Verify genuine Google music constraints and separate metadata cache revisions

docs/MEDIA-CONSTRAINTS.md

@@ -0,0 +1,56 @@
+# Exact music identity filters
+
+The current source supports exact `media_artist` and `media_title` constraints
+in the desktop filter panel, CLI and read-only MCP. They compare genuine probed
+full tag fields using Unicode lowercase and trimmed outer whitespace. Both
+constraints combine with existing filters before lexical and ANN candidate
+limits; comment text cannot impersonate an artist or title.
+
+A metadata-only request can omit query text. It returns a bounded stable list
+without query inference. Missing tags yield no match, including in semantic
+search. This is a narrow, explicit constraint, not general natural-language
+no-answer detection. Blank or over-1024-byte request fields fail explicitly;
+oversized genuine tags remain keyword-searchable but have no exact identity key.
+
+SQLite schema 14 preserves legacy keyword tags without guessing structured
+identities from flattened text. Existing music needs a media indexing pass to
+populate the new fields. A separate durable metadata epoch refreshes filtered eligibility without changing
+the source-corpus snapshot during indexing. Metadata revision guards, same-stat event invalidation,
+deletions and eligibility-cache invalidation retain source freshness.
+
+CLI examples:
+
+```sh
+searchi search --db /path/to/index.db --media-artist "Nina Simone"
+searchi search --db /path/to/index.db --media-title "Feeling Good"
+searchi search --db /path/to/index.db "live recording" --media-artist "Nina Simone"
+```
+
+Replace `/path/to/index.db` with your existing media-indexed database. The desktop controls are **Artist (exact)** and
+**Track title (exact)**. v0.1.4 downloads predate these additions.
+
+Windows CPU checks: the full ordinary workspace suite passed (asset-dependent
+checks remain explicitly ignored). Shared migration/lifecycle/eligibility tests, five CLI unit
+tests including real MCP response, 48 native desktop tests and 61 frontend tests
+passed. Strict workspace/CLI/native Clippy and formatting passed; frontend build
+passed. Native visual interaction remains unexecuted. Actual Google CPU integration also passed in 58.59 seconds (whole test, not
+search latency): two owned two-second 16 kHz mono PCM WAVs carried real
+artist/title tags and identical audio. The initial generation made two actual
+audio encodes. Query-role semantic and hybrid searches with limit one returned
+the eligible file, absent artist/field-collision constraints returned empty,
+metadata-only traces contained no query embedding, and same-stat invalidation,
+actual media refresh and deletion remained correct with warmed readers.
+
+The normal auto worker was forced to CPU with one thread. Its SHA-256 was
+`c01cb3ec13cfca722ee768e8350e1399a8b9a4d14a24a35adc3473a5cfc82a73`.
+The first integration run failed because metadata publication advanced the
+source-corpus revision; the separate metadata epoch corrected this, and the
+rerun passed. Service tests and strict workspace Clippy passed after the fix.
+This tiny identity-contract test does not measure music understanding or general
+no-answer quality.
+
+Reproduce with verified assets/helpers and `SEARCHI_FORCE_CPU=1`:
+
+```sh
+cargo test -p searchi-service --test media_constraints_google_cpu --locked -- --ignored --nocapture --test-threads=1
+```

docs/MUSIC-METADATA.md

@@ -0,0 +1,76 @@
+# Music metadata hypothesis: actual Google CPU diagnostic
+
+This known two-file diagnostic compares real audio evidence with real embedded
+metadata. It does **not** change production ranking or establish independent
+music quality, general abstention, or a higher media rating.
+
+The preserved v1 run encoded eleven default audio windows and two whole-tag
+passages. Adding the whole passage left music memories at **2/4 first hits**:
+the violin's English similarity increased, but stayed below the wrong piano.
+
+The subsequent v2 policy was frozen in source commit `7055004` before inference.
+It encodes artist, title, album, genre and composer separately, in fixed order
+with a shared 2048-byte UTF-8 budget and the neutral document title `File metadata`.
+The file score is the maximum of its actual evidence, with no weights or cutoff.
+This is a hypothesis motivated by v1, not untouched held-out testing.
+
+## Recomputed results
+
+All 65 original queries remain in the report. Three filter queries are explicitly
+unsupported. Among 62 executed queries, only seven positive queries name one of
+the two candidates; 50 positives name files outside this deliberately limited
+pool and cannot receive a quality score. Five unfiltered no-answer queries remain.
+
+| Two-file diagnostic | Audio only | Whole tags v1 | Individual fields v2 |
+| --- | ---: | ---: | ---: |
+| Music memories: correct first file | 2/4 | 2/4 | 4/4 |
+| Music identity queries: correct first file | 2/3 | 2/3 | 3/3 |
+| All eligible positives: correct first file | 4/7 | 4/7 | 7/7 |
+| Eligible positives: recall within first five | 7/7 | 7/7 | 7/7 |
+| Eligible positive MRR | 0.786 | 0.786 | 1.000 |
+| No-answer queries returning candidates, failure | 5/5 | 5/5 | 5/5 |
+
+The first-hit gains are `q049`, `q050` and `q056`, with no scored positive
+regression. English violin selected the literal composer field
+`Violinist WTD/LPC Jazz Band` (cosine 0.73714); German violin selected the actual
+title `Jazz Violin Solo` (0.73508). Their wrong piano audio maxima were 0.68972
+and 0.70654 respectively. The piano memories retained their original audio hits.
+
+This improvement also strengthens unrelated nearest neighbors: the purple-elephant
+violin negatives increased by 0.04994 and 0.04801 cosine, and the German quantum
+entanglement negative by 0.00749. All negatives still return files. Consequently,
+the diagnostic provides **no abstention improvement** and no safe rejection
+threshold. Metadata is useful evidence, not a calibrated confidence score.
+
+## Inputs, execution and limits
+
+The actual piano tags identify Kimiko Ishizaka, Goldberg Variation 13, Classical
+and J.S. Bach. The violin tags identify Violinist WTD, Jazz Violin Solo, Jazz and
+the LPC Jazz Band. No instrument descriptions were generated from the waveform.
+Blank/missing whitelisted fields add no vector; encoder, comments, URLs and
+copyright are excluded. Misleading tags remain unverified literal evidence.
+Metadata citations have a field and text, never an invented playback timestamp.
+
+V2 used actual Google EmbeddingGemma 2 Q8 through the same native
+`b11461-no-logits-v1` worker on CPU, one thread, 768 dimensions and a 2048-token
+indexing context. Ten field encodes took **750.03 ms**, excluding model startup
+and query inference. It made **zero audio inference calls**: per-query audio
+maxima were reused verbatim from the SHA-verified v1 report. Independent read-only
+recomputation checked query equality and exact retained audio/whole-tag rankings
+for all 62 executed rows. This tiny shared-VM measurement is not a throughput
+guarantee or a production ANN/hybrid measurement.
+
+- Frozen v2 plan SHA-256:
+  `566bcd608ccf898abaceab32b247786e895368c8428b1bfa6e0bbb8396211b05`.
+- Preserved v1 report SHA-256:
+  `f985ba639a14b8c0288b8fa7812d580f179f31c8cad0c21d67531c8a4fddc5b6`.
+- Ignored v2 report `.searchi/qa/music-fields-v2-results.json`, 288944 bytes,
+  SHA-256 `c13ceca2150059a21e10ee190893a66f5ac82570675e7725e54524c660a2ff30`.
+
+Reproduction commands and structural tests are in the
+[evaluation tool README](../tools/media-eval/README.md). Before deployment,
+evaluate independently frozen unseen music, missing/misleading metadata, additional
+instrument/style hard negatives and the complete mixed candidate pool. Production
+integration must retain real metadata field citations, source-byte/revision guards,
+strict filters and generation policy invalidation. The broader
+[media quality gates and experimental rating](MEDIA-QUALITY.md) remain unchanged.

docs/ROADMAP.md

@@ -12,8 +12,24 @@ timestamps and irrelevant results when the requested content is absent. The
 million-record lexical benchmark is deferred while this quality work proceeds.
 Google EmbeddingGemma 2 remains the main text/image/audio/video search model.
 
-- [ ] Evaluate actual whitelisted music metadata as additional Google text evidence, retaining raw audio and real metadata source citations.
-- [ ] Evaluate finer local ASR token/word timing and source-preserving phrase windows with Google text retrieval; preserve every competitor and reject invalid timestamps.
+- [x] Run frozen actual Google music metadata diagnostics: separate fields improved
+  known two-file music memories from 2/4 to 4/4; no-answer remained 5/5 failing.
+  This is hypothesis evidence, not independent production validation.
+  See [music evidence](MUSIC-METADATA.md).
+- [ ] Validate and integrate metadata embeddings on independent unseen music and
+  the full mixed pool with real field citations and stale-source guards.
+- [x] Implement exact artist/title constraints in shared storage, lexical/ANN
+  eligibility, CLI/MCP and desktop controls; metadata-only search skips inference.
+  Unit/lifecycle evidence is recorded separately from actual model validation.
+- [x] Actual Google CPU constraint integration passed with genuine tagged WAVs,
+  semantic/hybrid limit-one retrieval, empty absent identities, no-inference
+  metadata lookup and warmed lifecycle refresh; see [evidence](MEDIA-CONSTRAINTS.md).
+- [ ] Package and install an updated desktop release with these exact filters.
+- [ ] Evaluate finer local ASR token/word timing and source-preserving phrase windows
+  with Google text retrieval. Ordinary-token run completed but failed interval
+  validation; DTW run stopped on invalid native UTF-8 and remains incomplete.
+  Neither receives an accepted score. Future diagnostics retain bounded failing
+  raw bytes and atomic checkpoints; see tools/speech-eval/README.md.
 - [ ] Validate richer no-answer evidence on new independent positive/negative data; do not retune the failed universal cosine cutoff on old held-out results.
 - [ ] Integrate accepted improvements into shared engine/UI/headless clients with verified setup, lifecycle and CPU performance evidence. Diagnostics alone do not raise the media quality rating.
 - [x] Publish v0.1.0 Windows installer/checksum, verify public download bytes,