Add local spoken passages with Google retrieval and isolated runtime setup

crates/searchi-service/README.md

@@ -48,3 +48,48 @@ a separate durable metadata epoch so warmed readers cannot retain old eligibilit
 They do not change source-corpus revisions during the indexer's own probe publication.
 Empty metadata-only hybrid requests use core results without model inference.
 These explicit constraints do not establish abstention for free-form topic queries.
+
+## Optional speech evidence
+
+Attach a verified `searchi_speech::SpeechWorker` through `with_speech_provider`.
+`BudgetedSpeechProvider` admits one background thread per contiguous window;
+its admission time remains separate from native VAD/ASR/load/transport metrics.
+Aborted acceleration and CPU retry cost is aggregated separately as `fallback_us`.
+Recognition consumes at most thirty seconds of mono 16-kHz PCM, with two-second
+window overlap and an explicit 1024-window source ceiling. Four-hour default
+media fits the contiguous policy. Recognition never receives reference captions.
+
+Speech uses `decode_audio_aligned`: source-frame timestamps preserve positive
+track origins, internal gaps, seeks and tails. Its CPU FFmpeg regression compares
+actual samples against known fixture clocks. Raw Google audio preprocessing is
+unchanged. DTW first/last point spans may have equal start/end; no invented duration
+is added. These functional contracts do not prove general timestamp accuracy.
+
+Raw media, speech and document passages have independent completed source tasks.
+Adding/upgrading speech or retrying its failures reuses compatible verified raw
+vectors. Speech task identity includes native recognition assets/policy, aligned
+decoder policy, input SHA-256, title, maximum duration and maximum file bytes;
+raw sampling changes do not force speech recognition. Failed speech tasks publish
+explicit partial coverage while retaining raw evidence, and remain retryable.
+A genuine Google inference failure still aborts semantic publication.
+
+`SpeechProvider` returns bounded recognized passages and numeric metrics. Google
+EmbeddingGemma 2 alone embeds those passages. Spoken-intent requests prefer
+`semantic_speech`, falling back to raw audio; music and sound requests use audio.
+Source locations retain `timestamp_ms`; recognized snippets are identified as
+`local_speech_recognition`, not exact document bytes. `speech_excerpt_matching`
+binds an issued result's recognized text when timestamps repeat, verifies current
+media SHA-256/revision and serves only active indexed evidence.
+
+`speech_policy_key` and `EmbeddingStatus.corpus_revision` provide the stable
+(policy, source revision) automatic-retry key. Generation IDs and metadata-only
+updates must not trigger an endless retry loop. Status includes active speech
+policy and bounded explicit failures. Native interaction, full speech quality,
+other-platform execution and GPU evidence remain separate release gates.
+
+Actual ASR/Google integration is an explicit ignored test:
+`cargo test -p searchi-service --test speech_google_cpu -- --ignored --nocapture --test-threads=1`.
+Provide verified `SEARCHI_SPEECH_WORKER`, `SEARCHI_SPEECH_BASE`, `SEARCHI_SPEECH_VAD`,
+Google model/worker variables, CPU FFmpeg/FFprobe helpers and a real short WAV in
+`SEARCHI_TEST_SPEECH_AUDIO`; Windows VM execution requires `SEARCHI_FORCE_CPU=1`.
+This tests publication/reuse and evidence binding, not independent relevance.