diff --git a/docs/legal-and-assets.md b/docs/legal-and-assets.md
index cccba14..4d10a81 100644
--- a/docs/legal-and-assets.md
+++ b/docs/legal-and-assets.md
@@ -9,14 +9,18 @@ The engine is MIT. It ships **no** Microsoft or Lernout & Hauspie IP and **no**
 - These are Microsoft's copyrighted works. Use them at your discretion; we don't redistribute them. Store them locally under a gitignored `fixtures/raw/` path.
 
 ## 2. Speech runtime — for the authentic voice (Cycle 5+)
-The authentic Genie voice is the **L&H TruVoice** synthesizer driven by the **Microsoft Speech API 4 (SAPI4)** runtime. Both are closed Win32 binaries — they cannot run natively in a browser, which is *why* the voice lives in a Wine-based service. You need two installers inside the Wine prefix:
-- **`spchapi.exe`** — Microsoft Speech API 4.0 runtime.
-- **`tv_enua.exe`** — L&H TruVoice American English TTS engine (this is the one that holds Genie's "Adult Male" voice and friends).
+The authentic Genie voice is the **L&H TruVoice** synthesizer driven by the **Microsoft Speech API 4 (SAPI4)** runtime — closed Win32 software that can't run natively in a browser, which is *why* the voice lives in a Wine-based service. You supply **three** files, all under the gitignored `services/voice-server/vendor/`:
+- **`spchapi.exe`** — Microsoft Speech API 4.0 runtime (a closed Win32 installer).
+- **`tv_enua.exe`** — L&H TruVoice American English TTS engine (the closed Win32 installer that holds Genie's "Adult Male" voice and friends).
+- **`sdk/include/speech.h`** — the **SAPI4 SDK header** the build needs to compile the voice bridge (the small C++ program that talks to the engine). Drop it at `services/voice-server/vendor/sdk/include/speech.h`. It carries `Copyright 1994-1998 Microsoft Corporation. All rights reserved.`, so it gets the **same posture as the binaries**: user-supplied, never committed or redistributed by us, and never auto-fetched by the build (see ADR-0006 and ADR-0027).
+
+The first two are installed into the Wine prefix; the third is a source header used only at build time. The image build **fails loudly, naming the exact drop path**, if `speech.h` is missing.
 
 ### Where to get them
-- **TETYYS/SAPI4** (`github.com/TETYYS/SAPI4`) — a working reference that installs exactly these two into Wine and exposes TTS over HTTP. Start here; it documents the install commands and which files you need. We extend its approach to also capture the mouth/viseme timeline.
+- **TETYYS/SAPI4** (`github.com/TETYYS/SAPI4`) — a working reference that installs the two runtime binaries (`spchapi.exe` + `tv_enua.exe`) into Wine and exposes TTS over HTTP. Start here; it documents the install commands and which files you need. We extend its approach to also capture the mouth/viseme timeline.
 - **LouisGameDev/Microsoft-Sam-Mary-Mike-TruVoice-WSAPI4** — an archive of the Windows Speech API 4 SDK and the TruVoice voices, confirmed working under Wine.
 - **Wayback Machine** for `tv_enua.exe` directly: `http://web.archive.org/web/20000816050308/http://activex.microsoft.com:80/activex/controls/agent2/tv_enua.exe`.
+- **`speech.h`** ships inside the **SAPI4 SDK** — it's part of the Windows Speech API 4 SDK in the **LouisGameDev** archive above, and in community SAPI4 SDK mirrors (e.g. the SAPI4 SDK headers carried in the **miranda-ng** sources). As with the binaries, we don't hot-link the proprietary header; pull it from the SDK at your own discretion.
 
 We do **not** need the Microsoft Agent runtime (`msagent.exe`) at all — we reimplement the character engine. Only the *speech* pieces are required, and only for the authentic-voice path.
 
@@ -27,5 +31,5 @@ Not shipped, not redistributed — local dev tools to validate our parser agains
 
 ## Posture summary
 - MIT engine + tooling: ours, shipped.
-- `.acs` files, SAPI4/TruVoice binaries, Wine prefix, extracted Microsoft bitmaps/sounds: **never committed**, user-supplied, gitignored.
+- `.acs` files, SAPI4/TruVoice binaries, the SAPI4 SDK header (`speech.h`), Wine prefix, extracted Microsoft bitmaps/sounds: **never committed**, user-supplied, gitignored.
 - This keeps the repo permissively licensable and clean for developers to adopt.