Rust formatting and strict Clippy passed after lockfile refresh.
-- PDF/DOCX fixture tests include matching source locations, corrupt replacement,
-  encrypted PDF behavior and compressed-input limits.
+The branded launcher launched natively. Accessibility inspection showed real
+controls and a warmed Google CPU worker. Native screenshots, input automation
+and complete image/audio/video playback interactions remain blocked by Windows
+access/capture errors recorded in [design QA](../design-qa.md). Passing pure
+preview policy tests does not establish real WebView codec playback or visual
+fidelity. Default-application opening is not exact timestamp navigation.
 
-Not yet established: production latency targets, semantic inference, desktop
-runtime behavior, Linux/macOS execution, installer signing or upgrades.
-CI configuration is source configuration, not evidence that remote jobs ran.
-Gitea workflows require matching Windows, Linux and macOS runners; runner
-availability has not been established. GitHub workflows are also supplied for
-future mirroring, but do not run merely because code was pushed to Gitea.
+Windows x86-64 verified decoder provisioning/staging has executed. Manifest
+entries for Linux and ARM64 are configuration, not evidence of native execution.
+A vetted macOS decoder package remains missing. Linux/macOS worker/desktop
+execution, production GPU parity/fallback, installer signing, upgrade/rollback,
+licenses/source distribution, large libraries and calibrated absence handling
+remain unexecuted release gates. FFmpeg subprocess memory is not sandbox-capped;
+bounded outputs/timeouts are not an absolute RSS guarantee.
+
+Gitea needs matching registered runners. GitHub workflows are supplied for
+mirroring; they do not run merely because code is pushed to Gitea. The current
+workflow checks do not automatically certify downloaded Google assets or the
+separately built worker. CI configuration is not remote job evidence.
+
+## Historical evidence
+
+Initial engine/CLI checks covered retrieval, persistence, filesystem changes,
+exclusions/filters, migration, concurrent readers, PDF pages, DOCX paragraphs,
+corrupt replacement, encrypted PDF errors and bounded compressed input.
+The first actual Google text adapter matched five pinned reference vectors
+above 0.999, including multilingual queries and long-document window coverage.
+
+The rejected MiniLM/ONNX experiment achieved 5/6 top-1 on its six-query fixture;
+it is retained under the opt-in historical proof only and is not a production
+fallback. [Historical experiment](../tools/semantic-proof/HISTORICAL.md).
+Repository metadata/avatar updates were read back successfully. Historical
+foundation/default test totals changed as implementation expanded and must not
+be presented as the current aggregate.
+
+Reproduction commands and exact interfaces are in [BUILDING.md](BUILDING.md),
+[SEMANTIC.md](SEMANTIC.md), and [MEDIA-QUALITY.md](MEDIA-QUALITY.md).

docs/evidence/windows-cpu-google-query-diagnostics.json

@@ -0,0 +1,22 @@
+{
+  "date": "2026-10-12",
+  "model": "google/embeddinggemma-2",
+  "runtime": "llama.cpp b11461 with pinned no-logits patch",
+  "device": "cpu",
+  "threads": 1,
+  "test": "google_cpu_debug_query_reports_actual_worker_stages_without_changing_vectors",
+  "test_elapsed_seconds_including_initialization_and_two_queries": 18.09,
+  "debug_normal_cosine": 0.99999999,
+  "diagnostics": {
+    "request_encode_us": 24,
+    "request_write_us": 52,
+    "response_validate_us": 92,
+    "worker_batch_prepare_us": 22,
+    "worker_inference_us": 112914,
+    "worker_pool_normalize_us": 17,
+    "worker_token_count": 13,
+    "worker_tokenization_us": 149,
+    "worker_wait_and_response_decode_us": 113960
+  },
+  "scope": "One actual query diagnostic; native worker clocks are not aligned to Rust. VM had concurrent media inference. No production latency or broad overhead claim."
+}

docs/evidence/windows-cpu-trace-overhead.json

@@ -0,0 +1,990 @@
+{
+  "arch": "x86_64",
+  "basic": {
+    "mean_ms": 0.5563772916666668,
+    "p50_ms": 0.4403,
+    "p95_ms": 0.9344,
+    "samples": 480
+  },
+  "basic_samples_ms": [
+    0.434,
+    0.4441,
+    0.5638000000000001,
+    0.41350000000000003,
+    0.4078,
+    0.44470000000000004,
+    0.4078,
+    0.5291,
+    0.416,
+    0.4223,
+    0.43360000000000004,
+    0.4181,
+    0.5680999999999999,
+    0.44630000000000003,
+    0.4105,
+    0.3995,
+    0.43829999999999997,
+    0.4223,
+    0.4192,
+    0.4153,
+    0.5199999999999999,
+    0.4115,
+    0.482,
+    0.5616,
+    0.417,
+    0.4108,
+    0.412,
+    0.3987,
+    0.4224,
+    0.5749000000000001,
+    0.39780000000000004,
+    0.40240000000000004,
+    0.4188,
+    0.39809999999999995,
+    0.3923,
+    0.532,
+    0.44880000000000003,
+    0.5005,
+    0.4576,
+    0.4341,
+    0.5256,
+    0.4138,
+    0.5062000000000001,
+    0.4152,
+    0.3983,
+    0.5354,
+    0.4163,
+    0.5561999999999999,
+    0.7023,
+    2.0184,
+    0.483,
+    0.5897,
+    0.5286,
+    0.4496,
+    0.41750000000000004,
+    2.5051,
+    0.4249,
+    0.8365999999999999,
+    0.5505,
+    0.4127,
+    0.5488999999999999,
+    0.47009999999999996,
+    0.6473,
+    0.4203,
+    0.6688,
+    0.4081,
+    0.46749999999999997,
+    0.4396,
+    0.4638,
+    0.4878,
+    0.5753,
+    0.8668,
+    0.4817,
+    0.41829999999999995,
+    0.4106,
+    0.482,
+    0.4837,
+    0.3935,
+    0.5321,
+    0.42860000000000004,
+    0.41859999999999997,
+    0.3914,
+    0.3881,
+    0.522,
+    0.4021,
+    0.3938,
+    0.3918,
+    0.38739999999999997,
+    0.5252,
+    0.39740000000000003,
+    0.3877,
+    0.421,
+    0.40850000000000003,
+    0.5257000000000001,
+    0.40299999999999997,
+    0.4779,
+    1.9503000000000001,
+    0.416,
+    0.4799,
+    0.5547,
+    0.41209999999999997,
+    0.4281,
+    0.6578,
+    0.4112,
+    0.704,
+    0.5748,
+    0.4073,
+    3.9541999999999997,
+    0.5597,
+    0.6794,
+    0.46690000000000004,
+    0.4059,
+    0.5046999999999999,
+    0.4214,
+    0.5058,
+    0.4331,
+    0.4039,
+    0.41100000000000003,
+    2.5677,
+    0.4401,
+    0.4058,
+    0.4004,
+    0.4566,
+    0.4249,
+    0.5615,
+    0.3956,
+    0.6221,
+    0.53,
+    0.4347,
+    0.5176999999999999,
+    0.3959,
+    0.4193,
+    0.627,
+    0.42719999999999997,
+    1.1775,
+    0.6066999999999999,
+    0.5718,
+    0.45,
+    0.4439,
+    0.5364,
+    0.5308,
+    0.4416,
+    0.5453,
+    0.4424,
+    0.5058,
+    0.4075,
+    0.46099999999999997,
+    0.5885,
+    0.5032,
+    1.3806999999999998,
+    0.4668,
+    0.5145,
+    0.40959999999999996,
+    0.5816,
+    0.4249,
+    0.3986,
+    0.6983999999999999,
+    2.6059,
+    0.4276,
+    0.5638000000000001,
+    0.5913,
+    0.4168,
+    0.4255,
+    1.4086999999999998,
+    1.5349000000000002,
+    0.4954,
+    0.5483,
+    0.41350000000000003,
+    0.42450000000000004,
+    1.1743999999999999,
+    0.6155,
+    0.48319999999999996,
+    0.6431,
+    0.4142,
+    0.43370000000000003,
+    0.5195,
+    0.3939,
+    0.41609999999999997,
+    0.41619999999999996,
+    0.38949999999999996,
+    1.9449999999999998,
+    0.5754,
+    0.4729,
+    0.5639,
+    0.40719999999999995,
+    1.8393000000000002,
+    0.46490000000000004,
+    0.5271,
+    0.4041,
+    0.5678000000000001,
+    0.5701,
+    0.4301,
+    0.9139,
+    0.4016,
+    0.4486,
+    0.41659999999999997,
+    0.6462,
+    0.7081999999999999,
+    0.6969,
+    0.6972,
+    0.5947,
+    0.4736,
+    0.6512,
+    0.4312,
+    0.4189,
+    0.5238,
+    0.39130000000000004,
+    0.4522,
+    0.4057,
+    0.5138,
+    0.8949,
+    0.9114,
+    0.5758,
+    0.5318999999999999,
+    0.4661,
+    0.4411,
+    1.6324,
+    0.4342,
+    2.5791999999999997,
+    0.4112,
+    0.4033,
+    3.1165,
+    0.424,
+    0.5136000000000001,
+    0.40549999999999997,
+    0.631,
+    0.4153,
+    2.9606,
+    0.4458,
+    0.4709,
+    0.4316,
+    0.4279,
+    0.45790000000000003,
+    0.4303,
+    0.397,
+    1.674,
+    1.2691,
+    0.7015,
+    0.5775,
+    0.5308,
+    0.4457,
+    0.7706,
+    0.7252,
+    0.49720000000000003,
+    0.5576,
+    0.5545,
+    0.4265,
+    0.5495,
+    0.40690000000000004,
+    0.4043,
+    0.3976,
+    0.3864,
+    0.3887,
+    0.4118,
+    0.7454000000000001,
+    0.7821,
+    0.7821,
+    0.627,
+    0.623,
+    0.41590000000000005,
+    0.4231,
+    0.45130000000000003,
+    0.4584,
+    0.5218,
+    0.4885,
+    0.38880000000000003,
+    0.6336,
+    0.4138,
+    0.3964,
+    0.5286,
+    0.4095,
+    0.40440000000000004,
+    0.7086,
+    0.5809,
+    0.6849,
+    0.4264,
+    0.5157,
+    0.4281,
+    0.4668,
+    0.6745,
+    0.7035,
+    0.7287,
+    0.6853,
+    0.415,
+    0.5748,
+    0.42319999999999997,
+    0.3932,
+    0.4022,
+    0.5082,
+    0.39599999999999996,
+    0.42700000000000005,
+    0.4045,
+    0.3875,
+    0.5247999999999999,
+    0.4077,
+    0.4099,
+    0.4001,
+    0.3945,
+    1.2222,
+    0.423,
+    0.4063,
+    0.4059,
+    0.40890000000000004,
+    0.528,
+    0.4066,
+    0.402,
+    0.39530000000000004,
+    0.3986,
+    0.3931,
+    0.48069999999999996,
+    0.4489,
+    0.4098,
+    0.40059999999999996,
+    0.5538000000000001,
+    0.4022,
+    0.4113,
+    0.6244,
+    0.40440000000000004,
+    0.4828,
+    0.40349999999999997,
+    0.4216,
+    0.41800000000000004,
+    0.3955,
+    0.3921,
+    0.5814,
+    0.4569,
+    0.4053,
+    0.47869999999999996,
+    0.4563,
+    0.5081,
+    0.5031,
+    0.44270000000000004,
+    0.6819999999999999,
+    0.44670000000000004,
+    0.42719999999999997,
+    0.5216,
+    0.41619999999999996,
+    0.4459,
+    0.4079,
+    0.5176000000000001,
+    0.4091,
+    0.4403,
+    0.4271,
+    0.399,
+    0.5476,
+    0.4369,
+    1.5406,
+    0.4229,
+    0.5256,
+    0.4348,
+    0.40190000000000003,
+    0.491,
+    0.6232,
+    0.4165,
+    0.5216,
+    0.3937,
+    0.41619999999999996,
+    0.4152,
+    0.40640000000000004,
+    0.5112,
+    0.381,
+    0.38230000000000003,
+    0.5358,
+    0.4103,
+    0.3923,
+    0.3892,
+    0.4074,
+    0.5296,
+    0.40900000000000003,
+    0.419,
+    0.3923,
+    0.4018,
+    0.518,
+    0.3943,
+    0.443,
+    0.3878,
+    0.3998,
+    0.39120000000000005,
+    0.4237,
+    0.5232,
+    0.3859,
+    0.4138,
+    0.4401,
+    0.4011,
+    0.39530000000000004,
+    0.4001,
+    0.3907,
+    0.4242,
+    0.5098,
+    0.3998,
+    0.5058,
+    0.4314,
+    0.388,
+    0.3998,
+    0.3986,
+    0.5114,
+    0.3856,
+    0.39490000000000003,
+    0.4326,
+    0.4249,
+    0.5303,
+    0.3922,
+    0.3905,
+    0.4299,
+    0.3973,
+    0.47409999999999997,
+    0.38939999999999997,
+    0.5234000000000001,
+    0.4118,
+    0.4851,
+    0.4848,
+    0.4082,
+    0.4038,
+    0.48410000000000003,
+    0.4568,
+    0.4204,
+    0.7379,
+    0.7857,
+    0.7318,
+    0.9344,
+    0.9292,
+    0.883,
+    0.8180000000000001,
+    0.7191,
+    1.4266999999999999,
+    0.43629999999999997,
+    0.5381,
+    0.4556,
+    0.6560999999999999,
+    0.5197999999999999,
+    0.4394,
+    0.46309999999999996,
+    0.5307000000000001,
+    0.42319999999999997,
+    0.4075,
+    0.3964,
+    0.5482,
+    0.3926,
+    0.388,
+    0.4299,
+    0.44499999999999995,
+    0.7485999999999999,
+    0.44470000000000004,
+    0.40759999999999996,
+    0.5051,
+    0.3889,
+    0.5062000000000001,
+    0.40700000000000003,
+    0.4002,
+    0.3934,
+    0.3889,
+    0.5202,
+    0.40049999999999997,
+    0.40650000000000003,
+    0.3976,
+    0.4211,
+    0.4279,
+    0.5324,
+    0.40059999999999996,
+    1.4782,
+    0.6034999999999999,
+    0.43679999999999997,
+    0.4105,
+    0.408,
+    0.7263000000000001,
+    0.4593,
+    0.6996,
+    0.4271,
+    0.5413,
+    0.3998,
+    0.4329,
+    0.7967,
+    0.9076000000000001,
+    0.8878,
+    0.4333,
+    0.431,
+    0.8344999999999999,
+    1.1369,
+    0.42410000000000003,
+    0.4025
+  ],
+  "debug": {
+    "mean_ms": 0.967733333333333,
+    "p50_ms": 0.8194,
+    "p95_ms": 1.6146,
+    "samples": 480
+  },
+  "debug_samples_ms": [
+    0.8167,
+    0.7293,
+    0.9592,
+    0.8642,
+    0.7673,
+    0.8222,
+    0.7207,
+    0.7231,
+    0.8286,
+    0.7298,
+    0.8266,
+    0.7201,
+    0.7448,
+    0.8205,
+    0.7162,
+    1.0768,
+    0.8357,
+    0.7537,
+    0.8582000000000001,
+    0.7343999999999999,
+    0.7179000000000001,
+    4.9764,
+    0.8008,
+    0.8557,
+    0.7527,
+    0.9688,
+    0.8746999999999999,
+    0.727,
+    0.8711,
+    0.7105,
+    0.7215,
+    0.8220000000000001,
+    0.7176,
+    0.8272,
+    0.7191,
+    0.9924999999999999,
+    0.9016000000000001,
+    0.7423,
+    1.2084000000000001,
+    0.8556,
+    0.7384,
+    0.7409,
+    0.7081999999999999,
+    0.8427,
+    0.8474,
+    0.7284,
+    0.7603,
+    3.1463,
+    1.6184999999999998,
+    1.1203999999999998,
+    0.8165,
+    1.4208,
+    0.924,
+    0.85,
+    0.7396,
+    0.8244,
+    0.9145,
+    0.7588,
+    0.812,
+    1.0149,
+    0.7919,
+    0.9867999999999999,
+    0.8725999999999999,
+    0.7468,
+    0.8335,
+    1.1976,
+    0.9091,
+    0.7374999999999999,
+    0.8851,
+    1.9234,
+    1.1454,
+    1.2746000000000002,
+    1.474,
+    0.7353000000000001,
+    0.8841,
+    0.9075,
+    0.7607999999999999,
+    0.8289000000000001,
+    0.8323999999999999,
+    0.8009000000000001,
+    0.8202,
+    0.7681,
+    0.8252999999999999,
+    0.8329,
+    0.7232999999999999,
+    0.8313,
+    0.7251,
+    0.8301,
+    0.7288,
+    0.7092,
+    0.8169,
+    0.7212,
+    0.882,
+    0.7234,
+    0.7201,
+    3.2547,
+    0.7303000000000001,
+    0.9255,
+    0.755,
+    0.7154,
+    0.9,
+    0.8394,
+    0.7272,
+    0.9393,
+    0.8936000000000001,
+    0.733,
+    6.3655,
+    2.8007,
+    0.8151999999999999,
+    0.7929999999999999,
+    0.8479,
+    1.1844,
+    0.8132,
+    0.9790000000000001,
+    0.8571,
+    0.7755000000000001,
+    0.8656,
+    0.73,
+    0.7969999999999999,
+    0.8276,
+    0.7308,
+    0.883,
+    0.7273,
+    0.8855,
+    0.7218,
+    0.7303999999999999,
+    0.8796999999999999,
+    0.9757,
+    2.321,
+    0.7583,
+    0.7388,
+    0.8352,
+    0.7089000000000001,
+    1.1594000000000002,
+    0.9188999999999999,
+    1.6146,
+    7.5508,
+    0.8053,
+    1.2301,
+    0.7657,
+    1.4819,
+    1.0386,
+    0.7665000000000001,
+    0.7372000000000001,
+    0.7472,
+    0.9138,
+    0.782,
+    0.8009999999999999,
+    0.9136,
+    0.9881,
+    0.846,
+    0.7302,
+    0.7045,
+    0.7411,
+    0.8925,
+    0.7107,
+    3.5707,
+    0.7821,
+    0.8599,
+    0.8071,
+    0.7342,
+    0.8309,
+    0.7102999999999999,
+    2.6215,
+    0.8529,
+    0.7293,
+    0.7728,
+    0.8239000000000001,
+    1.3806,
+    3.0549,
+    1.4774,
+    1.4057,
+    1.4697,
+    0.8741000000000001,
+    1.2217,
+    0.8339000000000001,
+    0.7242000000000001,
+    0.8094,
+    0.7016,
+    0.8065,
+    0.7062999999999999,
+    1.1670999999999998,
+    0.7271,
+    1.4295,
+    0.7381,
+    2.2805,
+    1.673,
+    0.7472,
+    0.7219,
+    3.197,
+    0.7538999999999999,
+    0.8595999999999999,
+    0.7359,
+    0.8168,
+    0.7067,
+    0.7971,
+    2.1982999999999997,
+    1.2154,
+    1.27,
+    3.3795,
+    1.1157000000000001,
+    0.7726999999999999,
+    0.8442000000000001,
+    0.8882,
+    0.7017,
+    0.7211,
+    1.2641,
+    0.8506,
+    0.723,
+    3.8099000000000003,
+    1.1316,
+    1.0410000000000001,
+    0.8524999999999999,
+    1.0685,
+    0.7464999999999999,
+    0.8846999999999999,
+    1.0812,
+    1.107,
+    1.093,
+    1.1158,
+    0.7374,
+    1.5673,
+    1.0413,
+    0.8394999999999999,
+    0.7274,
+    0.8664000000000001,
+    1.0905,
+    0.7726000000000001,
+    1.5097,
+    0.9828,
+    0.9055,
+    0.7475,
+    0.9872,
+    0.9333,
+    0.8344999999999999,
+    0.7199,
+    1.4668,
+    2.1616999999999997,
+    1.0192999999999999,
+    0.7895000000000001,
+    1.8851,
+    1.3231,
+    1.2965,
+    0.7644000000000001,
+    0.7393000000000001,
+    0.9441,
+    0.7245,
+    0.7081000000000001,
+    0.8285,
+    0.7283,
+    0.8108,
+    0.7171000000000001,
+    0.7234999999999999,
+    0.7841,
+    1.0449000000000002,
+    1.0277,
+    1.0941,
+    1.2095,
+    1.158,
+    0.8891,
+    0.7197,
+    0.882,
+    0.7267,
+    0.7133,
+    0.7043,
+    0.727,
+    0.7603,
+    0.8140000000000001,
+    0.8274,
+    0.7349,
+    0.723,
+    0.8446,
+    0.9939,
+    0.9430999999999999,
+    1.2679,
+    0.8774,
+    0.7139,
+    0.7448999999999999,
+    0.7282000000000001,
+    0.7496,
+    1.2924,
+    1.2619,
+    1.2734999999999999,
+    0.8732,
+    0.9319000000000001,
+    0.7432,
+    0.842,
+    0.7283,
+    0.7115,
+    0.8179,
+    0.7108,
+    0.8030999999999999,
+    0.7085,
+    0.7425,
+    0.9125,
+    0.7362,
+    0.8239000000000001,
+    0.7027,
+    0.7646000000000001,
+    0.841,
+    0.727,
+    0.8307,
+    0.7421,
+    0.7456,
+    0.8228000000000001,
+    0.7144,
+    0.8956,
+    0.7155,
+    0.8194,
+    1.1168,
+    0.8448,
+    0.7318,
+    0.8819,
+    0.7425,
+    0.7328,
+    0.8884,
+    0.7295999999999999,
+    0.7747,
+    0.8804000000000001,
+    0.7343999999999999,
+    1.1522,
+    0.9186,
+    0.7333,
+    0.8239000000000001,
+    0.8241999999999999,
+    0.759,
+    0.861,
+    0.7278,
+    0.8876,
+    0.7179000000000001,
+    0.7827,
+    0.8582000000000001,
+    0.7512000000000001,
+    1.0376,
+    0.8305,
+    0.7426,
+    0.7012999999999999,
+    0.8982,
+    0.7402,
+    0.7324,
+    0.8277,
+    0.7297,
+    0.8775000000000001,
+    0.7464999999999999,
+    0.7191,
+    1.0924,
+    0.8524999999999999,
+    0.7319,
+    0.7194,
+    0.8802,
+    0.7388,
+    1.2646,
+    0.8413,
+    0.7404999999999999,
+    0.7242000000000001,
+    0.8245,
+    0.725,
+    0.8404,
+    0.7255,
+    0.7195,
+    0.7114,
+    0.8140000000000001,
+    0.7406,
+    0.7184,
+    0.8338,
+    0.7412,
+    0.8614,
+    0.7208,
+    0.7693,
+    0.8305,
+    0.7565000000000001,
+    0.8252,
+    0.7134,
+    0.7383,
+    0.8237,
+    0.7262,
+    0.8196,
+    0.7092,
+    0.8099,
+    0.7102999999999999,
+    0.7117,
+    0.837,
+    0.7314,
+    0.8402000000000001,
+    0.8168,
+    0.7099,
+    0.8225,
+    0.7115,
+    0.713,
+    0.7081999999999999,
+    0.7036,
+    0.8197,
+    0.7163,
+    0.8418,
+    0.7012,
+    0.7218,
+    0.8236,
+    0.7665000000000001,
+    0.8529,
+    0.759,
+    0.7396,
+    0.8301,
+    0.7272,
+    0.828,
+    0.7037,
+    0.7199,
+    0.7303999999999999,
+    1.0776,
+    0.8279,
+    0.8061,
+    0.7394,
+    0.7934,
+    0.805,
+    0.8004,
+    0.9452,
+    0.791,
+    1.0659,
+    1.2731000000000001,
+    1.2185,
+    1.1789,
+    1.4793,
+    1.3232000000000002,
+    1.3123,
+    1.1511,
+    4.9007,
+    1.9954999999999998,
+    0.7574,
+    0.7156,
+    1.063,
+    0.7659,
+    0.7311000000000001,
+    0.8957,
+    0.9449000000000001,
+    0.7726999999999999,
+    0.7187,
+    0.7123,
+    0.7200000000000001,
+    0.8279,
+    0.7073,
+    0.7967,
+    0.785,
+    0.7429,
+    0.8313,
+    0.7189,
+    0.7351000000000001,
+    0.7239,
+    0.7041000000000001,
+    0.8423,
+    0.7414999999999999,
+    0.8124,
+    0.7135,
+    0.7106,
+    0.8559,
+    0.7453,
+    0.9529,
+    0.7197,
+    0.8180000000000001,
+    0.7674,
+    0.7205,
+    0.8537,
+    1.0651,
+    0.862,
+    0.7998000000000001,
+    0.8413,
+    0.7829,
+    0.7494999999999999,
+    0.9843000000000001,
+    1.0847,
+    0.7273,
+    0.7253999999999999,
+    0.8928,
+    0.722,
+    1.1499,
+    1.1878,
+    0.8394,
+    0.8515,
+    1.642,
+    1.8285,
+    0.7554000000000001,
+    0.8442999999999999
+  ],
+  "debug_span_count_max": 14,
+  "debug_span_count_min": 14,
+  "files": 1000,
+  "kind": "prepared_sqlite_trace_overhead",
+  "limits": "tiny warm lexical corpus; harness serial/no model/media/GPU; other VM work including native photo inference may contend; not isolated production performance",
+  "measurement": "outer Rust call including metrics assembly; excludes fixture setup/JSON serialization",
+  "os": "windows",
+  "production_claim": false,
+  "profile": "release",
+  "queries": 24,
+  "repetitions": 20
+}