Merge pull request 'feat(config): config.toml v2→v3 스키마 재편 — 미디어 [ingest.*] 통합 + 무손실 자동 마이그레이션' (#207) from feat/config-schema-reorg into main

Reviewed-on: #207

.gitattributes

@@ -0,0 +1,6 @@
+# PP-OCRv5 ONNX OCR models (paddle-onnx engine). git-lfs is not installed on
+# this host, so they are committed as plain binary blobs (treated as binary —
+# no textual diff/merge). If/when git-lfs becomes available, migrate with
+# `git lfs migrate import --include='*.onnx'` and restore the filter line:
+#   *.onnx filter=lfs diff=lfs merge=lfs -text
+*.onnx -text

CLAUDE.md

@@ -82,7 +82,10 @@ Release 절차:
 
 1. `gitea-release v<X.Y.Z>` (gitea-ops skill) 으로 tag + push + release notes.
 2. release notes 는 사용자 도그푸딩에 영향이 가는 surface 변경을 위주로 — wire schema 추가, CLI flag 신규, TUI 키 변경, V00X migration 등 — 다룬다. 이때 추가된 기능과 변경사항은 유저가 이해할 수 있도록 친절하고 자세하게 풀어서 설명해야 하며, 단순히 commit subject 를 나열하는 형태로 끝내면 안 된다. 필요하다면 도그푸딩이나 테스트 결과도 함께 적어 둔다.
-3. 프리-1.0 (`0.x.y`) 단계: minor bump 시 wire schema additive / surface 변경 누적, patch bump 시 bug fix only.
+3. 프리-1.0 (`0.x.y`) 단계 bump 규칙 — **기능(behavior) 또는 인터페이스(interface) 변경 여부**로 판정:
+   - **minor bump** (`0.x.0`): 기능 또는 인터페이스에 *실질적* 변경이 있을 때. 인터페이스 = 신규/변경/삭제된 CLI subcommand·flag, config 키, wire schema 의 **breaking** 변경, 임베딩/검색/RAG 등 사용자가 받는 **결과·동작**의 변화, V00X migration, frozen 설계 변경. 기능 = 새 source 형식·검색 모드·백엔드 등 *할 수 있는 일*의 추가/변경.
+   - **patch bump** (`0.x.y`): 기능·인터페이스 변경이 **없을** 때. bug fix, 내부 refactor, 성능 개선, 로깅/진행표시 등 **관측성(observability) 개선**, **additive-only wire 변경**(backward-compat 신규 필드/이벤트라 기존 소비자 무영향), 문서. ← 즉 "결과가 같고 새 명령/플래그/config 도 없으면 patch".
+   - 경계 예: 진행 로그에 phase/파일명 추가 + additive wire 이벤트(asset_phase) = **patch** (검색·색인 결과 불변, 새 명령/플래그/config 없음). arctic 임베더 provider + 신규 config 키 = **minor** (인터페이스 추가). 별칭 기능 제거 + migration = **minor** (동작·인터페이스 변경).
 
 **bump 시점 = release 시점 같은 commit**. 즉 commit `chore: bump version 0.x → 0.y` 직후 같은 commit 에 tag. v0.1.0 (`2319206`) 처럼 bump 없이 tag 만 찍는 패턴은 후속 release 가 대상 commit 을 헷갈리게 함 — pre-release snapshot 은 SHA reference 로 충분.
 

Cargo.toml

@@ -11,6 +11,8 @@ members = [
     "crates/kebab-search",
     "crates/kebab-embed",
     "crates/kebab-embed-local",
+    "crates/kebab-embed-candle",
+    "crates/kebab-embed-ollama",
     "crates/kebab-llm",
     "crates/kebab-llm-local",
     "crates/kebab-rag",
@@ -30,7 +32,7 @@ edition       = "2024"
 rust-version  = "1.85"
 license       = "MIT OR Apache-2.0"
 repository    = "https://github.com/altair823/kebab"
-version       = "0.21.0"   # v0.21.0 — doc-side expansion 별칭(개별 dense 벡터) + 파생물 캐시(V012, 내용 해시 키) — CLAUDE.md §Release 도그푸딩 트리거
+version       = "0.28.0"   # v0.28.0 — config 스키마 v2→v3 재편: 미디어 형식 설정을 `[ingest.*]` 우산으로 통합(`[indexing]`→`[ingest]` 스칼라, `[chunking]`/`[image.ocr]`/`[image.caption]`/`[pdf.ocr]`→`[ingest.*]`). 기존 v2 파일은 load 시 메모리 자동 변환(디스크 미변경), 파일 갱신은 `kebab config migrate`(값·주석 보존). env 이름(LHS) 100% 보존 + RHS 만 새 경로, 신규 `KEBAB_PDF_OCR_{DET_MODEL,REC_MODEL,DICT,SCORE_THRESH,UNCLIP_RATIO,MAX_BOXES}`. `ingest_config_signature` 바이트 불변(재색인 0). PdfOcrCfg paddle 대칭 키. 신규 인터페이스(config 레이아웃 rename + env 추가) → minor. — CLAUDE.md §Release
 
 # pre-v0.18 workspace-wide cleanup: enable clippy::pedantic group with
 # intentional allow-list. The allowed lints are either cosmetic (doc style),

HANDOFF.md

@@ -30,8 +30,16 @@ P0~P5 직렬. P6~P9 P5 이후 병렬 가능.
 
 ## 머지 후 발견된 버그 / 결정 (요약)
 
+- **candle 임베딩 백엔드 다변화** (2026-06-01, Track 1, v0.22.0): `provider = "candle"` opt-in 추가 — 같은 `multilingual-e5-large` 모델을 순수 Rust(candle)로 돌려 듀얼소켓 NUMA 서버의 onnxruntime 48-스레드 double-free 를 회피. `[models.embedding].num_threads`(+env `KEBAB_EMBED_THREADS`)로 CPU 스레드 캡. fastembed default 동작·벡터 불변, `embedding_version` 유지(재색인 0). Phase 0 스파이크 패리티 cosine 1.000000. 상세 HOTFIXES 동일 일자.
+- **config 마이그레이션** (2026-05-31, PR #198): `kebab config migrate` 추가 — 기존 config.toml 에 빠진 섹션을 주석과 함께 채우고 deprecated 정리(멱등·`.bak`·dry-run, 값/주석 보존). `schema_version` 1→2, `init` 도 섹션 주석 포함, doctor 에 `config_migration` 체크. 상세 HOTFIXES 동일 일자.
+
 머지 후 발견된 모든 deviation / hotfix 의 dated 로그는 [tasks/HOTFIXES.md](tasks/HOTFIXES.md). 본 요약은 \"누군가가 인수받을 때 알아두면 시간을 많이 절약하는\" 항목만:
 
+- **2026-06-04 PP-OCRv5 ONNX Rust 네이티브 OCR** — v0.27.0. `[image.ocr] engine = "paddle-onnx"` 로 PP-OCRv5(검출+인식) ONNX 를 in-process(`ort` =2.0.0-rc.9) 실행 — Python 런타임/원격 호출 없이 큰 페이지 CPU <4초(Ollama vision ~50초 대비). default 는 여전히 `"ollama-vision"`. 후처리(min-area rect/unclip)는 pure-Rust. **함정**: unclip 은 corner 를 centroid 에서 방사 확장하면 안 되고 edge 별 polygon offset 이어야 함(방사 확장 시 wide/short 텍스트 박스 높이가 안 커져 글자 윗부분 잘림 → ㄷ→ㄴ, e2e CER 0.26). 수정 후 CER 0.005. 모델 ONNX 는 `crates/kebab-parse-image/assets/paddleocr-onnx/`(LFS). 자세한 내용: `tasks/HOTFIXES.md` (2026-06-04 PP-OCRv5 ONNX), spec/plan `docs/superpowers/{specs,plans}/2026-06-04-rust-native-ocr-*.md`.
+- **2026-06-03 ingest 설정 변경 자동 재색인** — v0.26.2. ingest 산출에 영향 주는 설정(청킹/이미지 OCR·caption/pdf.ocr/`[ingest.code]`)을 변경하면 `--force-reingest` 없이 영향 자산만 자동 재색인. 그 설정들의 결정적 서명(`ingest_config_signature`)을 effective parser_version(skip 비교 + 저장 doc 필드 양쪽)에 폴딩 → 다음 ingest 비교가 mismatch. 비산출 설정(search/rag/ui/log + max_pixels/languages/timeout)은 제외(과도 무효화 회피), doc_id 는 base 로 안정 유지. **업그레이드 후 첫 ingest 는 전 자산 1회 재색인**(저장된 상수 parser_version ≠ 새 composite; embedding 은 V012 캐시 히트). 결과 포맷·CLI·wire 불변(내부 skip 판정 정정). 자세한 내용: `tasks/HOTFIXES.md` (2026-06-03 ingest 설정 변경 자동 재색인), spec/plan `docs/superpowers/{specs,plans}/2026-06-03-*invalidation*.md`.
+- **2026-06-03 ingest 진행 로그 개선** — v0.26.1. 이미지/PDF + OCR/caption on 볼트 ingest 가 "멈춘 듯" 보이던 문제 해소: TTY 진행바에 현재 파일명 + 느린 phase(ocr/caption/embed)+모델명 + 경과초 `(Ns)` heartbeat, 종료 시 최장 소요 파일 top-5 요약. 신규 wire `asset_phase{idx,total,phase,model}` + `asset_timings.ocr_ms`/`caption_ms`(additive, `ingest_progress.v1` 유지, serde default 0). 이미지·PDF 경로도 `asset_timings` emit(이전 markdown 만). 기본 동작 불변. 자세한 내용: `tasks/HOTFIXES.md` (2026-06-03 ingest 진행 로그), spec/plan `docs/superpowers/{specs,plans}/2026-06-03-ingest-log-improve-*.md`.
+- **2026-06-03 arctic-embed-l-v2.0 임베더 통합** — v0.26.0. 별칭 제거 후 설명형 query recall 보강(측정 recall@10 130/132, e5 +7). `kebab-embed-candle` 모델 레지스트리화(e5 mean + `snowflake-arctic-embed-l-v2.0` CLS, 모델별 pooling/prefix) + 신규 `kebab-embed-ollama`(`provider="ollama"`, `/api/embed`). config `endpoint: Option<String>` 추가. 기본 e5 유지(opt-in), arctic 전환은 embedding_version cascade → 재색인. candle↔Ollama cosine>0.99 게이트로 pooling/prefix 정확성 고정(`#[ignore]`). 자세한 내용: `tasks/HOTFIXES.md` (2026-06-03 arctic), spec `docs/superpowers/specs/2026-06-03-arctic-embedder-spec.md`.
+- **2026-06-03 doc-side expansion(별칭) 기능 완전 제거** — v0.25.0. 아래 2026-05-31 항목의 색인-시 청크당 LLM 별칭 생성 + 별칭 검색 채널을 **전부 제거**(ROI 음수: cross-lingual 은 e5-large 단독으로 충분, 기여는 설명형 +2 그룹뿐인데 대가가 청크당 색인-시 LLM). `Chunk.aliases`/`expansion.rs`/`IngestExpansionCfg`/alias lexical arm/`expansion_progress` wire kind 제거, 신규 마이그레이션 **V013** 이 `chunk_aliases_fts`+`chunks.aliases` DROP. 별칭 default-off 였어 사용자 체감 0, 기존 KB 도 재색인 불요(잔존 별칭 벡터는 `strip_alias_suffix` graceful 매핑/`reset` 정리). `AssetTimings.expansion_ms` 는 wire 호환 위해 값 0 으로 유지. 자세한 내용: `tasks/HOTFIXES.md` (2026-06-03), spec `docs/superpowers/specs/2026-06-03-remove-doc-expansion-spec.md`.
 - **2026-05-31 Phase 2 doc-side expansion 별칭(개별 dense 벡터) + 파생물 캐시(V012)** — v0.21.0 cut. 색인 시 LLM 이 청크별 별칭("같은 의미 다른 표현")을 생성, 줄별 **개별 dense 벡터**(sentinel `{chunk}#alias#N`)로 색인 (묶음 1벡터는 평균화 희석으로 회귀 → 폐기) + boilerplate 청크 skip. `[ingest.expansion]` default off. 측정(나무위키 ~1000 문서 CS corpus): 변형 일관성 14/18 → **16/18**, spread 0.222→0.111, 대조군 false-positive 별칭 무죄. 비용 병목(별칭 18문서 2.5h)은 **파생물 캐시(V012, 청크 내용 해시 키)**로 해소 — 정답 3개 cold 1879s → warm 13s **≈ 145배**, embedding+별칭 LLM 캐싱, version_key cascade 정합. search/ask 가 `kebab.sqlite`+`lancedb` 만으로 동작 → 외부 서버 색인 후 DB 만 복사하는 이식 워크플로 가능. **결정/known limitation**: grounded/refusal 판정이 부분 인용을 grounded 로 오분류(정직한 거부가 false-positive 로 집계) — 별도 개선 후보. stack·svm 설명형 2개 잔존. 자세한 내용: `tasks/HOTFIXES.md` (2026-05-31), 측정: `docs/superpowers/handoffs/2026-05-31-namu-wiki-alias-cache-study.md`.
 - **2026-05-29 v0.20.2 dogfood findings + 검색 품질 baseline** — 8-finding 라운드 완료. (1) Ask 응답언어: rag-v3 default (질문 언어 = 답변 언어). (2) eval `--config` facade 패치 로 dogfood KB 직접 eval 가능. (3) 검색 품질 baseline — hybrid hit@3=1.0 / MRR=0.833, lexical hit@3=1.0 / MRR=0.7 (golden 10 query). **O-2 known limitation**: 소형 모델(gemma4:e4b) refusal 메시지의 query 언어 불일치 가능 — 판정은 정상, 표시 문구만 해당. 자세한 내용: `tasks/HOTFIXES.md` (2026-05-29).
 - **v0.20 sub-item 1 (scanned PDF OCR via qwen2.5vl:3b)**: post-extract enrichment pattern (`kebab-app::pdf_ocr_apply`, H-1 resolution), DCTDecode-only v1 scope (FlateDecode/CCITTFax page 는 warning + skip), parser_version `"pdf-text-v1"` 보존 + force-reingest UX 명문 (H-4).

README.md

@@ -41,21 +41,34 @@ clone 없이 git URL 로 바로 설치할 수도 있다: `cargo install --git ht
 
 lexical (FTS5 BM25) 과 vector (cosine) 두 채널을 **RRF fusion** 으로 합쳐 검색한다. 모든 hit 은 출처 위치를 매체별로 정확히 담는다 — Markdown/코드는 line, 이미지는 region, PDF 는 page. `--tag` · `--media` · `--lang` · `--path-glob` 등 다양한 필터와 `--max-tokens` · `--cursor` 같은 agent budget flag 를 지원한다.
 
-### doc-side expansion 별칭 (opt-in)
-
-색인 시 각 청크에 대해 "같은 의미의 다른 표현"(동의어 · 약어 · 한↔영 번역 · 풀어쓴 설명) 별칭을 LLM 으로 생성해 별도 dense 벡터로 색인한다. 설명형 query 나 cross-lingual query 의 검색 일관성을 높인다 (나무위키 ~1000 문서 CS corpus 측정: 변형 일관성 14/18 → 16/18, 대조군 false-positive 미유발). 청크당 LLM 호출이 들어 비용이 크므로 **default off** — `[ingest.expansion] enabled = true` 로 opt-in.
-
 ### 파생물 캐시 (자동)
 
-embedding 벡터와 별칭 LLM 결과를 청크 **내용 해시** 로 캐싱한다 (`derivation_cache`). 재색인·갱신 시 내용이 같은 청크는 재계산을 건너뛴다 (측정: cold 1879s → warm 13s ≈ 145배). 캐시 키에 모델·프롬프트·차원 버전이 포함돼 버전 변경 시 자동 무효화된다 (cascade 안전). 별도 설정 없이 투명하게 동작한다. (현재 TTL/LRU 자동 정리는 미구현 — 누적된 캐시는 `kebab reset` 으로만 정리.)
+embedding 벡터를 청크 **내용 해시** 로 캐싱한다 (`derivation_cache`). 재색인·갱신 시 내용이 같은 청크는 재계산을 건너뛴다. 캐시 키에 모델·차원 버전이 포함돼 버전 변경 시 자동 무효화된다 (cascade 안전). 별도 설정 없이 투명하게 동작한다. (현재 TTL/LRU 자동 정리는 미구현 — 누적된 캐시는 `kebab reset` 으로만 정리.)
 
 ### 외부 계산 + 로컬 검색 워크플로
 
-search/ask 는 asset 파일 없이 `kebab.sqlite` + `lancedb` 만으로 동작한다. 비싼 색인(임베딩·OCR·별칭 생성)을 성능 좋은 서버에서 수행한 뒤, 이 두 산출물만 로컬로 복사하면 그대로 검색·질문할 수 있다.
+search/ask 는 원본 파일 없이 KB 산출물만으로 동작한다 (청크 본문이 SQLite 에 저장되고 문서 경로는 상대경로로 기록됨). 비싼 색인(임베딩·OCR)을 성능 좋은 머신에서 수행한 뒤(예: Apple Silicon 맥에서 candle Metal GPU), **두 산출물만** 다른 머신(예: NUMA 서버)으로 복사하면 그대로 검색·질문할 수 있다.
+
+**무엇을 복사하나 — `[storage]` 에서 정의된 두 경로:**
+
+| 복사 대상 | config 키 (`[storage]`) | 기본 경로 | 내용 |
+|-----------|------------------------|-----------|------|
+| `kebab.sqlite` | `sqlite = "{data_dir}/kebab.sqlite"` | `{data_dir}/kebab.sqlite` | 문서·청크·본문·FTS5·메타 |
+| `lancedb/` | `vector_dir = "{data_dir}/lancedb"` | `{data_dir}/lancedb/` | 임베딩 벡터 |
+
+`{data_dir}` 는 `[storage].data_dir` (예: `~/.local/share/kebab`). `models/`(`model_dir`)·`assets/`(`asset_dir`)는 **복사 불필요** — 모델은 각 머신이 자기 캐시를 받고, asset 원본 바이트는 검색·질문에 쓰이지 않는다 (단일파일/`stdin` 색인의 원본 재읽기·재색인까지 보존하려면 `assets/` 도 함께 복사).
+
+```bash
+# ingest 가 끝난(쓰기 없는) 상태에서 복사
+rsync -a <src-data_dir>/kebab.sqlite  user@server:<dst-data_dir>/
+rsync -a <src-data_dir>/lancedb/      user@server:<dst-data_dir>/lancedb/
+```
+
+조건: **양쪽 동일 `kebab` 버전 + 동일 임베딩 모델/차원** (`[models.embedding].model`·`dimensions`). provider 는 달라도 됨 (예: 맥 `candle`/Metal ↔ 서버 `candle`/CPU 또는 `fastembed` — 같은 모델이면 벡터 호환). 복사는 반드시 ingest 가 돌지 않을 때.
 
 ### 멀티미디어 색인
 
-Markdown · PDF · 이미지(OCR + caption) · 소스코드(Rust/Python/TS/JS/Go/Java/Kotlin/C/C++ AST) · 리소스(YAML/Dockerfile/TOML/JSON/XML 등)를 확장자에 따라 자동으로 적절한 chunker 에 라우팅한다. embedded text 가 없는 scanned PDF 는 `[pdf.ocr]` 로 page-단위 OCR (opt-in). 전체 확장자→chunker 매핑은 [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md).
+Markdown · PDF · 이미지(OCR + caption) · 소스코드(Rust/Python/TS/JS/Go/Java/Kotlin/C/C++ AST) · 리소스(YAML/Dockerfile/TOML/JSON/XML 등)를 확장자에 따라 자동으로 적절한 chunker 에 라우팅한다. embedded text 가 없는 scanned PDF 는 `[ingest.pdf.ocr]` 로 page-단위 OCR (opt-in). 전체 확장자→chunker 매핑은 [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md).
 
 ### RAG (근거 인용 + 거절)
 
@@ -70,7 +83,7 @@ Markdown · PDF · 이미지(OCR + caption) · 소스코드(Rust/Python/TS/JS/Go
 | 명령 | 동작 |
 |------|------|
 | `kebab init` | XDG 경로에 데이터 디렉토리 + config.toml 생성 |
-| `kebab ingest [<path>]` | 워크스페이스 스캔 후 새/변경 문서 색인 (idempotent · incremental, `--force-reingest` 로 강제 재처리). 미지원 확장자는 자동 skip |
+| `kebab ingest [<path>]` | 워크스페이스 스캔 후 새/변경 문서 색인 (idempotent · incremental, `--force-reingest` 로 강제 재처리). 미지원 확장자는 자동 skip. 진행바는 현재 **파일명** · 느린 **phase(ocr/caption/embed)+모델명** · **경과초**`(Ns)` · 문서별 청크 수 · phase별 소요시간(parse/chunk/ocr/caption/embed/store)을 표시하고, 종료 시 **최장 소요 파일 top-5** 를 요약한다 (`--json` 은 `asset_phase`/`asset_chunked`/`asset_timings` 이벤트로, 사람용 요약은 미출력) |
 | `kebab ingest-file <path>` | 단일 파일 ingest (workspace 외부 가능 — `_external/` 로 deterministic copy) |
 | `kebab ingest-stdin --title <T>` | stdin 의 markdown 본문 ingest |
 | `kebab search --mode {lexical,vector,hybrid} "<query>" [flags]` | 검색 (default hybrid = RRF fusion, citation 포함). 필터/budget flag 는 `--help` |
@@ -97,20 +110,70 @@ root = "~/KnowledgeBase"   # 색인할 폴더. 절대 / tilde / env / 상대 경
                           # 상대 경로의 base 는 config.toml 위치 (cwd 무관).
 
 [models.embedding]
+provider = "fastembed"            # "fastembed"(기본, onnxruntime) / "candle"(순수 Rust)
+                                  # / "ollama"(원격 HTTP) / "none"(lexical-only).
+                                  # candle 는 같은 모델·같은 벡터를 순수 Rust 로 돌려
+                                  # NUMA 서버의 onnxruntime 48-스레드 double-free 를 피하는
+                                  # opt-in 백엔드 (e5 는 재색인 불필요).
 model = "multilingual-e5-large"   # 다국어 sentence embedding (1024-dim).
                                   # 첫 ingest 시 ONNX (~1.3GB) 자동 다운로드.
+                                  # candle provider 는 safetensors (~2GB) 다운로드.
+                                  # candle/ollama 는 "snowflake-arctic-embed-l-v2.0"
+                                  # (설명형 query 의 recall 보강) 도 지원 — 아래 참고.
 dimensions = 1024                 # config 와 LanceDB stored dim 불일치 시 검색 0건.
+num_threads = 0                   # candle 전용 CPU 스레드 캡 (0=auto=#cores).
+                                  # env KEBAB_EMBED_THREADS 가 우선. NUMA 노드 바인딩은
+                                  # numactl 과 조합. fastembed provider 는 무시.
+# endpoint = "http://127.0.0.1:11434"  # provider="ollama" 전용 HTTP endpoint.
+                                  # 생략 시 [models.llm].endpoint 로 폴백.
+                                  # fastembed/candle provider 는 무시.
+```
+
+**arctic-embed-l-v2.0 (설명형 query recall 보강)**: 기본 e5-large 대신
+Snowflake `arctic-embed-l-v2.0` 임베더를 쓸 수 있다 (1024-dim, opt-in). 측정에서
+설명형/약어/영문 용어 query 의 recall@10 이 e5 대비 향상됐다. 두 경로:
+
+```toml
+# (A) candle 백엔드 — 순수 Rust, in-process (NUMA 안전, Metal GPU 가능):
+[models.embedding]
+provider = "candle"
+model    = "snowflake-arctic-embed-l-v2.0"   # CLS pooling, query 에 "query: " 접두어
+                                             # (문서는 무접두어). safetensors ~2GB 다운로드.
+
+# (B) ollama 백엔드 — 원격/로컬 Ollama 데몬에 위임 (POST /api/embed):
+[models.embedding]
+provider = "ollama"
+model    = "snowflake-arctic-embed2"          # Ollama 모델 태그 (ollama pull 필요)
+endpoint = "http://127.0.0.1:11434"           # 생략 시 [models.llm].endpoint
+```
+
+> ⚠️ e5 → arctic 전환은 `embedding_version` cascade 를 트리거한다 (모델이 다르면
+> 벡터도 다름). 기존 e5 KB 와 혼용 불가 — 전환 시 **재색인** 필요 (`kebab reset`
+> 후 재 ingest). 기본값은 e5 라 기존 사용자는 영향 없음.
+
+**Apple Silicon GPU 가속 (candle / macOS)**: M-시리즈 맥에서 candle 임베딩을
+GPU(Metal)로 돌리면 CPU 대비 대용량 ingest 가 크게 빨라진다. 빌드 또는 설치 시
+`embed_metal` feature 를 켠다:
+
+```bash
+# 빌드만:
+cargo build --release --features embed_metal
+# 전역 설치 (~/.cargo/bin/kebab):
+cargo install --path crates/kebab-cli --features embed_metal --locked
+```
+
+벡터는 CPU candle 과 동일 모델이라 호환되므로, 맥에서 GPU 로 색인한
+`kebab.sqlite` + `lancedb/` 를 그대로 Linux 서버(CPU candle)로 복사해 질의할 수
+있다. 색인 로그에 `candle device = Metal (GPU)` 가 보이면 GPU 사용 중. metal
+feature 는 macOS 전용 (Linux/서버는 기본 CPU 빌드).
+
+```toml
 
 [models.llm]
 endpoint = "http://localhost:11434"   # Ollama host:port
 model = "gemma4:e4b"
 # request_timeout_secs = 300          # 큰 모델은 늘림. 0 은 disable 이 아니라 "즉시 timeout".
 
-[ingest.expansion]        # doc-side expansion 별칭 (opt-in)
-enabled = false           # true 면 청크당 LLM 호출로 별칭 생성 — 비용 큼.
-embed_aliases = true      # 별칭을 줄별 개별 dense 벡터로 색인.
-max_aliases_per_chunk = 8
-
 [search]
 stale_threshold_days = 30   # search hit / citation 의 stale 플래그 기준 (0 = off).
 
@@ -119,10 +182,13 @@ prompt_template_version = "rag-v3"   # 답변 언어 = 질문 언어. rag-v1/v2
 nli_threshold = 0.0                  # >0 (예: 0.5) 면 mDeBERTa XNLI groundedness 검증.
 ```
 
-- **파생물 캐시** — embedding·별칭 결과를 내용 해시로 자동 캐싱한다 (위 「핵심 기능」 참고). 설정 항목 없음.
+- **`[ingest]`** (v0.28.0) — 모든 형식 ingest 설정의 우산. 병렬도(`max_parallel_extractors`/`max_parallel_embeddings`/`watch_filesystem`, ← 옛 `[indexing]`)와 형식별 하위 절(`[ingest.chunking]` ← 옛 `[chunking]`, `[ingest.code]`, `[ingest.image.ocr]` ← 옛 `[image.ocr]`, `[ingest.pdf.ocr]` ← 옛 `[pdf.ocr]`)이 전부 이 아래로 모인다. 기존 v2 `config.toml` 은 그대로 둬도 로드 시 메모리에서 자동 변환되며, 파일을 새 레이아웃으로 갱신하려면 `kebab config migrate` (값·주석 보존).
+- **파생물 캐시** — embedding 결과를 내용 해시로 자동 캐싱한다 (위 「핵심 기능」 참고). 설정 항목 없음.
 - **`[ingest.code]`** — code ingest 의 skip 정책 (`skip_generated_header`, `max_file_bytes`, `extra_skip_globs`). `.gitignore` 자동 honor, `.kebabignore` 는 추가 layer.
-- **`[pdf.ocr]`** — scanned PDF 의 page-단위 OCR (default off / opt-in, page 당 ~수십 초 cost). 활성화 후 v0.19 시절 색인분은 `kebab ingest --force-reingest` 로 재처리.
+- **`[ingest.image.ocr]`** — 이미지 OCR (default off / opt-in). `engine` 으로 백엔드 선택: `"ollama-vision"` (default, 원격 vision LM) 또는 `"paddle-onnx"` (PP-OCRv5 ONNX 를 in-process 로 실행, Python 런타임 불필요, 큰 페이지 CPU <4초, 오프라인). `paddle-onnx` 는 워크스페이스에 번들된 모델을 쓰며 `det_model`/`rec_model`/`dict` 로 경로 override, `score_thresh`(0.3)/`unclip_ratio`(1.5)/`max_boxes`(1000) 로 검출 튜닝 가능 (`KEBAB_IMAGE_OCR_*` env 동일 지원 — env 이름은 v3 에서도 불변). engine 또는 모델을 바꾸면 영향 이미지가 자동 재색인된다.
+- **`[ingest.pdf.ocr]`** — scanned PDF 의 page-단위 OCR (default off / opt-in, page 당 ~수십 초 cost). `engine` 은 `[ingest.image.ocr]` 과 동일하게 `"ollama-vision"`/`"paddle-onnx"` 선택. v3 에서 paddle 모델 경로 키(`det_model`/`rec_model`/`dict`/`score_thresh`/`unclip_ratio`/`max_boxes`)를 PDF 자체적으로 가질 수 있다(`KEBAB_PDF_OCR_*` env 동일). 활성화 후 옛 색인분은 `kebab ingest --force-reingest` 로 재처리.
 - **`--config <path>`** — 임시 워크스페이스 / 격리 테스트용 (CLI · TUI 모두 honor).
+- **`kebab config migrate`** — 새 버전에서 추가된 config 섹션을 기존 `config.toml` 에 설명 주석과 함께 채워 넣는다 (사용자가 손본 값·주석·순서는 보존, 멱등, 변경 시 자동 `.bak` 백업). `--dry-run` 으로 변경 미리보기. `kebab doctor` 가 갱신 필요 시 안내한다. `kebab init` 으로 새로 생성되는 config.toml 도 섹션별 주석을 포함한다.
 - **`KEBAB_*` env** — 일부 키 override (`KEBAB_RAG_SCORE_GATE`, `KEBAB_EVAL_GOLDEN` 등).
 - **XDG layout**: `~/.config/kebab/`, `~/.local/share/kebab/`, `~/.cache/kebab/`, `~/.local/state/kebab/`.
 

crates/kebab-app/Cargo.toml

@@ -18,6 +18,8 @@ kebab-store-vector = { path = "../kebab-store-vector" }
 kebab-search = { path = "../kebab-search" }
 kebab-embed = { path = "../kebab-embed" }
 kebab-embed-local = { path = "../kebab-embed-local" }
+kebab-embed-candle = { path = "../kebab-embed-candle" }
+kebab-embed-ollama = { path = "../kebab-embed-ollama" }
 kebab-llm = { path = "../kebab-llm" }
 kebab-llm-local = { path = "../kebab-llm-local" }
 kebab-rag = { path = "../kebab-rag" }
@@ -71,6 +73,7 @@ base64               = { workspace = true }
 rusqlite             = { workspace = true }
 
 [dev-dependencies]
+kebab-config = { path = "../kebab-config" }
 # doc-side expansion (Phase 2) Task 4: ExpansionGenerator unit tests build
 # MockLanguageModel (gated behind kebab-llm's `mock` feature, default OFF in
 # [dependencies]). Enabling it here turns it on for the test build only.
@@ -98,6 +101,8 @@ reqwest      = { version = "0.12", default-features = false, features = ["blocki
 # disable path 없음; 이 feature 는 spec §6.3 명시를 honor 하는 role 만.
 default = ["fts_korean_morphological"]
 fts_korean_morphological = []
+# opt-in (macOS): candle embedder runs on the Apple Silicon GPU. See kebab-embed-candle.
+embed_metal = ["kebab-embed-candle/metal"]
 
 [lints]
 workspace = true

crates/kebab-app/src/app.rs

@@ -43,7 +43,9 @@ use kebab_core::{
     Answer, DocumentStore, Embedder, ExtractContext, Extractor, IndexVersion, LanguageModel,
     MediaType, Retriever, SearchHit, SearchMode, SearchOpts, SearchQuery, VectorStore,
 };
+use kebab_embed_candle::CandleEmbedder;
 use kebab_embed_local::FastembedEmbedder;
+use kebab_embed_ollama::OllamaEmbedder;
 use kebab_llm_local::OllamaLanguageModel;
 use kebab_parse_code::{
     CAstExtractor, CppAstExtractor, GoAstExtractor, JavaAstExtractor, JavascriptAstExtractor,
@@ -833,9 +835,31 @@ impl App {
         if let Some(e) = self.embedder.get() {
             return Ok(Some(e.clone()));
         }
-        let emb: Arc<dyn Embedder + Send + Sync> = Arc::new(
-            FastembedEmbedder::new(&self.config).context("kb-app: load FastembedEmbedder")?,
-        );
+        // Provider branch (Track 1 spec §3 + arctic-embedder spec). The
+        // `embeddings_disabled()` check above already handled `"none"`; here we
+        // route the live providers. `fastembed`/`onnx`/(empty) keep the default
+        // onnxruntime path (vectors unchanged — `embedding_version` is
+        // preserved); `candle` selects the pure-Rust NUMA-safe backend (e5 or
+        // arctic via its model registry); `ollama` offloads to a remote
+        // `/api/embed` daemon.
+        let provider = self.config.models.embedding.provider.as_str();
+        let emb: Arc<dyn Embedder + Send + Sync> = match provider {
+            "fastembed" | "onnx" | "" => Arc::new(
+                FastembedEmbedder::new(&self.config).context("kb-app: load FastembedEmbedder")?,
+            ),
+            "candle" => Arc::new(
+                CandleEmbedder::new(&self.config).context("kb-app: load CandleEmbedder")?,
+            ),
+            "ollama" => Arc::new(
+                OllamaEmbedder::new(&self.config).context("kb-app: load OllamaEmbedder")?,
+            ),
+            other => {
+                return Err(anyhow!(
+                    "kb-app: unknown embedding provider {other:?}; expected one of \
+                     `fastembed` (default), `candle`, `ollama`, or `none` (lexical-only)"
+                ));
+            }
+        };
         // `set` returns Err if another thread won the race; in that case
         // the loser still returns the (now-cached) winner via `get()`.
         let _ = self.embedder.set(emb.clone());
@@ -900,7 +924,7 @@ impl App {
             k: u32::try_from(query.k).unwrap_or(u32::MAX),
             snippet_chars: u32::try_from(self.config.search.snippet_chars).unwrap_or(u32::MAX),
             embedding_version,
-            chunker_version: self.config.chunking.chunker_version.clone(),
+            chunker_version: self.config.ingest.chunking.chunker_version.clone(),
             corpus_revision: self.sqlite.corpus_revision(),
         })
     }
@@ -1001,7 +1025,7 @@ impl App {
 fn lexical_index_version(config: &kebab_config::Config) -> IndexVersion {
     IndexVersion(format!(
         "lex:{}:fts5-v009-korean-morphological",
-        config.chunking.chunker_version
+        config.ingest.chunking.chunker_version
     ))
 }
 

crates/kebab-app/src/expansion.rs

@@ -1,274 +0,0 @@
-//! 색인시 doc-side expansion (Phase 2) — 청크당 "검색용 별칭" 생성.
-//!
-//! 설계 spec docs/superpowers/specs/2026-05-30-doc-side-expansion-design.md §3.2 / §5.
-
-use kebab_core::{Chunk, GenerateRequest, LanguageModel};
-
-/// 별칭 1줄의 최대 글자 수(이 이상은 문장형/환각으로 보고 drop).
-const MAX_ALIAS_CHARS: usize = 120;
-
-/// 별칭 프롬프트 템플릿 버전. derivation cache 의 alias version_key 에 포함되어
-/// (§3.1), 프롬프트를 바꾸면 bump 해 캐시를 무효화한다(전부 miss → 재생성).
-/// `build_request` 의 gemma 프롬프트와 한 쌍 — 프롬프트 수정 시 함께 bump.
-pub const PROMPT_VERSION: &str = "expansion-v1";
-
-/// 청크당 검색용 별칭을 생성한다.
-///
-/// 반환: 검증·상한 적용된 별칭들을 개행 join 한 문자열. 생성 0개 / LLM
-/// 실패 / 빈 출력이면 `None` (호출측은 chunk.aliases 를 None 으로 두고 진행).
-pub struct ExpansionGenerator<'a> {
-    llm: &'a dyn LanguageModel,
-    max_aliases: usize,
-}
-
-impl<'a> ExpansionGenerator<'a> {
-    pub fn new(llm: &'a dyn LanguageModel, max_aliases: usize) -> Self {
-        Self { llm, max_aliases }
-    }
-
-    /// gemma 프롬프트(expansion-v1)를 구성한다. (self 미사용 — associated fn.)
-    fn build_request(chunk: &Chunk) -> GenerateRequest {
-        let heading = chunk.heading_path.join(" > ");
-        let system = "당신은 검색 색인용 별칭 생성기다. 주어진 문단을 찾을 사용자가 \
-입력할 법한 짧은 검색어/질문을 생성한다. 동의어·풀어쓴 표현을 포함하라. \
-문단이 한국어면 영어 표현도, 영어면 한국어 표현도 섞어라. \
-한 줄에 하나씩, 설명·번호·머리기호 없이 검색어만 출력하라."
-            .to_string();
-        let user = format!(
-            "제목 경로: {heading}\n\n문단:\n{}\n\n검색 별칭(한 줄에 하나):",
-            chunk.text
-        );
-        GenerateRequest {
-            system,
-            user,
-            stop: vec![],
-            max_tokens: 256,
-            temperature: 0.0,
-            seed: Some(0),
-            images: vec![],
-        }
-    }
-
-    pub fn generate(&self, chunk: &Chunk) -> Option<String> {
-        // 나무위키 네비게이션 boilerplate 청크는 LLM 호출 없이 skip — 별칭
-        // 생성 가치가 없고 노이즈 sentinel 벡터만 만든다.
-        if is_nav_boilerplate(chunk) {
-            return None;
-        }
-        let req = Self::build_request(chunk);
-        let raw = match self.llm.generate_stream(req) {
-            Ok(iter) => {
-                let mut acc = String::new();
-                for ch in iter {
-                    match ch {
-                        Ok(kebab_core::TokenChunk::Token(t)) => acc.push_str(&t),
-                        Ok(kebab_core::TokenChunk::Done { .. }) => {}
-                        Err(_) => return None, // fail-soft
-                    }
-                }
-                acc
-            }
-            Err(_) => return None, // fail-soft (connection refused 등)
-        };
-        let aliases = parse_aliases(&raw, self.max_aliases);
-        if aliases.is_empty() {
-            None
-        } else {
-            Some(aliases.join("\n"))
-        }
-    }
-}
-
-/// 나무위키 네비게이션 boilerplate 청크 판정.
-///
-/// heading_path 가 비어 있고(문서 본문 섹션이 아닌 머리/꼬리 nav), text 앞부분에
-/// nav 키워드("최근 변경" 등)가 하나라도 있으면 boilerplate 로 본다. 둘 다
-/// 만족할 때만 true — 정상 본문(heading 있음, 또는 nav 키워드 없음)은 false.
-pub fn is_nav_boilerplate(chunk: &Chunk) -> bool {
-    const NAV_KEYWORDS: [&str; 5] = [
-        "최근 변경",
-        "Recent changes",
-        "최근 토론",
-        "특수 기능",
-        "편집 토론 역사",
-    ];
-    if !chunk.heading_path.is_empty() {
-        return false;
-    }
-    let head: String = chunk.text.chars().take(200).collect();
-    NAV_KEYWORDS.iter().any(|kw| head.contains(kw))
-}
-
-/// 줄 선두의 목록 마커만 1회 제거한다. **마커 뒤 공백이 필수** — 별칭 내용이
-/// 숫자/하이픈/별표로 시작하는 경우(예: "3D 렌더링", "-fast", "2단계")는 보존한다.
-/// (Task 4 리뷰 MAJOR-1: 탐욕적 `trim_start_matches` 가 정당한 별칭을 손상시키던 버그 수정.)
-fn strip_list_marker(s: &str) -> &str {
-    // 1) 머리기호 + 공백 ("- " / "* " / "• ").
-    for marker in ["- ", "* ", "• "] {
-        if let Some(rest) = s.strip_prefix(marker) {
-            return rest.trim_start();
-        }
-    }
-    // 2) 번호 + ('.' | ')') + 공백 ("1. " / "2) "). 마커 뒤 공백이 없으면
-    //    ("3D", "2단계") 번호가 아니라 내용으로 보고 보존.
-    let digit_end = s.find(|c: char| !c.is_ascii_digit()).unwrap_or(s.len());
-    if digit_end > 0 {
-        let after = &s[digit_end..];
-        if let Some(rest) = after.strip_prefix(". ").or_else(|| after.strip_prefix(") ")) {
-            return rest.trim_start();
-        }
-    }
-    s
-}
-
-/// LLM 출력 문자열 → 검증된 별칭 리스트.
-/// 줄 단위 split → trim → 목록 마커 1회 제거 → 빈 줄·과길이 drop →
-/// 중복 제거 → 상한 N.
-fn parse_aliases(raw: &str, max_aliases: usize) -> Vec<String> {
-    let mut out: Vec<String> = Vec::new();
-    for line in raw.lines() {
-        let t = strip_list_marker(line.trim());
-        if t.is_empty() || t.chars().count() > MAX_ALIAS_CHARS {
-            continue;
-        }
-        let s = t.to_string();
-        if !out.contains(&s) {
-            out.push(s);
-        }
-        if out.len() >= max_aliases {
-            break;
-        }
-    }
-    out
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use kebab_core::{ChunkId, ChunkerVersion, DocumentId, FinishReason, TokenUsage};
-    use kebab_llm::MockLanguageModel;
-
-    fn mk_chunk(text: &str) -> Chunk {
-        Chunk {
-            chunk_id: ChunkId("c1".into()),
-            doc_id: DocumentId("d1".into()),
-            block_ids: vec![],
-            text: text.into(),
-            heading_path: vec!["Guide".into()],
-            source_spans: vec![],
-            token_estimate: 3,
-            chunker_version: ChunkerVersion("md-heading-v1".into()),
-            policy_hash: "h".into(),
-            tokenized_korean_text: None,
-            aliases: None,
-        }
-    }
-
-    fn mock(resp: &str) -> MockLanguageModel {
-        MockLanguageModel {
-            model_id: "gemma4:e4b".into(),
-            provider: "ollama".into(),
-            context_tokens: 32768,
-            canned_response: resp.into(),
-            canned_finish: FinishReason::Stop,
-            canned_usage: TokenUsage {
-                prompt_tokens: 0,
-                completion_tokens: 0,
-                latency_ms: 0,
-            },
-        }
-    }
-
-    #[test]
-    fn parses_lines_strips_bullets_and_caps() {
-        let llm = mock("- 메모리 안전성\n1. who owns the value\nborrow checker\n\n* 소유권");
-        let generator = ExpansionGenerator::new(&llm, 2);
-        let out = generator.generate(&mk_chunk("Rust ownership")).unwrap();
-        // 상한 2 → 앞 2개만, 접두 제거됨.
-        assert_eq!(out, "메모리 안전성\nwho owns the value");
-    }
-
-    #[test]
-    fn drops_overlong_lines() {
-        let long = "x".repeat(200);
-        let llm = mock(&format!("{long}\n짧은 별칭"));
-        let generator = ExpansionGenerator::new(&llm, 8);
-        let out = generator.generate(&mk_chunk("t")).unwrap();
-        assert_eq!(out, "짧은 별칭", "120자 초과 줄은 drop");
-    }
-
-    #[test]
-    fn empty_output_returns_none() {
-        let llm = mock("   \n\n");
-        let generator = ExpansionGenerator::new(&llm, 8);
-        assert_eq!(generator.generate(&mk_chunk("t")), None);
-    }
-
-    /// Task 4 리뷰 MAJOR-1 회귀: 숫자/하이픈/별표로 시작하는 정당한 별칭은
-    /// 손상 없이 보존돼야 한다(목록 마커는 마커 뒤 공백이 있을 때만 제거).
-    #[test]
-    fn preserves_numeric_and_dash_leading_aliases() {
-        let llm = mock("3D 렌더링\n2단계 커밋\n-fast 플래그\n- 메모리 안전성\n1. 첫 항목");
-        let generator = ExpansionGenerator::new(&llm, 8);
-        let out = generator.generate(&mk_chunk("graphics")).unwrap();
-        // 마커 없는 선두 숫자/하이픈은 보존; "- "/"1. " 만 마커로 제거.
-        assert_eq!(out, "3D 렌더링\n2단계 커밋\n-fast 플래그\n메모리 안전성\n첫 항목");
-    }
-
-    fn mk_chunk_nav(text: &str, heading: Vec<String>) -> Chunk {
-        let mut c = mk_chunk(text);
-        c.heading_path = heading;
-        c
-    }
-
-    #[test]
-    fn nav_boilerplate_skips_alias_generation() {
-        // heading 없음 + nav 키워드 → boilerplate → LLM 호출 전에 None.
-        let llm = mock("별칭1\n별칭2");
-        let generator = ExpansionGenerator::new(&llm, 8);
-        let chunk = mk_chunk_nav("최근 변경 최근 토론 특수 기능", vec![]);
-        assert_eq!(generator.generate(&chunk), None);
-    }
-
-    #[test]
-    fn normal_body_chunk_generates_aliases() {
-        // heading 없지만 nav 키워드도 없음 → 정상 본문 → 별칭 생성.
-        let llm = mock("별칭1\n별칭2");
-        let generator = ExpansionGenerator::new(&llm, 8);
-        let chunk = mk_chunk_nav("러스트의 소유권과 빌림 검사기 개요", vec![]);
-        assert_eq!(generator.generate(&chunk).unwrap(), "별칭1\n별칭2");
-    }
-
-    #[test]
-    fn nav_keyword_with_heading_is_not_boilerplate() {
-        // nav 키워드가 있어도 heading 이 있으면 본문 섹션 → 생성.
-        let llm = mock("별칭1");
-        let generator = ExpansionGenerator::new(&llm, 8);
-        let chunk = mk_chunk_nav("최근 변경 내역 설명", vec!["문서 변경사항".into()]);
-        assert_eq!(generator.generate(&chunk).unwrap(), "별칭1");
-    }
-
-    #[test]
-    fn is_nav_boilerplate_unit() {
-        assert!(is_nav_boilerplate(&mk_chunk_nav("Recent changes list", vec![])));
-        assert!(is_nav_boilerplate(&mk_chunk_nav("편집 토론 역사", vec![])));
-        assert!(!is_nav_boilerplate(&mk_chunk_nav("일반 본문 텍스트", vec![])));
-        assert!(!is_nav_boilerplate(&mk_chunk_nav(
-            "최근 변경",
-            vec!["섹션".into()]
-        )));
-    }
-
-    #[test]
-    fn strip_list_marker_unit() {
-        assert_eq!(strip_list_marker("- 메모리"), "메모리");
-        assert_eq!(strip_list_marker("* 소유권"), "소유권");
-        assert_eq!(strip_list_marker("1. who owns"), "who owns");
-        assert_eq!(strip_list_marker("2) 항목"), "항목");
-        // 마커 뒤 공백 없음 → 보존.
-        assert_eq!(strip_list_marker("3D 렌더링"), "3D 렌더링");
-        assert_eq!(strip_list_marker("-fast"), "-fast");
-        assert_eq!(strip_list_marker("2단계"), "2단계");
-        assert_eq!(strip_list_marker("2.0 릴리스"), "2.0 릴리스");
-    }
-}

crates/kebab-app/src/ingest_progress.rs

@@ -47,11 +47,19 @@ pub struct AggregateCounts {
 ///
 /// ```text
 /// ScanStarted < ScanCompleted
-///   < (AssetStarted [< (PdfOcrStarted < PdfOcrFinished)*] < AssetFinished)*
+///   < ( AssetStarted
+///         [< (PdfOcrStarted < PdfOcrFinished)*]
+///         [< AssetChunked]
+///         [< AssetTimings]
+///       < AssetFinished )*
 ///   < (Completed | Aborted)
 /// ```
 ///
-/// `[]` = optional, per-PDF asset only (v0.20.0 sub-item 1).
+/// `[]` = optional. `PdfOcr*` is per-PDF asset only (v0.20.0 sub-item 1).
+/// `AssetChunked` / `AssetTimings` are the v0.24.0 asset-internal phase
+/// events: `AssetChunked` fires once right after chunking (markdown /
+/// image / PDF); `AssetTimings` reports per-phase wall-clock once
+/// (markdown only).
 ///
 /// Embed-batch events (`embed_batch_started` / `embed_batch_finished`
 /// in §2.4a) are reserved for a future iteration and are not emitted
@@ -82,6 +90,52 @@ pub enum IngestEvent {
         result: IngestItemKind,
         chunks: u32,
     },
+    /// v0.24.0 (additive): emitted right after an asset is chunked, before
+    /// expansion / embed / store. Surfaces "this document is N chunks"
+    /// immediately so a single large document no longer looks frozen at
+    /// `idx/total` while its per-chunk phases churn. `chunks` is the chunk
+    /// count for asset `idx`.
+    AssetChunked { idx: u32, total: u32, chunks: u32 },
+    /// v0.26.1 (additive): emitted when an asset enters a *slow* internal
+    /// phase, so the interactive progress bar can show **which** phase
+    /// (and which model) is currently running instead of looking frozen.
+    /// `phase` ∈ {`"ocr"`, `"caption"`, `"embed"`}; short phases
+    /// (parse / chunk / store) are intentionally *not* emitted to avoid
+    /// noise. `model` is the model performing the phase — the vision LLM
+    /// id for `ocr` / `caption`, the embedder `model_id` for `embed`
+    /// (`None` when the phase runs without a configured model, e.g. embed
+    /// with no embedder wired). Emitted once per (asset, phase); no
+    /// throttle needed (low frequency). Wire v1 consumers that predate
+    /// this variant simply ignore the unknown `asset_phase` kind.
+    AssetPhase {
+        idx: u32,
+        total: u32,
+        phase: String,
+        model: Option<String>,
+    },
+    /// v0.24.0 (additive): per-phase wall-clock (milliseconds) for asset
+    /// `idx`, emitted once the asset's pipeline finishes. Lets a user see
+    /// *where* the time went (parse / chunk / ocr / caption / embed /
+    /// store) without parsing logs. The markdown path leaves `ocr_ms` /
+    /// `caption_ms` at 0 (no image analysis); the image / PDF paths fill
+    /// them so the slowest-asset summary attributes vision-model time
+    /// correctly. `expansion_ms` is retained for wire compatibility but is
+    /// always 0 since doc-side expansion was removed (HOTFIXES 2026-06-03).
+    /// `ocr_ms` / `caption_ms` (v0.26.1) are additive with serde default 0
+    /// so pre-v0.26.1 consumers deserialize cleanly.
+    AssetTimings {
+        idx: u32,
+        total: u32,
+        parse_ms: u64,
+        chunk_ms: u64,
+        expansion_ms: u64,
+        embed_ms: u64,
+        store_ms: u64,
+        #[serde(default)]
+        ocr_ms: u64,
+        #[serde(default)]
+        caption_ms: u64,
+    },
     /// Run finished normally. `counts` is the final aggregate.
     Completed { counts: AggregateCounts },
     /// Run finished by user cancellation. `counts` is the partial
@@ -199,6 +253,121 @@ mod tests {
         assert_eq!(v.get("media").and_then(|s| s.as_str()), Some("markdown"));
     }
 
+    #[test]
+    fn asset_chunked_serializes_with_discriminator() {
+        // v0.24.0 additive variant — `kind` must be snake_case
+        // `asset_chunked` so wire v1 consumers branch on it cleanly.
+        let ev = IngestEvent::AssetChunked {
+            idx: 3,
+            total: 10,
+            chunks: 142,
+        };
+        let v = serde_json::to_value(&ev).unwrap();
+        assert_eq!(
+            v.get("kind").and_then(|s| s.as_str()),
+            Some("asset_chunked")
+        );
+        assert_eq!(v.get("idx").and_then(serde_json::Value::as_u64), Some(3));
+        assert_eq!(
+            v.get("chunks").and_then(serde_json::Value::as_u64),
+            Some(142)
+        );
+    }
+
+    #[test]
+    fn asset_timings_serializes_all_phase_fields() {
+        let ev = IngestEvent::AssetTimings {
+            idx: 2,
+            total: 7,
+            parse_ms: 12,
+            chunk_ms: 3,
+            expansion_ms: 45_000,
+            embed_ms: 800,
+            store_ms: 20,
+            ocr_ms: 1_200,
+            caption_ms: 3_400,
+        };
+        let v = serde_json::to_value(&ev).unwrap();
+        assert_eq!(
+            v.get("kind").and_then(|s| s.as_str()),
+            Some("asset_timings")
+        );
+        // All phase fields are present (plain u64, always serialized).
+        for (field, want) in [
+            ("parse_ms", 12u64),
+            ("chunk_ms", 3),
+            ("expansion_ms", 45_000),
+            ("embed_ms", 800),
+            ("store_ms", 20),
+            ("ocr_ms", 1_200),
+            ("caption_ms", 3_400),
+        ] {
+            assert_eq!(
+                v.get(field).and_then(serde_json::Value::as_u64),
+                Some(want),
+                "field {field}"
+            );
+        }
+    }
+
+    #[test]
+    fn asset_timings_ocr_caption_default_to_zero_for_legacy_wire() {
+        // v0.26.1 additive: a pre-v0.26.1 wire payload omits ocr_ms /
+        // caption_ms; serde `default` must fill 0 so old producers stay
+        // compatible.
+        let legacy = serde_json::json!({
+            "kind": "asset_timings",
+            "idx": 1, "total": 1,
+            "parse_ms": 5, "chunk_ms": 2, "expansion_ms": 0,
+            "embed_ms": 10, "store_ms": 3
+        });
+        let ev: IngestEvent = serde_json::from_value(legacy).unwrap();
+        match ev {
+            IngestEvent::AssetTimings {
+                ocr_ms,
+                caption_ms,
+                embed_ms,
+                ..
+            } => {
+                assert_eq!(ocr_ms, 0);
+                assert_eq!(caption_ms, 0);
+                assert_eq!(embed_ms, 10);
+            }
+            other => panic!("unexpected event: {other:?}"),
+        }
+    }
+
+    #[test]
+    fn asset_phase_serializes_with_discriminator() {
+        // v0.26.1 additive variant — `kind` must be snake_case
+        // `asset_phase`, `phase` is the slow-phase label, `model` the
+        // model id (nullable).
+        let ev = IngestEvent::AssetPhase {
+            idx: 4,
+            total: 12,
+            phase: "ocr".into(),
+            model: Some("gemma4:e4b".into()),
+        };
+        let v = serde_json::to_value(&ev).unwrap();
+        assert_eq!(v.get("kind").and_then(|s| s.as_str()), Some("asset_phase"));
+        assert_eq!(v.get("idx").and_then(serde_json::Value::as_u64), Some(4));
+        assert_eq!(v.get("phase").and_then(|s| s.as_str()), Some("ocr"));
+        assert_eq!(v.get("model").and_then(|s| s.as_str()), Some("gemma4:e4b"));
+    }
+
+    #[test]
+    fn asset_phase_model_none_serializes_as_null() {
+        let ev = IngestEvent::AssetPhase {
+            idx: 1,
+            total: 1,
+            phase: "embed".into(),
+            model: None,
+        };
+        let v = serde_json::to_value(&ev).unwrap();
+        assert_eq!(v.get("phase").and_then(|s| s.as_str()), Some("embed"));
+        assert!(v.get("model").is_some_and(serde_json::Value::is_null));
+    }
+
     #[test]
     fn ingest_event_completed_has_counts() {
         let ev = IngestEvent::Completed {

crates/kebab-app/src/schema.rs

@@ -108,6 +108,7 @@ const WIRE_SCHEMAS: &[&str] = &[
     "doc_summary.v1",
     "chunk_inspection.v1",
     "doctor.v1",
+    "config_migration.v1",
     "ingest_report.v1",
     "ingest_progress.v1",
     "reset_report.v1",
@@ -204,7 +205,7 @@ fn collect_models(cfg: &Config, store: &kebab_store_sqlite::SqliteStore) -> Mode
         // maintain their own versions; surface those when SchemaV1.models
         // becomes a multi-medium map (P+).
         parser_version: kebab_parse_md::PARSER_VERSION.to_string(),
-        chunker_version: cfg.chunking.chunker_version.clone(),
+        chunker_version: cfg.ingest.chunking.chunker_version.clone(),
         active_parsers,
         active_chunkers,
         // EmbeddingModelCfg uses `.model` (not `.id`) — adapt from plan.

crates/kebab-app/tests/code_ingest_smoke.rs

@@ -52,7 +52,9 @@ fn rust_file_ingests_and_searches_as_code_citation() {
         "at least one chunk expected: {code_item:?}"
     );
     assert_eq!(
-        code_item.parser_version.as_ref().map(|p| p.0.as_str()),
+        code_item.parser_version
+            .as_ref()
+            .map(|p| p.0.split('|').next().unwrap()),
         Some("code-rust-v1"),
         "parser_version must be code-rust-v1"
     );
@@ -185,7 +187,9 @@ fn python_file_ingests_and_searches_as_code_citation() {
         .find(|i| i.doc_path.0.ends_with("metrics.py"))
         .expect("metrics.py item");
     assert_eq!(
-        py_item.parser_version.as_ref().map(|p| p.0.as_str()),
+        py_item.parser_version
+            .as_ref()
+            .map(|p| p.0.split('|').next().unwrap()),
         Some("code-python-v1"),
         "parser_version must be code-python-v1"
     );
@@ -261,7 +265,9 @@ fn typescript_file_ingests_and_searches_as_code_citation() {
         .find(|i| i.doc_path.0.ends_with("Foo.ts"))
         .expect("Foo.ts item");
     assert_eq!(
-        ts_item.parser_version.as_ref().map(|p| p.0.as_str()),
+        ts_item.parser_version
+            .as_ref()
+            .map(|p| p.0.split('|').next().unwrap()),
         Some("code-ts-v1"),
         "parser_version must be code-ts-v1"
     );
@@ -337,7 +343,9 @@ fn javascript_file_ingests_and_searches_as_code_citation() {
         .find(|i| i.doc_path.0.ends_with("Bar.js"))
         .expect("Bar.js item");
     assert_eq!(
-        js_item.parser_version.as_ref().map(|p| p.0.as_str()),
+        js_item.parser_version
+            .as_ref()
+            .map(|p| p.0.split('|').next().unwrap()),
         Some("code-js-v1"),
         "parser_version must be code-js-v1"
     );
@@ -415,7 +423,9 @@ fn go_file_ingests_and_searches_as_code_citation() {
         .find(|i| i.doc_path.0.ends_with("ast.go"))
         .expect("ast.go item present");
     assert_eq!(
-        go_item.parser_version.as_ref().map(|p| p.0.as_str()),
+        go_item.parser_version
+            .as_ref()
+            .map(|p| p.0.split('|').next().unwrap()),
         Some("code-go-v1"),
         "parser_version must be code-go-v1"
     );
@@ -486,7 +496,9 @@ fn java_file_ingests_and_searches_as_code_citation() {
         .find(|i| i.doc_path.0.ends_with("Foo.java"))
         .expect("Foo.java item present");
     assert_eq!(
-        java_item.parser_version.as_ref().map(|p| p.0.as_str()),
+        java_item.parser_version
+            .as_ref()
+            .map(|p| p.0.split('|').next().unwrap()),
         Some("code-java-v1"),
         "parser_version must be code-java-v1"
     );
@@ -561,7 +573,9 @@ fn kotlin_file_ingests_and_searches_as_code_citation() {
         .find(|i| i.doc_path.0.ends_with("Foo.kt"))
         .expect("Foo.kt item present");
     assert_eq!(
-        kt_item.parser_version.as_ref().map(|p| p.0.as_str()),
+        kt_item.parser_version
+            .as_ref()
+            .map(|p| p.0.split('|').next().unwrap()),
         Some("code-kotlin-v1"),
         "parser_version must be code-kotlin-v1"
     );
@@ -634,7 +648,9 @@ fn tier2_k8s_yaml_ingest_searchable() {
         .find(|i| i.doc_path.0.ends_with("deploy.yaml"))
         .expect("deploy.yaml item present");
     assert_eq!(
-        yaml_item.parser_version.as_ref().map(|p| p.0.as_str()),
+        yaml_item.parser_version
+            .as_ref()
+            .map(|p| p.0.split('|').next().unwrap()),
         Some("none-v1"),
         "parser_version must be none-v1"
     );
@@ -717,7 +733,9 @@ fn tier2_dockerfile_ingest_searchable() {
         .find(|i| i.doc_path.0.ends_with("Dockerfile"))
         .expect("Dockerfile item present");
     assert_eq!(
-        df_item.parser_version.as_ref().map(|p| p.0.as_str()),
+        df_item.parser_version
+            .as_ref()
+            .map(|p| p.0.split('|').next().unwrap()),
         Some("none-v1"),
         "parser_version must be none-v1"
     );
@@ -800,7 +818,9 @@ fn tier2_cargo_toml_ingest_searchable() {
         .find(|i| i.doc_path.0.ends_with("Cargo.toml"))
         .expect("Cargo.toml item present");
     assert_eq!(
-        toml_item.parser_version.as_ref().map(|p| p.0.as_str()),
+        toml_item.parser_version
+            .as_ref()
+            .map(|p| p.0.split('|').next().unwrap()),
         Some("none-v1"),
         "parser_version must be none-v1"
     );
@@ -883,7 +903,9 @@ fn tier3_shell_ingest_searchable() {
         .find(|i| i.doc_path.0.ends_with("deploy.sh"))
         .expect("deploy.sh item present");
     assert_eq!(
-        sh_item.parser_version.as_ref().map(|p| p.0.as_str()),
+        sh_item.parser_version
+            .as_ref()
+            .map(|p| p.0.split('|').next().unwrap()),
         Some("none-v1"),
         "parser_version must be none-v1 for shell (Tier 3 direct)"
     );
@@ -974,7 +996,9 @@ fn tier3_yaml_fallback_picks_up_non_k8s_yaml() {
         .find(|i| i.doc_path.0.ends_with("docker-compose.yml"))
         .expect("docker-compose.yml item present");
     assert_eq!(
-        yaml_item.parser_version.as_ref().map(|p| p.0.as_str()),
+        yaml_item.parser_version
+            .as_ref()
+            .map(|p| p.0.split('|').next().unwrap()),
         Some("none-v1"),
         "parser_version must be none-v1 after Tier 3 fallback"
     );
@@ -1144,7 +1168,9 @@ fn tier1_c_ingest_searchable() {
         .find(|i| i.doc_path.0.ends_with("parser.c"))
         .expect("parser.c item present");
     assert_eq!(
-        c_item.parser_version.as_ref().map(|p| p.0.as_str()),
+        c_item.parser_version
+            .as_ref()
+            .map(|p| p.0.split('|').next().unwrap()),
         Some("code-c-v2"),
         "parser_version must be code-c-v2 (v0.17.0 PR-B: typedef-wrapped struct/enum/union 이 typedef alias unit 으로 방출)"
     );
@@ -1228,7 +1254,9 @@ fn tier1_cpp_ingest_searchable() {
         .find(|i| i.doc_path.0.ends_with("chunker.cpp"))
         .expect("chunker.cpp item present");
     assert_eq!(
-        cpp_item.parser_version.as_ref().map(|p| p.0.as_str()),
+        cpp_item.parser_version
+            .as_ref()
+            .map(|p| p.0.split('|').next().unwrap()),
         Some("code-cpp-v1"),
         "parser_version must be code-cpp-v1"
     );

crates/kebab-app/tests/common/mock_ocr.rs

@@ -39,6 +39,11 @@ impl OcrEngine for MockOcrEngine {
         "mock-v1".to_string()
     }
 
+    #[allow(clippy::unnecessary_literal_bound)]
+    fn model(&self) -> &str {
+        "mock-model"
+    }
+
     fn recognize(&self, _img: &[u8], _hint: Option<&Lang>) -> Result<OcrText> {
         if self.fail {
             anyhow::bail!("mock failure");

crates/kebab-app/tests/common/mod.rs

@@ -62,8 +62,8 @@ impl TestEnv {
         // Drop in a small chunk policy so the fixture's small files
         // emit at least a couple of chunks even with overlap_tokens
         // honored.
-        config.chunking.target_tokens = 80;
-        config.chunking.overlap_tokens = 20;
+        config.ingest.chunking.target_tokens = 80;
+        config.ingest.chunking.overlap_tokens = 20;
 
         Self {
             temp,

crates/kebab-app/tests/config_invalidation.rs

@@ -0,0 +1,169 @@
+//! v0.26.2: ingest-config invalidation — changing a setting that affects
+//! ingest output auto-re-indexes the affected assets on the next ingest
+//! (no `--force-reingest`), while changing an unrelated setting does not.
+//!
+//! These end-to-end tests exercise the model-free signals (chunking +
+//! `[ingest.code]` options vs `search` settings). The exhaustive per-setting
+//! mapping (image OCR / caption, pdf.ocr, code options, search/rag/ui
+//! invariance) is unit-tested in
+//! `kebab-app/src/lib.rs::ingest_config_signature_tests` — those toggles
+//! (OCR/caption) require a live vision endpoint to ingest, so the wiring is
+//! verified here via the signature-driven chunking path that shares the same
+//! `effective_parser_version` plumbing.
+
+mod common;
+
+use common::TestEnv;
+
+use kebab_app::{IngestOpts, ingest_with_config, ingest_with_config_opts};
+use kebab_core::IngestItemKind;
+
+/// Seed a workspace with a markdown + a rust file so both the markdown and
+/// the code ingest paths are exercised. Returns the first-ingest report.
+fn seed_and_first_ingest(env: &TestEnv) -> kebab_core::IngestReport {
+    std::fs::write(
+        env.workspace_root.join("demo.rs"),
+        "/// adds two integers\npub fn add(a: i32, b: i32) -> i32 {\n    a + b\n}\n",
+    )
+    .unwrap();
+    let first = ingest_with_config(env.config.clone(), env.scope(), false).expect("first ingest");
+    assert_eq!(first.errors, 0, "first ingest must not error: {first:?}");
+    assert!(first.new >= 1, "first ingest creates docs: {first:?}");
+    assert_eq!(first.unchanged, 0, "first ingest has no unchanged: {first:?}");
+    first
+}
+
+fn reingest(env: &TestEnv) -> kebab_core::IngestReport {
+    ingest_with_config_opts(env.config.clone(), env.scope(), false, IngestOpts::default())
+        .expect("re-ingest")
+}
+
+/// Re-running with the identical config skips every asset (no spurious
+/// re-index). Regression guard for over-invalidation.
+#[test]
+fn identical_config_skips_all_assets() {
+    let env = TestEnv::lexical_only();
+    let first = seed_and_first_ingest(&env);
+    let scanned = first.scanned;
+
+    let second = reingest(&env);
+    assert_eq!(second.scanned, scanned);
+    assert_eq!(second.new, 0, "no new docs: {second:?}");
+    assert_eq!(second.updated, 0, "nothing re-indexed: {second:?}");
+    assert_eq!(second.unchanged, scanned, "every doc Unchanged: {second:?}");
+    assert_eq!(second.errors, 0);
+}
+
+/// Changing a common chunking parameter re-indexes EVERY media type
+/// (markdown + code here) without `--force-reingest`.
+#[test]
+fn chunking_change_reindexes_all_types() {
+    let mut env = TestEnv::lexical_only();
+    let first = seed_and_first_ingest(&env);
+    let scanned = first.scanned;
+
+    // Bump target_tokens — folds into every type's signature.
+    env.config.ingest.chunking.target_tokens += 100;
+
+    let second = reingest(&env);
+    assert_eq!(second.scanned, scanned);
+    assert_eq!(second.new, 0, "no new docs: {second:?}");
+    assert_eq!(
+        second.unchanged, 0,
+        "chunking change must re-index all: {second:?}"
+    );
+    assert_eq!(
+        second.updated, scanned,
+        "every doc re-indexed as Updated: {second:?}"
+    );
+    assert_eq!(second.errors, 0);
+}
+
+/// Changing an `[ingest.code]` option re-indexes only the code asset; the
+/// markdown assets stay Unchanged.
+#[test]
+fn code_option_change_reindexes_code_only() {
+    let mut env = TestEnv::lexical_only();
+    let first = seed_and_first_ingest(&env);
+    let scanned = first.scanned;
+
+    // Raise max_file_lines (keeps the tiny demo.rs in-scope; only the code
+    // signature changes).
+    env.config.ingest.code.max_file_lines += 1000;
+
+    let second = reingest(&env);
+    assert_eq!(second.scanned, scanned);
+    assert_eq!(second.new, 0, "no new docs: {second:?}");
+    assert_eq!(second.errors, 0);
+    assert_eq!(
+        second.updated, 1,
+        "exactly the code asset re-indexed: {second:?}"
+    );
+    assert_eq!(
+        second.unchanged,
+        scanned - 1,
+        "all markdown assets stay Unchanged: {second:?}"
+    );
+
+    let items = second.items.as_ref().expect("items present");
+    let code = items
+        .iter()
+        .find(|i| i.doc_path.0.ends_with("demo.rs"))
+        .expect("demo.rs item");
+    assert_eq!(
+        code.kind,
+        IngestItemKind::Updated,
+        "demo.rs must be re-indexed: {code:?}"
+    );
+    for i in items.iter().filter(|i| i.doc_path.0.ends_with(".md")) {
+        assert_eq!(
+            i.kind,
+            IngestItemKind::Unchanged,
+            "markdown must be Unchanged: {i:?}"
+        );
+    }
+}
+
+/// Regression guard: changing a non-ingest setting (`search.default_k`) does
+/// NOT re-index anything.
+#[test]
+fn search_setting_change_reindexes_nothing() {
+    let mut env = TestEnv::lexical_only();
+    let first = seed_and_first_ingest(&env);
+    let scanned = first.scanned;
+
+    env.config.search.default_k += 5;
+    env.config.search.snippet_chars += 50;
+    env.config.rag.score_gate = 0.5;
+
+    let second = reingest(&env);
+    assert_eq!(second.scanned, scanned);
+    assert_eq!(
+        second.unchanged, scanned,
+        "search/rag changes must not re-index: {second:?}"
+    );
+    assert_eq!(second.updated, 0, "nothing re-indexed: {second:?}");
+    assert_eq!(second.new, 0);
+    assert_eq!(second.errors, 0);
+}
+
+/// v3 불변식 #1: `ingest_config_signature` 출력 문자열은 값 기반이라 struct
+/// 경로 재편(미디어 ingest 통합) 후에도 v2 와 **바이트 동일**해야 한다. 깨지면
+/// 업그레이드 시 전체 재색인 발생. paddle-onnx image 분기 형식 골든.
+#[test]
+fn ingest_signature_image_paddle_byte_stable() {
+    let mut cfg = kebab_config::Config::defaults();
+    cfg.ingest.image.ocr.enabled = true;
+    cfg.ingest.image.ocr.engine = "paddle-onnx".into();
+    let sig = kebab_app::test_ingest_config_signature(
+        &cfg,
+        &kebab_core::MediaType::Image(kebab_core::ImageType::Png),
+    );
+    // 골든: chunk:... |ocr:1:paddle-onnx:<engine_version> |cap:0
+    assert!(
+        sig.starts_with("chunk:500:80:true:md-heading-v1"),
+        "chunk prefix drift: {sig}"
+    );
+    assert!(sig.contains("|ocr:1:paddle-onnx:"), "ocr token drift: {sig}");
+    assert!(sig.ends_with("|cap:0"), "cap token drift: {sig}");
+}

crates/kebab-app/tests/config_migrate.rs

@@ -0,0 +1,85 @@
+use std::fs;
+
+#[test]
+fn migrate_writes_backup_and_atomic_with_dry_run_noop() {
+    let dir = tempfile::tempdir().unwrap();
+    let cfg = dir.path().join("config.toml");
+    fs::write(
+        &cfg,
+        "schema_version = 1\n\n[workspace]\nroot = \"/n\"\ninclude = [\"*.md\"]\n",
+    )
+    .unwrap();
+
+    // dry-run: 파일·백업 미변경.
+    let report = kebab_app::config_migrate_with_config_path(Some(&cfg), true).unwrap();
+    assert!(report.changed);
+    assert!(report.dry_run);
+    assert!(report.backup_path.is_none());
+    assert!(!dir.path().join("config.toml.bak").exists());
+    assert!(
+        fs::read_to_string(&cfg).unwrap().contains("include"),
+        "dry-run modified file"
+    );
+
+    // 실제 적용: 백업 생성 + 파일 갱신.
+    let report = kebab_app::config_migrate_with_config_path(Some(&cfg), false).unwrap();
+    assert!(report.changed);
+    assert!(!report.dry_run);
+    assert!(report.backup_path.is_some());
+    assert!(dir.path().join("config.toml.bak").exists());
+    let new = fs::read_to_string(&cfg).unwrap();
+    assert!(!new.contains("include"));
+    assert!(new.contains("[ingest.code]"));
+
+    // 멱등: 재실행 changed=false.
+    let report = kebab_app::config_migrate_with_config_path(Some(&cfg), false).unwrap();
+    assert!(!report.changed);
+}
+
+#[test]
+fn migrate_missing_file_errors() {
+    let dir = tempfile::tempdir().unwrap();
+    let cfg = dir.path().join("nope.toml");
+    assert!(kebab_app::config_migrate_with_config_path(Some(&cfg), false).is_err());
+}
+
+#[test]
+fn annotated_default_serialization_contains_section_comments() {
+    let doc = kebab_config::migrate::annotated_default_document();
+    let text = doc.to_string();
+    assert!(
+        text.contains("code ingest skip 정책"),
+        "section comment missing:\n{text}"
+    );
+    assert!(text.contains("[ingest.code]"));
+}
+
+#[test]
+fn doctor_flags_outdated_config() {
+    let dir = tempfile::tempdir().unwrap();
+    let cfg = dir.path().join("config.toml");
+    fs::write(
+        &cfg,
+        "schema_version = 1\n\n[workspace]\nroot = \"/n\"\ninclude=[\"*.md\"]\n",
+    )
+    .unwrap();
+    let report = kebab_app::doctor_with_config_path(Some(&cfg)).unwrap();
+    let check = report
+        .checks
+        .iter()
+        .find(|c| c.name == "config_migration")
+        .unwrap();
+    assert!(!check.ok, "outdated config should fail check");
+    assert!(check.hint.as_deref().unwrap().contains("config migrate"));
+    assert!(!report.ok, "overall doctor should be false");
+
+    // migrate 후엔 통과.
+    kebab_app::config_migrate_with_config_path(Some(&cfg), false).unwrap();
+    let report = kebab_app::doctor_with_config_path(Some(&cfg)).unwrap();
+    let check = report
+        .checks
+        .iter()
+        .find(|c| c.name == "config_migration")
+        .unwrap();
+    assert!(check.ok, "after migrate should pass");
+}

crates/kebab-app/tests/image_pipeline.rs

@@ -34,11 +34,11 @@ fn cfg_with_image_pipeline(env: &TestEnv, mock_endpoint: &str) -> Config {
     let mut cfg = env.config.clone();
     // p9-fb-25: workspace.include removed; extension routing is now
     // handled by extractor matching alone (no config knob).
-    cfg.image.ocr.enabled = true;
-    cfg.image.ocr.endpoint = Some(mock_endpoint.to_string());
-    cfg.image.ocr.model = "vision-mock:1b".to_string();
-    cfg.image.ocr.max_pixels = 512;
-    cfg.image.caption.enabled = false; // tested separately below
+    cfg.ingest.image.ocr.enabled = true;
+    cfg.ingest.image.ocr.endpoint = Some(mock_endpoint.to_string());
+    cfg.ingest.image.ocr.model = "vision-mock:1b".to_string();
+    cfg.ingest.image.ocr.max_pixels = 512;
+    cfg.ingest.image.caption.enabled = false; // tested separately below
     cfg.models.llm.endpoint = mock_endpoint.to_string();
     cfg.models.llm.model = "vision-mock:1b".to_string();
     cfg
@@ -161,8 +161,8 @@ async fn ingest_image_with_ocr_and_caption_populates_both_fields() {
     let env = TestEnv::lexical_only();
     write_red_png(&env.workspace_root, "diagram.png");
     let mut cfg = cfg_with_image_pipeline(&env, &server.uri());
-    cfg.image.caption.enabled = true;
-    cfg.image.caption.max_pixels = 384;
+    cfg.ingest.image.caption.enabled = true;
+    cfg.ingest.image.caption.max_pixels = 384;
 
     let cfg_clone = cfg.clone();
     let scope = env.scope();
@@ -270,8 +270,8 @@ async fn image_indexed_with_filename_when_ocr_and_caption_disabled() {
     let mut cfg = env.config.clone();
     // p9-fb-25: workspace.include removed; extension routing is now
     // handled by extractor matching alone (no config knob).
-    cfg.image.ocr.enabled = false;
-    cfg.image.caption.enabled = false;
+    cfg.ingest.image.ocr.enabled = false;
+    cfg.ingest.image.caption.enabled = false;
 
     let cfg_clone = cfg.clone();
     let scope = env.scope();
@@ -334,8 +334,8 @@ async fn garbage_png_increments_errors_counter_exactly_once() {
     let mut cfg = env.config.clone();
     // p9-fb-25: workspace.include removed; extension routing is now
     // handled by extractor matching alone (no config knob).
-    cfg.image.ocr.enabled = false;
-    cfg.image.caption.enabled = false;
+    cfg.ingest.image.ocr.enabled = false;
+    cfg.ingest.image.caption.enabled = false;
 
     let cfg_clone = cfg.clone();
     let scope = env.scope();

crates/kebab-app/tests/ingest_log_smoke.rs

@@ -23,8 +23,8 @@ fn minimal_config(workspace: &std::path::Path, log_dir: &std::path::Path) -> Con
     cfg.storage.model_dir = model_dir.to_string_lossy().into_owned();
     cfg.models.embedding.provider = "none".to_string();
     cfg.models.embedding.dimensions = 0;
-    cfg.chunking.target_tokens = 80;
-    cfg.chunking.overlap_tokens = 20;
+    cfg.ingest.chunking.target_tokens = 80;
+    cfg.ingest.chunking.overlap_tokens = 20;
     cfg.logging = LoggingCfg {
         ingest_log_enabled: true,
         ingest_log_dir: log_dir.to_path_buf(),

crates/kebab-app/tests/ingest_pdf_ocr_smoke.rs

@@ -22,8 +22,8 @@ fn ollama_endpoint() -> String {
 
 fn make_ocr_env_real() -> TestEnv {
     let mut env = TestEnv::lexical_only();
-    env.config.pdf.ocr.enabled = true;
-    env.config.pdf.ocr.endpoint = Some(ollama_endpoint());
+    env.config.ingest.pdf.ocr.enabled = true;
+    env.config.ingest.pdf.ocr.endpoint = Some(ollama_endpoint());
     env.config.models.embedding.provider = "none".to_string();
 
     let src = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
@@ -92,8 +92,8 @@ fn ocr_text_indexed_and_searchable() {
 #[test]
 fn ingest_with_cancel_aborts_mid_pdf() {
     let mut env = TestEnv::lexical_only();
-    env.config.pdf.ocr.enabled = true;
-    env.config.pdf.ocr.endpoint = Some("http://127.0.0.1:1".to_string());
+    env.config.ingest.pdf.ocr.enabled = true;
+    env.config.ingest.pdf.ocr.endpoint = Some("http://127.0.0.1:1".to_string());
 
     let src = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
         .parent()

crates/kebab-app/tests/ingest_progress.rs

@@ -69,40 +69,74 @@ fn progress_event_sequence_matches_design_section_2_4a() {
         other => panic!("expected Completed last, got {other:?}"),
     }
 
-    // Middle: 3 AssetStarted/AssetFinished pairs in monotonic idx order.
-    let asset_events: Vec<&IngestEvent> = events[2..events.len() - 1].iter().collect();
-    assert_eq!(
-        asset_events.len(),
-        6,
-        "expected 3 (Started + Finished) pairs, got {asset_events:?}"
-    );
-    for (chunk_idx, pair) in asset_events.chunks(2).enumerate() {
-        let expected_idx = chunk_idx as u32 + 1;
-        match (pair[0], pair[1]) {
-            (
-                IngestEvent::AssetStarted {
-                    idx: si,
-                    total: st,
-                    media,
-                    ..
-                },
-                IngestEvent::AssetFinished {
-                    idx: fi,
-                    total: ft,
-                    result,
-                    chunks,
-                },
-            ) => {
-                assert_eq!(*si, expected_idx, "Started idx mismatch: {pair:?}");
-                assert_eq!(*fi, expected_idx, "Finished idx mismatch: {pair:?}");
-                assert_eq!(*st, 3, "Started total mismatch");
-                assert_eq!(*ft, 3, "Finished total mismatch");
-                assert_eq!(media, "markdown", "fixture is markdown only");
-                assert_eq!(*result, IngestItemKind::New, "first ingest → New");
-                assert!(*chunks >= 1, "chunks: {pair:?}");
+    // Middle (v0.24.0 ordering invariant §2.4a): per asset the stream is
+    //   AssetStarted < AssetChunked < [ExpansionProgress*] < AssetTimings
+    //     < AssetFinished
+    // Expansion is disabled in the lexical fixture, so no ExpansionProgress
+    // frames appear here — but AssetChunked + AssetTimings are emitted for
+    // every markdown asset.
+    let middle = &events[2..events.len() - 1];
+
+    // 3 AssetStarted events, monotonic idx 1..=3, all markdown, total = 3.
+    let started: Vec<u32> = middle
+        .iter()
+        .filter_map(|e| match e {
+            IngestEvent::AssetStarted {
+                idx, total, media, ..
+            } => {
+                assert_eq!(*total, 3, "Started total mismatch: {e:?}");
+                assert_eq!(media, "markdown", "fixture is markdown only: {e:?}");
+                Some(*idx)
             }
-            other => panic!("expected Started+Finished pair, got {other:?}"),
-        }
+            _ => None,
+        })
+        .collect();
+    assert_eq!(started, vec![1, 2, 3], "AssetStarted idx order: {middle:?}");
+
+    // 3 AssetFinished events, monotonic idx 1..=3, each New with ≥1 chunk.
+    let finished: Vec<u32> = middle
+        .iter()
+        .filter_map(|e| match e {
+            IngestEvent::AssetFinished {
+                idx,
+                total,
+                result,
+                chunks,
+            } => {
+                assert_eq!(*total, 3, "Finished total mismatch: {e:?}");
+                assert_eq!(*result, IngestItemKind::New, "first ingest → New: {e:?}");
+                assert!(*chunks >= 1, "chunks: {e:?}");
+                Some(*idx)
+            }
+            _ => None,
+        })
+        .collect();
+    assert_eq!(finished, vec![1, 2, 3], "AssetFinished idx order: {middle:?}");
+
+    // v0.24.0 additive events: exactly one AssetChunked + one AssetTimings
+    // per asset, each strictly bracketed by that asset's Started / Finished.
+    for target in 1u32..=3 {
+        let started_at = middle
+            .iter()
+            .position(|e| matches!(e, IngestEvent::AssetStarted { idx, .. } if *idx == target))
+            .unwrap_or_else(|| panic!("missing AssetStarted for idx {target}: {middle:?}"));
+        let finished_at = middle
+            .iter()
+            .position(|e| matches!(e, IngestEvent::AssetFinished { idx, .. } if *idx == target))
+            .unwrap_or_else(|| panic!("missing AssetFinished for idx {target}: {middle:?}"));
+        let chunked_at = middle
+            .iter()
+            .position(|e| matches!(e, IngestEvent::AssetChunked { idx, chunks, .. } if *idx == target && *chunks >= 1))
+            .unwrap_or_else(|| panic!("missing AssetChunked for idx {target}: {middle:?}"));
+        let timings_at = middle
+            .iter()
+            .position(|e| matches!(e, IngestEvent::AssetTimings { idx, .. } if *idx == target))
+            .unwrap_or_else(|| panic!("missing AssetTimings for idx {target}: {middle:?}"));
+        assert!(
+            started_at < chunked_at && chunked_at < timings_at && timings_at < finished_at,
+            "idx {target} ordering: started={started_at} chunked={chunked_at} \
+             timings={timings_at} finished={finished_at}: {middle:?}"
+        );
     }
 }
 
@@ -162,9 +196,9 @@ fn pdf_ocr_progress_emits_started_finished_events() {
     config.storage.data_dir = data_dir.to_string_lossy().into_owned();
     config.models.embedding.provider = "none".to_string();
     config.models.embedding.dimensions = 0;
-    config.pdf.ocr.enabled = true;
+    config.ingest.pdf.ocr.enabled = true;
     if let Ok(endpoint) = std::env::var("KEBAB_PDF_OCR_ENDPOINT") {
-        config.pdf.ocr.endpoint = Some(endpoint);
+        config.ingest.pdf.ocr.endpoint = Some(endpoint);
     }
 
     let scope = kebab_core::SourceScope {

crates/kebab-app/tests/pdf_ocr_events_insert_smoke.rs

@@ -49,9 +49,9 @@ async fn ingest_dual_write_doc_id_matches_ndjson() {
     let result = spawn_blocking(move || {
         let mut env = TestEnv::lexical_only();
         // Enable PDF OCR + set up mock endpoint
-        env.config.pdf.ocr.enabled = true;
-        env.config.pdf.ocr.endpoint = Some(mock_url.clone());
-        env.config.pdf.ocr.model = "qwen2.5vl:3b".to_string();
+        env.config.ingest.pdf.ocr.enabled = true;
+        env.config.ingest.pdf.ocr.endpoint = Some(mock_url.clone());
+        env.config.ingest.pdf.ocr.model = "qwen2.5vl:3b".to_string();
         // Enable ingest log
         let log_dir = env.temp.path().join("logs");
         std::fs::create_dir_all(&log_dir).unwrap();

crates/kebab-app/tests/pdf_pipeline.rs

@@ -121,8 +121,8 @@ fn cfg_with_pdf(env: &TestEnv) -> Config {
     // PDF ingest does not need OCR / caption / LM — leave defaults
     // (ocr.enabled=false, caption.enabled=false). The image pipeline
     // construction step skips both adapters.
-    cfg.image.ocr.enabled = false;
-    cfg.image.caption.enabled = false;
+    cfg.ingest.image.ocr.enabled = false;
+    cfg.ingest.image.caption.enabled = false;
     cfg
 }
 
@@ -162,7 +162,9 @@ fn ingest_3_page_pdf_produces_one_doc_and_per_page_chunks() {
         "one chunk per non-empty page"
     );
     assert_eq!(
-        pdf_item.parser_version.as_ref().map(|p| p.0.as_str()),
+        pdf_item.parser_version
+            .as_ref()
+            .map(|p| p.0.split('|').next().unwrap()),
         Some("pdf-text-v1")
     );
     assert_eq!(
@@ -477,7 +479,10 @@ fn inspect_doc_surfaces_page_spans() {
         .find(|i| i.doc_path.0.ends_with("inspect.pdf"))
         .unwrap();
     let doc = kebab_app::inspect_doc_with_config(cfg, pdf_item.doc_id.as_ref().unwrap()).unwrap();
-    assert_eq!(doc.parser_version.0, "pdf-text-v1");
+    // v0.26.2: stored parser_version is now `pdf-text-v1|<ingest-config-sig>`
+    // (the signature folds chunking / pdf.ocr settings for skip detection).
+    // Assert the base identity by taking the prefix before the first '|'.
+    assert_eq!(doc.parser_version.0.split('|').next().unwrap(), "pdf-text-v1");
     assert_eq!(doc.blocks.len(), 3);
     for block in &doc.blocks {
         match block {

crates/kebab-app/tests/schema_active_versions.rs

@@ -12,8 +12,8 @@ fn minimal_config(data_dir: &std::path::Path, workspace_root: &std::path::Path)
     cfg.storage.model_dir = data_dir.join("models").to_string_lossy().into_owned();
     cfg.models.embedding.provider = "none".to_string();
     cfg.models.embedding.dimensions = 0;
-    cfg.chunking.target_tokens = 80;
-    cfg.chunking.overlap_tokens = 20;
+    cfg.ingest.chunking.target_tokens = 80;
+    cfg.ingest.chunking.overlap_tokens = 20;
     cfg
 }
 

crates/kebab-app/tests/schema_report.rs

@@ -14,8 +14,8 @@ fn minimal_config(data_dir: &std::path::Path, workspace_root: &std::path::Path)
     config.storage.model_dir = data_dir.join("models").to_string_lossy().into_owned();
     config.models.embedding.provider = "none".to_string();
     config.models.embedding.dimensions = 0;
-    config.chunking.target_tokens = 80;
-    config.chunking.overlap_tokens = 20;
+    config.ingest.chunking.target_tokens = 80;
+    config.ingest.chunking.overlap_tokens = 20;
     config
 }
 

crates/kebab-app/tests/search_lexical.rs

@@ -111,7 +111,8 @@ fn first_ingest_bumps_corpus_revision() {
     store_before.run_migrations().unwrap();
     // V004 seeds 0; V009 + V010 + V011 migrations each bump by 1 to
     // invalidate stale LRU caches (spec §5.2). Baseline before ingest = 3.
-    // (V012 derivation_cache is purely additive — does NOT bump.)
+    // (V012 derivation_cache + V013 drop-chunk-aliases are structural/additive
+    // — neither bumps corpus_revision.)
     let baseline = store_before.corpus_revision();
     assert_eq!(baseline, 3, "fresh store post-V011 baseline = 3");
 

crates/kebab-chunk/src/code_c_ast_v1.rs

@@ -152,7 +152,6 @@ fn make_chunk(
         token_estimate,
         chunker_version: chunker_version.clone(),
         policy_hash: base_policy_hash.to_string(),
-        aliases: None,
     }
 }
 

crates/kebab-chunk/src/code_cpp_ast_v1.rs

@@ -154,7 +154,6 @@ fn make_chunk(
         token_estimate,
         chunker_version: chunker_version.clone(),
         policy_hash: base_policy_hash.to_string(),
-        aliases: None,
     }
 }
 

crates/kebab-chunk/src/code_go_ast_v1.rs

@@ -154,7 +154,6 @@ fn make_chunk(
         token_estimate,
         chunker_version: chunker_version.clone(),
         policy_hash: base_policy_hash.to_string(),
-        aliases: None,
     }
 }
 

crates/kebab-chunk/src/code_java_ast_v1.rs

@@ -154,7 +154,6 @@ fn make_chunk(
         token_estimate,
         chunker_version: chunker_version.clone(),
         policy_hash: base_policy_hash.to_string(),
-        aliases: None,
     }
 }
 

crates/kebab-chunk/src/code_js_ast_v1.rs

@@ -154,7 +154,6 @@ fn make_chunk(
         token_estimate,
         chunker_version: chunker_version.clone(),
         policy_hash: base_policy_hash.to_string(),
-        aliases: None,
     }
 }
 

crates/kebab-chunk/src/code_kotlin_ast_v1.rs

@@ -154,7 +154,6 @@ fn make_chunk(
         token_estimate,
         chunker_version: chunker_version.clone(),
         policy_hash: base_policy_hash.to_string(),
-        aliases: None,
     }
 }
 

crates/kebab-chunk/src/code_python_ast_v1.rs

@@ -154,7 +154,6 @@ fn make_chunk(
         token_estimate,
         chunker_version: chunker_version.clone(),
         policy_hash: base_policy_hash.to_string(),
-        aliases: None,
     }
 }
 

crates/kebab-chunk/src/code_rust_ast_v1.rs

@@ -154,7 +154,6 @@ fn make_chunk(
         token_estimate,
         chunker_version: chunker_version.clone(),
         policy_hash: base_policy_hash.to_string(),
-        aliases: None,
     }
 }
 

crates/kebab-chunk/src/code_ts_ast_v1.rs

@@ -154,7 +154,6 @@ fn make_chunk(
         token_estimate,
         chunker_version: chunker_version.clone(),
         policy_hash: base_policy_hash.to_string(),
-        aliases: None,
     }
 }
 

crates/kebab-chunk/src/md_heading_v1.rs

@@ -339,7 +339,6 @@ fn build_chunk(
         token_estimate,
         chunker_version: chunker_version.clone(),
         policy_hash: policy_hash.to_string(),
-        aliases: None,
     }
 }
 

crates/kebab-chunk/src/pdf_page_v1.rs

@@ -177,7 +177,6 @@ impl Chunker for PdfPageV1Chunker {
                     token_estimate,
                     chunker_version: chunker_version.clone(),
                     policy_hash: base_policy_hash.clone(),
-                    aliases: None,
                 });
             }
         }

crates/kebab-chunk/src/tier2_shared.rs

@@ -196,6 +196,5 @@ fn build_chunk_from_span(
         token_estimate,
         chunker_version: chunker_version.clone(),
         policy_hash: base_policy_hash.to_string(),
-        aliases: None,
     }
 }

crates/kebab-chunk/tests/fixtures/code-sample.c.chunks.snapshot.json

@@ -1,6 +1,5 @@
 [
   {
-    "aliases": null,
     "block_ids": [
       "8149e12ca002489acb4a0f74c97a061a"
     ],
@@ -23,7 +22,6 @@
     "tokenized_korean_text": "# include < stdio . h > # include < stdlib . h > # define MAX _ BUF 4096 typedef enum { OK = 0 , ERR _ PARSE , ERR _ IO , } status _ t ; typedef struct { int id ; char name [ 64 ]; status _ t status ; } record _ t ; static int counter = 0 ;"
   },
   {
-    "aliases": null,
     "block_ids": [
       "1baaa89f21a47b2f32d6396a24a85454"
     ],
@@ -46,7 +44,6 @@
     "tokenized_korean_text": "int parse _ record ( const char * line , record _ t * out ) { if ( line == NULL || out == NULL ) return ERR _ PARSE ; return OK ; }"
   },
   {
-    "aliases": null,
     "block_ids": [
       "8d0e14cbcc6d1e92d7878ab796ea68b8"
     ],
@@ -69,7 +66,6 @@
     "tokenized_korean_text": "void print _ record ( const record _ t * r ) { printf (\"[% d ] % s ( status =% d )\\ n \", r -> id , r -> name , r -> status ); }"
   },
   {
-    "aliases": null,
     "block_ids": [
       "9c2ede84423871b615d48c38fefb1853"
     ],

crates/kebab-chunk/tests/fixtures/code-sample.cpp.chunks.snapshot.json

@@ -1,6 +1,5 @@
 [
   {
-    "aliases": null,
     "block_ids": [
       "53292605459065d170cd36c118e20546"
     ],
@@ -23,7 +22,6 @@
     "tokenized_korean_text": "# include < string > # include < vector > namespace kebab {"
   },
   {
-    "aliases": null,
     "block_ids": [
       "f349acad94c9fa4cf9ad1c0a93e83610"
     ],
@@ -46,7 +44,6 @@
     "tokenized_korean_text": "class MdHeadingV 1 Chunker { public : MdHeadingV 1 Chunker ( ) = default ; ~ MdHeadingV 1 Chunker ( ) = default ; std : : string chunk _ doc ( const std : : string & doc ) { return doc ; } int operator ( ) ( int x ) const { return x * 2 ; } private : int counter _ = 0 ; };"
   },
   {
-    "aliases": null,
     "block_ids": [
       "8b9811387717d0bd4abf84abcc35b8b1"
     ],
@@ -69,7 +66,6 @@
     "tokenized_korean_text": "template < typename T > T identity ( T value ) { return value ; }"
   },
   {
-    "aliases": null,
     "block_ids": [
       "1754cb6b971f6a4cb292f144a4f0570b"
     ],
@@ -92,7 +88,6 @@
     "tokenized_korean_text": "void global _ helper ( ) { / / free function in kebab namespace }"
   },
   {
-    "aliases": null,
     "block_ids": [
       "14b5f3393d6d25f822f5b70763d24acd"
     ],

crates/kebab-chunk/tests/fixtures/code-sample.go.chunks.snapshot.json

@@ -1,6 +1,5 @@
 [
   {
-    "aliases": null,
     "block_ids": [
       "c182bf37e32c7fc1b868bd617f8eaf66"
     ],
@@ -23,7 +22,6 @@
     "tokenized_korean_text": "import ( \" fmt \" \" os \" \" strings \" )"
   },
   {
-    "aliases": null,
     "block_ids": [
       "c9992cdcfdf3c2a7700a4abc4782a8a4"
     ],
@@ -46,7 +44,6 @@
     "tokenized_korean_text": "func ComputeMRR ( scores [ ] float 64 ) float 64 { if len ( scores ) == 0 { return 0 . 0 } _ = fmt . Sprintf (\"% v \", scores ) return 1 . 0 / float 64 ( len ( scores ) ) }"
   },
   {
-    "aliases": null,
     "block_ids": [
       "5f18dc3e79fe946ba05d32c3bfc00684"
     ],
@@ -69,7 +66,6 @@
     "tokenized_korean_text": "type MetricsCollector struct { Scores [ ] float 64 Labels [ ] string Counts map [ string ] int Totals map [ string ] float 64 Tags [ ] string }"
   },
   {
-    "aliases": null,
     "block_ids": [
       "3009cc022ca832c323393e4f9bcdb388"
     ],
@@ -92,7 +88,6 @@
     "tokenized_korean_text": "type BaseEvaluator struct { Name string } func ( e * BaseEvaluator ) Evaluate ( data [ ] string ) error { _ = os . Stderr _ = strings . Join ( data , \",\") return nil }"
   },
   {
-    "aliases": null,
     "block_ids": [
       "e0e83d1d7f9327a1902ae9a8f67c1f1c"
     ],
@@ -115,7 +110,6 @@
     "tokenized_korean_text": "func ( m * MetricsCollector ) Run ( inputs [ ] float 64 ) { for _, inp := range inputs { m . Scores = append ( m . Scores , inp , ) } }"
   },
   {
-    "aliases": null,
     "block_ids": [
       "0e6a572bc3fe2bd6d173fe614bd1b763"
     ],
@@ -138,7 +132,6 @@
     "tokenized_korean_text": "func ( m * MetricsCollector ) Report ( ) map [ string ] interface {} { return map [ string ] interface {}{ \" mean \": 0 . 0 , \" count \": len ( m . Scores ) , \" tags \": m . Tags , } }"
   },
   {
-    "aliases": null,
     "block_ids": [
       "5d269745b2e5dbdcbef0c09ba54b0bd6"
     ],
@@ -161,7 +154,6 @@
     "tokenized_korean_text": "func BigCompute ( data [ ] int ) int { v 0 := 0 if 0 < len ( data ) { v 0 = data [ 0 ] } v 1 := 0 if 1 < len ( data ) { v 1 = data [ 1 ] } v 2 := 0 if 2 < len ( data ) { v 2 = data [ 2 ] } v 3 := 0 if 3 < len ( data ) { v 3 = data [ 3 ] } v 4 := 0 if 4 < len ( data ) { v 4 = data [ 4 ] } v 5 := 0 if 5 < len ( data ) { v 5 = data [ 5 ] } v 6 := 0 if 6 < len ( data ) { v 6 = data [ 6 ] } v 7 := 0 if 7 < len ( data ) { v 7 = data [ 7 ] } v 8 := 0 if 8 < len ( data ) { v 8 = data [ 8 ] } v 9 := 0 if 9 < len ( data ) { v 9 = data [ 9 ] } v 10 := 0 if 10 < len ( data ) { v 10 = data [ 10 ] } v 11 := 0 if 11 < len ( data ) { v 11 = data [ 11 ] } v 12 := 0 if 12 < len ( data ) { v 12 = data [ 12 ] } v 13 := 0 if 13 < len ( data ) { v 13 = data [ 13 ] } v 14 := 0 if 14 < len ( data ) { v 14 = data [ 14 ] } v 15 := 0 if 15 < len ( data ) { v 15 = data [ 15 ] } v 16 := 0 if 16 < len ( data ) { v 16 = data [ 16 ] } v 17 := 0 if 17 < len ( data ) { v 17 = data [ 17 ] } v 18 := 0 if 18 < len ( data ) { v 18 = data [ 18 ] } v 19 := 0 if 19 < len ( data ) { v 19 = data [ 19 ] } v 20 := 0 if 20 < len ( data ) { v 20 = data [ 20 ] } v 21 := 0 if 21 < len ( data ) { v 21 = data [ 21 ] } v 22 := 0 if 22 < len ( data ) { v 22 = data [ 22 ] } v 23 := 0 if 23 < len ( data ) { v 23 = data [ 23 ] } v 24 := 0 if 24 < len ( data ) { v 24 = data [ 24 ] } v 25 := 0 if 25 < len ( data ) { v 25 = data [ 25 ] } v 26 := 0 if 26 < len ( data ) { v 26 = data [ 26 ] } v 27 := 0 if 27 < len ( data ) { v 27 = data [ 27 ] } v 28 := 0 if 28 < len ( data ) { v 28 = data [ 28 ] } v 29 := 0 if 29 < len ( data ) { v 29 = data [ 29 ] } v 30 := 0 if 30 < len ( data ) { v 30 = data [ 30 ] } v 31 := 0 if 31 < len ( data ) { v 31 = data [ 31 ] } v 32 := 0 if 32 < len ( data ) { v 32 = data [ 32 ] } v 33 := 0 if 33 < len ( data ) { v 33 = data [ 33 ] } v 34 := 0 if 34 < len ( data ) { v 34 = data [ 34 ] } v 35 := 0 if 35 < len ( data ) { v 35 = data [ 35 ] } v 36 := 0 if 36 < len ( data ) { v 36 = data [ 36 ] } v 37 := 0 if 37 < len ( data ) { v 37 = data [ 37 ] } v 38 := 0 if 38 < len ( data ) { v 38 = data [ 38 ] } v 39 := 0 if 39 < len ( data ) { v 39 = data [ 39 ] } v 40 := 0 if 40 < len ( data ) { v 40 = data [ 40 ] } v 41 := 0 if 41 < len ( data ) { v 41 = data [ 41 ] } v 42 := 0 if 42 < len ( data ) { v 42 = data [ 42 ] } v 43 := 0 if 43 < len ( data ) { v 43 = data [ 43 ] } v 44 := 0 if 44 < len ( data ) { v 44 = data [ 44 ] } v 45 := 0 if 45 < len ( data ) { v 45 = data [ 45 ] } v 46 := 0 if 46 < len ( data ) { v 46 = data [ 46 ] } v 47 := 0 if 47 < len ( data ) { v 47 = data [ 47 ] } v 48 := 0 if 48 < len ( data ) { v 48 = data [ 48 ] } v 49 := 0 if 49 < len ( data ) { v 49 = data [ 49 ]"
   },
   {
-    "aliases": null,
     "block_ids": [
       "5d269745b2e5dbdcbef0c09ba54b0bd6"
     ],
@@ -184,7 +176,6 @@
     "tokenized_korean_text": "} v 50 := 0 if 50 < len ( data ) { v 50 = data [ 50 ] } v 51 := 0 if 51 < len ( data ) { v 51 = data [ 51 ] } v 52 := 0 if 52 < len ( data ) { v 52 = data [ 52 ] } v 53 := 0 if 53 < len ( data ) { v 53 = data [ 53 ] } v 54 := 0 if 54 < len ( data ) { v 54 = data [ 54 ] } v 55 := 0 if 55 < len ( data ) { v 55 = data [ 55 ] } v 56 := 0 if 56 < len ( data ) { v 56 = data [ 56 ] } v 57 := 0 if 57 < len ( data ) { v 57 = data [ 57 ] } v 58 := 0 if 58 < len ( data ) { v 58 = data [ 58 ] } v 59 := 0 if 59 < len ( data ) { v 59 = data [ 59 ] } v 60 := 0 if 60 < len ( data ) { v 60 = data [ 60 ] } v 61 := 0 if 61 < len ( data ) { v 61 = data [ 61 ] } v 62 := 0 if 62 < len ( data ) { v 62 = data [ 62 ] } v 63 := 0 if 63 < len ( data ) { v 63 = data [ 63 ] } v 64 := 0 if 64 < len ( data ) { v 64 = data [ 64 ] } v 65 := 0 if 65 < len ( data ) { v 65 = data [ 65 ] } v 66 := 0 if 66 < len ( data ) { v 66 = data [ 66 ] } v 67 := 0 if 67 < len ( data ) { v 67 = data [ 67 ] } v 68 := 0 if 68 < len ( data ) { v 68 = data [ 68 ] } v 69 := 0 if 69 < len ( data ) { v 69 = data [ 69 ] } v 70 := 0 if 70 < len ( data ) { v 70 = data [ 70 ] } v 71 := 0 if 71 < len ( data ) { v 71 = data [ 71 ] } v 72 := 0 if 72 < len ( data ) { v 72 = data [ 72 ] } v 73 := 0 if 73 < len ( data ) { v 73 = data [ 73 ] } v 74 := 0 if 74 < len ( data ) { v 74 = data [ 74 ] } v 75 := 0 if 75 < len ( data ) { v 75 = data [ 75 ] } v 76 := 0 if 76 < len ( data ) { v 76 = data [ 76 ] } v 77 := 0 if 77 < len ( data ) { v 77 = data [ 77 ] } v 78 := 0 if 78 < len ( data ) { v 78 = data [ 78 ] } v 79 := 0 if 79 < len ( data ) { v 79 = data [ 79 ] } v 80 := 0 if 80 < len ( data ) { v 80 = data [ 80 ] } v 81 := 0 if 81 < len ( data ) { v 81 = data [ 81 ] } v 82 := 0 if 82 < len ( data ) { v 82 = data [ 82 ] } v 83 := 0 if 83 < len ( data ) { v 83 = data [ 83 ] } v 84 := 0 if 84 < len ( data ) { v 84 = data [ 84 ] } v 85 := 0 if 85 < len ( data ) { v 85 = data [ 85 ] } v 86 := 0 if 86 < len ( data ) { v 86 = data [ 86 ] } v 87 := 0 if 87 < len ( data ) { v 87 = data [ 87 ] } v 88 := 0 if 88 < len ( data ) { v 88 = data [ 88 ] } v 89 := 0 if 89 < len ( data ) { v 89 = data [ 89 ] } v 90 := 0 if 90 < len ( data ) { v 90 = data [ 90 ] } v 91 := 0 if 91 < len ( data ) { v 91 = data [ 91 ] } v 92 := 0 if 92 < len ( data ) { v 92 = data [ 92 ] } v 93 := 0 if 93 < len ( data ) { v 93 = data [ 93 ] } v 94 := 0 if 94 < len ( data ) { v 94 = data [ 94 ] } v 95 := 0 if 95 < len ( data ) { v 95 = data [ 95 ] } v 96 := 0 if 96 < len ( data ) { v 96 = data [ 96 ] } v 97 := 0 if 97 < len ( data ) { v 97 = data [ 97 ] } v 98 := 0 if 98 < len ( data ) { v 98 = data [ 98 ] } v 99 := 0 if 99 < len ( data ) { v 99 = data [ 99 ]"
   },
   {
-    "aliases": null,
     "block_ids": [
       "5d269745b2e5dbdcbef0c09ba54b0bd6"
     ],
@@ -207,7 +198,6 @@
     "tokenized_korean_text": "} v 100 := 0 if 100 < len ( data ) { v 100 = data [ 100 ] } v 101 := 0 if 101 < len ( data ) { v 101 = data [ 101 ] } v 102 := 0 if 102 < len ( data ) { v 102 = data [ 102 ] } v 103 := 0 if 103 < len ( data ) { v 103 = data [ 103 ] } v 104 := 0 if 104 < len ( data ) { v 104 = data [ 104 ] } v 105 := 0 if 105 < len ( data ) { v 105 = data [ 105 ] } v 106 := 0 if 106 < len ( data ) { v 106 = data [ 106 ] } v 107 := 0 if 107 < len ( data ) { v 107 = data [ 107 ] } v 108 := 0 if 108 < len ( data ) { v 108 = data [ 108 ] } v 109 := 0 if 109 < len ( data ) { v 109 = data [ 109 ] } v 110 := 0 if 110 < len ( data ) { v 110 = data [ 110 ] } v 111 := 0 if 111 < len ( data ) { v 111 = data [ 111 ] } v 112 := 0 if 112 < len ( data ) { v 112 = data [ 112 ] } v 113 := 0 if 113 < len ( data ) { v 113 = data [ 113 ] } v 114 := 0 if 114 < len ( data ) { v 114 = data [ 114 ] } v 115 := 0 if 115 < len ( data ) { v 115 = data [ 115 ] } v 116 := 0 if 116 < len ( data ) { v 116 = data [ 116 ] } v 117 := 0 if 117 < len ( data ) { v 117 = data [ 117 ] } v 118 := 0 if 118 < len ( data ) { v 118 = data [ 118 ] } v 119 := 0 if 119 < len ( data ) { v 119 = data [ 119 ] } v 120 := 0 if 120 < len ( data ) { v 120 = data [ 120 ] } v 121 := 0 if 121 < len ( data ) { v 121 = data [ 121 ] } v 122 := 0 if 122 < len ( data ) { v 122 = data [ 122 ] } v 123 := 0 if 123 < len ( data ) { v 123 = data [ 123 ] } v 124 := 0 if 124 < len ( data ) { v 124 = data [ 124 ] } v 125 := 0 if 125 < len ( data ) { v 125 = data [ 125 ] } v 126 := 0 if 126 < len ( data ) { v 126 = data [ 126 ] } v 127 := 0 if 127 < len ( data ) { v 127 = data [ 127 ] } v 128 := 0 if 128 < len ( data ) { v 128 = data [ 128 ] } v 129 := 0 if 129 < len ( data ) { v 129 = data [ 129 ] } v 130 := 0 if 130 < len ( data ) { v 130 = data [ 130 ] } v 131 := 0 if 131 < len ( data ) { v 131 = data [ 131 ] } v 132 := 0 if 132 < len ( data ) { v 132 = data [ 132 ] } v 133 := 0 if 133 < len ( data ) { v 133 = data [ 133 ] } v 134 := 0 if 134 < len ( data ) { v 134 = data [ 134 ] } v 135 := 0 if 135 < len ( data ) { v 135 = data [ 135 ] } v 136 := 0 if 136 < len ( data ) { v 136 = data [ 136 ] } v 137 := 0 if 137 < len ( data ) { v 137 = data [ 137 ] } v 138 := 0 if 138 < len ( data ) { v 138 = data [ 138 ] } v 139 := 0 if 139 < len ( data ) { v 139 = data [ 139 ] } v 140 := 0 if 140 < len ( data ) { v 140 = data [ 140 ] } v 141 := 0 if 141 < len ( data ) { v 141 = data [ 141 ] } v 142 := 0 if 142 < len ( data ) { v 142 = data [ 142 ] } v 143 := 0 if 143 < len ( data ) { v 143 = data [ 143 ] } v 144 := 0 if 144 < len ( data ) { v 144 = data [ 144 ] } v 145 := 0 if 145 < len ( data ) { v 145 = data [ 145 ] } v 146 := 0 if 146 < len ( data ) { v 146 = data [ 146 ] } v 147 := 0 if 147 < len ( data ) { v 147 = data [ 147 ] } v 148 := 0 if 148 < len ( data ) { v 148 = data [ 148 ] } v 149 := 0 if 149 < len ( data ) { v 149 = data [ 149 ]"
   },
   {
-    "aliases": null,
     "block_ids": [
       "5d269745b2e5dbdcbef0c09ba54b0bd6"
     ],
@@ -230,7 +220,6 @@
     "tokenized_korean_text": "} v 150 := 0 if 150 < len ( data ) { v 150 = data [ 150 ] } v 151 := 0 if 151 < len ( data ) { v 151 = data [ 151 ] } v 152 := 0 if 152 < len ( data ) { v 152 = data [ 152 ] } v 153 := 0 if 153 < len ( data ) { v 153 = data [ 153 ] } v 154 := 0 if 154 < len ( data ) { v 154 = data [ 154 ] } v 155 := 0 if 155 < len ( data ) { v 155 = data [ 155 ] } v 156 := 0 if 156 < len ( data ) { v 156 = data [ 156 ] } v 157 := 0 if 157 < len ( data ) { v 157 = data [ 157 ] } v 158 := 0 if 158 < len ( data ) { v 158 = data [ 158 ] } v 159 := 0 if 159 < len ( data ) { v 159 = data [ 159 ] } v 160 := 0 if 160 < len ( data ) { v 160 = data [ 160 ] } v 161 := 0 if 161 < len ( data ) { v 161 = data [ 161 ] } v 162 := 0 if 162 < len ( data ) { v 162 = data [ 162 ] } v 163 := 0 if 163 < len ( data ) { v 163 = data [ 163 ] } v 164 := 0 if 164 < len ( data ) { v 164 = data [ 164 ] } v 165 := 0 if 165 < len ( data ) { v 165 = data [ 165 ] } v 166 := 0 if 166 < len ( data ) { v 166 = data [ 166 ] } v 167 := 0 if 167 < len ( data ) { v 167 = data [ 167 ] } v 168 := 0 if 168 < len ( data ) { v 168 = data [ 168 ] } v 169 := 0 if 169 < len ( data ) { v 169 = data [ 169 ] } v 170 := 0 if 170 < len ( data ) { v 170 = data [ 170 ] } v 171 := 0 if 171 < len ( data ) { v 171 = data [ 171 ] } v 172 := 0 if 172 < len ( data ) { v 172 = data [ 172 ] } v 173 := 0 if 173 < len ( data ) { v 173 = data [ 173 ] } v 174 := 0 if 174 < len ( data ) { v 174 = data [ 174 ] } v 175 := 0 if 175 < len ( data ) { v 175 = data [ 175 ] } v 176 := 0 if 176 < len ( data ) { v 176 = data [ 176 ] } v 177 := 0 if 177 < len ( data ) { v 177 = data [ 177 ] } v 178 := 0 if 178 < len ( data ) { v 178 = data [ 178 ] } v 179 := 0 if 179 < len ( data ) { v 179 = data [ 179 ] } v 180 := 0 if 180 < len ( data ) { v 180 = data [ 180 ] } v 181 := 0 if 181 < len ( data ) { v 181 = data [ 181 ] } v 182 := 0 if 182 < len ( data ) { v 182 = data [ 182 ] } v 183 := 0 if 183 < len ( data ) { v 183 = data [ 183 ] } v 184 := 0 if 184 < len ( data ) { v 184 = data [ 184 ] } v 185 := 0 if 185 < len ( data ) { v 185 = data [ 185 ] } v 186 := 0 if 186 < len ( data ) { v 186 = data [ 186 ] } v 187 := 0 if 187 < len ( data ) { v 187 = data [ 187 ] } v 188 := 0 if 188 < len ( data ) { v 188 = data [ 188 ] } v 189 := 0 if 189 < len ( data ) { v 189 = data [ 189 ] } v 190 := 0 if 190 < len ( data ) { v 190 = data [ 190 ] } v 191 := 0 if 191 < len ( data ) { v 191 = data [ 191 ] } v 192 := 0 if 192 < len ( data ) { v 192 = data [ 192 ] } v 193 := 0 if 193 < len ( data ) { v 193 = data [ 193 ] } v 194 := 0 if 194 < len ( data ) { v 194 = data [ 194 ] } v 195 := 0 if 195 < len ( data ) { v 195 = data [ 195 ] } v 196 := 0 if 196 < len ( data ) { v 196 = data [ 196 ] } v 197 := 0 if 197 < len ( data ) { v 197 = data [ 197 ] } v 198 := 0 if 198 < len ( data ) { v 198 = data [ 198 ] } v 199 := 0 if 199 < len ( data ) { v 199 = data [ 199 ]"
   },
   {
-    "aliases": null,
     "block_ids": [
       "5d269745b2e5dbdcbef0c09ba54b0bd6"
     ],

crates/kebab-cli/Cargo.toml

@@ -51,5 +51,10 @@ tempfile     = { workspace = true }
 rusqlite     = { workspace = true }
 time         = { workspace = true }
 
+[features]
+# opt-in (macOS): build the `kebab` binary with candle on the Apple Silicon GPU.
+#   cargo build --release --features embed_metal
+embed_metal = ["kebab-app/embed_metal"]
+
 [lints]
 workspace = true

crates/kebab-cli/src/main.rs

@@ -60,6 +60,12 @@ enum Cmd {
         force: bool,
     },
 
+    /// config.toml 관리 (스키마 마이그레이션 등).
+    Config {
+        #[command(subcommand)]
+        what: ConfigWhat,
+    },
+
     /// Scan the workspace and ingest new/updated documents.
     Ingest {
         /// Workspace root override.
@@ -346,6 +352,16 @@ enum Cmd {
     },
 }
 
+#[derive(Subcommand, Debug)]
+enum ConfigWhat {
+    /// 기존 config.toml 을 새 스키마로 마이그레이션(빠진 섹션 추가 + 멱등 + .bak 백업).
+    Migrate {
+        /// 변경만 출력하고 파일은 수정하지 않는다.
+        #[arg(long)]
+        dry_run: bool,
+    },
+}
+
 #[derive(Subcommand, Debug)]
 enum ListWhat {
     /// List documents currently indexed.
@@ -616,6 +632,24 @@ fn run(cli: &Cli) -> anyhow::Result<()> {
                 .map(|v| v.eq_ignore_ascii_case("plain"))
                 .unwrap_or(false);
             let mode = progress::ProgressMode::from_flags(cli.json, cli.quiet, plain_env);
+
+            // Surface the active embedding backend/device on the terminal so the
+            // user sees it without grepping kb.log (the per-device tracing line
+            // only lands in the log file at --verbose). Suppressed under
+            // --json/--quiet. The Metal note reflects the build (`embed_metal`);
+            // the confirmed runtime device is in kb.log (`candle device = ...`).
+            if !cli.json && !cli.quiet {
+                let backend = match cfg.models.embedding.provider.as_str() {
+                    "candle" if cfg!(feature = "embed_metal") => "candle (Metal/GPU 빌드)",
+                    "candle" => "candle (CPU, 순수 Rust)",
+                    "fastembed" | "onnx" | "" => "fastembed (onnxruntime)",
+                    "none" => "비활성 (lexical-only)",
+                    other => other,
+                };
+                eprintln!("임베딩 백엔드: {backend} · 모델 {} ({}-dim)",
+                    cfg.models.embedding.model, cfg.models.embedding.dimensions);
+            }
+
             let (tx, rx) = std::sync::mpsc::channel::<kebab_app::IngestEvent>();
             let display_handle =
                 std::thread::spawn(move || progress::ProgressDisplay::new(mode).run(rx));
@@ -1310,6 +1344,42 @@ fn run(cli: &Cli) -> anyhow::Result<()> {
             Ok(())
         }
 
+        Cmd::Config { what } => match what {
+            ConfigWhat::Migrate { dry_run } => {
+                let report =
+                    kebab_app::config_migrate_with_config_path(cli.config.as_deref(), *dry_run)?;
+                if cli.json {
+                    println!(
+                        "{}",
+                        serde_json::to_string(&wire::wire_config_migration(&report))?
+                    );
+                } else if !report.changed {
+                    println!(
+                        "config 이미 최신입니다 (schema v{}).",
+                        report.to_schema_version
+                    );
+                } else {
+                    let verb = if report.dry_run { "변경 예정" } else { "적용됨" };
+                    println!(
+                        "config 마이그레이션 {verb}: v{} → v{} ({} changes)",
+                        report.from_schema_version,
+                        report.to_schema_version,
+                        report.changes.len()
+                    );
+                    for c in &report.changes {
+                        println!("  - [{:?}] {} — {}", c.kind, c.path, c.detail);
+                    }
+                    if let Some(bak) = &report.backup_path {
+                        println!("백업: {bak}");
+                    }
+                    if report.dry_run {
+                        println!("(--dry-run: 파일 미수정. 적용하려면 --dry-run 없이 재실행)");
+                    }
+                }
+                Ok(())
+            }
+        },
+
         Cmd::Doctor => {
             let report = kebab_app::doctor_with_config_path(cli.config.as_deref())?;
             if cli.json {

crates/kebab-cli/src/progress.rs

@@ -19,16 +19,23 @@
 //! `Sender` end is dropped (i.e. when `ingest_with_config_progress`
 //! returns).
 
+use std::collections::HashMap;
 use std::io::{IsTerminal, Write};
 use std::sync::mpsc::Receiver;
+use std::sync::{Arc, Mutex};
+use std::time::Instant;
 
-use indicatif::{ProgressBar, ProgressDrawTarget, ProgressStyle};
+use indicatif::{ProgressBar, ProgressDrawTarget, ProgressState, ProgressStyle};
 use kebab_app::IngestEvent;
 use time::OffsetDateTime;
 use time::format_description::well_known::Rfc3339;
 
 use crate::wire;
 
+/// v0.26.1: number of slowest assets surfaced in the end-of-run summary.
+/// Constant for now (spec defers the config knob).
+const SLOWEST_TOP_N: usize = 5;
+
 /// Rendering mode for `ProgressDisplay`. The mode is fixed at
 /// construction — each `kebab ingest` invocation is a single mode
 /// (chosen from `--json` plus `IsTerminal` detection).
@@ -65,11 +72,33 @@ impl ProgressMode {
 pub struct ProgressDisplay {
     mode: ProgressMode,
     bar: Option<ProgressBar>,
+    /// v0.26.1 heartbeat: start `Instant` of the asset currently in
+    /// flight, shared with the bar's steady-tick custom template key so
+    /// the `(Ns)` elapsed counter advances *between* events (the drain
+    /// loop blocks on `recv()`, so without the ticker the counter would
+    /// freeze). `None` while scanning / between assets / after completion.
+    asset_start: Arc<Mutex<Option<Instant>>>,
+    /// v0.26.1: workspace path of the asset currently in flight — set on
+    /// `AssetStarted`, reused by `AssetPhase` to render `{path} · {phase}…`.
+    current_path: Option<String>,
+    /// v0.26.1 slowest summary: idx → path, captured from `AssetStarted`
+    /// so `AssetTimings` (which only carries `idx`) can name the asset.
+    asset_paths: HashMap<u32, String>,
+    /// v0.26.1 slowest summary: (path, total_ms) per asset that reported
+    /// `AssetTimings`. Sorted + truncated to top-N on `Completed`.
+    timings: Vec<(String, u64)>,
 }
 
 impl ProgressDisplay {
     pub fn new(mode: ProgressMode) -> Self {
-        Self { mode, bar: None }
+        Self {
+            mode,
+            bar: None,
+            asset_start: Arc::new(Mutex::new(None)),
+            current_path: None,
+            asset_paths: HashMap::new(),
+            timings: Vec::new(),
+        }
     }
 
     /// Block until `rx` returns `Err` (sender dropped). Renders one
@@ -120,15 +149,43 @@ impl ProgressDisplay {
             }
             IngestEvent::ScanCompleted { total } => {
                 if let Some(bar) = self.bar.as_mut() {
-                    bar.disable_steady_tick();
                     bar.set_length(u64::from(*total));
                     bar.set_position(0);
+                    // v0.26.1: a custom `{asset_elapsed}` key reads the shared
+                    // per-asset start `Instant` and appends ` (Ns)`. Combined
+                    // with the steady tick below, the elapsed counter advances
+                    // even while the drain loop is blocked on `recv()` waiting
+                    // for the next (possibly very slow) phase event.
+                    let asset_start = Arc::clone(&self.asset_start);
                     bar.set_style(
-                        ProgressStyle::with_template("ingest [{bar:30}] {pos}/{len} {wide_msg}")
-                            .unwrap()
-                            .progress_chars("=> "),
+                        ProgressStyle::with_template(
+                            "ingest [{bar:30}] {pos}/{len} {wide_msg}{asset_elapsed}",
+                        )
+                        .unwrap()
+                        .with_key(
+                            "asset_elapsed",
+                            move |_: &ProgressState, w: &mut dyn std::fmt::Write| {
+                                if let Ok(guard) = asset_start.lock()
+                                    && let Some(started) = *guard
+                                {
+                                    let secs = started.elapsed().as_secs();
+                                    // Only show once the asset has been running
+                                    // a moment — avoids `(0s)` flicker on fast
+                                    // assets.
+                                    if secs >= 1 {
+                                        let _ = write!(w, " ({secs}s)");
+                                    }
+                                }
+                            },
+                        )
+                        .progress_chars("=> "),
                     );
                     bar.set_message("");
+                    if tty && !quiet {
+                        bar.enable_steady_tick(std::time::Duration::from_secs(1));
+                    } else {
+                        bar.disable_steady_tick();
+                    }
                 }
                 if !tty && !quiet {
                     let mut err = std::io::stderr().lock();
@@ -141,11 +198,22 @@ impl ProgressDisplay {
                 path,
                 media,
             } => {
+                // v0.26.1: remember the path so AssetPhase can render it and
+                // the slowest summary (keyed by idx in AssetTimings) can name
+                // the asset.
+                self.current_path = Some(path.clone());
+                self.asset_paths.insert(*idx, path.clone());
+                // v0.26.1: (re)start the per-asset heartbeat clock.
+                if let Ok(mut guard) = self.asset_start.lock() {
+                    *guard = Some(Instant::now());
+                }
                 if let Some(bar) = self.bar.as_ref() {
-                    // One draw per file: position only. set_message() would
-                    // trigger a second independent draw and pollute TTY scrollback.
-                    // Filename is visible in the non-TTY plain-line path below.
                     bar.set_position(u64::from(idx.saturating_sub(1)));
+                    // v0.26.1: show the current filename on the bar (TTY).
+                    // Previously position-only — the interactive user couldn't
+                    // tell which file was in flight. The steady tick redraws
+                    // in place, so this no longer pollutes scrollback.
+                    bar.set_message(abbreviate_path(path));
                 }
                 if !tty && !quiet {
                     let mut err = std::io::stderr().lock();
@@ -154,13 +222,95 @@ impl ProgressDisplay {
             }
             IngestEvent::AssetFinished { .. } => {
                 // Position is advanced in AssetStarted; bar.finish_and_clear()
-                // in Completed handles the final state. No per-asset bar update
-                // here avoids the duplicate-frame artifact in TTY scrollback.
+                // in Completed handles the final state. v0.26.1: stop the
+                // heartbeat clock so the bar doesn't show a stale `(Ns)` in the
+                // gap before the next AssetStarted.
+                if let Ok(mut guard) = self.asset_start.lock() {
+                    *guard = None;
+                }
+                self.current_path = None;
+            }
+            // v0.26.1: an asset entered a slow internal phase (ocr / caption /
+            // embed). Surface which phase + model is running so a multi-second
+            // vision-model call no longer looks frozen.
+            IngestEvent::AssetPhase {
+                idx,
+                total,
+                phase,
+                model,
+            } => {
+                let label = match model {
+                    Some(m) => format!("{phase}({m})"),
+                    None => phase.clone(),
+                };
+                if let Some(bar) = self.bar.as_ref() {
+                    let path = self.current_path.as_deref().unwrap_or("");
+                    bar.set_message(format!("{} · {label}…", abbreviate_path(path)));
+                }
+                if !tty && !quiet {
+                    let mut err = std::io::stderr().lock();
+                    let _ = writeln!(err, "ingest: {idx}/{total} · {label}…");
+                }
+            }
+            // v0.24.0: asset-internal phase visibility. AssetChunked uses the
+            // bar *message* (live sub-progress for the current asset) —
+            // distinct from the per-file position draw, so a single large
+            // document no longer looks frozen. AssetTimings prints a one-line
+            // breakdown when the asset finishes.
+            IngestEvent::AssetChunked { idx, total, chunks } => {
+                if let Some(bar) = self.bar.as_ref() {
+                    bar.set_message(format!("→ {chunks} chunks"));
+                }
+                if !tty && !quiet {
+                    let mut err = std::io::stderr().lock();
+                    let _ = writeln!(err, "ingest: {idx}/{total} → {chunks} chunks");
+                }
+            }
+            IngestEvent::AssetTimings {
+                idx,
+                parse_ms,
+                chunk_ms,
+                embed_ms,
+                store_ms,
+                ocr_ms,
+                caption_ms,
+                ..
+            } => {
+                // v0.26.1: accumulate (path, total_ms) for the slowest summary.
+                // total = every measured phase (expansion_ms is always 0).
+                let total_ms = parse_ms + chunk_ms + embed_ms + store_ms + ocr_ms + caption_ms;
+                if let Some(path) = self.asset_paths.get(idx) {
+                    self.timings.push((path.clone(), total_ms));
+                }
+                if let Some(bar) = self.bar.as_ref() {
+                    bar.set_message("");
+                }
+                if !quiet {
+                    let mut err = std::io::stderr().lock();
+                    // v0.26.1: only print ocr / caption when they actually ran
+                    // (markdown leaves them 0) so the text path stays uncluttered.
+                    let mut parts = vec![
+                        format!("parse {}", fmt_ms(*parse_ms)),
+                        format!("chunk {}", fmt_ms(*chunk_ms)),
+                    ];
+                    if *ocr_ms > 0 {
+                        parts.push(format!("ocr {}", fmt_ms(*ocr_ms)));
+                    }
+                    if *caption_ms > 0 {
+                        parts.push(format!("caption {}", fmt_ms(*caption_ms)));
+                    }
+                    parts.push(format!("embed {}", fmt_ms(*embed_ms)));
+                    parts.push(format!("store {}", fmt_ms(*store_ms)));
+                    let _ = writeln!(err, "  ⏱ {}", parts.join(" · "));
+                }
             }
             IngestEvent::Completed { counts } => {
                 if let Some(bar) = self.bar.take() {
                     bar.finish_and_clear();
                 }
+                if let Ok(mut guard) = self.asset_start.lock() {
+                    *guard = None;
+                }
                 // Always emit summary in both TTY and non-TTY (unless quiet).
                 // Bug fix: previously TTY had no summary line after bar.finish_and_clear().
                 if !quiet {
@@ -170,6 +320,10 @@ impl ProgressDisplay {
                         "ingest: complete (scanned={} new={} updated={} skipped={} errors={})",
                         counts.scanned, counts.new, counts.updated, counts.skipped, counts.errors,
                     );
+                    // v0.26.1: slowest-asset summary. Useful in both TTY and
+                    // non-TTY (it pinpoints the bottleneck file), so it prints
+                    // unless --quiet. --json mode never reaches here (emit_json).
+                    let _ = write_slowest_summary(&mut err, &self.timings, SLOWEST_TOP_N);
                 }
             }
             IngestEvent::Aborted { counts } => {
@@ -239,6 +393,59 @@ fn emit_json(event: &IngestEvent) -> anyhow::Result<()> {
     Ok(())
 }
 
+/// Render a phase duration (milliseconds) compactly for the human-mode
+/// `AssetTimings` line: `< 1000ms` stays in `ms`, larger spans collapse to
+/// one-decimal seconds so a 45-second embed reads `45.0s`, not `45000ms`.
+fn fmt_ms(ms: u64) -> String {
+    if ms >= 1000 {
+        format!("{:.1}s", ms as f64 / 1000.0)
+    } else {
+        format!("{ms}ms")
+    }
+}
+
+/// v0.26.1: shorten an over-long workspace path for the progress-bar
+/// message so the live `(Ns)` heartbeat suffix stays visible on a narrow
+/// terminal. Keeps the tail (filename + a couple of parents) — that's the
+/// distinguishing part — and prefixes `…` when truncated. Paths up to the
+/// budget pass through verbatim.
+fn abbreviate_path(path: &str) -> String {
+    const MAX: usize = 48;
+    let char_count = path.chars().count();
+    if char_count <= MAX {
+        return path.to_string();
+    }
+    // Keep the last MAX-1 chars (1 reserved for the leading ellipsis).
+    let tail: String = path
+        .chars()
+        .skip(char_count - (MAX - 1))
+        .collect::<String>();
+    format!("…{tail}")
+}
+
+/// v0.26.1: render the end-of-run "slowest assets" summary. Sorts
+/// `(path, total_ms)` descending by time, takes the top `n`, and writes a
+/// compact table to `w`. No-op (writes nothing) when `timings` is empty so
+/// a run with no per-asset timing (e.g. all-skipped) prints no stray header.
+fn write_slowest_summary(
+    w: &mut impl Write,
+    timings: &[(String, u64)],
+    n: usize,
+) -> std::io::Result<()> {
+    if timings.is_empty() {
+        return Ok(());
+    }
+    let mut sorted: Vec<&(String, u64)> = timings.iter().collect();
+    // desc by ms; ties broken by path for deterministic output.
+    sorted.sort_by(|a, b| b.1.cmp(&a.1).then_with(|| a.0.cmp(&b.0)));
+    let top = &sorted[..sorted.len().min(n)];
+    writeln!(w, "⏱ 최장 소요 top-{}:", top.len())?;
+    for (rank, (path, ms)) in top.iter().enumerate() {
+        writeln!(w, "  {}. {} — {}", rank + 1, path, fmt_ms(*ms))?;
+    }
+    Ok(())
+}
+
 /// Format the current wall-clock as RFC 3339 — used by `wire_ingest_progress`
 /// so every emitted event carries an `ts` field per §2.4a / the wire schema.
 pub(crate) fn now_rfc3339() -> anyhow::Result<String> {
@@ -285,6 +492,15 @@ mod tests {
         }
     }
 
+    #[test]
+    fn fmt_ms_switches_unit_at_one_second() {
+        assert_eq!(fmt_ms(0), "0ms");
+        assert_eq!(fmt_ms(999), "999ms");
+        assert_eq!(fmt_ms(1000), "1.0s");
+        assert_eq!(fmt_ms(45_000), "45.0s");
+        assert_eq!(fmt_ms(1500), "1.5s");
+    }
+
     #[test]
     fn now_rfc3339_parses_back() {
         let s = now_rfc3339().unwrap();
@@ -292,4 +508,61 @@ mod tests {
         // well-formed RFC 3339 string.
         OffsetDateTime::parse(&s, &Rfc3339).expect("RFC 3339 round-trip");
     }
+
+    #[test]
+    fn abbreviate_path_passes_short_paths_through() {
+        assert_eq!(abbreviate_path("notes/foo.md"), "notes/foo.md");
+    }
+
+    #[test]
+    fn abbreviate_path_keeps_tail_with_ellipsis() {
+        let long = "a/very/deeply/nested/directory/structure/that/exceeds/the/budget/file.md";
+        let out = abbreviate_path(long);
+        assert!(out.starts_with('…'), "should be prefixed with ellipsis: {out}");
+        assert!(out.ends_with("file.md"), "should keep the filename tail: {out}");
+        // 48-char budget: 1 ellipsis + 47 tail chars.
+        assert_eq!(out.chars().count(), 48);
+    }
+
+    #[test]
+    fn write_slowest_summary_empty_writes_nothing() {
+        let mut buf = Vec::new();
+        write_slowest_summary(&mut buf, &[], 5).unwrap();
+        assert!(buf.is_empty());
+    }
+
+    #[test]
+    fn write_slowest_summary_sorts_desc_and_truncates() {
+        let timings = vec![
+            ("a.md".to_string(), 100),
+            ("b.png".to_string(), 5_000),
+            ("c.pdf".to_string(), 2_000),
+            ("d.md".to_string(), 50),
+        ];
+        let mut buf = Vec::new();
+        write_slowest_summary(&mut buf, &timings, 2).unwrap();
+        let out = String::from_utf8(buf).unwrap();
+        assert!(out.contains("top-2:"), "{out}");
+        // b (5s) ranks first, c (2s) second; a/d excluded.
+        let b_pos = out.find("b.png").expect("b.png present");
+        let c_pos = out.find("c.pdf").expect("c.pdf present");
+        assert!(b_pos < c_pos, "b before c: {out}");
+        assert!(!out.contains("a.md"), "a.md excluded by top-2: {out}");
+        assert!(out.contains("5.0s"), "b renders as 5.0s: {out}");
+    }
+
+    #[test]
+    fn write_slowest_summary_tie_breaks_by_path() {
+        let timings = vec![
+            ("z.md".to_string(), 1_000),
+            ("a.md".to_string(), 1_000),
+        ];
+        let mut buf = Vec::new();
+        write_slowest_summary(&mut buf, &timings, 5).unwrap();
+        let out = String::from_utf8(buf).unwrap();
+        assert!(
+            out.find("a.md").unwrap() < out.find("z.md").unwrap(),
+            "equal ms ties break alphabetically: {out}"
+        );
+    }
 }

crates/kebab-cli/src/wire.rs

@@ -225,6 +225,12 @@ pub fn wire_bulk_search_item(item: &kebab_core::BulkSearchItem) -> Value {
     v
 }
 
+/// `config_migration.v1` 직렬화. `ConfigMigrationReport` 가 `schema_version`
+/// 필드를 자체 보유하므로(doctor 와 동일) 그대로 직렬화한다.
+pub fn wire_config_migration(r: &kebab_app::ConfigMigrationReport) -> Value {
+    serde_json::to_value(r).expect("ConfigMigrationReport serializes")
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

crates/kebab-config/Cargo.toml

@@ -15,6 +15,7 @@ serde        = { workspace = true }
 serde_json   = { workspace = true }
 thiserror    = { workspace = true }
 toml         = "0.8"
+toml_edit    = "0.22"
 dirs         = "5"
 # p9-fb-05: warn-log when current_dir() fails (chroot, deleted cwd)
 # during workspace.root resolution.

crates/kebab-config/src/lib.rs

@@ -9,8 +9,21 @@ use std::path::{Path, PathBuf};
 use serde::{Deserialize, Serialize};
 
 mod paths;
+pub mod migrate;
 pub use paths::{expand_path, expand_path_with_base};
 
+/// f32 의 shortest round-trip(Display)을 f64 로 재파싱해 직렬화한다.
+/// `0.3_f32` 가 `0.30000001192092896` 으로 새지 않고 `0.3` 으로 출력되게 한다.
+/// 마이그레이션 시 toml_edit relocation 의 무손실 비교를 깨지 않도록, 그리고
+/// `kebab config migrate` 산출물이 사람이 읽기 좋게.
+fn ser_f32_clean<S>(v: &f32, s: S) -> Result<S::Ok, S::Error>
+where
+    S: serde::Serializer,
+{
+    let clean: f64 = format!("{v}").parse().unwrap_or(f64::from(*v));
+    s.serialize_f64(clean)
+}
+
 /// Signal: `Config::from_file` / `Config::load` failed due to missing path,
 /// I/O failure, TOML parse failure, or post-parse validation failure.
 ///
@@ -38,32 +51,20 @@ pub struct Config {
     pub schema_version: u32,
     pub workspace: WorkspaceCfg,
     pub storage: StorageCfg,
-    pub indexing: IndexingCfg,
-    pub chunking: ChunkingCfg,
     pub models: ModelsCfg,
+    /// v3: 모든 미디어 형식 ingest 설정의 우산 — 병렬도(← 옛 `[indexing]`),
+    /// chunking, code, image, pdf 가 전부 `[ingest.*]` 하위로 통합됐다.
+    /// `#[serde(default)]` 로 두어 미변환 / 부분 config 도 로드된다(자동
+    /// 변환은 `Config::from_file` 가 메모리에서 수행 — T6).
+    #[serde(default)]
+    pub ingest: IngestCfg,
     pub search: SearchCfg,
     pub rag: RagCfg,
-    /// Image-pipeline settings (P6: OCR, captioning). Tagged
-    /// `#[serde(default)]` so pre-P6 config files that predate the
-    /// `[image]` section still load — defaults disable OCR / caption
-    /// (they cost a model call per asset).
-    #[serde(default = "ImageCfg::defaults")]
-    pub image: ImageCfg,
     /// p9-fb-14: TUI palette + role-style mapping. `#[serde(default)]`
     /// so configs that predate this section still load (defaults to
     /// `dark`).
     #[serde(default = "UiCfg::defaults")]
     pub ui: UiCfg,
-    /// p10-1A-1: code ingest settings. `#[serde(default)]` so existing
-    /// config files without an `[ingest]` / `[ingest.code]` section
-    /// load cleanly with built-in defaults.
-    #[serde(default)]
-    pub ingest: IngestCfg,
-    /// v0.20.0 sub-item 1: PDF ingest pipeline settings. `#[serde(default)]`
-    /// so pre-v0.20 config files without a `[pdf]` section load with
-    /// built-in defaults (OCR disabled — opt-in for scanned PDF KB).
-    #[serde(default = "PdfCfg::defaults")]
-    pub pdf: PdfCfg,
     /// v0.20.x ingest log surface. `#[serde(default)]` so pre-v0.20
     /// config files without a `[logging]` section load with built-in
     /// defaults (enabled=true, dir=~/.local/state/kebab/logs).
@@ -103,13 +104,6 @@ pub struct StorageCfg {
     pub copy_threshold_mb: u64,
 }
 
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub struct IndexingCfg {
-    pub max_parallel_extractors: u32,
-    pub max_parallel_embeddings: u32,
-    pub watch_filesystem: bool,
-}
-
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct ChunkingCfg {
     pub target_tokens: usize,
@@ -118,6 +112,17 @@ pub struct ChunkingCfg {
     pub chunker_version: String,
 }
 
+impl ChunkingCfg {
+    pub fn defaults() -> Self {
+        Self {
+            target_tokens: 500,
+            overlap_tokens: 80,
+            respect_markdown_headings: true,
+            chunker_version: "md-heading-v1".to_string(),
+        }
+    }
+}
+
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct ModelsCfg {
     pub embedding: EmbeddingModelCfg,
@@ -154,11 +159,29 @@ impl NliCfg {
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct EmbeddingModelCfg {
+    /// `fastembed` (default, onnxruntime), `candle` (pure-Rust, NUMA-safe),
+    /// or `ollama` (remote HTTP embedding endpoint). `none` disables
+    /// embeddings (lexical-only). Unknown values error at embedder
+    /// construction.
     pub provider: String,
     pub model: String,
     pub version: String,
     pub dimensions: usize,
     pub batch_size: usize,
+    /// Cap on the CPU worker threads the `candle` provider spins up
+    /// (sizes the global rayon pool; env `KEBAB_EMBED_THREADS` overrides).
+    /// `0` = auto (rayon default = #cores). Lever to sidestep the
+    /// onnxruntime 48-thread NUMA double-free; ignored by the `fastembed`
+    /// provider. Defaulted on load so pre-0.22 config files still parse.
+    #[serde(default)]
+    pub num_threads: u32,
+    /// HTTP endpoint for the `ollama` embedding provider (e.g.
+    /// `"http://127.0.0.1:11434"`). `None` (or a missing key in TOML) means
+    /// "fall back to `models.llm.endpoint`" — same convention as the OCR /
+    /// vision endpoints. Ignored by the `fastembed` / `candle` providers.
+    /// Defaulted on load so pre-0.26 config files still parse.
+    #[serde(default)]
+    pub endpoint: Option<String>,
 }
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -167,6 +190,7 @@ pub struct LlmCfg {
     pub model: String,
     pub context_tokens: usize,
     pub endpoint: String,
+    #[serde(serialize_with = "ser_f32_clean")]
     pub temperature: f32,
     pub seed: u64,
     /// v0.17.0 post-dogfood: Hard ceiling on a single HTTP exchange to
@@ -225,6 +249,7 @@ fn default_stale_threshold_days() -> u32 {
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct RagCfg {
     pub prompt_template_version: String,
+    #[serde(serialize_with = "ser_f32_clean")]
     pub score_gate: f32,
     pub explain_default: bool,
     pub max_context_tokens: usize,
@@ -274,7 +299,7 @@ pub struct RagCfg {
     ///
     /// Single-pass `ask` ignores this knob entirely — only multi-hop
     /// runs through the verification step (PR-9c-2 wires it).
-    #[serde(default = "default_nli_threshold")]
+    #[serde(default = "default_nli_threshold", serialize_with = "ser_f32_clean")]
     pub nli_threshold: f32,
 }
 
@@ -358,6 +383,36 @@ pub struct OcrCfg {
     /// `86400`).
     #[serde(default = "default_ocr_request_timeout_secs")]
     pub request_timeout_secs: u64,
+
+    // ── paddle-onnx engine overrides (v0.27.0) ──────────────────────────
+    // Only consulted when `engine == "paddle-onnx"`; the ollama-vision
+    // engine ignores them. All `#[serde(default)]` so pre-v0.27 config
+    // files load unchanged.
+    /// Override path to the detection ONNX model. `None` → bundled
+    /// `assets/paddleocr-onnx/ppocrv5_mobile_det.onnx` (or the directory
+    /// named by `KEBAB_IMAGE_OCR_MODEL_DIR`).
+    #[serde(default)]
+    pub det_model: Option<String>,
+    /// Override path to the recognition ONNX model. `None` → bundled
+    /// `assets/paddleocr-onnx/korean_ppocrv5_mobile_rec.onnx`.
+    #[serde(default)]
+    pub rec_model: Option<String>,
+    /// Override path to the character dictionary. `None` → bundled
+    /// `assets/paddleocr-onnx/korean_dict.txt`.
+    #[serde(default)]
+    pub dict: Option<String>,
+    /// DBNet detection box score threshold (0.0..=1.0). Boxes whose mean
+    /// probability is below this are dropped. Default `0.3`.
+    #[serde(default = "default_ocr_score_thresh", serialize_with = "ser_f32_clean")]
+    pub score_thresh: f32,
+    /// Polygon unclip ratio applied to each detected box before crop.
+    /// Larger = more padding around the text. Default `1.5`.
+    #[serde(default = "default_ocr_unclip_ratio", serialize_with = "ser_f32_clean")]
+    pub unclip_ratio: f32,
+    /// Hard cap on detected boxes per image (runaway guard). Extra boxes
+    /// past this count are truncated with a warning. Default `1000`.
+    #[serde(default = "default_ocr_max_boxes")]
+    pub max_boxes: usize,
 }
 
 impl OcrCfg {
@@ -370,10 +425,29 @@ impl OcrCfg {
             languages: vec!["eng".to_string(), "kor".to_string()],
             max_pixels: 1600,
             request_timeout_secs: default_ocr_request_timeout_secs(),
+            det_model: None,
+            rec_model: None,
+            dict: None,
+            score_thresh: default_ocr_score_thresh(),
+            unclip_ratio: default_ocr_unclip_ratio(),
+            max_boxes: default_ocr_max_boxes(),
         }
     }
 }
 
+/// paddle-onnx DBNet box score threshold default. See [`OcrCfg::score_thresh`].
+fn default_ocr_score_thresh() -> f32 {
+    0.3
+}
+/// paddle-onnx unclip ratio default. See [`OcrCfg::unclip_ratio`].
+fn default_ocr_unclip_ratio() -> f32 {
+    1.5
+}
+/// paddle-onnx box-count cap default. See [`OcrCfg::max_boxes`].
+fn default_ocr_max_boxes() -> usize {
+    1000
+}
+
 /// v0.17.2 post-dogfood: matches the legacy hard-coded ceiling so
 /// existing configs that omit the field keep behaving identically.
 /// Overridable per config / `KEBAB_IMAGE_OCR_REQUEST_TIMEOUT_SECS`.
@@ -493,7 +567,9 @@ pub struct PdfOcrCfg {
     /// scanned pages only. `true` — vision LLM 호출 on every page
     /// (vector PDF 의 dual-text confidence boost — doubles chunk count).
     pub always_on: bool,
-    /// Engine identifier. v1 only ships `"ollama-vision"`.
+    /// Engine identifier: `"ollama-vision"` or `"paddle-onnx"`. When set to
+    /// `"paddle-onnx"`, model paths and tuning knobs are read from
+    /// `[image.ocr]`, not `[pdf.ocr]` — PaddleOCR has no PDF-specific tuning.
     pub engine: String,
     /// Vision model id. Default `"qwen2.5vl:3b"` per PoC (§3.5 family
     /// asymmetry vs image OCR's gemma4:e4b is acknowledged).
@@ -513,7 +589,7 @@ pub struct PdfOcrCfg {
     /// Valid char ratio threshold (0.0..=1.0). Page with ratio below
     /// this is classified as scanned/mojibake → OCR fallback. Default
     /// `0.5`.
-    #[serde(default = "default_pdf_ocr_valid_ratio")]
+    #[serde(default = "default_pdf_ocr_valid_ratio", serialize_with = "ser_f32_clean")]
     pub valid_ratio_threshold: f32,
     /// Minimum char count per page below which page is auto-scanned.
     /// Default `20`.
@@ -522,6 +598,30 @@ pub struct PdfOcrCfg {
     /// Single-page lang hint. Default `Some("kor")`. `None` = no hint.
     #[serde(default = "default_pdf_ocr_lang_hint")]
     pub lang_hint: Option<String>,
+
+    // ── paddle-onnx engine overrides (v3) ───────────────────────────────
+    // Symmetric with `[ingest.image.ocr]`. v2 의 "pdf paddle 이 image 의
+    // 모델 경로를 빌려쓰던" 비대칭을 제거 — pdf 자체 키로 옮긴다. 마이그레이션
+    // (T5)이 image 값을 이 키로 복사해 signature 바이트 동일 유지. 전부
+    // `#[serde(default)]` 이라 pre-v3 config 도 로드.
+    /// Override path to the detection ONNX model. `None` → bundled.
+    #[serde(default)]
+    pub det_model: Option<String>,
+    /// Override path to the recognition ONNX model. `None` → bundled.
+    #[serde(default)]
+    pub rec_model: Option<String>,
+    /// Override path to the character dictionary. `None` → bundled.
+    #[serde(default)]
+    pub dict: Option<String>,
+    /// DBNet detection box score threshold (0.0..=1.0). Default `0.3`.
+    #[serde(default = "default_ocr_score_thresh", serialize_with = "ser_f32_clean")]
+    pub score_thresh: f32,
+    /// Polygon unclip ratio applied to each detected box. Default `1.5`.
+    #[serde(default = "default_ocr_unclip_ratio", serialize_with = "ser_f32_clean")]
+    pub unclip_ratio: f32,
+    /// Hard cap on detected boxes per page (runaway guard). Default `1000`.
+    #[serde(default = "default_ocr_max_boxes")]
+    pub max_boxes: usize,
 }
 
 impl PdfOcrCfg {
@@ -538,6 +638,12 @@ impl PdfOcrCfg {
             valid_ratio_threshold: default_pdf_ocr_valid_ratio(),
             min_char_count: default_pdf_ocr_min_char_count(),
             lang_hint: default_pdf_ocr_lang_hint(),
+            det_model: None,
+            rec_model: None,
+            dict: None,
+            score_thresh: default_ocr_score_thresh(),
+            unclip_ratio: default_ocr_unclip_ratio(),
+            max_boxes: default_ocr_max_boxes(),
         }
     }
 }
@@ -589,14 +695,47 @@ impl UiCfg {
     }
 }
 
-/// p10-1A-1: top-level ingest configuration wrapper. Contains per-media-type
-/// sub-sections; currently only `code` is defined.
-#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
-#[serde(default)]
+/// v3: 모든 미디어 형식 ingest 설정의 우산. 스칼라(병렬도)는 ← 옛 `[indexing]`,
+/// 미디어별 하위 테이블(chunking/code/image/pdf)은 ← 옛 top-level 섹션.
+/// 직렬화 순서 = 필드 순서: 스칼라(병렬도) 먼저, 하위 테이블 뒤
+/// (TOML 의 "bare key 는 sub-table header 앞" 규칙 준수).
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct IngestCfg {
-    pub code: IngestCodeCfg,
+    #[serde(default = "default_max_parallel_extractors")]
+    pub max_parallel_extractors: u32,
+    #[serde(default = "default_max_parallel_embeddings")]
+    pub max_parallel_embeddings: u32,
     #[serde(default)]
-    pub expansion: IngestExpansionCfg,
+    pub watch_filesystem: bool,
+    #[serde(default = "ChunkingCfg::defaults")]
+    pub chunking: ChunkingCfg,
+    #[serde(default)]
+    pub code: IngestCodeCfg,
+    #[serde(default = "ImageCfg::defaults")]
+    pub image: ImageCfg,
+    #[serde(default = "PdfCfg::defaults")]
+    pub pdf: PdfCfg,
+}
+
+impl Default for IngestCfg {
+    fn default() -> Self {
+        Self {
+            max_parallel_extractors: default_max_parallel_extractors(),
+            max_parallel_embeddings: default_max_parallel_embeddings(),
+            watch_filesystem: false,
+            chunking: ChunkingCfg::defaults(),
+            code: IngestCodeCfg::default(),
+            image: ImageCfg::defaults(),
+            pdf: PdfCfg::defaults(),
+        }
+    }
+}
+
+fn default_max_parallel_extractors() -> u32 {
+    2
+}
+fn default_max_parallel_embeddings() -> u32 {
+    1
 }
 
 /// p10-1A-1: settings for the code ingest pipeline. All fields have
@@ -637,39 +776,11 @@ impl Default for IngestCodeCfg {
     }
 }
 
-/// doc-side expansion config. Default: disabled (requires explicit opt-in).
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
-#[serde(default)]
-pub struct IngestExpansionCfg {
-    /// Whether doc-side alias expansion is enabled during ingest.
-    pub enabled: bool,
-    /// Ollama model used for alias generation (empty = use LLM default).
-    pub model: String,
-    /// Maximum aliases generated per chunk.
-    pub max_aliases_per_chunk: usize,
-    /// Prompt template version tag.
-    pub prompt_version: String,
-    /// Whether alias embeddings are stored as separate dense vectors.
-    pub embed_aliases: bool,
-}
-
-impl Default for IngestExpansionCfg {
-    fn default() -> Self {
-        Self {
-            enabled: false,
-            model: String::new(),
-            max_aliases_per_chunk: 8,
-            prompt_version: "expansion-v1".to_string(),
-            embed_aliases: false,
-        }
-    }
-}
-
 impl Config {
     /// Defaults per design §6.4.
     pub fn defaults() -> Self {
         Self {
-            schema_version: 1,
+            schema_version: crate::migrate::CURRENT_SCHEMA_VERSION,
             workspace: WorkspaceCfg {
                 root: "~/KnowledgeBase".to_string(),
                 exclude: vec![
@@ -688,17 +799,6 @@ impl Config {
                 runs_dir: "{data_dir}/runs".to_string(),
                 copy_threshold_mb: 100,
             },
-            indexing: IndexingCfg {
-                max_parallel_extractors: 2,
-                max_parallel_embeddings: 1,
-                watch_filesystem: false,
-            },
-            chunking: ChunkingCfg {
-                target_tokens: 500,
-                overlap_tokens: 80,
-                respect_markdown_headings: true,
-                chunker_version: "md-heading-v1".to_string(),
-            },
             models: ModelsCfg {
                 embedding: EmbeddingModelCfg {
                     provider: "fastembed".to_string(),
@@ -706,6 +806,8 @@ impl Config {
                     version: "v1".to_string(),
                     dimensions: 1024,
                     batch_size: 64,
+                    num_threads: 0,
+                    endpoint: None,
                 },
                 llm: LlmCfg {
                     provider: "ollama".to_string(),
@@ -723,6 +825,15 @@ impl Config {
                 },
                 nli: NliCfg::defaults(),
             },
+            ingest: IngestCfg {
+                max_parallel_extractors: 2,
+                max_parallel_embeddings: 1,
+                watch_filesystem: false,
+                chunking: ChunkingCfg::defaults(),
+                code: IngestCodeCfg::default(),
+                image: ImageCfg::defaults(),
+                pdf: PdfCfg::defaults(),
+            },
             search: SearchCfg {
                 default_k: 10,
                 hybrid_fusion: "rrf".to_string(),
@@ -741,10 +852,7 @@ impl Config {
                 multi_hop_max_pool_chunks: default_multi_hop_max_pool_chunks(),
                 nli_threshold: default_nli_threshold(),
             },
-            image: ImageCfg::defaults(),
             ui: UiCfg::defaults(),
-            ingest: IngestCfg::default(),
-            pdf: PdfCfg::defaults(),
             logging: LoggingCfg::default(),
             // p9-fb-05: defaults are not loaded from disk, so no
             // source_dir. Relative `workspace.root` (rare with
@@ -856,29 +964,56 @@ impl Config {
             })
         })?;
 
-        // p9-fb-25: probe for the legacy `workspace.include` key — if
-        // present, emit a one-shot deprecation warning. Detection uses
-        // raw `toml::Value` lookup; the warning fires via a process-
-        // level OnceLock so a long-running TUI / CLI run doesn't spam
-        // the log on every Config::load.
-        if let Ok(value) = toml::from_str::<toml::Value>(&text) {
-            if value
-                .get("workspace")
-                .and_then(|v| v.get("include"))
-                .is_some()
-            {
-                static DEPRECATION_FIRED: std::sync::OnceLock<()> = std::sync::OnceLock::new();
-                DEPRECATION_FIRED.get_or_init(|| {
+        // raw `toml::Value` 를 한 번만 파싱해 (1) legacy `workspace.include`
+        // deprecation probe (p9-fb-25) 와 (2) `schema_version` 감지(v3 자동변환)
+        // 에 함께 쓴다 — config load 는 매 CLI 호출마다 일어나므로 파싱 1회로.
+        let probe = toml::from_str::<toml::Value>(&text).ok();
+
+        // p9-fb-25: legacy `workspace.include` 키가 있으면 일회성 deprecation
+        // 경고(process-level OnceLock 로 장기 실행 시 로그 도배 방지).
+        if probe
+            .as_ref()
+            .and_then(|v| v.get("workspace"))
+            .and_then(|v| v.get("include"))
+            .is_some()
+        {
+            static DEPRECATION_FIRED: std::sync::OnceLock<()> = std::sync::OnceLock::new();
+            DEPRECATION_FIRED.get_or_init(|| {
+                tracing::warn!(
+                    target: "kebab-config",
+                    config = %path.display(),
+                    "deprecated config: `workspace.include` 필드는 더 이상 사용되지 않습니다 (p9-fb-25, v0.2.1+). 처리 가능한 형식 (md / png / jpg / pdf) 은 extractor 가 자동 결정. config 에서 이 필드를 제거해도 안전 — 더 이상 enforce 안 됨."
+                );
+            });
+        }
+
+        // v3: 파일의 schema_version 이 CURRENT 보다 낮으면 메모리에서 변환한다
+        // (디스크 미변경 — 파일 갱신은 `kebab config migrate`). 미변환 v2 파일도
+        // 설정 유실 없이 로드(불변식 #3). non-additive relocation(v2→v3) 은
+        // serde default forward-compat 로는 커버 안 되므로 반드시 거쳐야 한다.
+        let parse_text = {
+            let from = probe
+                .as_ref()
+                .and_then(|v| v.get("schema_version").and_then(toml::Value::as_integer))
+                .unwrap_or(1) as u32;
+            if from < crate::migrate::CURRENT_SCHEMA_VERSION {
+                static MIGRATE_WARNED: std::sync::OnceLock<()> = std::sync::OnceLock::new();
+                MIGRATE_WARNED.get_or_init(|| {
                     tracing::warn!(
                         target: "kebab-config",
                         config = %path.display(),
-                        "deprecated config: `workspace.include` 필드는 더 이상 사용되지 않습니다 (p9-fb-25, v0.2.1+). 처리 가능한 형식 (md / png / jpg / pdf) 은 extractor 가 자동 결정. config 에서 이 필드를 제거해도 안전 — 더 이상 enforce 안 됨."
+                        from,
+                        to = crate::migrate::CURRENT_SCHEMA_VERSION,
+                        "config 가 옛 스키마입니다 — 이번 실행은 메모리에서 변환됨. 파일 갱신: `kebab config migrate`."
                     );
                 });
+                crate::migrate::migrate_document(&text).new_text
+            } else {
+                text.clone()
             }
-        }
+        };
 
-        let mut cfg: Self = toml::from_str(&text).map_err(|e| {
+        let mut cfg: Self = toml::from_str(&parse_text).map_err(|e| {
             anyhow::Error::new(ConfigInvalid {
                 path: path.to_path_buf(),
                 cause: format!("parse_failed: {e}"),
@@ -921,33 +1056,33 @@ impl Config {
                 // indexing
                 "KEBAB_INDEXING_MAX_PARALLEL_EXTRACTORS" => {
                     if let Ok(n) = v.parse::<u32>() {
-                        self.indexing.max_parallel_extractors = n;
+                        self.ingest.max_parallel_extractors = n;
                     }
                 }
                 "KEBAB_INDEXING_MAX_PARALLEL_EMBEDDINGS" => {
                     if let Ok(n) = v.parse::<u32>() {
-                        self.indexing.max_parallel_embeddings = n;
+                        self.ingest.max_parallel_embeddings = n;
                     }
                 }
                 "KEBAB_INDEXING_WATCH_FILESYSTEM" => {
-                    self.indexing.watch_filesystem = parse_bool(v);
+                    self.ingest.watch_filesystem = parse_bool(v);
                 }
 
                 // chunking
                 "KEBAB_CHUNKING_TARGET_TOKENS" => {
                     if let Ok(n) = v.parse::<usize>() {
-                        self.chunking.target_tokens = n;
+                        self.ingest.chunking.target_tokens = n;
                     }
                 }
                 "KEBAB_CHUNKING_OVERLAP_TOKENS" => {
                     if let Ok(n) = v.parse::<usize>() {
-                        self.chunking.overlap_tokens = n;
+                        self.ingest.chunking.overlap_tokens = n;
                     }
                 }
                 "KEBAB_CHUNKING_RESPECT_MARKDOWN_HEADINGS" => {
-                    self.chunking.respect_markdown_headings = parse_bool(v);
+                    self.ingest.chunking.respect_markdown_headings = parse_bool(v);
                 }
-                "KEBAB_CHUNKING_CHUNKER_VERSION" => self.chunking.chunker_version = v.clone(),
+                "KEBAB_CHUNKING_CHUNKER_VERSION" => self.ingest.chunking.chunker_version = v.clone(),
 
                 // models.embedding
                 "KEBAB_MODELS_EMBEDDING_PROVIDER" => self.models.embedding.provider = v.clone(),
@@ -963,6 +1098,17 @@ impl Config {
                         self.models.embedding.batch_size = n;
                     }
                 }
+                "KEBAB_MODELS_EMBEDDING_NUM_THREADS" => {
+                    if let Ok(n) = v.parse::<u32>() {
+                        self.models.embedding.num_threads = n;
+                    }
+                }
+                "KEBAB_MODELS_EMBEDDING_ENDPOINT" => {
+                    // Empty value → None (= fall back to models.llm.endpoint),
+                    // mirroring the OCR endpoint override semantics.
+                    self.models.embedding.endpoint =
+                        if v.is_empty() { None } else { Some(v.clone()) };
+                }
 
                 // models.llm
                 "KEBAB_MODELS_LLM_PROVIDER" => self.models.llm.provider = v.clone(),
@@ -1069,18 +1215,18 @@ impl Config {
 
                 // image.ocr
                 "KEBAB_IMAGE_OCR_ENABLED" => {
-                    self.image.ocr.enabled = parse_bool(v);
+                    self.ingest.image.ocr.enabled = parse_bool(v);
                 }
-                "KEBAB_IMAGE_OCR_ENGINE" => self.image.ocr.engine = v.clone(),
-                "KEBAB_IMAGE_OCR_MODEL" => self.image.ocr.model = v.clone(),
+                "KEBAB_IMAGE_OCR_ENGINE" => self.ingest.image.ocr.engine = v.clone(),
+                "KEBAB_IMAGE_OCR_MODEL" => self.ingest.image.ocr.model = v.clone(),
                 "KEBAB_IMAGE_OCR_ENDPOINT" => {
                     // Empty env value is treated the same as "fall back
                     // to models.llm.endpoint" — i.e. set None.
-                    self.image.ocr.endpoint = if v.is_empty() { None } else { Some(v.clone()) };
+                    self.ingest.image.ocr.endpoint = if v.is_empty() { None } else { Some(v.clone()) };
                 }
                 "KEBAB_IMAGE_OCR_LANGUAGES" => {
                     // Comma-separated list, e.g. "eng,kor".
-                    self.image.ocr.languages = v
+                    self.ingest.image.ocr.languages = v
                         .split(',')
                         .map(|s| s.trim().to_string())
                         .filter(|s| !s.is_empty())
@@ -1088,38 +1234,66 @@ impl Config {
                 }
                 "KEBAB_IMAGE_OCR_MAX_PIXELS" => {
                     if let Ok(n) = v.parse::<u32>() {
-                        self.image.ocr.max_pixels = n;
+                        self.ingest.image.ocr.max_pixels = n;
                     }
                 }
                 "KEBAB_IMAGE_OCR_REQUEST_TIMEOUT_SECS" => {
                     if let Ok(n) = v.parse::<u64>() {
-                        self.image.ocr.request_timeout_secs = n;
+                        self.ingest.image.ocr.request_timeout_secs = n;
+                    }
+                }
+                // paddle-onnx engine overrides (v0.27.0). Empty string → None
+                // (fall back to bundled / KEBAB_IMAGE_OCR_MODEL_DIR).
+                "KEBAB_IMAGE_OCR_DET_MODEL" => {
+                    self.ingest.image.ocr.det_model =
+                        if v.is_empty() { None } else { Some(v.clone()) };
+                }
+                "KEBAB_IMAGE_OCR_REC_MODEL" => {
+                    self.ingest.image.ocr.rec_model =
+                        if v.is_empty() { None } else { Some(v.clone()) };
+                }
+                "KEBAB_IMAGE_OCR_DICT" => {
+                    self.ingest.image.ocr.dict = if v.is_empty() { None } else { Some(v.clone()) };
+                }
+                "KEBAB_IMAGE_OCR_SCORE_THRESH" => {
+                    if let Ok(f) = v.parse::<f32>() {
+                        self.ingest.image.ocr.score_thresh = f;
+                    }
+                }
+                "KEBAB_IMAGE_OCR_UNCLIP_RATIO" => {
+                    if let Ok(f) = v.parse::<f32>() {
+                        self.ingest.image.ocr.unclip_ratio = f;
+                    }
+                }
+                "KEBAB_IMAGE_OCR_MAX_BOXES" => {
+                    if let Ok(n) = v.parse::<usize>() {
+                        self.ingest.image.ocr.max_boxes = n;
                     }
                 }
 
                 // image.caption (P6-3)
                 "KEBAB_IMAGE_CAPTION_ENABLED" => {
-                    self.image.caption.enabled = parse_bool(v);
+                    self.ingest.image.caption.enabled = parse_bool(v);
                 }
                 "KEBAB_IMAGE_CAPTION_MAX_PIXELS" => {
                     if let Ok(n) = v.parse::<u32>() {
-                        self.image.caption.max_pixels = n;
+                        self.ingest.image.caption.max_pixels = n;
                     }
                 }
                 "KEBAB_IMAGE_CAPTION_PROMPT_TEMPLATE_VERSION" => {
-                    self.image.caption.prompt_template_version = v.clone();
+                    self.ingest.image.caption.prompt_template_version = v.clone();
                 }
 
                 // pdf.ocr (v0.20.0 sub-item 1)
-                "KEBAB_PDF_OCR_ENABLED" => self.pdf.ocr.enabled = parse_bool(v),
-                "KEBAB_PDF_OCR_ALWAYS_ON" => self.pdf.ocr.always_on = parse_bool(v),
-                "KEBAB_PDF_OCR_ENGINE" => self.pdf.ocr.engine = v.clone(),
-                "KEBAB_PDF_OCR_MODEL" => self.pdf.ocr.model = v.clone(),
+                "KEBAB_PDF_OCR_ENABLED" => self.ingest.pdf.ocr.enabled = parse_bool(v),
+                "KEBAB_PDF_OCR_ALWAYS_ON" => self.ingest.pdf.ocr.always_on = parse_bool(v),
+                "KEBAB_PDF_OCR_ENGINE" => self.ingest.pdf.ocr.engine = v.clone(),
+                "KEBAB_PDF_OCR_MODEL" => self.ingest.pdf.ocr.model = v.clone(),
                 "KEBAB_PDF_OCR_ENDPOINT" => {
-                    self.pdf.ocr.endpoint = if v.is_empty() { None } else { Some(v.clone()) };
+                    self.ingest.pdf.ocr.endpoint = if v.is_empty() { None } else { Some(v.clone()) };
                 }
                 "KEBAB_PDF_OCR_LANGUAGES" => {
-                    self.pdf.ocr.languages = v
+                    self.ingest.pdf.ocr.languages = v
                         .split(',')
                         .map(|s| s.trim().to_string())
                         .filter(|s| !s.is_empty())
@@ -1127,45 +1301,54 @@ impl Config {
                 }
                 "KEBAB_PDF_OCR_MAX_PIXELS" => {
                     if let Ok(n) = v.parse::<u32>() {
-                        self.pdf.ocr.max_pixels = n;
+                        self.ingest.pdf.ocr.max_pixels = n;
                     }
                 }
                 "KEBAB_PDF_OCR_REQUEST_TIMEOUT_SECS" => {
                     if let Ok(n) = v.parse::<u64>() {
-                        self.pdf.ocr.request_timeout_secs = n;
+                        self.ingest.pdf.ocr.request_timeout_secs = n;
                     }
                 }
                 "KEBAB_PDF_OCR_VALID_RATIO_THRESHOLD" => {
                     if let Ok(n) = v.parse::<f32>() {
-                        self.pdf.ocr.valid_ratio_threshold = n.clamp(0.0, 1.0);
+                        self.ingest.pdf.ocr.valid_ratio_threshold = n.clamp(0.0, 1.0);
                     }
                 }
                 "KEBAB_PDF_OCR_MIN_CHAR_COUNT" => {
                     if let Ok(n) = v.parse::<u32>() {
-                        self.pdf.ocr.min_char_count = n;
+                        self.ingest.pdf.ocr.min_char_count = n;
                     }
                 }
                 "KEBAB_PDF_OCR_LANG_HINT" => {
-                    self.pdf.ocr.lang_hint = if v.is_empty() { None } else { Some(v.clone()) };
+                    self.ingest.pdf.ocr.lang_hint = if v.is_empty() { None } else { Some(v.clone()) };
                 }
-
-                // ingest.expansion
-                "KEBAB_INGEST_EXPANSION_ENABLED" => {
-                    self.ingest.expansion.enabled = parse_bool(v);
+                // pdf paddle-onnx engine overrides (v3). image.ocr paddle 패턴 복제.
+                // Empty string → None (fall back to bundled / KEBAB_IMAGE_OCR_MODEL_DIR).
+                "KEBAB_PDF_OCR_DET_MODEL" => {
+                    self.ingest.pdf.ocr.det_model =
+                        if v.is_empty() { None } else { Some(v.clone()) };
                 }
-                "KEBAB_INGEST_EXPANSION_MODEL" => {
-                    self.ingest.expansion.model = v.clone();
+                "KEBAB_PDF_OCR_REC_MODEL" => {
+                    self.ingest.pdf.ocr.rec_model =
+                        if v.is_empty() { None } else { Some(v.clone()) };
                 }
-                "KEBAB_INGEST_EXPANSION_MAX_ALIASES" => {
-                    if let Ok(n) = v.parse::<usize>() {
-                        self.ingest.expansion.max_aliases_per_chunk = n;
+                "KEBAB_PDF_OCR_DICT" => {
+                    self.ingest.pdf.ocr.dict = if v.is_empty() { None } else { Some(v.clone()) };
+                }
+                "KEBAB_PDF_OCR_SCORE_THRESH" => {
+                    if let Ok(f) = v.parse::<f32>() {
+                        self.ingest.pdf.ocr.score_thresh = f;
                     }
                 }
-                "KEBAB_INGEST_EXPANSION_PROMPT_VERSION" => {
-                    self.ingest.expansion.prompt_version = v.clone();
+                "KEBAB_PDF_OCR_UNCLIP_RATIO" => {
+                    if let Ok(f) = v.parse::<f32>() {
+                        self.ingest.pdf.ocr.unclip_ratio = f;
+                    }
                 }
-                "KEBAB_INGEST_EXPANSION_EMBED_ALIASES" => {
-                    self.ingest.expansion.embed_aliases = parse_bool(v);
+                "KEBAB_PDF_OCR_MAX_BOXES" => {
+                    if let Ok(n) = v.parse::<usize>() {
+                        self.ingest.pdf.ocr.max_boxes = n;
+                    }
                 }
 
                 // Unknown KEBAB_* keys are silently ignored — see
@@ -1351,11 +1534,68 @@ theme = "dark"
         assert_eq!(c, back);
     }
 
+    /// 불변식 #3: `from_file` 이 v2 파일을 디스크 미변경으로 메모리에서 v3
+    /// 변환 — 미변환 v2 파일도 설정 유실 0.
+    #[test]
+    fn from_file_auto_migrates_v2_in_memory() {
+        let dir = tempfile::tempdir().unwrap();
+        let p = dir.path().join("config.toml");
+        std::fs::write(
+            &p,
+            "\
+schema_version = 2
+
+[workspace]
+root = \"/my/notes\"
+exclude = []
+
+[chunking]
+target_tokens = 777
+
+[image.ocr]
+enabled = true
+engine = \"ollama-vision\"
+model = \"gemma4:e4b\"
+languages = [\"kor\"]
+max_pixels = 1600
+",
+        )
+        .unwrap();
+        let c = Config::from_file(&p).expect("v2 auto-migrate load");
+        // 사용자 v2 값이 새 경로로 살아있어야(기본값 유실 X).
+        assert_eq!(c.ingest.chunking.target_tokens, 777);
+        assert!(c.ingest.image.ocr.enabled);
+        assert_eq!(c.ingest.image.ocr.languages, vec!["kor"]);
+        // 디스크 파일은 안 바뀜(여전히 schema_version = 2 + [chunking]).
+        let on_disk = std::fs::read_to_string(&p).unwrap();
+        assert!(
+            on_disk.contains("schema_version = 2"),
+            "파일이 변경됨:\n{on_disk}"
+        );
+        assert!(on_disk.contains("[chunking]"), "파일이 변경됨:\n{on_disk}");
+    }
+
+    #[test]
+    fn v3_layout_nests_media_under_ingest() {
+        let c = Config::defaults();
+        // 새 경로가 컴파일·접근 가능해야 한다.
+        assert_eq!(c.ingest.max_parallel_extractors, 2);
+        assert_eq!(c.ingest.chunking.target_tokens, 500);
+        assert_eq!(c.ingest.code.max_file_bytes, 262_144);
+        assert_eq!(c.ingest.image.ocr.engine, "ollama-vision");
+        assert_eq!(c.ingest.image.caption.max_pixels, 768);
+        assert_eq!(c.ingest.pdf.ocr.model, "qwen2.5vl:3b");
+        // pdf paddle 대칭 키 존재 + 기본값.
+        assert_eq!(c.ingest.pdf.ocr.score_thresh, 0.3);
+        assert_eq!(c.ingest.pdf.ocr.max_boxes, 1000);
+        assert!(c.ingest.pdf.ocr.det_model.is_none());
+    }
+
     #[test]
     fn defaults_match_design_64_score_gate() {
         let c = Config::defaults();
         assert_eq!(c.rag.score_gate, 0.30);
-        assert_eq!(c.chunking.target_tokens, 500);
+        assert_eq!(c.ingest.chunking.target_tokens, 500);
         assert_eq!(c.models.embedding.model, "multilingual-e5-large");
         assert_eq!(c.models.embedding.dimensions, 1024);
         assert_eq!(c.search.rrf_k, 60);
@@ -1383,6 +1623,34 @@ theme = "dark"
         assert_eq!(c.search.default_k, 25);
     }
 
+    /// 불변식 #2: env override 이름(LHS) 100% 보존 — struct 경로가 바뀌어도
+    /// 기존 `KEBAB_*` 스크립트가 새 경로로 대입되어 무파손.
+    #[test]
+    fn env_names_preserved_target_new_paths() {
+        let mut env = HashMap::new();
+        env.insert("KEBAB_CHUNKING_TARGET_TOKENS".into(), "640".into());
+        env.insert("KEBAB_INDEXING_MAX_PARALLEL_EXTRACTORS".into(), "6".into());
+        env.insert("KEBAB_IMAGE_OCR_ENABLED".into(), "true".into());
+        env.insert("KEBAB_PDF_OCR_ENGINE".into(), "paddle-onnx".into());
+        let c = Config::defaults().apply_env(&env);
+        assert_eq!(c.ingest.chunking.target_tokens, 640);
+        assert_eq!(c.ingest.max_parallel_extractors, 6);
+        assert!(c.ingest.image.ocr.enabled);
+        assert_eq!(c.ingest.pdf.ocr.engine, "paddle-onnx");
+    }
+
+    #[test]
+    fn env_pdf_paddle_symmetric_overrides() {
+        let mut env = HashMap::new();
+        env.insert("KEBAB_PDF_OCR_DET_MODEL".into(), "/d.onnx".into());
+        env.insert("KEBAB_PDF_OCR_SCORE_THRESH".into(), "0.4".into());
+        env.insert("KEBAB_PDF_OCR_MAX_BOXES".into(), "500".into());
+        let c = Config::defaults().apply_env(&env);
+        assert_eq!(c.ingest.pdf.ocr.det_model.as_deref(), Some("/d.onnx"));
+        assert!((c.ingest.pdf.ocr.score_thresh - 0.4).abs() < 1e-6);
+        assert_eq!(c.ingest.pdf.ocr.max_boxes, 500);
+    }
+
     #[test]
     fn env_unknown_key_is_ignored() {
         let baseline = Config::defaults();
@@ -1400,7 +1668,7 @@ theme = "dark"
             "777".to_string(),
         );
         let c = Config::defaults().apply_env(&env);
-        assert_eq!(c.chunking.target_tokens, 777);
+        assert_eq!(c.ingest.chunking.target_tokens, 777);
     }
 
     #[test]
@@ -1455,24 +1723,24 @@ theme = "dark"
             "true".to_string(),
         );
         let c = Config::defaults().apply_env(&env);
-        assert!(c.indexing.watch_filesystem);
+        assert!(c.ingest.watch_filesystem);
     }
 
     #[test]
     fn image_ocr_defaults_disabled_with_ollama_vision() {
         let c = Config::defaults();
-        assert!(!c.image.ocr.enabled);
-        assert_eq!(c.image.ocr.engine, "ollama-vision");
-        assert_eq!(c.image.ocr.model, "gemma4:e4b");
-        assert_eq!(c.image.ocr.languages, vec!["eng", "kor"]);
-        assert_eq!(c.image.ocr.max_pixels, 1600);
+        assert!(!c.ingest.image.ocr.enabled);
+        assert_eq!(c.ingest.image.ocr.engine, "ollama-vision");
+        assert_eq!(c.ingest.image.ocr.model, "gemma4:e4b");
+        assert_eq!(c.ingest.image.ocr.languages, vec!["eng", "kor"]);
+        assert_eq!(c.ingest.image.ocr.max_pixels, 1600);
     }
 
     /// v0.17.2 post-dogfood: matches the legacy hard-coded 300s cap so
     /// existing configs that omit the new field keep behaving identically.
     #[test]
     fn default_ocr_request_timeout_secs_is_300() {
-        assert_eq!(Config::defaults().image.ocr.request_timeout_secs, 300);
+        assert_eq!(Config::defaults().ingest.image.ocr.request_timeout_secs, 300);
     }
 
     #[test]
@@ -1483,7 +1751,7 @@ theme = "dark"
             "900".to_string(),
         );
         let c = Config::defaults().apply_env(&env);
-        assert_eq!(c.image.ocr.request_timeout_secs, 900);
+        assert_eq!(c.ingest.image.ocr.request_timeout_secs, 900);
     }
 
     /// post-v0.17.1 dogfood: a config file written before the OCR
@@ -1493,7 +1761,7 @@ theme = "dark"
     #[test]
     fn legacy_config_without_ocr_request_timeout_secs_uses_default() {
         let c: Config = toml::from_str(LEGACY_PRE_TIMEOUT_TOML).expect("parse legacy config");
-        assert_eq!(c.image.ocr.request_timeout_secs, 300);
+        assert_eq!(c.ingest.image.ocr.request_timeout_secs, 300);
     }
 
     // ── p9-fb-41: multi-hop RAG knobs ────────────────────────────────────
@@ -1645,14 +1913,14 @@ theme = "dark"
         );
         env.insert("KEBAB_IMAGE_OCR_MAX_PIXELS".to_string(), "2048".to_string());
         let c = Config::defaults().apply_env(&env);
-        assert!(c.image.ocr.enabled);
-        assert_eq!(c.image.ocr.model, "gemma4:31b");
+        assert!(c.ingest.image.ocr.enabled);
+        assert_eq!(c.ingest.image.ocr.model, "gemma4:31b");
         assert_eq!(
-            c.image.ocr.endpoint.as_deref(),
+            c.ingest.image.ocr.endpoint.as_deref(),
             Some("http://192.168.0.47:11434")
         );
-        assert_eq!(c.image.ocr.languages, vec!["eng", "kor", "jpn"]);
-        assert_eq!(c.image.ocr.max_pixels, 2048);
+        assert_eq!(c.ingest.image.ocr.languages, vec!["eng", "kor", "jpn"]);
+        assert_eq!(c.ingest.image.ocr.max_pixels, 2048);
     }
 
     /// Pre-P6 config files don't have an `[image]` section. The
@@ -1661,9 +1929,9 @@ theme = "dark"
     #[test]
     fn image_caption_defaults_disabled() {
         let c = Config::defaults();
-        assert!(!c.image.caption.enabled);
-        assert_eq!(c.image.caption.max_pixels, 768);
-        assert_eq!(c.image.caption.prompt_template_version, "caption-v1");
+        assert!(!c.ingest.image.caption.enabled);
+        assert_eq!(c.ingest.image.caption.max_pixels, 768);
+        assert_eq!(c.ingest.image.caption.prompt_template_version, "caption-v1");
     }
 
     #[test]
@@ -1682,9 +1950,9 @@ theme = "dark"
             "caption-v2".to_string(),
         );
         let c = Config::defaults().apply_env(&env);
-        assert!(c.image.caption.enabled);
-        assert_eq!(c.image.caption.max_pixels, 1024);
-        assert_eq!(c.image.caption.prompt_template_version, "caption-v2");
+        assert!(c.ingest.image.caption.enabled);
+        assert_eq!(c.ingest.image.caption.max_pixels, 1024);
+        assert_eq!(c.ingest.image.caption.prompt_template_version, "caption-v2");
     }
 
     /// `KEBAB_IMAGE_OCR_ENDPOINT=""` (empty value) should map to `None`
@@ -1695,7 +1963,7 @@ theme = "dark"
         let mut env = HashMap::new();
         env.insert("KEBAB_IMAGE_OCR_ENDPOINT".to_string(), String::new());
         let c = Config::defaults().apply_env(&env);
-        assert_eq!(c.image.ocr.endpoint, None);
+        assert_eq!(c.ingest.image.ocr.endpoint, None);
     }
 
     #[test]
@@ -1758,7 +2026,7 @@ explain_default = false
 max_context_tokens = 8000
 "#;
         let c: Config = toml::from_str(toml_text).expect("pre-P6 TOML must still parse");
-        assert_eq!(c.image, ImageCfg::defaults());
+        assert_eq!(c.ingest.image, ImageCfg::defaults());
     }
 
     /// p9-fb-25: legacy config with `workspace.include = [...]` must
@@ -1896,41 +2164,6 @@ max_context_tokens = 8000
         assert_eq!(cfg.ingest.code.max_file_bytes, 524_288);
     }
 
-    #[test]
-    fn expansion_defaults_off() {
-        let cfg = Config::defaults();
-        assert!(!cfg.ingest.expansion.enabled);
-        assert_eq!(cfg.ingest.expansion.max_aliases_per_chunk, 8);
-        assert_eq!(cfg.ingest.expansion.prompt_version, "expansion-v1");
-    }
-
-    #[test]
-    fn expansion_env_override() {
-        let mut env = HashMap::new();
-        env.insert("KEBAB_INGEST_EXPANSION_ENABLED".into(), "true".into());
-        env.insert("KEBAB_INGEST_EXPANSION_MODEL".into(), "gemma3:4b".into());
-        env.insert("KEBAB_INGEST_EXPANSION_MAX_ALIASES".into(), "12".into());
-        env.insert("KEBAB_INGEST_EXPANSION_PROMPT_VERSION".into(), "expansion-v2".into());
-        let c = Config::defaults().apply_env(&env);
-        assert!(c.ingest.expansion.enabled);
-        assert_eq!(c.ingest.expansion.model, "gemma3:4b");
-        assert_eq!(c.ingest.expansion.max_aliases_per_chunk, 12);
-        assert_eq!(c.ingest.expansion.prompt_version, "expansion-v2");
-    }
-
-    #[test]
-    fn embed_aliases_defaults_off() {
-        let cfg = Config::defaults();
-        assert!(!cfg.ingest.expansion.embed_aliases);
-    }
-
-    #[test]
-    fn embed_aliases_env_override() {
-        let mut env = HashMap::new();
-        env.insert("KEBAB_INGEST_EXPANSION_EMBED_ALIASES".into(), "true".into());
-        let c = Config::defaults().apply_env(&env);
-        assert!(c.ingest.expansion.embed_aliases);
-    }
 }
 
 #[cfg(test)]

crates/kebab-config/src/migrate.rs

@@ -0,0 +1,658 @@
+//! config.toml 마이그레이션 엔진 (순수 변환, I/O 없음).
+//!
+//! 두 메커니즘: (1) reconciliation — default 구조에 있고 사용자 파일에
+//! 없는 섹션/키를 주석과 함께 추가. (2) step 체인 — schema_version 기반
+//! non-additive 변환(deprecated 제거 등). 자세한 계약은 spec
+//! `docs/superpowers/specs/2026-05-31-config-migration-design.md`.
+
+use toml_edit::{DocumentMut, Item};
+
+/// 현재 바이너리가 이해하는 config 스키마 버전. 마이그레이션 완료 시
+/// 사용자 파일의 `schema_version` 을 이 값으로 stamp 한다.
+pub const CURRENT_SCHEMA_VERSION: u32 = 3;
+
+/// 한 번의 마이그레이션에서 발생한 개별 변경.
+#[derive(Clone, Debug, PartialEq, serde::Serialize)]
+pub struct MigrationChange {
+    pub kind: ChangeKind,
+    /// dotted path, 예: `ingest.code`, `workspace.include`.
+    pub path: String,
+    /// 사람·wire 용 한 줄 설명.
+    pub detail: String,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ChangeKind {
+    AddedSection,
+    AddedKey,
+    RemovedDeprecated,
+}
+
+/// 마이그레이션 결과 요약(순수 변환 단계 산출). I/O 계층이 backup_path
+/// 등을 채워 wire 로 내보낸다.
+#[derive(Clone, Debug, PartialEq, serde::Serialize)]
+pub struct MigrationOutcome {
+    pub from_schema_version: u32,
+    pub to_schema_version: u32,
+    pub changes: Vec<MigrationChange>,
+    /// 변환 후 직렬화된 새 문서 텍스트(멱등 시 입력과 동일).
+    pub new_text: String,
+}
+
+impl MigrationOutcome {
+    pub fn changed(&self) -> bool {
+        !self.changes.is_empty()
+    }
+}
+
+/// 문서 최상단 헤더(경로 정책 등). 기존 init 헤더를 이전.
+const HEADER: &str = "\
+# kebab config — `~/.config/kebab/config.toml`.
+#
+# `workspace.root` accepts: 절대 / tilde(~) / env(${VAR}) / 상대 경로.
+#   상대 경로의 base 는 cwd 가 아니라 THIS config 파일의 디렉토리.
+#
+# 처리 가능한 형식 (extractor 가 자동 결정 — config 에 명시할 수 없음):
+#   • Markdown: .md
+#   • 이미지:   .png .jpg .jpeg  (OCR + caption)
+#   • PDF:      .pdf
+#
+# 런타임 override: `KEBAB_*` env (예: KEBAB_WORKSPACE_ROOT=/tmp kebab ingest).
+#
+# 이 파일은 `kebab config migrate` 로 새 스키마에 맞춰 갱신할 수 있다
+# (빠진 섹션 추가 + 손본 값·주석 보존).
+";
+
+/// 테이블 헤더(`[section]`) 위에 붙일 주석. dotted path → 한 줄(들).
+fn section_comment(path: &str) -> Option<&'static str> {
+    Some(match path {
+        "workspace" => "# 색인 대상 워크스페이스.",
+        "storage" => "# XDG 저장 경로(데이터/sqlite/벡터/에셋/모델).",
+        "indexing" => "# 병렬도 + 파일시스템 watch.",
+        "chunking" => "# 청크 크기·오버랩·heading 존중.",
+        "models" => "# embedding / llm / nli 모델.",
+        "models.embedding" => "# 다국어 sentence embedding. dim 불일치 시 검색 0건.",
+        "models.llm" => "# Ollama host:port + 모델.",
+        "models.nli" => "# NLI(groundedness) 모델.",
+        "search" => "# 검색 기본 k·stale 기준·fusion.",
+        "rag" => "# 답변 생성: prompt 템플릿·score gate·NLI.",
+        "ui" => "# TUI 팔레트·role 스타일.",
+        "ingest" => "# 모든 형식 ingest 우산: 병렬도 + chunking/code/image/pdf.",
+        "ingest.chunking" => "# 청크 크기·오버랩·heading 존중(전 형식 공통).",
+        "ingest.code" => "# code ingest skip 정책(.gitignore 자동 honor).",
+        "ingest.image" => "# 이미지 OCR + 캡션(기본 off, asset 당 모델 호출 비용).",
+        "ingest.image.ocr" => "# 이미지 OCR(기본 off).",
+        "ingest.image.caption" => "# 이미지 캡션(기본 off).",
+        "ingest.pdf" => "# PDF ingest. scanned PDF OCR 은 기본 off(page 당 cost).",
+        "ingest.pdf.ocr" => "# scanned PDF page-단위 OCR(기본 off).",
+        "logging" => "# ingest 로그(기본 on, ~/.local/state/kebab/logs).",
+        _ => return None,
+    })
+}
+
+/// leaf 키 인라인 주석. dotted path(예: `ingest.chunking.target_tokens`) → 한 줄.
+/// 값 뒤에 `  # ...` suffix 로 부착된다(`#` 없이 본문만 반환).
+fn key_comment(path: &str) -> Option<&'static str> {
+    Some(match path {
+        "workspace.root" => "색인 루트. 절대/~/${VAR}/상대(=이 파일 기준).",
+        "workspace.exclude" => "denylist glob.",
+        "storage.copy_threshold_mb" => "이 크기(MB) 초과 파일은 사본 대신 참조.",
+        "models.embedding.provider" => "fastembed | candle | ollama | none.",
+        "models.embedding.dimensions" => "모델 출력 차원. 틀리면 검색 0건.",
+        "models.embedding.num_threads" => "candle 전용 CPU 스레드 cap(0=auto).",
+        "models.embedding.endpoint" => "ollama provider 시 HTTP. 비우면 llm.endpoint fallback.",
+        "models.llm.request_timeout_secs" => "단일 HTTP 상한. 0=즉시실패(비활성화 아님).",
+        "ingest.max_parallel_extractors" => "동시 extractor 수.",
+        "ingest.max_parallel_embeddings" => "동시 임베딩 수.",
+        "ingest.chunking.target_tokens" => "청크 목표 토큰(전 형식 공통).",
+        "ingest.chunking.respect_markdown_headings" => "markdown heading 경계 존중.",
+        "ingest.image.ocr.enabled" => "이미지 OCR(기본 off, asset 당 비용).",
+        "ingest.image.ocr.engine" => "ollama-vision | paddle-onnx.",
+        "ingest.image.ocr.model" => "ollama-vision 전용. paddle-onnx 는 번들 모델 사용(이 값 무시).",
+        "ingest.image.ocr.request_timeout_secs" => "0=즉시실패(비활성화 아님).",
+        "ingest.image.ocr.score_thresh" => "DBNet box 점수 하한(paddle).",
+        "ingest.image.ocr.unclip_ratio" => "box 패딩 비율(paddle).",
+        "ingest.image.ocr.max_boxes" => "이미지당 box cap(paddle).",
+        "ingest.image.caption.enabled" => "이미지 캡션(기본 off).",
+        "ingest.pdf.ocr.enabled" => "scanned PDF OCR(기본 off, page 당 비용).",
+        "ingest.pdf.ocr.always_on" => "true=모든 page vision 호출(dual-text).",
+        "ingest.pdf.ocr.engine" => "ollama-vision | paddle-onnx.",
+        "ingest.pdf.ocr.model" => "ollama-vision 전용. paddle-onnx 는 번들 모델 사용.",
+        "ingest.pdf.ocr.valid_ratio_threshold" => "유효문자 비율 < 이면 scanned 판정.",
+        "ingest.pdf.ocr.min_char_count" => "page 문자수 < 이면 auto-scanned.",
+        "ingest.pdf.ocr.request_timeout_secs" => "0=즉시실패(비활성화 아님).",
+        "rag.score_gate" => "검색 점수 게이트.",
+        "rag.nli_threshold" => "0=NLI 게이트 off.",
+        "search.default_k" => "기본 검색 결과 수.",
+        "ui.theme" => "dark | light.",
+        "logging.ingest_log_enabled" => "ingest 로그(기본 on).",
+        _ => return None,
+    })
+}
+
+/// Config::defaults() 를 직렬화 + 주석 부착한 "완전체" 문서.
+/// init 과 migrate reconciliation 의 단일 참조 원천.
+pub fn annotated_default_document() -> DocumentMut {
+    let defaults = crate::Config::defaults();
+    let pretty = toml::to_string_pretty(&defaults).expect("defaults serialize");
+    let mut doc: DocumentMut = pretty.parse().expect("defaults parse as toml_edit");
+
+    // 헤더: 첫 최상위 항목의 prefix 로.
+    if let Some((mut first_key, _)) = doc.as_table_mut().iter_mut().next() {
+        first_key.leaf_decor_mut().set_prefix(format!("{HEADER}\n"));
+    }
+
+    annotate_table(doc.as_table_mut(), "");
+    doc
+}
+
+/// 재귀적으로 하위 테이블에 헤더 주석 부착. `prefix_path` 는 dotted 누적 경로.
+/// annotated_default_document 는 항상 주석 없는 defaults 에서 새로 만들므로
+/// 무조건 부착해도 중복되지 않는다.
+fn annotate_table(table: &mut toml_edit::Table, prefix_path: &str) {
+    let keys: Vec<String> = table.iter().map(|(k, _)| k.to_string()).collect();
+    for key in keys {
+        let path = if prefix_path.is_empty() {
+            key.clone()
+        } else {
+            format!("{prefix_path}.{key}")
+        };
+        if let Some(item) = table.get_mut(&key) {
+            if let Some(sub) = item.as_table_mut() {
+                if let Some(c) = section_comment(&path) {
+                    sub.decor_mut().set_prefix(format!("\n{c}\n"));
+                }
+                annotate_table(sub, &path);
+            } else if let Some(kc) = key_comment(&path) {
+                // 스칼라/배열 leaf: 값 뒤 인라인 주석 suffix. 배열(exclude 등)은
+                // 멀티라인 직렬화돼도 닫는 `]` 뒤로 가 유효.
+                if let Some(v) = item.as_value_mut() {
+                    v.decor_mut().set_suffix(format!("  # {kc}"));
+                }
+            }
+        }
+    }
+}
+
+/// 참조(주석 달린 default) 테이블 `reference` 를 기준으로, 사용자 테이블
+/// `user` 에 없는 항목을 decor(주석) 포함 통째 복사한다. 이미 있는 키는
+/// 건드리지 않는다(값 불가침). 양쪽이 테이블이면 하위로 재귀.
+pub fn reconcile(
+    reference: &toml_edit::Table,
+    user: &mut toml_edit::Table,
+    prefix_path: &str,
+    changes: &mut Vec<MigrationChange>,
+) {
+    for (key, ref_item) in reference.iter() {
+        let path = if prefix_path.is_empty() {
+            key.to_string()
+        } else {
+            format!("{prefix_path}.{key}")
+        };
+        match user.get_mut(key) {
+            None => {
+                // schema_version 키는 stamp 단계가 다룬다(change 기록 X).
+                if path == "schema_version" {
+                    user.insert(key, ref_item.clone());
+                    continue;
+                }
+                let kind = if ref_item.is_table() {
+                    ChangeKind::AddedSection
+                } else {
+                    ChangeKind::AddedKey
+                };
+                user.insert(key, ref_item.clone());
+                changes.push(MigrationChange {
+                    kind,
+                    path: path.clone(),
+                    detail: section_comment(&path).map_or_else(
+                        || format!("{key} 추가"),
+                        |c| c.trim_start_matches("# ").to_string(),
+                    ),
+                });
+            }
+            Some(existing) => {
+                if let (Some(ref_tbl), Some(user_tbl)) =
+                    (ref_item.as_table(), existing.as_table_mut())
+                {
+                    reconcile(ref_tbl, user_tbl, &path, changes);
+                }
+                // 둘 다 테이블이 아니면(스칼라 등) 값 불가침 → 무시.
+            }
+        }
+    }
+}
+
+/// v1 → v2: deprecated `workspace.include` 제거(p9-fb-25). 멱등.
+pub fn step_1_to_2(doc: &mut DocumentMut, changes: &mut Vec<MigrationChange>) {
+    if let Some(ws) = doc.get_mut("workspace").and_then(|i| i.as_table_mut()) {
+        if ws.remove("include").is_some() {
+            changes.push(MigrationChange {
+                kind: ChangeKind::RemovedDeprecated,
+                path: "workspace.include".to_string(),
+                detail: "p9-fb-25: 처리 형식은 extractor 가 자동 결정 — 더 이상 사용 안 함."
+                    .to_string(),
+            });
+        }
+    }
+}
+
+/// `from_path` 의 마지막 키를 통째(decor 포함) remove 해 `to_path` 의 dotted
+/// 경로에 삽입한다(중간 테이블 자동 생성). 대상 키가 이미 있으면 덮어쓰지
+/// 않는다(사용자 명시 우선). 원본이 없으면 no-op(멱등).
+fn move_table(
+    doc: &mut DocumentMut,
+    from_path: &[&str],
+    to_path: &[&str],
+    changes: &mut Vec<MigrationChange>,
+) {
+    // from 의 부모까지 내려가 마지막 키를 remove.
+    let (from_parent, from_key) = from_path.split_at(from_path.len() - 1);
+    let mut cur = doc.as_table_mut();
+    for k in from_parent {
+        match cur.get_mut(k).and_then(Item::as_table_mut) {
+            Some(t) => cur = t,
+            None => return, // 원본 없음 → no-op.
+        }
+    }
+    let Some(item) = cur.remove(from_key[0]) else {
+        return;
+    };
+
+    // to 경로의 부모 테이블 확보(없으면 생성), 마지막 키에 삽입.
+    let (to_parent, to_key) = to_path.split_at(to_path.len() - 1);
+    let mut cur = doc.as_table_mut();
+    for k in to_parent {
+        if cur.get(k).is_none() {
+            cur.insert(k, Item::Table(toml_edit::Table::new()));
+        }
+        cur = cur
+            .get_mut(k)
+            .and_then(Item::as_table_mut)
+            .expect("just inserted");
+    }
+    if cur.get(to_key[0]).is_none() {
+        cur.insert(to_key[0], item);
+        changes.push(MigrationChange {
+            kind: ChangeKind::AddedSection,
+            path: to_path.join("."),
+            detail: format!("{} → {}", from_path.join("."), to_path.join(".")),
+        });
+    }
+}
+
+/// 옛 `[indexing]` 의 bare 스칼라 키들을 `[ingest]` 로 옮긴다(테이블 자체가
+/// 아니라 키 단위). 대상에 이미 있는 키는 덮어쓰지 않는다.
+fn move_indexing_keys(doc: &mut DocumentMut, changes: &mut Vec<MigrationChange>) {
+    let Some(idx) = doc.as_table_mut().remove("indexing") else {
+        return;
+    };
+    let Some(idx_tbl) = idx.as_table().cloned() else {
+        return;
+    };
+    if doc.get("ingest").is_none() {
+        doc["ingest"] = Item::Table(toml_edit::Table::new());
+    }
+    let ingest = doc["ingest"].as_table_mut().expect("ingest table");
+    for (k, v) in idx_tbl.iter() {
+        if ingest.get(k).is_none() {
+            ingest.insert(k, v.clone());
+        }
+    }
+    changes.push(MigrationChange {
+        kind: ChangeKind::AddedKey,
+        path: "ingest".to_string(),
+        detail: "indexing → ingest (병렬도 키)".to_string(),
+    });
+}
+
+/// v3: pdf paddle 동작 보존. v2 는 pdf paddle 이 `[image.ocr]` 의 모델 경로를
+/// 빌려썼다. relocation 후 image.ocr 의 paddle 6키 실제 값을 pdf.ocr 대칭
+/// 키로 복사한다(pdf 가 이미 명시한 키는 덮어쓰지 않음, pdf 가 paddle 일 때만).
+fn copy_image_paddle_to_pdf(doc: &mut DocumentMut) {
+    const PADDLE_KEYS: [&str; 6] = [
+        "det_model",
+        "rec_model",
+        "dict",
+        "score_thresh",
+        "unclip_ratio",
+        "max_boxes",
+    ];
+    let img = doc
+        .get("ingest")
+        .and_then(|i| i.get("image"))
+        .and_then(|i| i.get("ocr"))
+        .and_then(Item::as_table)
+        .cloned();
+    let Some(img) = img else {
+        return;
+    };
+    let pdf_is_paddle = doc
+        .get("ingest")
+        .and_then(|i| i.get("pdf"))
+        .and_then(|i| i.get("ocr"))
+        .and_then(|o| o.get("engine"))
+        .and_then(Item::as_str)
+        == Some("paddle-onnx");
+    if !pdf_is_paddle {
+        return;
+    }
+    let Some(pdf) = doc["ingest"]["pdf"]["ocr"].as_table_mut() else {
+        return;
+    };
+    for k in PADDLE_KEYS {
+        if pdf.get(k).is_none() {
+            if let Some(v) = img.get(k) {
+                pdf.insert(k, v.clone());
+            }
+        }
+    }
+}
+
+/// v2 → v3: 미디어 테이블을 `[ingest.*]` 로 relocation(값·주석 보존) + pdf
+/// paddle 값 보존. 멱등(이미 v3 면 원본 테이블이 없어 전부 no-op).
+pub fn step_2_to_3(doc: &mut DocumentMut, changes: &mut Vec<MigrationChange>) {
+    move_indexing_keys(doc, changes);
+    move_table(doc, &["chunking"], &["ingest", "chunking"], changes);
+    move_table(doc, &["image", "ocr"], &["ingest", "image", "ocr"], changes);
+    move_table(
+        doc,
+        &["image", "caption"],
+        &["ingest", "image", "caption"],
+        changes,
+    );
+    move_table(doc, &["pdf", "ocr"], &["ingest", "pdf", "ocr"], changes);
+
+    // 빈 껍데기 [image] / [pdf] 제거.
+    for empty in ["image", "pdf"] {
+        if let Some(t) = doc.get(empty).and_then(Item::as_table) {
+            if t.is_empty() {
+                doc.as_table_mut().remove(empty);
+            }
+        }
+    }
+
+    copy_image_paddle_to_pdf(doc);
+}
+
+/// 파일의 schema_version(없으면 1) 부터 CURRENT 까지 step 적용.
+fn run_steps(doc: &mut DocumentMut, from: u32, changes: &mut Vec<MigrationChange>) {
+    if from < 2 {
+        step_1_to_2(doc, changes);
+    }
+    if from < 3 {
+        step_2_to_3(doc, changes);
+    }
+}
+
+/// 사용자 config.toml 텍스트를 받아 step 체인 + reconciliation + version
+/// stamp 를 적용하고 결과를 반환한다. 순수 함수(I/O 없음). 파싱 실패 시
+/// from=1, 변경 없음, new_text=입력 그대로(상위에서 파싱 에러를 따로 처리).
+pub fn migrate_document(text: &str) -> MigrationOutcome {
+    let mut doc: DocumentMut = match text.parse() {
+        Ok(d) => d,
+        Err(_) => {
+            return MigrationOutcome {
+                from_schema_version: 1,
+                to_schema_version: CURRENT_SCHEMA_VERSION,
+                changes: Vec::new(),
+                new_text: text.to_string(),
+            };
+        }
+    };
+    let from = doc
+        .get("schema_version")
+        .and_then(toml_edit::Item::as_integer)
+        .unwrap_or(1) as u32;
+
+    let mut changes = Vec::new();
+
+    // 1. non-additive step 체인.
+    run_steps(&mut doc, from, &mut changes);
+
+    // 2. additive reconciliation(버전 무관).
+    let reference = annotated_default_document();
+    let ref_table = reference.as_table().clone();
+    reconcile(&ref_table, doc.as_table_mut(), "", &mut changes);
+
+    // 3. schema_version stamp.
+    let current_in_file = doc
+        .get("schema_version")
+        .and_then(toml_edit::Item::as_integer)
+        .unwrap_or(0) as u32;
+    if current_in_file != CURRENT_SCHEMA_VERSION {
+        doc["schema_version"] = toml_edit::value(i64::from(CURRENT_SCHEMA_VERSION));
+    }
+
+    MigrationOutcome {
+        from_schema_version: from,
+        to_schema_version: CURRENT_SCHEMA_VERSION,
+        changes,
+        new_text: doc.to_string(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn annotated_default_has_per_key_comments() {
+        let text = annotated_default_document().to_string();
+        // 대표 키 인라인 주석 존재.
+        assert!(text.contains("# 색인 루트"), "workspace.root 주석 누락:\n{text}");
+        assert!(text.contains("0=즉시실패"), "request_timeout 주석 누락:\n{text}");
+        assert!(
+            text.contains("paddle-onnx 는 번들 모델"),
+            "ocr.model 주석 누락:\n{text}"
+        );
+        // 주석 추가가 파싱을 깨지 않는다.
+        let back: crate::Config = toml::from_str(&text).expect("parse annotated default");
+        assert_eq!(back, crate::Config::defaults());
+    }
+
+    #[test]
+    fn annotated_default_has_all_sections_and_parses_back_to_defaults() {
+        let doc = annotated_default_document();
+        let text = doc.to_string();
+        // v3: 미디어 형식 섹션이 전부 `[ingest.*]` 하위로 통합됐다. IngestCfg
+        // 는 스칼라(병렬도) 필드가 있어 bare `[ingest]` + 하위 테이블이 함께
+        // 직렬화된다.
+        for section in [
+            "[workspace]",
+            "[ingest]",
+            "[ingest.chunking]",
+            "[ingest.code]",
+            "[ingest.image.ocr]",
+            "[ingest.pdf.ocr]",
+            "[logging]",
+            "[ui]",
+        ] {
+            assert!(text.contains(section), "missing {section}:\n{text}");
+        }
+        assert!(text.contains("# "), "no comments attached");
+        let back: crate::Config = toml::from_str(&text).expect("parse annotated default");
+        assert_eq!(back, crate::Config::defaults());
+    }
+
+    #[test]
+    fn reconcile_adds_missing_section_preserving_user_values_and_comments() {
+        // ingest 통째 누락(→ ingest.code 추가), logging 통째 누락,
+        // default_k 는 사용자가 바꿈, 주석 보유.
+        let user_text = "\
+schema_version = 1
+
+[workspace]
+root = \"/my/notes\"   # 내 워크스페이스
+
+[search]
+default_k = 25
+";
+        let mut user: DocumentMut = user_text.parse().unwrap();
+        let reference = annotated_default_document();
+        let ref_tbl = reference.as_table().clone();
+        let mut changes = Vec::new();
+        reconcile(&ref_tbl, user.as_table_mut(), "", &mut changes);
+        let out = user.to_string();
+
+        // 누락된 [ingest.code] 가 주석과 함께 추가.
+        assert!(out.contains("[ingest.code]"), "ingest.code not added:\n{out}");
+        // 통째 누락된 logging 추가.
+        assert!(out.contains("[logging]"), "logging not added");
+        // 사용자 값/주석/기존 섹션 보존.
+        assert!(out.contains("root = \"/my/notes\""));
+        assert!(out.contains("# 내 워크스페이스"));
+        assert!(out.contains("default_k = 25"));
+        // 새 섹션 주석 부착.
+        assert!(out.contains("code ingest skip 정책"));
+        // 통째 누락 부모는 부모 경로로 한 번 기록.
+        assert!(
+            changes
+                .iter()
+                .any(|c| c.kind == ChangeKind::AddedSection && c.path == "ingest")
+        );
+        assert!(
+            changes
+                .iter()
+                .any(|c| c.kind == ChangeKind::AddedSection && c.path == "logging")
+        );
+    }
+
+    #[test]
+    fn reconcile_does_not_overwrite_user_value_differing_from_default() {
+        let user_text = "\
+schema_version = 2
+
+[rag]
+score_gate = 0.8
+";
+        let mut user: DocumentMut = user_text.parse().unwrap();
+        let reference = annotated_default_document();
+        let ref_tbl = reference.as_table().clone();
+        let mut changes = Vec::new();
+        reconcile(&ref_tbl, user.as_table_mut(), "", &mut changes);
+        let out = user.to_string();
+        assert!(out.contains("score_gate = 0.8"), "user value clobbered:\n{out}");
+        assert!(!changes.iter().any(|c| c.path == "rag.score_gate"));
+    }
+
+    #[test]
+    fn step_1_to_2_removes_deprecated_workspace_include() {
+        let user_text = "\
+[workspace]
+root = \"/n\"
+include = [\"*.md\"]
+";
+        let mut user: DocumentMut = user_text.parse().unwrap();
+        let mut changes = Vec::new();
+        step_1_to_2(&mut user, &mut changes);
+        let out = user.to_string();
+        assert!(!out.contains("include"), "include not removed:\n{out}");
+        assert!(
+            changes
+                .iter()
+                .any(|c| c.kind == ChangeKind::RemovedDeprecated && c.path == "workspace.include")
+        );
+        let mut changes2 = Vec::new();
+        step_1_to_2(&mut user, &mut changes2);
+        assert!(changes2.is_empty());
+    }
+
+    fn read_schema_version(text: &str) -> u32 {
+        let doc: DocumentMut = text.parse().unwrap();
+        doc.get("schema_version")
+            .and_then(toml_edit::Item::as_integer)
+            .unwrap_or(1) as u32
+    }
+
+    #[test]
+    fn migrate_document_stamps_version_and_is_idempotent() {
+        let old = "\
+schema_version = 1
+
+[workspace]
+root = \"/n\"
+include = [\"*.md\"]
+";
+        let outcome = migrate_document(old);
+        assert_eq!(outcome.from_schema_version, 1);
+        assert_eq!(outcome.to_schema_version, CURRENT_SCHEMA_VERSION);
+        assert!(outcome.changed());
+        assert!(!outcome.new_text.contains("include"));
+        assert!(outcome.new_text.contains("[ingest.code]"));
+        assert_eq!(read_schema_version(&outcome.new_text), CURRENT_SCHEMA_VERSION);
+
+        let again = migrate_document(&outcome.new_text);
+        assert!(!again.changed(), "not idempotent: {:?}", again.changes);
+        assert_eq!(again.new_text, outcome.new_text);
+    }
+
+    fn changes_after_second_pass(text: &str) -> Vec<MigrationChange> {
+        let mut doc: DocumentMut = text.parse().unwrap();
+        let mut ch = Vec::new();
+        step_2_to_3(&mut doc, &mut ch);
+        ch
+    }
+
+    #[test]
+    fn step_2_to_3_relocates_media_tables() {
+        let v2 = "\
+schema_version = 2
+
+[indexing]
+max_parallel_extractors = 4
+watch_filesystem = true
+
+[chunking]
+target_tokens = 700
+
+[image.ocr]
+enabled = true
+engine = \"paddle-onnx\"
+det_model = \"/custom/det.onnx\"
+
+[image.caption]
+enabled = true
+
+[pdf.ocr]
+enabled = false
+engine = \"paddle-onnx\"
+";
+        let mut doc: DocumentMut = v2.parse().unwrap();
+        let mut changes = Vec::new();
+        step_2_to_3(&mut doc, &mut changes);
+        let out = doc.to_string();
+        // 새 위치 존재.
+        assert!(out.contains("[ingest]"), "{out}");
+        assert!(out.contains("max_parallel_extractors = 4"));
+        assert!(out.contains("watch_filesystem = true"));
+        assert!(out.contains("[ingest.chunking]"));
+        assert!(out.contains("target_tokens = 700"));
+        assert!(out.contains("[ingest.image.ocr]"));
+        assert!(out.contains("det_model = \"/custom/det.onnx\""));
+        assert!(out.contains("[ingest.image.caption]"));
+        assert!(out.contains("[ingest.pdf.ocr]"));
+        // 옛 위치 제거.
+        assert!(!out.contains("[indexing]"));
+        assert!(!out.contains("\n[chunking]"));
+        assert!(!out.contains("\n[image.ocr]"));
+        assert!(!out.contains("\n[image.caption]"));
+        assert!(!out.contains("\n[pdf.ocr]"));
+        // pdf paddle 동작 보존: image paddle det_model 이 pdf 대칭 키로 복사.
+        let reparsed: DocumentMut = out.parse().unwrap();
+        let pdf_det = reparsed["ingest"]["pdf"]["ocr"].get("det_model");
+        assert_eq!(pdf_det.and_then(|v| v.as_str()), Some("/custom/det.onnx"));
+        // 멱등.
+        let again = changes_after_second_pass(&out);
+        assert!(again.is_empty(), "not idempotent: {again:?}");
+    }
+
+    #[test]
+    fn migrate_document_missing_schema_version_treated_as_v1() {
+        let old = "[workspace]\nroot = \"/n\"\n";
+        let outcome = migrate_document(old);
+        assert_eq!(outcome.from_schema_version, 1);
+        assert_eq!(read_schema_version(&outcome.new_text), CURRENT_SCHEMA_VERSION);
+    }
+}

crates/kebab-config/tests/fixtures/user_v2_config.toml

@@ -0,0 +1,149 @@
+# kebab config — `~/.config/kebab/config.toml`.
+#
+## `workspace.root` accepts:
+#   • absolute paths       (`/home/me/KnowledgeBase`)
+#   • tilde                (`~/KnowledgeBase`)         ← default
+#   • env vars             (`${XDG_DATA_HOME}/kebab`)
+#   • relative paths       (`./notes`, `notes`, `../shared/x`)
+#     — relative paths resolve against the directory of THIS
+#       config file, NOT the user's `cwd` at invocation time.
+#
+# 처리 가능한 형식 (extractor 가 자동 결정 — config 에 명시할 수 없음):
+#   • Markdown: .md
+#   • 이미지:   .png .jpg .jpeg  (OCR + caption)
+#   • PDF:      .pdf
+# 다른 확장자는 ingest 시 자동 skip + warning. 처리 대상 폴더의
+# 일부만 ingest 하고 싶으면 `kebab ingest <path>` 로 root 명시
+# 또는 `.kebabignore` 파일 / 본 `workspace.exclude` 로 denylist.
+#
+# Override individual keys at runtime with `KEBAB_*` env vars
+# (e.g. `KEBAB_WORKSPACE_ROOT=/tmp/test kebab ingest`).
+schema_version = 2
+
+[workspace]
+root = "/Users/user/Obsidian/Default"
+exclude = [
+    ".git/**",
+    "node_modules/**",
+    ".obsidian/**",
+]
+
+[storage]
+data_dir = "${XDG_DATA_HOME:-~/.local/share}/kebab"
+sqlite = "{data_dir}/kebab.sqlite"
+vector_dir = "{data_dir}/lancedb"
+asset_dir = "{data_dir}/assets"
+artifact_dir = "{data_dir}/artifacts"
+model_dir = "{data_dir}/models"
+runs_dir = "{data_dir}/runs"
+copy_threshold_mb = 100
+
+[indexing]
+max_parallel_extractors = 2
+max_parallel_embeddings = 1
+watch_filesystem = false
+
+[chunking]
+target_tokens = 500
+overlap_tokens = 80
+respect_markdown_headings = true
+chunker_version = "md-heading-v1"
+
+[models.embedding]
+provider = "ollama"
+endpoint = "http://127.0.0.1:11434"
+# endpoint = "http://192.168.0.2:11943"
+model = "snowflake-arctic-embed2"
+# provider = "candle"
+# model    = "snowflake-arctic-embed-l-v2.0"
+version = "v1"
+dimensions = 1024
+batch_size = 64
+num_threads = 0
+
+[models.llm]
+provider = "ollama"
+model = "gemma4:e4b"
+context_tokens = 32768
+# endpoint = "http://127.0.0.1:11434"
+endpoint = "http://192.168.0.2:11943"
+temperature = 0.0
+seed = 0
+request_timeout_secs = 300
+
+# NLI(groundedness) 모델.
+[models.nli]
+model = "Xenova/mDeBERTa-v3-base-xnli-multilingual-nli-2mil7"
+provider = "onnx"
+
+[search]
+default_k = 10
+hybrid_fusion = "rrf"
+rrf_k = 60
+snippet_chars = 220
+cache_capacity = 256
+stale_threshold_days = 30
+
+[rag]
+prompt_template_version = "rag-v3"
+score_gate = 0.30000001192092896
+explain_default = false
+max_context_tokens = 8000
+multi_hop_max_depth = 3
+multi_hop_max_sub_queries_per_iter = 5
+multi_hop_max_pool_chunks = 15
+nli_threshold = 0.0
+
+[image.ocr]
+enabled = true
+engine = "paddle-onnx"
+# engine = "ollama-vision"
+model = "gemma4:e4b"
+languages = [
+    "eng",
+    "kor",
+]
+max_pixels = 1600
+request_timeout_secs = 300
+
+[image.caption]
+enabled = true
+max_pixels = 768
+prompt_template_version = "caption-v1"
+
+[ui]
+theme = "dark"
+
+# code ingest skip 정책(.gitignore 자동 honor).
+[ingest.code]
+skip_generated_header = false
+max_file_bytes = 262144
+max_file_lines = 5000
+extra_skip_globs = []
+ast_chunk_max_lines = 200
+fallback_lines_per_chunk = 80
+fallback_lines_overlap = 20
+
+# scanned PDF page-단위 OCR(기본 off).
+[pdf.ocr]
+enabled = false
+always_on = false
+engine = "paddle-onnx"
+# engine = "ollama-vision"
+model = "qwen2.5vl:3b"
+languages = [
+    "eng",
+    "kor",
+]
+max_pixels = 2048
+request_timeout_secs = 180
+valid_ratio_threshold = 0.5
+min_char_count = 20
+lang_hint = "kor"
+
+# ingest 로그(기본 on, ~/.local/state/kebab/logs).
+[logging]
+ingest_log_enabled = true
+ingest_log_dir = "{state_dir}/logs"
+keep_recent_runs = 100
+retention_days = 30

crates/kebab-config/tests/migrate_v3.rs

@@ -0,0 +1,48 @@
+//! v3 마이그레이션 무손실 골든 — 사용자 실제 v2 config.
+//!
+//! 불변식: 사용자가 손본 값·주석·대안(commented) 줄이 [ingest.*] relocation
+//! 후에도 전부 보존되고, v3 Config 로 파싱했을 때 같은 값을 내며, 재실행이
+//! 멱등이어야 한다.
+use kebab_config::migrate::migrate_document;
+
+const USER_V2: &str = include_str!("fixtures/user_v2_config.toml");
+
+#[test]
+fn user_v2_migrates_losslessly() {
+    let out = migrate_document(USER_V2);
+    assert_eq!(out.from_schema_version, 2);
+    assert_eq!(out.to_schema_version, 3);
+    let t = &out.new_text;
+
+    // 사용자 값 보존.
+    assert!(t.contains("root = \"/Users/user/Obsidian/Default\""), "{t}");
+    assert!(t.contains("model = \"snowflake-arctic-embed2\""));
+    assert!(t.contains("endpoint = \"http://192.168.0.2:11943\""));
+    // 사용자 주석/대안 줄 보존.
+    assert!(t.contains("# engine = \"ollama-vision\""), "대안 주석 유실:\n{t}");
+    assert!(t.contains("# provider = \"candle\""));
+    // 새 위치.
+    assert!(t.contains("[ingest.image.ocr]"));
+    assert!(t.contains("[ingest.pdf.ocr]"));
+    assert!(t.contains("[ingest.chunking]"));
+    assert!(t.contains("[ingest.image.caption]"));
+    // 옛 top-level 위치 제거.
+    assert!(!t.contains("\n[chunking]"));
+    assert!(!t.contains("\n[image.ocr]"));
+    assert!(!t.contains("\n[indexing]"));
+
+    // v3 Config 로 parse + 값 동일.
+    let cfg: kebab_config::Config = toml::from_str(t).expect("v3 parse");
+    assert!(cfg.ingest.image.ocr.enabled);
+    assert_eq!(cfg.ingest.image.ocr.engine, "paddle-onnx");
+    assert_eq!(cfg.models.embedding.model, "snowflake-arctic-embed2");
+    assert_eq!(cfg.models.llm.endpoint, "http://192.168.0.2:11943");
+    // pdf paddle 값 보존(v2 비대칭 → pdf 대칭 키로 복사). user 의 pdf.ocr 는
+    // engine=paddle-onnx 이고 자체 det_model 없으므로 번들(None) 유지.
+    assert_eq!(cfg.ingest.pdf.ocr.engine, "paddle-onnx");
+
+    // 멱등.
+    let again = migrate_document(t);
+    assert!(!again.changed(), "재실행 변경: {:?}", again.changes);
+    assert_eq!(again.new_text, *t);
+}

crates/kebab-config/tests/pdf_ocr.rs

@@ -47,20 +47,20 @@ lang_hint = "kor"
 #[test]
 fn pdf_ocr_defaults_off_with_qwen_3b() {
     let cfg = Config::defaults();
-    assert!(!cfg.pdf.ocr.enabled);
-    assert!(!cfg.pdf.ocr.always_on);
-    assert_eq!(cfg.pdf.ocr.engine, "ollama-vision");
-    assert_eq!(cfg.pdf.ocr.model, "qwen2.5vl:3b");
-    assert!(cfg.pdf.ocr.endpoint.is_none());
+    assert!(!cfg.ingest.pdf.ocr.enabled);
+    assert!(!cfg.ingest.pdf.ocr.always_on);
+    assert_eq!(cfg.ingest.pdf.ocr.engine, "ollama-vision");
+    assert_eq!(cfg.ingest.pdf.ocr.model, "qwen2.5vl:3b");
+    assert!(cfg.ingest.pdf.ocr.endpoint.is_none());
     assert_eq!(
-        cfg.pdf.ocr.languages,
+        cfg.ingest.pdf.ocr.languages,
         vec!["eng".to_string(), "kor".to_string()]
     );
-    assert_eq!(cfg.pdf.ocr.max_pixels, 2048);
-    assert_eq!(cfg.pdf.ocr.request_timeout_secs, 180); // Bug #11: 600 → 60 → 180 (HOTFIXES 2026-05-28)
-    assert!((cfg.pdf.ocr.valid_ratio_threshold - 0.5).abs() < 1e-6);
-    assert_eq!(cfg.pdf.ocr.min_char_count, 20);
-    assert_eq!(cfg.pdf.ocr.lang_hint.as_deref(), Some("kor"));
+    assert_eq!(cfg.ingest.pdf.ocr.max_pixels, 2048);
+    assert_eq!(cfg.ingest.pdf.ocr.request_timeout_secs, 180); // Bug #11: 600 → 60 → 180 (HOTFIXES 2026-05-28)
+    assert!((cfg.ingest.pdf.ocr.valid_ratio_threshold - 0.5).abs() < 1e-6);
+    assert_eq!(cfg.ingest.pdf.ocr.min_char_count, 20);
+    assert_eq!(cfg.ingest.pdf.ocr.lang_hint.as_deref(), Some("kor"));
 }
 
 // Test 3: env var override — 4 keys 의 typical override case.
@@ -80,12 +80,12 @@ fn pdf_ocr_env_overrides() {
 
     let cfg = Config::defaults().apply_env(&env);
 
-    assert!(cfg.pdf.ocr.enabled);
-    assert_eq!(cfg.pdf.ocr.model, "qwen2.5vl:7b");
-    assert!(cfg.pdf.ocr.always_on);
-    assert!((cfg.pdf.ocr.valid_ratio_threshold - 0.75).abs() < 1e-6);
+    assert!(cfg.ingest.pdf.ocr.enabled);
+    assert_eq!(cfg.ingest.pdf.ocr.model, "qwen2.5vl:7b");
+    assert!(cfg.ingest.pdf.ocr.always_on);
+    assert!((cfg.ingest.pdf.ocr.valid_ratio_threshold - 0.75).abs() < 1e-6);
 
     // 다른 env var 가 default 보존
-    assert_eq!(cfg.pdf.ocr.engine, "ollama-vision");
-    assert_eq!(cfg.pdf.ocr.min_char_count, 20);
+    assert_eq!(cfg.ingest.pdf.ocr.engine, "ollama-vision");
+    assert_eq!(cfg.ingest.pdf.ocr.min_char_count, 20);
 }

crates/kebab-core/src/chunk.rs

@@ -28,13 +28,6 @@ pub struct Chunk {
     /// Bug #8 (한국어 2자 query) 해결을 위한 V009 cascade.
     #[serde(default)]
     pub tokenized_korean_text: Option<String>,
-    /// 색인시 doc-side expansion (Phase 2) 으로 생성된 "검색용 별칭"
-    /// (같은언어 paraphrase + 한↔영 번역, 개행 join). `[ingest.expansion]`
-    /// flag off 또는 미생성이면 None — 별도 FTS5 테이블 `chunk_aliases_fts`
-    /// 에만 색인되고 본문 매칭/dense 임베딩에는 영향 없음. 설계 spec
-    /// `2026-05-30-doc-side-expansion-design.md` §3.3.
-    #[serde(default)]
-    pub aliases: Option<String>,
 }
 
 #[cfg(test)]
@@ -42,8 +35,8 @@ mod tests {
     use super::*;
 
     #[test]
-    fn aliases_defaults_to_none_on_deserialize() {
-        // aliases 필드가 없는 과거 JSON 도 파싱되어야 한다 (#[serde(default)]).
+    fn tokenized_korean_text_defaults_to_none_on_deserialize() {
+        // tokenized_korean_text 필드가 없는 과거 JSON 도 파싱되어야 한다 (#[serde(default)]).
         let json = r#"{
             "chunk_id": "c1",
             "doc_id": "d1",
@@ -56,7 +49,6 @@ mod tests {
             "policy_hash": "abc"
         }"#;
         let c: Chunk = serde_json::from_str(json).unwrap();
-        assert_eq!(c.aliases, None);
         assert_eq!(c.tokenized_korean_text, None);
     }
 }

crates/kebab-embed-candle/Cargo.toml

@@ -0,0 +1,50 @@
+[package]
+name = "kebab-embed-candle"
+version       = { workspace = true }
+edition       = { workspace = true }
+rust-version  = { workspace = true }
+license       = { workspace = true }
+repository    = { workspace = true }
+description   = "Pure-Rust candle adapter implementing kb_core::Embedder (multilingual-e5-large, NUMA-safe thread cap)"
+
+[dependencies]
+kebab-core = { path = "../kebab-core" }
+kebab-config = { path = "../kebab-config" }
+# candle stack — pinned to the workspace-locked crates.io release (0.10.x),
+# same versions the Phase 0 spike compiled so build artifacts are reused.
+candle-core = "0.10.2"
+candle-nn = "0.10.2"
+candle-transformers = "0.10.2"
+tokenizers = "0.21"
+hf-hub = { version = "0.4", features = ["ureq"] }
+serde_json = { workspace = true }
+# Thread cap: a one-shot global rayon pool sizes candle's CPU threads
+# (the Phase 0 spike proved RAYON_NUM_THREADS caps candle), so a NUMA host
+# can keep onnxruntime's hard-coded 48-intra-op heap corruption at bay.
+rayon = "1"
+anyhow = { workspace = true }
+tracing = { workspace = true }
+
+[features]
+# opt-in: run candle on the Apple Silicon GPU (Metal). macOS-only — the build
+# enables candle's metal backend and `select_device()` picks Metal (CPU fallback
+# on failure). Lets an M-series Mac ingest e5-large on GPU (10×+ vs CPU); the
+# resulting vectors are cross-compatible with the CPU path (same model), so the
+# Linux server can serve queries on CPU candle.
+metal = ["candle-core/metal", "candle-nn/metal", "candle-transformers/metal"]
+
+[dev-dependencies]
+# Integration-test binaries can only see the library's public API + these,
+# not the library's own (non-dev) dependencies — so rayon/kebab-config/kebab-core
+# are repeated here for tests/parity.rs and tests/thread_cap.rs.
+kebab-embed-local = { path = "../kebab-embed-local" }
+# arctic↔Ollama parity test drives the real Ollama adapter for the reference
+# vectors (tests/arctic_ollama_parity.rs, `#[ignore]` — live Ollama).
+kebab-embed-ollama = { path = "../kebab-embed-ollama" }
+kebab-config = { path = "../kebab-config" }
+kebab-core = { path = "../kebab-core" }
+rayon = "1"
+tempfile = { workspace = true }
+
+[lints]
+workspace = true

crates/kebab-embed-candle/src/lib.rs

@@ -0,0 +1,619 @@
+//! `kebab-embed-candle` — [`CandleEmbedder`], a pure-Rust (candle)
+//! implementation of [`Embedder`](kebab_core::Embedder).
+//!
+//! Runs an XLM-RoBERTa-large embedding model through `candle`
+//! (`candle-transformers`' XLM-RoBERTa) instead of onnxruntime. Two models
+//! are wired through a small **registry** ([`MODEL_REGISTRY`]):
+//!
+//! * `multilingual-e5-large` — the same weights the default
+//!   [`FastembedEmbedder`](kebab_embed_local) uses (mean pooling,
+//!   `query: `/`passage: ` prefixes). candle is the NUMA-safe drop-in:
+//!   fastembed 4.9's onnxruntime hard-codes 48 intra-op threads, which
+//!   corrupts the heap (double-free) on dual-socket NUMA hosts. candle's
+//!   CPU backend sizes its threads off the global rayon pool, so a one-shot
+//!   [`rayon::ThreadPoolBuilder`] cap (config `num_threads` / env
+//!   `KEBAB_EMBED_THREADS`) keeps the worker count NUMA-safe.
+//! * `snowflake-arctic-embed-l-v2.0` — Snowflake's arctic-embed v2.0
+//!   (CLS pooling, `query: ` on queries / no prefix on documents). Same
+//!   XLM-RoBERTa-large architecture, dim 1024, so it rides the exact same
+//!   tokenize → forward → L2 pipeline; only the pooling step and prefixes
+//!   differ (both keyed off the per-model [`EmbedModelSpec`]).
+//!
+//! Output parity with the onnxruntime path (for e5) was proven by the
+//! Phase 0 spike (cosine 1.000000); the arctic path's pooling/prefix
+//! correctness is pinned by an `#[ignore]`d cosine>0.99 cross-check against
+//! Ollama's `snowflake-arctic-embed2` (see `tests/arctic_ollama_parity.rs`).
+//! The shared pipeline:
+//!
+//! 1. instruction prefix per [`EmbedModelSpec`] (query/doc);
+//! 2. tokenize (max_len 512, batch-longest padding, special tokens);
+//! 3. XLM-RoBERTa forward on the selected [`Device`];
+//! 4. pooling — mean (attention-mask-weighted) or CLS (first token);
+//! 5. L2 normalization.
+//!
+//! Model files (`config.json`, `tokenizer.json`, `model.safetensors`) are
+//! fetched via `hf-hub` into `{config.storage.model_dir}/candle/` (hf-hub's
+//! cache layout namespaces by repo, so e5 and arctic never collide).
+//!
+//! This crate is **opt-in** (`config.models.embedding.provider = "candle"`);
+//! the default provider stays `fastembed`. See
+//! `docs/superpowers/specs/2026-06-01-embed-candle-track-spec.md` and
+//! `docs/superpowers/specs/2026-06-03-arctic-embedder-spec.md`.
+
+use std::sync::Mutex;
+
+use anyhow::{Context, Result};
+use candle_core::{DType, Device, Tensor};
+use candle_nn::VarBuilder;
+use candle_transformers::models::xlm_roberta::{Config as XlmConfig, XLMRobertaModel};
+use kebab_config::{Config, expand_path};
+use kebab_core::{Embedder, EmbeddingInput, EmbeddingKind, EmbeddingModelId, EmbeddingVersion};
+use tokenizers::{PaddingParams, PaddingStrategy, Tokenizer, TruncationParams};
+
+/// Subdirectory under `config.storage.model_dir` where the candle adapter
+/// caches safetensors + tokenizer. Mirrors `kebab-embed-local`'s
+/// `fastembed/` subdir so the two backends never collide.
+const CANDLE_CACHE_SUBDIR: &str = "candle";
+
+/// Token truncation length (both e5 and arctic-embed-l-v2.0 train at 512).
+const MAX_LEN: usize = 512;
+
+/// Env var that overrides `config.models.embedding.num_threads`. Read once in
+/// [`CandleEmbedder::new`]; `0`/unset/unparseable means "leave rayon default".
+const ENV_EMBED_THREADS: &str = "KEBAB_EMBED_THREADS";
+
+/// Pooling strategy over the model's last hidden state. Keyed per-model by
+/// [`EmbedModelSpec::pooling`] — e5 is mean, arctic is CLS.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Pooling {
+    /// Attention-mask-weighted mean over all tokens (e5 / sentence-transformers
+    /// `pooling_mode_mean_tokens`).
+    Mean,
+    /// First token (`<s>`/`[CLS]`) hidden state (arctic-embed v2.0 —
+    /// `1_Pooling/config.json` has `pooling_mode_cls_token: true`).
+    Cls,
+}
+
+/// One supported embedding model: the HF repo candle downloads, the pooling
+/// strategy, and the e5-style instruction prefixes. [`MODEL_REGISTRY`] maps a
+/// `config.models.embedding.model` value to one of these.
+#[derive(Clone, Copy, Debug)]
+pub struct EmbedModelSpec {
+    /// The short `config.models.embedding.model` value that selects this spec.
+    pub name: &'static str,
+    /// HuggingFace repo id candle fetches `config.json` / `tokenizer.json` /
+    /// `model.safetensors` from.
+    pub hf_repo: &'static str,
+    /// Pooling over the last hidden state.
+    pub pooling: Pooling,
+    /// Prefix prepended to **query** inputs before tokenization.
+    pub query_prefix: &'static str,
+    /// Prefix prepended to **document** inputs before tokenization (arctic
+    /// uses `""` — documents are embedded raw).
+    pub doc_prefix: &'static str,
+    /// Expected embedding dimension (model hidden size).
+    pub dim: usize,
+    /// Suffix folded into `model_version` so switching **to** this model
+    /// triggers the `embedding_version` cascade even if the operator forgets
+    /// to bump `config.version`. `None` keeps the bare `config.version` — used
+    /// by e5 so candle-e5 and fastembed-e5 report the *same* version and stay
+    /// interchangeable (the NUMA drop-in invariant — Phase 0 cosine 1.0).
+    pub version_tag: Option<&'static str>,
+}
+
+/// The models the candle adapter can load. Adding a model = one entry here
+/// (plus, for a non-XLM-R architecture, a new forward path — both current
+/// entries are XLM-RoBERTa-large so they share everything but pooling/prefix).
+static MODEL_REGISTRY: &[EmbedModelSpec] = &[
+    EmbedModelSpec {
+        name: "multilingual-e5-large",
+        hf_repo: "intfloat/multilingual-e5-large",
+        pooling: Pooling::Mean,
+        query_prefix: "query: ",
+        doc_prefix: "passage: ",
+        dim: 1024,
+        version_tag: None,
+    },
+    EmbedModelSpec {
+        name: "snowflake-arctic-embed-l-v2.0",
+        hf_repo: "Snowflake/snowflake-arctic-embed-l-v2.0",
+        pooling: Pooling::Cls,
+        query_prefix: "query: ",
+        doc_prefix: "",
+        dim: 1024,
+        version_tag: Some("arctic-cls"),
+    },
+];
+
+/// Look up a model spec by `config.models.embedding.model`. Accepts either the
+/// short `name` or the full `hf_repo` id (mirrors the old e5 guard, which
+/// accepted both `multilingual-e5-large` and `intfloat/multilingual-e5-large`).
+pub(crate) fn lookup_spec(model: &str) -> Option<&'static EmbedModelSpec> {
+    MODEL_REGISTRY
+        .iter()
+        .find(|s| s.name == model || s.hf_repo == model)
+}
+
+/// Comma-separated list of supported model names, for the
+/// unsupported-model error message.
+fn supported_models() -> String {
+    MODEL_REGISTRY
+        .iter()
+        .map(|s| s.name)
+        .collect::<Vec<_>>()
+        .join("`, `")
+}
+
+/// Pure-Rust candle adapter. Construct via [`CandleEmbedder::new`]; the
+/// constructor downloads the model on first use, so share one instance.
+pub struct CandleEmbedder {
+    // candle's `forward` is `&self`, but `XLMRobertaModel` is not guaranteed
+    // `Sync`; the `Mutex` both supplies that bound and serializes inference
+    // (callers batch sequentially anyway — same rationale as
+    // `FastembedEmbedder`).
+    model: Mutex<XLMRobertaModel>,
+    tokenizer: Tokenizer,
+    device: Device,
+    /// The resolved model spec (pooling + prefixes) — drives `embed` and
+    /// `embed_batch`.
+    spec: &'static EmbedModelSpec,
+    model_id: EmbeddingModelId,
+    version: EmbeddingVersion,
+    dimensions: usize,
+    batch_size: usize,
+}
+
+impl CandleEmbedder {
+    /// Build an embedder from `Config`. Resolves the model spec from
+    /// `config.models.embedding.model`, applies the NUMA thread cap, fetches
+    /// the model into `{model_dir}/candle/`, and validates that the model's
+    /// hidden size matches `config.models.embedding.dimensions` before
+    /// returning.
+    pub fn new(config: &Config) -> Result<Self> {
+        // 1. NUMA thread cap. env `KEBAB_EMBED_THREADS` wins over the config
+        //    field; `0`/unset leaves rayon's default. `build_global` errors if
+        //    the pool was already initialized — intentionally ignored so a
+        //    second embedder (or a prior rayon user) is a no-op, not a failure.
+        let n_threads = std::env::var(ENV_EMBED_THREADS)
+            .ok()
+            .and_then(|v| v.parse::<usize>().ok())
+            .unwrap_or(config.models.embedding.num_threads as usize);
+        if n_threads > 0 {
+            if apply_thread_cap(n_threads) {
+                tracing::info!(
+                    target: "kebab-embed-candle",
+                    num_threads = n_threads,
+                    "capped global rayon pool for candle CPU backend"
+                );
+            } else {
+                tracing::debug!(
+                    target: "kebab-embed-candle",
+                    requested = n_threads,
+                    "global rayon pool already initialized; thread cap not applied"
+                );
+            }
+        }
+
+        // 1b. Model registry lookup. If the operator configured a model the
+        //     candle adapter doesn't know, fail fast (BEFORE the ~2GB
+        //     download) — never silently download one model and then label its
+        //     vectors with another name via `model_id()`, which would mislabel
+        //     `embedding_version` and corrupt a mixed index.
+        let want = config.models.embedding.model.as_str();
+        let spec = lookup_spec(want).ok_or_else(|| {
+            anyhow::anyhow!(
+                "candle provider supports the models `{}`, but \
+                 config.models.embedding.model = '{want}'. Use provider=fastembed \
+                 for other models, or pick a supported one.",
+                supported_models()
+            )
+        })?;
+
+        // 2. Resolve `{data_dir}/models/candle/` exactly like the fastembed
+        //    adapter resolves its own subdir.
+        let data_dir = expand_path(&config.storage.data_dir, "");
+        let model_dir = expand_path(&config.storage.model_dir, &data_dir.to_string_lossy());
+        let cache_dir = model_dir.join(CANDLE_CACHE_SUBDIR);
+        std::fs::create_dir_all(&cache_dir)
+            .with_context(|| format!("create candle cache dir {}", cache_dir.display()))?;
+
+        let device = select_device();
+
+        // 3. Fetch model files via hf-hub into the candle cache.
+        tracing::info!(
+            target: "kebab-embed-candle",
+            cache_dir = %cache_dir.display(),
+            model = spec.hf_repo,
+            pooling = ?spec.pooling,
+            "loading candle embedding model (first run downloads ~2GB safetensors)"
+        );
+        let api = hf_hub::api::sync::ApiBuilder::new()
+            .with_cache_dir(cache_dir.clone())
+            .build()
+            .context("kb-embed-candle: build hf-hub api")?;
+        let repo = api.model(spec.hf_repo.to_string());
+        let config_path = repo.get("config.json").context("download config.json")?;
+        let tokenizer_path = repo
+            .get("tokenizer.json")
+            .context("download tokenizer.json")?;
+        let weights_path = repo
+            .get("model.safetensors")
+            .context("download model.safetensors")?;
+
+        // 4. Build the candle XLM-RoBERTa model.
+        let cfg_json = std::fs::read_to_string(&config_path)
+            .with_context(|| format!("read {}", config_path.display()))?;
+        let cfg: XlmConfig =
+            serde_json::from_str(&cfg_json).context("kb-embed-candle: parse XLM-R config")?;
+
+        // Validate dim BEFORE building the model so a misconfigured
+        // `dimensions` fails cheaply (matches FastembedEmbedder's contract).
+        check_dim(cfg.hidden_size, config.models.embedding.dimensions)?;
+
+        let vb = unsafe {
+            VarBuilder::from_mmaped_safetensors(&[weights_path], DType::F32, &device)
+                .context("kb-embed-candle: mmap safetensors")?
+        };
+        let model =
+            XLMRobertaModel::new(&cfg, vb).context("kb-embed-candle: build XLMRobertaModel")?;
+
+        let mut tokenizer = Tokenizer::from_file(&tokenizer_path)
+            .map_err(|e| anyhow::anyhow!("kb-embed-candle: load tokenizer: {e}"))?;
+        tokenizer
+            .with_padding(Some(PaddingParams {
+                strategy: PaddingStrategy::BatchLongest,
+                ..Default::default()
+            }))
+            .with_truncation(Some(TruncationParams {
+                max_length: MAX_LEN,
+                ..Default::default()
+            }))
+            .map_err(|e| anyhow::anyhow!("kb-embed-candle: set truncation: {e}"))?;
+
+        // model_version: fold the model tag in for non-e5 models so a switch
+        // triggers the embedding_version cascade; e5 keeps the bare
+        // config.version to stay interchangeable with fastembed-e5.
+        let version = match spec.version_tag {
+            Some(tag) => {
+                EmbeddingVersion(format!("{}+{}", config.models.embedding.version, tag))
+            }
+            None => EmbeddingVersion(config.models.embedding.version.clone()),
+        };
+
+        tracing::info!(
+            target: "kebab-embed-candle",
+            dimensions = cfg.hidden_size,
+            layers = cfg.num_hidden_layers,
+            model = spec.name,
+            "candle embedding model loaded"
+        );
+
+        Ok(Self {
+            model: Mutex::new(model),
+            tokenizer,
+            device,
+            spec,
+            model_id: EmbeddingModelId(config.models.embedding.model.clone()),
+            version,
+            dimensions: cfg.hidden_size,
+            batch_size: config.models.embedding.batch_size.max(1),
+        })
+    }
+
+    /// Embed one batch of **already-prefixed** strings (the per-model prefix
+    /// is applied by the caller [`CandleEmbedder::embed`]) through the candle
+    /// pipeline: tokenize → forward → pool (mean|CLS) → L2.
+    fn embed_batch(&self, prefixed: &[String]) -> Result<Vec<Vec<f32>>> {
+        let encodings = self
+            .tokenizer
+            .encode_batch(prefixed.to_vec(), true)
+            .map_err(|e| anyhow::anyhow!("kb-embed-candle: encode_batch: {e}"))?;
+
+        let bsz = encodings.len();
+        // `embed` already returns early on empty input and `.chunks()` never
+        // yields an empty slice, so this is currently unreachable — but guard
+        // the index so a future refactor can't turn it into a panic.
+        let Some(first) = encodings.first() else {
+            return Ok(Vec::new());
+        };
+        let seq = first.get_ids().len();
+
+        let mut ids = Vec::with_capacity(bsz * seq);
+        let mut mask = Vec::with_capacity(bsz * seq);
+        for enc in &encodings {
+            ids.extend(enc.get_ids().iter().copied());
+            mask.extend(enc.get_attention_mask().iter().map(|&m| m as f32));
+        }
+
+        let input_ids = Tensor::from_vec(ids, (bsz, seq), &self.device)?;
+        let attn_f32 = Tensor::from_vec(mask, (bsz, seq), &self.device)?;
+        let token_type_ids = input_ids.zeros_like()?;
+
+        let hidden = {
+            let guard = self
+                .model
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            // forward: (input_ids, attention_mask, token_type_ids, past,
+            // encoder_hidden, encoder_mask)
+            guard.forward(&input_ids, &attn_f32, &token_type_ids, None, None, None)?
+        };
+
+        // Pooling — per the model spec.
+        let pooled = match self.spec.pooling {
+            Pooling::Mean => {
+                // attention-mask-weighted mean pooling
+                let mask3 = attn_f32.unsqueeze(2)?; // (b, seq, 1)
+                let summed = hidden.broadcast_mul(&mask3)?.sum(1)?; // (b, hidden)
+                // counts ≥ 1 always: every input is prefixed AND special
+                // tokens are added (encode_batch(_, true)), so no row has an
+                // all-zero mask. If that invariant ever breaks, broadcast_div
+                // would emit NaN vectors.
+                let counts = mask3.sum(1)?; // (b, 1)
+                summed.broadcast_div(&counts)?
+            }
+            Pooling::Cls => {
+                // CLS pooling: the first token's hidden state. arctic-embed
+                // v2.0 prepends `<s>` (the XLM-R BOS/CLS) at index 0, so
+                // `hidden[:, 0, :]` is the sentence embedding.
+                hidden.narrow(1, 0, 1)?.squeeze(1)? // (b, hidden)
+            }
+        };
+
+        // L2 normalize
+        let norm = pooled.sqr()?.sum_keepdim(1)?.sqrt()?;
+        let normalized = pooled.broadcast_div(&norm)?;
+
+        // `.contiguous()` before host copy: broadcast ops can leave a strided
+        // view, which `to_vec2` rejects on the Metal backend (CPU tolerates it).
+        Ok(normalized.contiguous()?.to_vec2::<f32>()?)
+    }
+}
+
+impl Embedder for CandleEmbedder {
+    fn model_id(&self) -> EmbeddingModelId {
+        self.model_id.clone()
+    }
+
+    fn model_version(&self) -> EmbeddingVersion {
+        self.version.clone()
+    }
+
+    fn dimensions(&self) -> usize {
+        self.dimensions
+    }
+
+    fn embed(&self, inputs: &[EmbeddingInput<'_>]) -> Result<Vec<Vec<f32>>> {
+        if inputs.is_empty() {
+            return Ok(Vec::new());
+        }
+
+        // Per-model instruction prefix BEFORE tokenization (same convention as
+        // FastembedEmbedder for e5; arctic uses `query: `/no-prefix).
+        let prefixed: Vec<String> = inputs.iter().map(|i| prefix_input(self.spec, i)).collect();
+
+        let mut out: Vec<Vec<f32>> = Vec::with_capacity(prefixed.len());
+        for chunk in prefixed.chunks(self.batch_size) {
+            let batch = self.embed_batch(chunk)?;
+            for v in &batch {
+                if v.len() != self.dimensions {
+                    anyhow::bail!(
+                        "candle returned vector of length {} but adapter expects {}",
+                        v.len(),
+                        self.dimensions
+                    );
+                }
+            }
+            out.extend(batch);
+        }
+
+        debug_assert_eq!(out.len(), inputs.len());
+        Ok(out)
+    }
+}
+
+/// Build the prefixed string for one [`EmbeddingInput`] using the model spec.
+/// Free function so a unit test can pin the format without loading the model.
+/// For e5 this is byte-identical to `kebab-embed-local`'s `prefix_input` — the
+/// two backends MUST agree there or their vectors diverge.
+fn prefix_input(spec: &EmbedModelSpec, input: &EmbeddingInput<'_>) -> String {
+    match input.kind {
+        EmbeddingKind::Document => format!("{}{}", spec.doc_prefix, input.text),
+        EmbeddingKind::Query => format!("{}{}", spec.query_prefix, input.text),
+    }
+}
+
+/// Select the compute device. Built with the `metal` feature (Apple Silicon
+/// GPU), try Metal and fall back to CPU on failure; otherwise CPU. Metal only
+/// compiles/runs on macOS — the Linux server builds the CPU path. Embedding
+/// vectors are model-defined, so Metal-produced and CPU-produced embeddings
+/// are cross-compatible (a Mac can ingest on GPU, the server query on CPU).
+fn select_device() -> Device {
+    #[cfg(feature = "metal")]
+    {
+        match Device::new_metal(0) {
+            Ok(d) => {
+                tracing::info!(target: "kebab-embed-candle", "candle device = Metal (GPU)");
+                return d;
+            }
+            Err(e) => {
+                tracing::warn!(
+                    target: "kebab-embed-candle",
+                    error = %e,
+                    "Metal device unavailable; falling back to CPU"
+                );
+            }
+        }
+    }
+    tracing::info!(target: "kebab-embed-candle", "candle device = CPU");
+    Device::Cpu
+}
+
+/// Apply a one-shot global rayon thread cap (the NUMA-safety lever). Returns
+/// `true` if this call set the pool, `false` if it was already initialized
+/// (cap not applied) or `n_threads == 0`. `#[doc(hidden)] pub` so the
+/// thread-cap test can drive it without loading the 2GB model.
+#[doc(hidden)]
+pub fn apply_thread_cap(n_threads: usize) -> bool {
+    if n_threads == 0 {
+        return false;
+    }
+    rayon::ThreadPoolBuilder::new()
+        .num_threads(n_threads)
+        .build_global()
+        .is_ok()
+}
+
+/// Compare model hidden size against the configured dim. Extracted so a unit
+/// test can exercise the error branch without loading the model.
+pub(crate) fn check_dim(model_dim: usize, cfg_dim: usize) -> Result<()> {
+    if model_dim != cfg_dim {
+        anyhow::bail!(
+            "dimension mismatch: model={model_dim}, config={cfg_dim}; \
+             update `config.models.embedding.dimensions` to match the model \
+             (or pick a different model)."
+        );
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn e5_spec() -> &'static EmbedModelSpec {
+        lookup_spec("multilingual-e5-large").expect("e5 in registry")
+    }
+
+    fn arctic_spec() -> &'static EmbedModelSpec {
+        lookup_spec("snowflake-arctic-embed-l-v2.0").expect("arctic in registry")
+    }
+
+    // ── registry ─────────────────────────────────────────────────────
+
+    #[test]
+    fn registry_resolves_e5_by_name_and_hf_repo() {
+        assert_eq!(
+            lookup_spec("multilingual-e5-large").map(|s| s.name),
+            Some("multilingual-e5-large")
+        );
+        assert_eq!(
+            lookup_spec("intfloat/multilingual-e5-large").map(|s| s.name),
+            Some("multilingual-e5-large")
+        );
+    }
+
+    #[test]
+    fn registry_resolves_arctic_and_its_pooling_is_cls() {
+        let s = arctic_spec();
+        assert_eq!(s.name, "snowflake-arctic-embed-l-v2.0");
+        assert_eq!(s.hf_repo, "Snowflake/snowflake-arctic-embed-l-v2.0");
+        assert_eq!(s.pooling, Pooling::Cls);
+        assert_eq!(s.dim, 1024);
+        assert_eq!(s.version_tag, Some("arctic-cls"));
+    }
+
+    #[test]
+    fn registry_e5_is_mean_pooling_no_version_tag() {
+        let s = e5_spec();
+        assert_eq!(s.pooling, Pooling::Mean);
+        assert_eq!(s.version_tag, None);
+    }
+
+    #[test]
+    fn registry_rejects_unknown_model() {
+        assert!(lookup_spec("multilingual-e5-small").is_none());
+    }
+
+    // ── prefix_input ─────────────────────────────────────────────────
+    // e5 prefixes MUST match kebab-embed-local::prefix_input or candle vs
+    // fastembed parity breaks; arctic uses query-only prefixing.
+
+    #[test]
+    fn e5_prefix_document_uses_passage() {
+        let input = EmbeddingInput {
+            text: "hello world",
+            kind: EmbeddingKind::Document,
+        };
+        assert_eq!(prefix_input(e5_spec(), &input), "passage: hello world");
+    }
+
+    #[test]
+    fn e5_prefix_query_uses_query() {
+        let input = EmbeddingInput {
+            text: "hello world",
+            kind: EmbeddingKind::Query,
+        };
+        assert_eq!(prefix_input(e5_spec(), &input), "query: hello world");
+    }
+
+    #[test]
+    fn arctic_prefix_query_uses_query_doc_is_bare() {
+        let doc = EmbeddingInput {
+            text: "후입선출 자료구조",
+            kind: EmbeddingKind::Document,
+        };
+        let qry = EmbeddingInput {
+            text: "스택 자료구조",
+            kind: EmbeddingKind::Query,
+        };
+        // arctic: documents are embedded raw, queries get `query: `.
+        assert_eq!(prefix_input(arctic_spec(), &doc), "후입선출 자료구조");
+        assert_eq!(prefix_input(arctic_spec(), &qry), "query: 스택 자료구조");
+    }
+
+    #[test]
+    fn prefix_handles_empty_text() {
+        let doc = EmbeddingInput {
+            text: "",
+            kind: EmbeddingKind::Document,
+        };
+        let qry = EmbeddingInput {
+            text: "",
+            kind: EmbeddingKind::Query,
+        };
+        assert_eq!(prefix_input(e5_spec(), &doc), "passage: ");
+        assert_eq!(prefix_input(e5_spec(), &qry), "query: ");
+        assert_eq!(prefix_input(arctic_spec(), &doc), "");
+        assert_eq!(prefix_input(arctic_spec(), &qry), "query: ");
+    }
+
+    // ── check_dim ────────────────────────────────────────────────────
+
+    #[test]
+    fn check_dim_passes_for_1024() {
+        check_dim(1024, 1024).expect("matching dims must pass");
+    }
+
+    #[test]
+    fn check_dim_rejects_384_vs_1024() {
+        let err = check_dim(384, 1024).expect_err("dim mismatch must error");
+        let msg = format!("{err}");
+        assert!(
+            msg.contains("384") && msg.contains("1024"),
+            "error must mention both dims, got: {msg}"
+        );
+    }
+
+    // ── model guard ──────────────────────────────────────────────────
+    // A model name not in the registry must fail fast (BEFORE the ~2GB
+    // download), so we never download one model yet label its vectors with
+    // another name via model_id() — which would mislabel embedding_version.
+
+    #[test]
+    fn new_rejects_unsupported_model() {
+        let mut config = kebab_config::Config::defaults();
+        config.models.embedding.model = "multilingual-e5-small".to_string();
+        // num_threads defaults to 0, so no global rayon side effect here.
+        // `.err()` (not `expect_err`) avoids requiring `CandleEmbedder: Debug`
+        // — it holds a Mutex/Tokenizer and intentionally derives no Debug.
+        let err = CandleEmbedder::new(&config)
+            .err()
+            .expect("unsupported model must error");
+        let msg = format!("{err:#}");
+        assert!(
+            msg.contains("candle provider supports the models"),
+            "expected model-registry error, got: {msg}"
+        );
+    }
+}

crates/kebab-embed-candle/tests/arctic_ollama_parity.rs

@@ -0,0 +1,128 @@
+//! arctic-embed-l-v2.0 correctness gate (`#[ignore]` — needs the ~2GB candle
+//! model + a live Ollama serving `snowflake-arctic-embed2`).
+//!
+//! This is the load-bearing pooling/prefix check for the arctic integration.
+//! The recall measurement that justified adopting arctic (recall@10 130/132)
+//! went through Ollama's `snowflake-arctic-embed2`. The candle path
+//! re-implements the model (XLM-RoBERTa-large + **CLS** pooling + `query: ` on
+//! queries / no prefix on documents). If candle's pooling or prefix is wrong,
+//! its vectors silently diverge from the measured route and the 130 number
+//! does NOT carry over. This test pins them together: per-sentence cosine
+//! between the candle vector and the Ollama vector must be **> 0.99**.
+//!
+//! `#[ignore]` because it depends on an external Ollama daemon (CI is
+//! headless/offline). The leader MUST run it once before merge.
+//!
+//! ## Manual run
+//!
+//! 1. Confirm Ollama is reachable and has the model:
+//!    ```sh
+//!    curl -s http://192.168.0.47:11434/api/tags        # should list snowflake-arctic-embed2
+//!    ```
+//! 2. Run (downloads the ~2GB candle safetensors on first run):
+//!    ```sh
+//!    CARGO_TARGET_DIR=/build/out/cargo-target \
+//!    KEBAB_ARCTIC_OLLAMA_ENDPOINT=http://192.168.0.47:11434 \
+//!    cargo test -p kebab-embed-candle --test arctic_ollama_parity -- --ignored --nocapture
+//!    ```
+//!    The endpoint defaults to `http://192.168.0.47:11434` if the env is unset.
+//!
+//! Record the printed `ARCTIC_PARITY_SUMMARY cosine_min=...` in
+//! `/tmp/arctic-result.md` + `tasks/HOTFIXES.md`.
+
+use kebab_config::Config;
+use kebab_core::{Embedder, EmbeddingInput, EmbeddingKind};
+use kebab_embed_candle::CandleEmbedder;
+use kebab_embed_ollama::OllamaEmbedder;
+
+const DOGFOOD_CONFIG: &str = "/build/dogfood/config.toml";
+const DEFAULT_OLLAMA_ENDPOINT: &str = "http://192.168.0.47:11434";
+
+/// Mixed Korean / English + the descriptive-recall shapes arctic was adopted
+/// for (synonym / abbreviation / English term). Covers both prefix paths.
+const SENTENCES: &[&str] = &[
+    "스택 자료구조",
+    "후입선출 방식으로 동작하는 자료구조",
+    "큐는 선입선출 자료구조이다",
+    "Rust ownership and the borrow checker",
+    "소유권과 빌림 검사기는 메모리 안전성을 보장한다",
+    "SVM 은 support vector machine 의 약자이다",
+    "정렬 알고리즘의 시간 복잡도",
+    "The capital of France is Paris.",
+];
+
+fn cosine(a: &[f32], b: &[f32]) -> f32 {
+    let dot: f32 = a.iter().zip(b).map(|(x, y)| x * y).sum();
+    let na: f32 = a.iter().map(|x| x * x).sum::<f32>().sqrt();
+    let nb: f32 = b.iter().map(|x| x * x).sum::<f32>().sqrt();
+    dot / (na * nb)
+}
+
+/// Base config: prefer the canonical dogfood config (for storage/cache roots),
+/// fall back to `Config::defaults()` so the test still runs on a bare clone.
+fn base_config() -> Config {
+    Config::load(Some(std::path::Path::new(DOGFOOD_CONFIG))).unwrap_or_else(|_| Config::defaults())
+}
+
+#[test]
+#[ignore = "needs ~2GB candle model + live Ollama (snowflake-arctic-embed2); run manually before merge"]
+fn candle_arctic_matches_ollama_arctic() {
+    let endpoint = std::env::var("KEBAB_ARCTIC_OLLAMA_ENDPOINT")
+        .unwrap_or_else(|_| DEFAULT_OLLAMA_ENDPOINT.to_string());
+
+    // candle side: the in-process arctic model.
+    let mut candle_cfg = base_config();
+    candle_cfg.models.embedding.provider = "candle".to_string();
+    candle_cfg.models.embedding.model = "snowflake-arctic-embed-l-v2.0".to_string();
+    candle_cfg.models.embedding.dimensions = 1024;
+
+    // Ollama side: the reference route the recall numbers came from.
+    let mut ollama_cfg = base_config();
+    ollama_cfg.models.embedding.provider = "ollama".to_string();
+    ollama_cfg.models.embedding.model = "snowflake-arctic-embed2".to_string();
+    ollama_cfg.models.embedding.dimensions = 1024;
+    ollama_cfg.models.embedding.endpoint = Some(endpoint.clone());
+
+    let candle = CandleEmbedder::new(&candle_cfg).expect("build candle arctic embedder");
+    let ollama = OllamaEmbedder::new(&ollama_cfg).expect("build ollama arctic embedder");
+
+    // Exercise BOTH prefix paths so a query-side divergence can't hide.
+    let inputs: Vec<EmbeddingInput> = SENTENCES
+        .iter()
+        .flat_map(|s| {
+            [EmbeddingKind::Document, EmbeddingKind::Query]
+                .into_iter()
+                .map(move |kind| EmbeddingInput { text: s, kind })
+        })
+        .collect();
+
+    let cv = candle.embed(&inputs).expect("candle embed");
+    let ov = ollama
+        .embed(&inputs)
+        .expect("ollama embed (is snowflake-arctic-embed2 pulled @ the endpoint?)");
+
+    assert_eq!(cv.len(), ov.len(), "embedding counts must match");
+    assert_eq!(cv.len(), inputs.len(), "one vector per input");
+    assert_eq!(candle.dimensions(), 1024);
+
+    let mut min_cos = f32::INFINITY;
+    for (i, inp) in inputs.iter().enumerate() {
+        assert_eq!(cv[i].len(), 1024, "candle dim");
+        assert_eq!(ov[i].len(), 1024, "ollama dim");
+        let c = cosine(&cv[i], &ov[i]);
+        min_cos = min_cos.min(c);
+        let kind = match inp.kind {
+            EmbeddingKind::Document => "doc",
+            EmbeddingKind::Query => "qry",
+        };
+        let preview: String = inp.text.chars().take(36).collect();
+        println!("[{i:>2}] {kind} cos={c:.6}  {preview}");
+    }
+
+    println!("ARCTIC_PARITY_SUMMARY cosine_min={min_cos:.6} endpoint={endpoint}");
+    assert!(
+        min_cos > 0.99,
+        "candle arctic vs Ollama arctic cosine_min={min_cos:.6} ≤ 0.99 — \
+         pooling/prefix mismatch; the recall=130 measurement will NOT reproduce"
+    );
+}

crates/kebab-embed-candle/tests/parity.rs

@@ -0,0 +1,96 @@
+//! Parity test (spec §7, `#[ignore]` — needs the ~2GB model + network).
+//!
+//! Confirms the candle backend reproduces the onnxruntime `FastembedEmbedder`
+//! vectors closely enough that no re-index is required (spec D-reindex):
+//! per-sentence cosine ≥ 0.9999, and reports the dimension-wise max absolute
+//! difference (the number the re-index decision hangs on).
+//!
+//! Run manually:
+//!   CARGO_TARGET_DIR=/build/out/cargo-target/target \
+//!   cargo test -p kebab-embed-candle --release -- --ignored --nocapture
+//!
+//! Uses the canonical dogfood config so both backends resolve the same model
+//! identifiers and cache roots.
+
+use kebab_config::Config;
+use kebab_core::{Embedder, EmbeddingInput, EmbeddingKind};
+use kebab_embed_candle::CandleEmbedder;
+use kebab_embed_local::FastembedEmbedder;
+
+const DOGFOOD_CONFIG: &str = "/build/dogfood/config.toml";
+
+/// Mixed Korean / English parity set (≥ 8 sentences, mirrors the Phase 0 spike).
+const SENTENCES: &[&str] = &[
+    "The quick brown fox jumps over the lazy dog.",
+    "오늘 날씨가 정말 좋아서 산책을 나가고 싶다.",
+    "Rust is a systems programming language focused on safety and performance.",
+    "벡터 검색은 임베딩 사이의 코사인 유사도를 이용한다.",
+    "Machine learning models require large amounts of training data.",
+    "한국어와 영어가 섞인 문장도 멀티링구얼 모델은 잘 처리한다.",
+    "The capital of France is Paris, a city known for its art and culture.",
+    "이 프로젝트는 로컬 우선 지식 베이스와 검색 증강 생성을 목표로 한다.",
+    "Database indexing dramatically speeds up query performance.",
+    "임베딩 모델을 candle 로 옮기면 NUMA 서버에서 안전하게 돌릴 수 있다.",
+];
+
+fn cosine(a: &[f32], b: &[f32]) -> f32 {
+    let dot: f32 = a.iter().zip(b).map(|(x, y)| x * y).sum();
+    let na: f32 = a.iter().map(|x| x * x).sum::<f32>().sqrt();
+    let nb: f32 = b.iter().map(|x| x * x).sum::<f32>().sqrt();
+    dot / (na * nb)
+}
+
+#[test]
+#[ignore = "needs ~2GB model + network; run manually for the re-index decision"]
+fn candle_matches_fastembed() {
+    let config = Config::load(Some(std::path::Path::new(DOGFOOD_CONFIG)))
+        .expect("load dogfood config for parity baseline");
+
+    let candle = CandleEmbedder::new(&config).expect("build CandleEmbedder");
+    let fastembed = FastembedEmbedder::new(&config).expect("build FastembedEmbedder");
+
+    // Cover BOTH prefix paths (`passage:` for Document, `query:` for Query) so
+    // a query-side prefix/pooling divergence can't slip through (reviewer note).
+    let inputs: Vec<EmbeddingInput> = SENTENCES
+        .iter()
+        .flat_map(|s| {
+            [EmbeddingKind::Document, EmbeddingKind::Query]
+                .into_iter()
+                .map(move |kind| EmbeddingInput { text: s, kind })
+        })
+        .collect();
+
+    let cv = candle.embed(&inputs).expect("candle embed");
+    let fv = fastembed.embed(&inputs).expect("fastembed embed");
+
+    assert_eq!(cv.len(), fv.len(), "embedding counts must match");
+    assert_eq!(cv.len(), inputs.len(), "one vector per input");
+    assert_eq!(candle.dimensions(), 1024);
+
+    let mut min_cos = f32::INFINITY;
+    let mut max_abs_diff = 0f32;
+    for (i, inp) in inputs.iter().enumerate() {
+        assert_eq!(cv[i].len(), 1024, "candle dim");
+        assert_eq!(fv[i].len(), 1024, "fastembed dim");
+        let c = cosine(&cv[i], &fv[i]);
+        min_cos = min_cos.min(c);
+        let diff = cv[i]
+            .iter()
+            .zip(&fv[i])
+            .map(|(a, b)| (a - b).abs())
+            .fold(0f32, f32::max);
+        max_abs_diff = max_abs_diff.max(diff);
+        let kind = match inp.kind {
+            EmbeddingKind::Document => "doc",
+            EmbeddingKind::Query => "qry",
+        };
+        let preview: String = inp.text.chars().take(36).collect();
+        println!("[{i:>2}] {kind} cos={c:.6} max_abs_diff={diff:.6e}  {preview}");
+    }
+
+    println!("PARITY_SUMMARY cosine_min={min_cos:.6} max_abs_diff={max_abs_diff:.6e}");
+    assert!(
+        min_cos >= 0.9999,
+        "candle vs fastembed cosine_min={min_cos:.6} < 0.9999 — investigate before merge"
+    );
+}

crates/kebab-embed-candle/tests/thread_cap.rs

@@ -0,0 +1,32 @@
+//! Thread-cap test (spec §7). Own integration binary → clean process, so the
+//! one-shot global rayon pool is initialized exactly once, by us.
+//!
+//! Verifies that `apply_thread_cap(4)` sizes the global rayon pool to 4, which
+//! is the lever that keeps candle's CPU backend NUMA-safe (vs onnxruntime's
+//! hard-coded 48 intra-op threads).
+
+use kebab_embed_candle::apply_thread_cap;
+
+#[test]
+fn thread_cap_sizes_global_rayon_pool() {
+    // Must run before any other rayon use in this process. As the only test in
+    // this binary that touches rayon, that holds.
+    let applied = apply_thread_cap(4);
+    assert!(applied, "first build_global call should succeed");
+    assert_eq!(
+        rayon::current_num_threads(),
+        4,
+        "global rayon pool must be capped at the requested 4 threads"
+    );
+
+    // A second cap attempt is a no-op (pool already built), not a panic.
+    assert!(
+        !apply_thread_cap(8),
+        "second build_global must report not-applied"
+    );
+    assert_eq!(
+        rayon::current_num_threads(),
+        4,
+        "thread count must stay at the first cap"
+    );
+}

crates/kebab-embed-ollama/Cargo.toml

@@ -0,0 +1,30 @@
+[package]
+name = "kebab-embed-ollama"
+version       = { workspace = true }
+edition       = { workspace = true }
+rust-version  = { workspace = true }
+license       = { workspace = true }
+repository    = { workspace = true }
+description   = "Ollama HTTP adapter implementing kebab_core::Embedder (POST /api/embed, L2-normalized, batched + fail-soft)"
+
+[dependencies]
+kebab-core = { path = "../kebab-core" }
+kebab-config = { path = "../kebab-config" }
+# `default-features = false` drops native-tls (system OpenSSL); we pin rustls.
+# reqwest 0.12's `blocking` feature wraps a private current-thread tokio
+# runtime — this crate exposes NO async surface (no `async`/`await`/`tokio::*`
+# symbols), matching the kebab-llm-local invariant.
+reqwest    = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls"] }
+serde      = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+tracing    = { workspace = true }
+anyhow     = { workspace = true }
+
+[dev-dependencies]
+# wiremock hosts the mock /api/embed server (needs a tokio runtime); tokio is
+# also pulled transitively at runtime by reqwest's `blocking` feature.
+wiremock   = { workspace = true }
+tokio      = { workspace = true, features = ["macros", "rt"] }
+
+[lints]
+workspace = true

crates/kebab-embed-ollama/src/lib.rs

@@ -0,0 +1,310 @@
+//! `kebab-embed-ollama` — [`OllamaEmbedder`], a `reqwest::blocking` adapter
+//! implementing [`Embedder`](kebab_core::Embedder) over Ollama's
+//! `POST /api/embed` endpoint.
+//!
+//! ## Why this exists
+//!
+//! The candle backend ([`kebab-embed-candle`]) runs arctic-embed-l-v2.0
+//! in-process (pure Rust, NUMA-safe). This crate is the **fallback** path:
+//! it offloads embedding to a local/remote Ollama daemon (`snowflake-arctic-embed2`),
+//! which is exactly the route the recall measurements used — so it reproduces
+//! the measured numbers (recall@10 130/132) byte-for-route. Opt-in via
+//! `config.models.embedding.provider = "ollama"`.
+//!
+//! ## Wire shape
+//!
+//! Request (`POST {endpoint}/api/embed`):
+//!
+//! ```json
+//! { "model": "snowflake-arctic-embed2", "input": ["query: 스택", "후입선출 ..."] }
+//! ```
+//!
+//! Response:
+//!
+//! ```json
+//! { "model": "...", "embeddings": [[0.01, ...], [0.02, ...]] }
+//! ```
+//!
+//! ## Pipeline
+//!
+//! 1. instruction prefix per model ([`prefixes_for`] — arctic: `query: ` on
+//!    queries, no prefix on documents; e5: `query: `/`passage: `);
+//! 2. batch into `BATCH` (48) inputs per request;
+//! 3. `POST /api/embed`, with fail-soft retry (`MAX_RETRIES`);
+//! 4. **L2 normalize** each returned vector — Ollama returns raw (un-normalized)
+//!    embeddings, so we normalize for cosine consistency with the candle path;
+//! 5. dim check against `config.models.embedding.dimensions`.
+//!
+//! ## Send-safety
+//!
+//! `reqwest::blocking::Client: Send + Sync`; the adapter holds only the client,
+//! an endpoint string, and small config scalars, so it is trivially `Send + Sync`
+//! as the [`Embedder`] trait requires.
+
+use std::time::Duration;
+
+use anyhow::{Context, Result};
+use kebab_core::{Embedder, EmbeddingInput, EmbeddingKind, EmbeddingModelId, EmbeddingVersion};
+use serde::{Deserialize, Serialize};
+
+/// Inputs per `/api/embed` request. Ollama handles arbitrary batch sizes, but
+/// a cap keeps a single HTTP body bounded and lets a partial failure retry a
+/// smaller unit.
+const BATCH: usize = 48;
+
+/// Fail-soft retry attempts per batch before the error propagates. Cold model
+/// load on the Ollama side can transiently 500/timeout; a couple of retries
+/// smooth that over without masking a hard misconfiguration.
+const MAX_RETRIES: u32 = 3;
+
+/// Default per-request HTTP timeout (seconds). Cold-loading an embedding model
+/// on first call can take tens of seconds; this matches the generous default
+/// used by the LLM adapter.
+const REQUEST_TIMEOUT_SECS: u64 = 300;
+
+/// Resolve the (query_prefix, doc_prefix) for an Ollama embedding model tag.
+///
+/// Mirrors `kebab-embed-candle`'s `MODEL_REGISTRY`, but keyed on the **Ollama
+/// model tag** (which differs from the HF id — e.g. `snowflake-arctic-embed2`
+/// vs `Snowflake/snowflake-arctic-embed-l-v2.0`). Kept here rather than shared
+/// so this crate does not depend on the candle backend.
+///
+/// An unrecognized model gets no prefix (`("", "")`): many embedding models
+/// are not instruction-tuned, so embedding the raw text is the correct default
+/// — and a misspelled known model surfaces as a recall regression, not a silent
+/// wrong-prefix, because the dim check still passes either way.
+fn prefixes_for(model: &str) -> (&'static str, &'static str) {
+    let m = model.to_ascii_lowercase();
+    if m.contains("arctic-embed") {
+        // arctic-embed v2.0: `query: ` on queries, documents embedded raw.
+        ("query: ", "")
+    } else if m.contains("e5") {
+        // multilingual-e5: `query: ` / `passage: `.
+        ("query: ", "passage: ")
+    } else {
+        ("", "")
+    }
+}
+
+/// `reqwest::blocking` adapter implementing [`Embedder`] over Ollama's
+/// `/api/embed`. Construction is offline; the first network call happens in
+/// [`Embedder::embed`].
+pub struct OllamaEmbedder {
+    client: reqwest::blocking::Client,
+    /// Validated endpoint base (e.g. `"http://127.0.0.1:11434"`).
+    endpoint: String,
+    /// Ollama model tag (e.g. `"snowflake-arctic-embed2"`).
+    model: String,
+    query_prefix: &'static str,
+    doc_prefix: &'static str,
+    model_id: EmbeddingModelId,
+    version: EmbeddingVersion,
+    dimensions: usize,
+}
+
+impl OllamaEmbedder {
+    /// Build from a workspace [`kebab_config::Config`]. Reads
+    /// `config.models.embedding.{model, dimensions}` and resolves the endpoint
+    /// as `models.embedding.endpoint` → fallback `models.llm.endpoint`.
+    ///
+    /// Does NOT touch the network. The caller (app layer) is expected to have
+    /// validated `provider == "ollama"`.
+    pub fn new(config: &kebab_config::Config) -> Result<Self> {
+        let emb = &config.models.embedding;
+        let endpoint = emb
+            .endpoint
+            .clone()
+            .filter(|e| !e.is_empty())
+            .unwrap_or_else(|| config.models.llm.endpoint.clone());
+        if endpoint.is_empty() {
+            anyhow::bail!(
+                "ollama embedding provider needs an endpoint: set \
+                 `models.embedding.endpoint` (or `models.llm.endpoint`)"
+            );
+        }
+        let client = reqwest::blocking::Client::builder()
+            .timeout(Duration::from_secs(REQUEST_TIMEOUT_SECS))
+            .build()
+            .context("kb-embed-ollama: build reqwest client")?;
+        let (query_prefix, doc_prefix) = prefixes_for(&emb.model);
+        Ok(Self {
+            client,
+            endpoint,
+            model: emb.model.clone(),
+            query_prefix,
+            doc_prefix,
+            model_id: EmbeddingModelId(emb.model.clone()),
+            // model_version = `ollama:{model}` so a provider/model switch
+            // triggers the embedding_version cascade and never collides with
+            // the candle path's version string for the same model.
+            version: EmbeddingVersion(format!("ollama:{}", emb.model)),
+            dimensions: emb.dimensions,
+        })
+    }
+
+    /// Embed one already-prefixed batch via `/api/embed`, with fail-soft retry.
+    fn embed_batch(&self, prefixed: &[String]) -> Result<Vec<Vec<f32>>> {
+        let url = format!("{}/api/embed", self.endpoint.trim_end_matches('/'));
+        let body = EmbedRequest {
+            model: &self.model,
+            input: prefixed,
+        };
+
+        let mut last_err: Option<anyhow::Error> = None;
+        for attempt in 1..=MAX_RETRIES {
+            match self.try_once(&url, &body) {
+                Ok(resp) => return self.finalize(resp, prefixed.len()),
+                Err(e) => {
+                    tracing::warn!(
+                        target: "kebab-embed-ollama",
+                        attempt,
+                        max = MAX_RETRIES,
+                        error = %e,
+                        "ollama /api/embed attempt failed; retrying"
+                    );
+                    last_err = Some(e);
+                }
+            }
+        }
+        Err(last_err.unwrap_or_else(|| {
+            anyhow::anyhow!("kb-embed-ollama: all {MAX_RETRIES} attempts failed")
+        }))
+    }
+
+    /// One HTTP round-trip. Network / non-2xx / decode errors all map to
+    /// `Err` so the retry loop can decide.
+    fn try_once(&self, url: &str, body: &EmbedRequest<'_>) -> Result<EmbedResponse> {
+        let resp = self
+            .client
+            .post(url)
+            .json(body)
+            .send()
+            .with_context(|| format!("kb-embed-ollama: POST {url}"))?;
+        let status = resp.status();
+        if !status.is_success() {
+            let text = resp.text().unwrap_or_default();
+            anyhow::bail!("kb-embed-ollama: /api/embed returned {status}: {text}");
+        }
+        resp.json::<EmbedResponse>()
+            .context("kb-embed-ollama: decode /api/embed response")
+    }
+
+    /// Validate count + dim, then L2-normalize each vector.
+    fn finalize(&self, resp: EmbedResponse, expected: usize) -> Result<Vec<Vec<f32>>> {
+        if resp.embeddings.len() != expected {
+            anyhow::bail!(
+                "kb-embed-ollama: expected {expected} embeddings, got {}",
+                resp.embeddings.len()
+            );
+        }
+        let mut out = Vec::with_capacity(resp.embeddings.len());
+        for v in resp.embeddings {
+            if v.len() != self.dimensions {
+                anyhow::bail!(
+                    "kb-embed-ollama: model returned dim {} but config expects {} \
+                     (check models.embedding.dimensions vs the Ollama model)",
+                    v.len(),
+                    self.dimensions
+                );
+            }
+            out.push(l2_normalize(v));
+        }
+        Ok(out)
+    }
+}
+
+impl Embedder for OllamaEmbedder {
+    fn model_id(&self) -> EmbeddingModelId {
+        self.model_id.clone()
+    }
+
+    fn model_version(&self) -> EmbeddingVersion {
+        self.version.clone()
+    }
+
+    fn dimensions(&self) -> usize {
+        self.dimensions
+    }
+
+    fn embed(&self, inputs: &[EmbeddingInput<'_>]) -> Result<Vec<Vec<f32>>> {
+        if inputs.is_empty() {
+            return Ok(Vec::new());
+        }
+        let prefixed: Vec<String> = inputs.iter().map(|i| self.prefix(i)).collect();
+        let mut out = Vec::with_capacity(prefixed.len());
+        for chunk in prefixed.chunks(BATCH) {
+            out.extend(self.embed_batch(chunk)?);
+        }
+        debug_assert_eq!(out.len(), inputs.len());
+        Ok(out)
+    }
+}
+
+impl OllamaEmbedder {
+    /// Prefix one input per the resolved model prefixes.
+    fn prefix(&self, input: &EmbeddingInput<'_>) -> String {
+        match input.kind {
+            EmbeddingKind::Document => format!("{}{}", self.doc_prefix, input.text),
+            EmbeddingKind::Query => format!("{}{}", self.query_prefix, input.text),
+        }
+    }
+}
+
+/// L2-normalize a vector in place-ish (consumes + returns). A zero vector is
+/// returned unchanged (norm 0 → no division) so a degenerate embedding can
+/// never produce NaNs.
+fn l2_normalize(mut v: Vec<f32>) -> Vec<f32> {
+    let norm = v.iter().map(|x| x * x).sum::<f32>().sqrt();
+    if norm > 0.0 {
+        for x in &mut v {
+            *x /= norm;
+        }
+    }
+    v
+}
+
+// ── Wire types ──────────────────────────────────────────────────────────────
+
+#[derive(Serialize)]
+struct EmbedRequest<'a> {
+    model: &'a str,
+    input: &'a [String],
+}
+
+#[derive(Deserialize)]
+struct EmbedResponse {
+    embeddings: Vec<Vec<f32>>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn prefixes_for_arctic_is_query_only() {
+        assert_eq!(prefixes_for("snowflake-arctic-embed2"), ("query: ", ""));
+        assert_eq!(prefixes_for("snowflake-arctic-embed2:latest"), ("query: ", ""));
+    }
+
+    #[test]
+    fn prefixes_for_e5_is_query_passage() {
+        assert_eq!(prefixes_for("multilingual-e5-large"), ("query: ", "passage: "));
+    }
+
+    #[test]
+    fn prefixes_for_unknown_is_bare() {
+        assert_eq!(prefixes_for("nomic-embed-text"), ("", ""));
+    }
+
+    #[test]
+    fn l2_normalize_unit_length() {
+        let v = l2_normalize(vec![3.0, 4.0]);
+        let norm = (v[0] * v[0] + v[1] * v[1]).sqrt();
+        assert!((norm - 1.0).abs() < 1e-6, "norm = {norm}");
+    }
+
+    #[test]
+    fn l2_normalize_zero_vector_is_unchanged() {
+        assert_eq!(l2_normalize(vec![0.0, 0.0, 0.0]), vec![0.0, 0.0, 0.0]);
+    }
+}

crates/kebab-embed-ollama/tests/embed_mock.rs

@@ -0,0 +1,99 @@
+//! `/api/embed` behavior against a `wiremock`-hosted mock server.
+//!
+//! `wiremock` is async, so the tests are `#[tokio::test]`; the sync
+//! [`OllamaEmbedder`] is driven from `spawn_blocking` to keep `reqwest::blocking`
+//! off the async runtime (same pattern as `kebab-llm-local`'s streaming tests).
+//! tokio is a `dev-dependency` only.
+
+use kebab_config::Config;
+use kebab_core::{Embedder, EmbeddingInput, EmbeddingKind};
+use kebab_embed_ollama::OllamaEmbedder;
+use wiremock::matchers::{method, path};
+use wiremock::{Mock, MockServer, ResponseTemplate};
+
+/// Config pointing at the mock server, with a small dim so the mock body is
+/// tiny. `model` is an arctic tag so prefix resolution is exercised.
+fn cfg_for(endpoint: &str, dim: usize) -> Config {
+    let mut cfg = Config::defaults();
+    cfg.models.embedding.provider = "ollama".to_string();
+    cfg.models.embedding.model = "snowflake-arctic-embed2".to_string();
+    cfg.models.embedding.dimensions = dim;
+    cfg.models.embedding.endpoint = Some(endpoint.to_string());
+    cfg
+}
+
+async fn embed_blocking(
+    cfg: Config,
+    inputs: Vec<(String, EmbeddingKind)>,
+) -> anyhow::Result<Vec<Vec<f32>>> {
+    tokio::task::spawn_blocking(move || -> anyhow::Result<Vec<Vec<f32>>> {
+        let emb = OllamaEmbedder::new(&cfg)?;
+        let refs: Vec<EmbeddingInput<'_>> = inputs
+            .iter()
+            .map(|(t, k)| EmbeddingInput { text: t, kind: *k })
+            .collect();
+        emb.embed(&refs)
+    })
+    .await
+    .expect("blocking task panicked")
+}
+
+#[tokio::test]
+async fn embed_returns_l2_normalized_vectors() {
+    let server = MockServer::start().await;
+    // Two raw (un-normalized) vectors of dim 2; the adapter must L2-normalize.
+    let body = r#"{"model":"snowflake-arctic-embed2","embeddings":[[3.0,4.0],[0.0,5.0]]}"#;
+    Mock::given(method("POST"))
+        .and(path("/api/embed"))
+        .respond_with(ResponseTemplate::new(200).set_body_string(body))
+        .mount(&server)
+        .await;
+
+    let out = embed_blocking(
+        cfg_for(&server.uri(), 2),
+        vec![
+            ("스택 자료구조".to_string(), EmbeddingKind::Query),
+            ("후입선출".to_string(), EmbeddingKind::Document),
+        ],
+    )
+    .await
+    .expect("embed should succeed");
+
+    assert_eq!(out.len(), 2);
+    for v in &out {
+        let norm = v.iter().map(|x| x * x).sum::<f32>().sqrt();
+        assert!((norm - 1.0).abs() < 1e-5, "expected unit norm, got {norm}");
+    }
+    // [3,4] → [0.6, 0.8].
+    assert!((out[0][0] - 0.6).abs() < 1e-5 && (out[0][1] - 0.8).abs() < 1e-5);
+}
+
+#[tokio::test]
+async fn embed_rejects_dim_mismatch() {
+    let server = MockServer::start().await;
+    // Server returns dim 3, config expects dim 2 → hard error.
+    let body = r#"{"model":"snowflake-arctic-embed2","embeddings":[[1.0,2.0,3.0]]}"#;
+    Mock::given(method("POST"))
+        .and(path("/api/embed"))
+        .respond_with(ResponseTemplate::new(200).set_body_string(body))
+        .mount(&server)
+        .await;
+
+    let err = embed_blocking(
+        cfg_for(&server.uri(), 2),
+        vec![("q".to_string(), EmbeddingKind::Query)],
+    )
+    .await
+    .expect_err("dim mismatch must error");
+    let msg = format!("{err:#}");
+    assert!(msg.contains("dim"), "expected dim error, got: {msg}");
+}
+
+#[tokio::test]
+async fn embed_empty_input_is_noop() {
+    // No mock needed — empty input must never hit the network.
+    let out = embed_blocking(cfg_for("http://127.0.0.1:1", 2), vec![])
+        .await
+        .expect("empty embed should be Ok(empty)");
+    assert!(out.is_empty());
+}

crates/kebab-eval/src/runner.rs

@@ -220,7 +220,7 @@ fn build_config_snapshot(cfg: &kebab_config::Config, eval_k: usize) -> Result<se
     Ok(serde_json::json!({
         "config": cfg_value,
         "eval_k": eval_k,
-        "chunker_version": cfg.chunking.chunker_version,
+        "chunker_version": cfg.ingest.chunking.chunker_version,
         "embedding": {
             "model": cfg.models.embedding.model,
             "version": cfg.models.embedding.version,

crates/kebab-parse-image/Cargo.toml

@@ -35,6 +35,24 @@ kamadak-exif = "0.6"
 # transitive tokio runtime is brought in once.
 reqwest      = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls"] }
 base64       = { workspace = true }
+thiserror    = { workspace = true }
+# paddle-onnx OCR engine (PP-OCRv5, in-process). We reuse the workspace ort
+# pin (=2.0.0-rc.9) so the ONNX Runtime native lib stays single-versioned with
+# fastembed / kebab-nli (oar-ocr is intentionally NOT a dep — it would pull
+# ort rc.12 + ndarray 0.17, splitting the native `links` and threatening the
+# embedding stack). `download-binaries` extends the pin the same way
+# `kebab-nli/Cargo.toml:23` does: this crate isn't in fastembed's build graph,
+# so a standalone `cargo test -p kebab-parse-image` needs it to link onnxruntime.
+ort          = { workspace = true, features = ["ndarray", "download-binaries"] }
+ndarray      = { workspace = true }
+# blake3: engine_version hash over the bundled det/rec/dict assets (computed
+# once at OnnxPaddleOcr construction, cached — `ingest_config_signature` calls
+# engine_version() per asset).
+blake3       = { workspace = true }
+# imageproc: connected-components / contours for DBNet det post-processing.
+# min-area rotated-rect (rotating calipers) and polygon unclip are implemented
+# in pure Rust (clipper2 is C++ FFI — would break the single-binary guarantee).
+imageproc    = "0.25"
 
 [dev-dependencies]
 tempfile     = { workspace = true }

crates/kebab-parse-image/assets/paddleocr-onnx/NOTICE

@@ -0,0 +1,33 @@
+PP-OCRv5 mobile ONNX models bundled with kebab (paddle-onnx OCR engine)
+=======================================================================
+
+These model weights and the recognition dictionary are derived from
+PaddleOCR (https://github.com/PaddlePaddle/PaddleOCR), licensed under the
+Apache License, Version 2.0.
+
+  Copyright (c) PaddlePaddle Authors.
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use these files except in compliance with the License.
+  You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+
+Files
+-----
+  ppocrv5_mobile_det.onnx          PP-OCRv5_mobile detection model (DBNet)
+  korean_ppocrv5_mobile_rec.onnx   korean_PP-OCRv5_mobile recognition model (CTC)
+  korean_dict.txt                  recognition dictionary (11,945 chars: KR + Latin + digits + symbols)
+
+These were converted from the official PaddlePaddle inference models to ONNX
+via paddle2onnx for in-process execution with onnxruntime (`ort`). No model
+architecture or weights were modified; only the serialization format changed.
+
+The recognition CTC class layout (empirically confirmed, see
+tests/golden/ctc_rec_golden.json):
+  index 0          = CTC blank
+  index 1..11945   = korean_dict.txt line N -> class N (dict[N-1])
+  index 11946      = space ' '
+  total classes    = 11947 (= 11945 dict + blank + space)
+
+If any post-processing source (min-area-rect / polygon unclip) is later
+ported verbatim from oar-ocr (Apache-2.0), record the per-file provenance
+here as required by the Apache-2.0 attribution clause.

crates/kebab-parse-image/src/caption.rs

@@ -18,7 +18,7 @@
 //!
 //! The original P6-3 spec asked for a cargo feature `caption` (default
 //! OFF at compile time). We collapse this into a single runtime gate
-//! (`config.image.caption.enabled = false`, default OFF). Reasoning:
+//! (`config.ingest.image.caption.enabled = false`, default OFF). Reasoning:
 //! the captioning module's only extra deps are `base64` + `image` +
 //! `kebab-llm` trait — all already pulled in by the rest of the
 //! crate. A cargo feature would only complicate the build matrix
@@ -50,13 +50,13 @@ const CAPTION_MAX_TOKENS: usize = 96;
 
 /// Run a caption pass and return the resulting `ModelCaption`.
 ///
-/// Pure raw operation — does **not** consult `config.image.caption.enabled`.
+/// Pure raw operation — does **not** consult `config.ingest.image.caption.enabled`.
 /// The runtime feature gate lives in [`apply_caption`]; this entry
 /// always invokes the LM. Tests pinning the produced `ModelCaption`
 /// shape can call this directly without flipping the config flag.
 ///
 /// Honours the `[MIN_CAPTION_LONG_EDGE, MAX_CAPTION_LONG_EDGE]` clamp
-/// on `config.image.caption.max_pixels` so a hostile config cannot
+/// on `config.ingest.image.caption.max_pixels` so a hostile config cannot
 /// blow up prompt cost.
 pub fn caption_image(
     llm: &dyn LanguageModel,
@@ -65,15 +65,16 @@ pub fn caption_image(
     cfg: &kebab_config::Config,
 ) -> Result<ModelCaption> {
     let max_pixels = cfg
+        .ingest
         .image
         .caption
         .max_pixels
         .clamp(MIN_CAPTION_LONG_EDGE, MAX_CAPTION_LONG_EDGE);
-    if max_pixels != cfg.image.caption.max_pixels {
+    if max_pixels != cfg.ingest.image.caption.max_pixels {
         tracing::warn!(
             target: "kebab-parse-image",
             "image.caption.max_pixels = {} clamped to {} (legal range [{}, {}])",
-            cfg.image.caption.max_pixels,
+            cfg.ingest.image.caption.max_pixels,
             max_pixels,
             MIN_CAPTION_LONG_EDGE,
             MAX_CAPTION_LONG_EDGE
@@ -129,7 +130,7 @@ pub fn caption_image(
     let caption_text = text.trim().to_string();
 
     let model_ref = llm.model_ref();
-    let prompt_v = &cfg.image.caption.prompt_template_version;
+    let prompt_v = &cfg.ingest.image.caption.prompt_template_version;
     let model_version = format!(
         "{provider}/{prompt}",
         provider = model_ref.provider,
@@ -151,7 +152,7 @@ pub fn caption_image(
     })
 }
 
-/// Pipeline entry point — gate-checks `config.image.caption.enabled`
+/// Pipeline entry point — gate-checks `config.ingest.image.caption.enabled`
 /// then mutates `block.caption` in place via [`caption_image`].
 ///
 /// When `enabled = false` the function is a clean no-op (returns
@@ -167,7 +168,7 @@ pub fn apply_caption(
     cfg: &kebab_config::Config,
     events: &mut Vec<ProvenanceEvent>,
 ) -> Result<()> {
-    if !cfg.image.caption.enabled {
+    if !cfg.ingest.image.caption.enabled {
         tracing::debug!(
             target: "kebab-parse-image",
             "captioning skipped — image.caption.enabled = false"

crates/kebab-parse-image/src/lib.rs

@@ -30,9 +30,14 @@ mod dims;
 mod exif_extract;
 mod image_prep;
 pub mod ocr;
+pub mod paddle_onnx;
 
 pub use caption::{apply_caption, caption_image};
-pub use ocr::{OcrEngine, OllamaVisionOcr, apply_ocr};
+pub use ocr::{OLLAMA_VISION_ENGINE, OcrEngine, OllamaVisionOcr, apply_ocr};
+pub use paddle_onnx::{
+    ModelPaths, OnnxPaddleOcr, PADDLE_ONNX_ENGINE, engine_version_for_config,
+    engine_version_for_paths,
+};
 
 use anyhow::{Context, Result};
 use kebab_core::{

crates/kebab-parse-image/src/ocr.rs

@@ -39,7 +39,7 @@ use crate::image_prep;
 /// Engine name written into `OcrText.engine` for the Ollama-vision adapter.
 pub const OLLAMA_VISION_ENGINE: &str = "ollama-vision";
 
-/// Lower bound on `config.image.ocr.max_pixels`. Anything below this is
+/// Lower bound on `config.ingest.image.ocr.max_pixels`. Anything below this is
 /// silently bumped to keep the model from receiving an unreadable thumbnail.
 const MIN_LONG_EDGE: u32 = 256;
 
@@ -65,6 +65,13 @@ pub trait OcrEngine: Send + Sync {
     /// through to engines that benefit from it (Tesseract languages,
     /// LLM prompt steering); ignore otherwise.
     fn recognize(&self, image_bytes: &[u8], lang_hint: Option<&Lang>) -> Result<OcrText>;
+
+    /// Human-facing model label for the ingest progress display
+    /// (`AssetPhase{phase:"ocr", model}`). Distinct from
+    /// [`engine_version`](Self::engine_version), which is the cache-key
+    /// hash. E.g. `"gemma4:e4b"` (ollama-vision) or `"ppocrv5-mobile-kor"`
+    /// (paddle-onnx).
+    fn model(&self) -> &str;
 }
 
 /// Mutate `block.ocr` in place by running `engine` over `image_bytes`,
@@ -119,14 +126,14 @@ pub struct OllamaVisionOcr {
 
 impl OllamaVisionOcr {
     /// Build an adapter from a workspace [`kebab_config::Config`].
-    /// Reads `config.image.ocr.{model, endpoint, languages, max_pixels}`;
+    /// Reads `config.ingest.image.ocr.{model, endpoint, languages, max_pixels}`;
     /// when `endpoint` is empty falls back to `config.models.llm.endpoint`
     /// so the same Ollama host serves both LLM and OCR by default.
     ///
     /// Construction does NOT touch the network — the first HTTP call
     /// happens inside [`OcrEngine::recognize`].
     pub fn new(config: &kebab_config::Config) -> Result<Self> {
-        let ocr = &config.image.ocr;
+        let ocr = &config.ingest.image.ocr;
         let endpoint = match ocr.endpoint.as_deref() {
             Some(s) if !s.is_empty() => s.to_string(),
             _ => config.models.llm.endpoint.clone(),
@@ -240,6 +247,10 @@ impl OcrEngine for OllamaVisionOcr {
         format!("ollama/{}", self.model)
     }
 
+    fn model(&self) -> &str {
+        &self.model
+    }
+
     fn recognize(&self, image_bytes: &[u8], lang_hint: Option<&Lang>) -> Result<OcrText> {
         let (prepared, w, h) = image_prep::downscale_to_png(image_bytes, self.max_pixels)
             .context("preparing image for OCR")?;

crates/kebab-parse-image/tests/caption.rs

@@ -22,8 +22,8 @@ use crate::common::red_100x50_png;
 
 fn cfg_with_caption_enabled() -> Config {
     let mut cfg = Config::defaults();
-    cfg.image.caption.enabled = true;
-    cfg.image.caption.max_pixels = 512;
+    cfg.ingest.image.caption.enabled = true;
+    cfg.ingest.image.caption.max_pixels = 512;
     cfg
 }
 
@@ -67,7 +67,7 @@ fn mk_mock(canned: &str) -> MockLanguageModel {
 #[test]
 fn apply_caption_no_op_when_feature_disabled() {
     let mut cfg = Config::defaults();
-    cfg.image.caption.enabled = false;
+    cfg.ingest.image.caption.enabled = false;
     let mock = mk_mock("ignored");
     let mut block = empty_image_block();
     let mut events: Vec<ProvenanceEvent> = Vec::new();
@@ -292,8 +292,8 @@ fn caption_image_deterministic_with_identical_inputs() {
 #[test]
 fn caption_image_clamps_oversized_max_pixels() {
     let mut cfg = Config::defaults();
-    cfg.image.caption.enabled = true;
-    cfg.image.caption.max_pixels = 99_999; // way over MAX_CAPTION_LONG_EDGE
+    cfg.ingest.image.caption.enabled = true;
+    cfg.ingest.image.caption.max_pixels = 99_999; // way over MAX_CAPTION_LONG_EDGE
     let captured_images: Arc<Mutex<Vec<String>>> = Arc::new(Mutex::new(Vec::new()));
     let mock = CapturingMock {
         captured_system: Arc::new(Mutex::new(None)),
@@ -339,8 +339,8 @@ fn caption_integration_real_ollama_describes_image() {
     use kebab_llm_local::OllamaLanguageModel;
 
     let mut cfg = Config::defaults();
-    cfg.image.caption.enabled = true;
-    cfg.image.caption.max_pixels = 768;
+    cfg.ingest.image.caption.enabled = true;
+    cfg.ingest.image.caption.max_pixels = 768;
     if let Ok(ep) = std::env::var("KEBAB_MODELS_LLM_ENDPOINT") {
         cfg.models.llm.endpoint = ep;
     } else {

crates/kebab-parse-image/tests/golden/ctc_rec_golden.json

@@ -0,0 +1,516 @@
+{
+  "dict_lines": 11945,
+  "rec_classes": 11947,
+  "blank_index": 0,
+  "space_index": 11946,
+  "mapping": "idx0=blank; idx 1..N=dict[idx-1]; idx N+1=space; classes=dict+2",
+  "rec_norm": "RGB, /255 then (x-0.5)/0.5 => [-1,1], height=48 keep-aspect pad",
+  "det_norm": "RGB, ImageNet mean/std *255 then /std, NCHW",
+  "rec_cases": [
+    {
+      "text": "RAG 시스템 검색 결과",
+      "decoded": "RAG시스템 검색 결과",
+      "cer": 0.0769,
+      "cer_nospace": 0.0,
+      "mapping_ok": true,
+      "T": 40,
+      "C": 11947,
+      "argmax_idx": [
+        0,
+        0,
+        11553,
+        0,
+        11536,
+        0,
+        0,
+        11542,
+        0,
+        0,
+        0,
+        6185,
+        0,
+        0,
+        6129,
+        0,
+        0,
+        9897,
+        0,
+        0,
+        11946,
+        0,
+        461,
+        0,
+        0,
+        0,
+        5654,
+        0,
+        11946,
+        0,
+        509,
+        0,
+        0,
+        0,
+        585,
+        0,
+        0,
+        0,
+        0,
+        0
+      ],
+      "collapsed_idx": [
+        11553,
+        11536,
+        11542,
+        6185,
+        6129,
+        9897,
+        11946,
+        461,
+        5654,
+        11946,
+        509,
+        585
+      ],
+      "collapsed_conf": [
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002
+      ],
+      "fired_timesteps": [
+        2,
+        4,
+        7,
+        11,
+        14,
+        17,
+        20,
+        22,
+        26,
+        28,
+        30,
+        34
+      ],
+      "fired_logit_top5": [
+        {
+          "t": 2,
+          "top5_idx": [
+            11553,
+            11583,
+            11551,
+            0,
+            11541
+          ],
+          "top5_val": [
+            0.9998,
+            0.0001,
+            0.0,
+            0.0,
+            0.0
+          ]
+        },
+        {
+          "t": 4,
+          "top5_idx": [
+            11536,
+            11566,
+            0,
+            11748,
+            11551
+          ],
+          "top5_val": [
+            0.9998,
+            0.0001,
+            0.0,
+            0.0,
+            0.0
+          ]
+        },
+        {
+          "t": 7,
+          "top5_idx": [
+            11542,
+            0,
+            11572,
+            11946,
+            11585
+          ],
+          "top5_val": [
+            0.9994,
+            0.0004,
+            0.0001,
+            0.0001,
+            0.0
+          ]
+        },
+        {
+          "t": 11,
+          "top5_idx": [
+            6185,
+            0,
+            11946,
+            7949,
+            11518
+          ],
+          "top5_val": [
+            0.9993,
+            0.0003,
+            0.0001,
+            0.0001,
+            0.0
+          ]
+        },
+        {
+          "t": 14,
+          "top5_idx": [
+            6129,
+            7893,
+            0,
+            9069,
+            11536
+          ],
+          "top5_val": [
+            0.9997,
+            0.0002,
+            0.0,
+            0.0,
+            0.0
+          ]
+        },
+        {
+          "t": 17,
+          "top5_idx": [
+            9897,
+            9882,
+            9889,
+            9785,
+            3429
+          ],
+          "top5_val": [
+            0.9999,
+            0.0,
+            0.0,
+            0.0,
+            0.0
+          ]
+        },
+        {
+          "t": 20,
+          "top5_idx": [
+            11946,
+            0,
+            11516,
+            11518,
+            11579
+          ],
+          "top5_val": [
+            0.9026,
+            0.0971,
+            0.0002,
+            0.0001,
+            0.0
+          ]
+        },
+        {
+          "t": 22,
+          "top5_idx": [
+            461,
+            462,
+            9281,
+            349,
+            0
+          ],
+          "top5_val": [
+            0.9995,
+            0.0003,
+            0.0001,
+            0.0,
+            0.0
+          ]
+        },
+        {
+          "t": 26,
+          "top5_idx": [
+            5654,
+            0,
+            5766,
+            8594,
+            6830
+          ],
+          "top5_val": [
+            1.0,
+            0.0,
+            0.0,
+            0.0,
+            0.0
+          ]
+        },
+        {
+          "t": 28,
+          "top5_idx": [
+            11946,
+            0,
+            11516,
+            11549,
+            11564
+          ],
+          "top5_val": [
+            0.9422,
+            0.0576,
+            0.0001,
+            0.0,
+            0.0
+          ]
+        },
+        {
+          "t": 30,
+          "top5_idx": [
+            509,
+            0,
+            453,
+            11946,
+            505
+          ],
+          "top5_val": [
+            0.9994,
+            0.0004,
+            0.0001,
+            0.0,
+            0.0
+          ]
+        },
+        {
+          "t": 34,
+          "top5_idx": [
+            585,
+            641,
+            0,
+            10329,
+            589
+          ],
+          "top5_val": [
+            0.9999,
+            0.0,
+            0.0,
+            0.0,
+            0.0
+          ]
+        }
+      ]
+    },
+    {
+      "text": "Embedding vector 0123",
+      "decoded": "Embedding vector 0123",
+      "cer": 0.0,
+      "cer_nospace": 0.0,
+      "mapping_ok": true,
+      "T": 41,
+      "C": 11947,
+      "argmax_idx": [
+        0,
+        11540,
+        0,
+        0,
+        11578,
+        0,
+        0,
+        11567,
+        0,
+        11570,
+        0,
+        11569,
+        0,
+        11569,
+        0,
+        11574,
+        0,
+        11579,
+        11572,
+        11572,
+        11946,
+        0,
+        11587,
+        11570,
+        0,
+        11568,
+        0,
+        11585,
+        11580,
+        0,
+        11583,
+        11946,
+        11946,
+        11520,
+        0,
+        11521,
+        0,
+        11522,
+        0,
+        11523,
+        0
+      ],
+      "collapsed_idx": [
+        11540,
+        11578,
+        11567,
+        11570,
+        11569,
+        11569,
+        11574,
+        11579,
+        11572,
+        11946,
+        11587,
+        11570,
+        11568,
+        11585,
+        11580,
+        11583,
+        11946,
+        11520,
+        11521,
+        11522,
+        11523
+      ],
+      "collapsed_conf": [
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0001,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002
+      ]
+    },
+    {
+      "text": "한글 OCR 정확도 테스트",
+      "decoded": "한글 OCR 정확도 테스트",
+      "cer": 0.0,
+      "cer_nospace": 0.0,
+      "mapping_ok": true,
+      "T": 41,
+      "C": 11947,
+      "argmax_idx": [
+        0,
+        0,
+        10921,
+        0,
+        0,
+        0,
+        845,
+        0,
+        11946,
+        0,
+        11550,
+        0,
+        0,
+        11538,
+        0,
+        11553,
+        0,
+        11946,
+        0,
+        7522,
+        0,
+        0,
+        11170,
+        0,
+        0,
+        0,
+        2321,
+        0,
+        11946,
+        11946,
+        9881,
+        0,
+        0,
+        0,
+        6129,
+        0,
+        0,
+        0,
+        10245,
+        0,
+        0
+      ],
+      "collapsed_idx": [
+        10921,
+        845,
+        11946,
+        11550,
+        11538,
+        11553,
+        11946,
+        7522,
+        11170,
+        2321,
+        11946,
+        9881,
+        6129,
+        10245
+      ],
+      "collapsed_conf": [
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002,
+        0.0002
+      ]
+    }
+  ],
+  "det_cases": [
+    {
+      "fixture": "clean_paragraph.png",
+      "orig_hw": [
+        192,
+        900
+      ],
+      "det_input_hw": [
+        192,
+        896
+      ],
+      "prob_shape": [
+        192,
+        896
+      ],
+      "prob_max": 1.0,
+      "prob_mean": 0.1139,
+      "positives_at_0.3": 19682,
+      "positive_frac": 0.1144,
+      "box_count": 3,
+      "postproc": "thresh=0.3 -> findContours -> minAreaRect -> unclip(ratio=1.5, area*r/peri); box_thresh=0.5 mean-prob filter; coords scaled back to orig hw"
+    }
+  ],
+  "blank_index_confirmed_by_gt": true
+}

crates/kebab-parse-image/tests/golden/det_boxes_clean_paragraph.json

@@ -0,0 +1,78 @@
+{
+  "fixture": "clean_paragraph.png",
+  "orig_hw": [
+    192,
+    900
+  ],
+  "det_input_hw": [
+    192,
+    896
+  ],
+  "thresh": 0.3,
+  "unclip_ratio": 1.5,
+  "boxes": [
+    {
+      "poly": [
+        [
+          29,
+          135
+        ],
+        [
+          615,
+          134
+        ],
+        [
+          615,
+          149
+        ],
+        [
+          29,
+          150
+        ]
+      ],
+      "score": 0.8724
+    },
+    {
+      "poly": [
+        [
+          30,
+          92
+        ],
+        [
+          597,
+          92
+        ],
+        [
+          597,
+          105
+        ],
+        [
+          30,
+          105
+        ]
+      ],
+      "score": 0.9627
+    },
+    {
+      "poly": [
+        [
+          30,
+          47
+        ],
+        [
+          509,
+          47
+        ],
+        [
+          509,
+          60
+        ],
+        [
+          30,
+          60
+        ]
+      ],
+      "score": 0.9304
+    }
+  ]
+}

crates/kebab-parse-image/tests/ocr.rs

@@ -19,10 +19,10 @@ use crate::common::red_100x50_png;
 
 fn cfg_for_endpoint(endpoint: &str) -> Config {
     let mut cfg = Config::defaults();
-    cfg.image.ocr.endpoint = Some(endpoint.to_string());
-    cfg.image.ocr.model = "gemma4:e4b".to_string();
-    cfg.image.ocr.languages = vec!["eng".to_string(), "kor".to_string()];
-    cfg.image.ocr.max_pixels = 1024;
+    cfg.ingest.image.ocr.endpoint = Some(endpoint.to_string());
+    cfg.ingest.image.ocr.model = "gemma4:e4b".to_string();
+    cfg.ingest.image.ocr.languages = vec!["eng".to_string(), "kor".to_string()];
+    cfg.ingest.image.ocr.max_pixels = 1024;
     cfg
 }
 
@@ -375,9 +375,9 @@ async fn ocr_integration_real_ollama_transcribes_text() {
     };
     let cfg = {
         let mut c = Config::defaults();
-        c.image.ocr.endpoint = Some(endpoint);
-        c.image.ocr.model = model;
-        c.image.ocr.max_pixels = 1024;
+        c.ingest.image.ocr.endpoint = Some(endpoint);
+        c.ingest.image.ocr.model = model;
+        c.ingest.image.ocr.max_pixels = 1024;
         c
     };
     let text = tokio::task::spawn_blocking(move || run_recognize(cfg, bytes, None))

crates/kebab-parse-image/tests/paddle_e2e.rs

@@ -0,0 +1,145 @@
+//! T11 e2e accuracy gate for the paddle-onnx OCR engine.
+//!
+//! Runs the full `OnnxPaddleOcr` pipeline (det → rectify → rec → CTC) over the
+//! synthetic OCR benchmark fixtures and asserts the mean character error rate
+//! (CER) over the clean text set is `<= 0.05`, matching the spec gate.
+//!
+//! Model assets come from `KEBAB_TEST_OCR_MODEL_DIR` (default: the crate's
+//! bundled `assets/paddleocr-onnx/`). Fixtures come from
+//! `KEBAB_TEST_OCR_FIXTURE_DIR` (default: the dogfood corpus). If either is
+//! absent the test skips with a warning rather than failing — CI without the
+//! large models / fixtures stays green (plan T0/M4).
+
+use std::collections::HashMap;
+use std::path::PathBuf;
+
+use kebab_parse_image::{ModelPaths, OcrEngine, OnnxPaddleOcr};
+
+/// Collapse all whitespace runs to a single space + trim — matches the Python
+/// `score_lib.norm` so the Rust gate and the bench harness agree.
+fn norm(s: &str) -> String {
+    s.split_whitespace().collect::<Vec<_>>().join(" ")
+}
+
+/// Character error rate = Levenshtein(gt, pred) / len(gt), both normalized.
+fn cer(gt: &str, pred: &str) -> f64 {
+    let g: Vec<char> = norm(gt).chars().collect();
+    let p: Vec<char> = norm(pred).chars().collect();
+    if g.is_empty() {
+        return if p.is_empty() { 0.0 } else { 1.0 };
+    }
+    let (m, n) = (g.len(), p.len());
+    let mut prev: Vec<usize> = (0..=n).collect();
+    for i in 1..=m {
+        let mut cur = vec![i; n + 1];
+        for j in 1..=n {
+            let cost = usize::from(g[i - 1] != p[j - 1]);
+            cur[j] = (prev[j] + 1).min(cur[j - 1] + 1).min(prev[j - 1] + cost);
+        }
+        prev = cur;
+    }
+    prev[n] as f64 / m as f64
+}
+
+fn fixture_dir() -> PathBuf {
+    std::env::var("KEBAB_TEST_OCR_FIXTURE_DIR").map_or_else(
+        |_| PathBuf::from("/build/dogfood/corpus/images/synthetic-ocr-bench"),
+        PathBuf::from,
+    )
+}
+
+/// T10: undecodable image bytes must surface as an error (the kebab-app caller
+/// then skips the asset + records provenance), not panic or return garbage.
+#[test]
+fn paddle_onnx_decode_failure_is_error() {
+    let paths = ModelPaths::from_default_dir();
+    if !paths.det.exists() || !paths.rec.exists() || !paths.dict.exists() {
+        eprintln!("SKIP paddle_onnx_decode_failure_is_error: model assets not found");
+        return;
+    }
+    let engine = OnnxPaddleOcr::from_paths(&paths, 0.3, 1.5, 1000, 1600).unwrap();
+    let err = engine
+        .recognize(b"not a real image", None)
+        .expect_err("garbage bytes must fail to decode");
+    let msg = format!("{err:#}");
+    assert!(msg.contains("decoding image"), "unexpected error: {msg}");
+}
+
+#[test]
+fn paddle_onnx_cer_gate() {
+    let paths = ModelPaths::from_default_dir();
+    if !paths.det.exists() || !paths.rec.exists() || !paths.dict.exists() {
+        eprintln!(
+            "SKIP paddle_onnx_cer_gate: model assets not found (det={}). \
+             Set KEBAB_TEST_OCR_MODEL_DIR or place assets/paddleocr-onnx/.",
+            paths.det.display()
+        );
+        return;
+    }
+    let fdir = fixture_dir();
+    let gt_path = fdir.join("gt.json");
+    if !gt_path.exists() {
+        eprintln!(
+            "SKIP paddle_onnx_cer_gate: fixtures not found at {}",
+            fdir.display()
+        );
+        return;
+    }
+
+    let gt: HashMap<String, String> =
+        serde_json::from_str(&std::fs::read_to_string(&gt_path).unwrap()).unwrap();
+
+    let engine = OnnxPaddleOcr::from_paths(&paths, 0.3, 1.5, 1000, 1600)
+        .expect("build OnnxPaddleOcr from bundled assets");
+
+    // "clean" set used for the gate — the standard, well-formed text fixtures.
+    // low_contrast / small_dense are intentionally hard and tracked but not
+    // part of the hard gate.
+    let gate_set = [
+        "clean_paragraph.png",
+        "title_body.png",
+        "tech_terms.png",
+        "korean_heavy.png",
+        "numbers_table.png",
+    ];
+
+    let mut gate_cers = Vec::new();
+    let mut names: Vec<&String> = gt.keys().collect();
+    names.sort();
+    println!("\n=== paddle-onnx CER per fixture ===");
+    for name in names {
+        let img_path = fdir.join(name);
+        if !img_path.exists() {
+            continue;
+        }
+        let bytes = std::fs::read(&img_path).unwrap();
+        let t0 = std::time::Instant::now();
+        let out = engine.recognize(&bytes, None).expect("recognize");
+        let dt = t0.elapsed();
+        let c = cer(&gt[name], &out.joined);
+        if std::env::var("KEBAB_OCR_DUMP").is_ok() {
+            println!("  GT  [{name}]: {:?}", norm(&gt[name]));
+            println!("  OUT [{name}]: {:?}", norm(&out.joined));
+        }
+        let gated = gate_set.contains(&name.as_str());
+        println!(
+            "{:<22} CER={:.4} {} ({} regions, {} ms)",
+            name,
+            c,
+            if gated { "[gate]" } else { "      " },
+            out.regions.len(),
+            dt.as_millis()
+        );
+        if gated {
+            gate_cers.push(c);
+        }
+    }
+
+    assert!(!gate_cers.is_empty(), "no gate fixtures were scored");
+    let mean = gate_cers.iter().sum::<f64>() / gate_cers.len() as f64;
+    println!("=== mean gate CER = {mean:.4} (threshold 0.05) ===\n");
+    assert!(
+        mean <= 0.05,
+        "paddle-onnx mean CER {mean:.4} exceeds 0.05 gate"
+    );
+}

crates/kebab-search/src/lexical.rs

@@ -123,29 +123,7 @@ impl Retriever for LexicalRetriever {
         };
 
         let conn = self.store.read_conn();
-        let body_rows = run_query(&conn, &match_str, self.snippet_words, filters, fetch_limit)?;
-        // doc-side expansion (V010): re-run the same query against the
-        // `aliases` column of `chunk_aliases_fts`. Empty table → 0 rows →
-        // `body_rows` unchanged (regression-safe). body wins; alias-only
-        // chunks are appended so a term present only in a chunk's aliases
-        // still enters the pool.
-        //
-        // Raw mode (`'...'`) is a body-FTS5 escape hatch and may reference
-        // body-only columns (e.g. `heading_path : ...`) that don't exist on
-        // `chunk_aliases_fts`. Running such an expression against the alias
-        // table is a hard FTS5 error, so we skip the alias channel for raw
-        // queries — they target the body intentionally.
-        let alias_rows = if strip_single_quotes(query.text.trim()).is_some() {
-            Vec::new()
-        } else {
-            match build_match_string_for_column(&query.text, "aliases") {
-                Some(alias_match) => {
-                    run_alias_query(&conn, &alias_match, self.snippet_chars, fetch_limit)?
-                }
-                None => Vec::new(),
-            }
-        };
-        let raw_rows = merge_body_alias(body_rows, alias_rows, fetch_limit);
+        let raw_rows = run_query(&conn, &match_str, self.snippet_words, filters, fetch_limit)?;
 
         let mut hits: Vec<SearchHit> = Vec::with_capacity(raw_rows.len().min(k));
         let mut rank: u32 = 0;
@@ -228,16 +206,6 @@ impl Retriever for LexicalRetriever {
 ///   match is scoped to the body column. FTS5's column-filter syntax
 ///   accepts an arbitrary OR/AND sub-expression inside the parens.
 fn build_match_string(text: &str) -> Option<String> {
-    build_match_string_for_column(text, "text")
-}
-
-/// Column-parameterized variant of [`build_match_string`]. `column` is the
-/// FTS5 column-filter prefix the combined expression is scoped to — `"text"`
-/// for the body channel (`chunks_fts`) or `"aliases"` for the doc-side
-/// expansion channel (`chunk_aliases_fts`, V010). Raw mode (`'...'`) is still
-/// passed through verbatim without any column scoping, so an explicit
-/// user-supplied column filter is honored unchanged.
-fn build_match_string_for_column(text: &str, column: &str) -> Option<String> {
     let trimmed = text.trim();
     if trimmed.is_empty() {
         return None;
@@ -274,7 +242,7 @@ fn build_match_string_for_column(text: &str, column: &str) -> Option<String> {
         (Some(w), Some(a)) if w == a => w,
         (Some(w), Some(a)) => format!("({w}) OR ({a})"),
     };
-    Some(format!("{column} : ({expression})"))
+    Some(format!("text : ({expression})"))
 }
 
 /// Return `Some(inner)` if `s` is wrapped in a matching pair of single
@@ -512,77 +480,6 @@ fn row_from_sql(row: &Row<'_>) -> rusqlite::Result<RawRow> {
     })
 }
 
-/// Search the doc-side expansion channel (`chunk_aliases_fts`, V010) and
-/// build [`RawRow`]s with the **same 10-column shape** as [`run_query`] so
-/// `row_from_sql` / `build_hit` can be reused verbatim. The snippet is taken
-/// from the body (`substr(c.text, 1, ?)`) rather than the alias text so the
-/// rendered hit stays consistent with the body channel. When
-/// `chunk_aliases_fts` is empty (no chunk carries aliases) this returns 0
-/// rows, making the merge a no-op (regression-safe).
-///
-/// 1차는 filters 미적용 — body 채널이 필터를 적용하고, 별칭 경로는 pool 진입
-/// (회수)이 목적이다(측정 후 필요 시 filters 공유). `bm25(chunk_aliases_fts)`
-/// 오름차순 + `af.chunk_id` tie-break 로 결정적 순서.
-fn run_alias_query(
-    conn: &Connection,
-    match_str: &str,
-    snippet_chars: usize,
-    fetch_limit: usize,
-) -> Result<Vec<RawRow>> {
-    let sql = "SELECT \
-            af.chunk_id, af.doc_id, \
-            bm25(chunk_aliases_fts) AS score, \
-            substr(c.text, 1, ?) AS snippet, \
-            c.heading_path_json, c.section_label, c.source_spans_json, \
-            c.chunker_version, \
-            d.workspace_path, d.updated_at \
-         FROM chunk_aliases_fts af \
-         JOIN chunks c    ON c.chunk_id = af.chunk_id \
-         JOIN documents d ON d.doc_id = af.doc_id \
-         WHERE chunk_aliases_fts MATCH ? \
-         ORDER BY score, af.chunk_id LIMIT ?";
-    let params: Vec<Box<dyn ToSql>> = vec![
-        Box::new(snippet_chars as i64),
-        Box::new(match_str.to_owned()),
-        Box::new(i64::try_from(fetch_limit).unwrap_or(i64::MAX)),
-    ];
-    let mut stmt = conn
-        .prepare(sql)
-        .context("kb-search lexical: prepare alias FTS5 statement")?;
-    let rows = stmt
-        .query_map(
-            params_from_iter(params.iter().map(std::convert::AsRef::as_ref)),
-            row_from_sql,
-        )
-        .context("kb-search lexical: execute alias FTS5 query")?;
-    let mut out: Vec<RawRow> = Vec::new();
-    for r in rows {
-        out.push(r.context("kb-search lexical: read alias row")?);
-    }
-    Ok(out)
-}
-
-/// Merge body + alias rows: body rows first (already bm25-ordered), then
-/// any alias-only chunk (not already present in the body result) appended in
-/// alias-relevance order. Capped at `limit`. An empty `alias` slice leaves
-/// `body` unchanged, so an empty `chunk_aliases_fts` reproduces the
-/// pre-expansion behavior exactly.
-fn merge_body_alias(body: Vec<RawRow>, alias: Vec<RawRow>, limit: usize) -> Vec<RawRow> {
-    use std::collections::HashSet;
-    let mut seen: HashSet<String> = body.iter().map(|r| r.chunk_id.clone()).collect();
-    let mut out = body;
-    for r in alias {
-        if out.len() >= limit {
-            break;
-        }
-        if seen.insert(r.chunk_id.clone()) {
-            out.push(r);
-        }
-    }
-    out.truncate(limit);
-    out
-}
-
 // ── Hit construction ─────────────────────────────────────────────────────
 
 fn build_hit(

crates/kebab-search/tests/lexical.rs

@@ -144,42 +144,6 @@ fn insert_chunk(
     .expect("insert chunk");
 }
 
-/// Like [`insert_chunk`] but also writes the `chunks.aliases` column so the
-/// `chunk_aliases_ai` trigger (V010) mirrors the row into `chunk_aliases_fts`.
-/// `aliases=None` leaves the column NULL (trigger skips → no alias row).
-#[allow(clippy::too_many_arguments)]
-fn insert_chunk_with_aliases(
-    conn: &Connection,
-    chunk_id: &str,
-    doc_id: &str,
-    text: &str,
-    heading_path: &[&str],
-    section_label: Option<&str>,
-    source_spans_json: &str,
-    chunker_version: &str,
-    aliases: Option<&str>,
-) {
-    let heading_json = serde_json::to_string(heading_path).unwrap();
-    conn.execute(
-        "INSERT INTO chunks (
-            chunk_id, doc_id, text, heading_path_json, section_label,
-            source_spans_json, token_estimate, chunker_version,
-            policy_hash, block_ids_json, created_at, aliases
-        ) VALUES (?, ?, ?, ?, ?, ?, 0, ?, 'h', '[]', '2024-01-01T00:00:00Z', ?)",
-        rusqlite::params![
-            chunk_id,
-            doc_id,
-            text,
-            heading_json,
-            section_label,
-            source_spans_json,
-            chunker_version,
-            aliases,
-        ],
-    )
-    .expect("insert chunk with aliases");
-}
-
 /// Pad a short ID to the 32-hex shape kebab_core newtypes expect.
 fn id32(prefix: &str) -> String {
     let mut s = prefix.to_string();
@@ -1290,51 +1254,14 @@ fn lexical_raw_mode_can_opt_into_heading_path_filter() {
     );
 }
 
-// ── doc-side expansion (V010) — body+alias merged search ──────────────────
+// ── body-only lexical recall (regression-safety) ──────────────────────────
 
-/// pool-rescue core: a term present ONLY in `chunks.aliases` (not in the
-/// body) must still recall the chunk via the `chunk_aliases_fts` channel.
-/// Body is English ("backpropagation…"); the Korean term "역전파" lives only
-/// in the alias text, so the body `chunks_fts` MATCH alone would miss it.
+/// Body `chunks_fts` recall works for a plain term in the chunk text.
+/// (Was previously the `empty_aliases_table_matches_baseline` regression
+/// guard; doc-side expansion was removed 2026-06-03 so the body channel is
+/// the only lexical channel.)
 #[test]
-fn alias_only_term_recalls_chunk() {
-    let env = Env::new();
-    let conn = env.raw_conn();
-    insert_document(&conn, &id32("d"), "notes/nn.md", "NN", "en", "primary", &[]);
-    insert_chunk_with_aliases(
-        &conn,
-        &id32("c1"),
-        &id32("d"),
-        "backpropagation computes gradients",
-        &["NN"],
-        None,
-        r#"[{"kind":"line","start":1,"end":1}]"#,
-        "v1",
-        Some("역전파\n신경망 오차 역전달"),
-    );
-    drop(conn);
-
-    let r = env.retriever();
-    let hits = r
-        .search(&SearchQuery {
-            text: "역전파".to_string(),
-            mode: SearchMode::Lexical,
-            k: 10,
-            filters: SearchFilters::default(),
-        })
-        .unwrap();
-    assert!(
-        hits.iter().any(|h| h.chunk_id.0 == id32("c1")),
-        "별칭에만 있는 term 으로도 청크가 회수돼야 한다 (pool-rescue); got {:?}",
-        hits.iter().map(|h| h.chunk_id.0.clone()).collect::<Vec<_>>()
-    );
-}
-
-/// Regression-safety: with every chunk's `aliases=NULL` the
-/// `chunk_aliases_fts` table is empty, so the alias channel yields 0 rows
-/// and the body search result is identical to the pre-expansion behavior.
-#[test]
-fn empty_aliases_table_matches_baseline() {
+fn body_term_recalls_chunk() {
     let env = Env::new();
     let conn = env.raw_conn();
     insert_document(
@@ -1346,7 +1273,6 @@ fn empty_aliases_table_matches_baseline() {
         "primary",
         &[],
     );
-    // aliases=None → no chunk_aliases_fts row; body channel only.
     insert_chunk(
         &conn,
         &id32("c1"),
@@ -1370,6 +1296,6 @@ fn empty_aliases_table_matches_baseline() {
         .unwrap();
     assert!(
         hits.iter().any(|h| h.chunk_id.0 == id32("c1")),
-        "aliases 빈 상태에서 본문 매칭 청크가 정상 회수돼야 한다 (회귀 안전)"
+        "본문 매칭 청크가 정상 회수돼야 한다 (회귀 안전)"
     );
 }

crates/kebab-store-sqlite/src/documents.rs

@@ -123,8 +123,8 @@ impl kebab_core::DocumentStore for SqliteStore {
                     chunk_id, doc_id, text, heading_path_json,
                     section_label, source_spans_json, token_estimate,
                     chunker_version, policy_hash, block_ids_json, created_at,
-                    tokenized_korean_text, aliases
-                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+                    tokenized_korean_text
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
             )
             .map_err(StoreError::from)?;
         for chunk in chunks {
@@ -153,7 +153,6 @@ impl kebab_core::DocumentStore for SqliteStore {
                 block_ids,
                 now,
                 chunk.tokenized_korean_text.as_deref(),
-                chunk.aliases.as_deref(),
             ])
             .map_err(StoreError::from)?;
         }
@@ -268,7 +267,6 @@ impl kebab_core::DocumentStore for SqliteStore {
             chunker_version: kebab_core::ChunkerVersion(row.chunker_version),
             policy_hash: row.policy_hash,
             tokenized_korean_text: row.tokenized_korean_text,
-            aliases: None,
         }))
     }
 

crates/kebab-store-sqlite/tests/chunk_aliases.rs

@@ -1,220 +0,0 @@
-//! V010 doc-side expansion: `put_chunks` 가 `chunk.aliases` 를 chunks.aliases
-//! 컬럼에 영속화하고, chunk_aliases_ai trigger 가 별도 `chunk_aliases_fts`
-//! 가상 테이블로 mirror 하는지 검증.
-//!
-//! `put_chunks` 는 store-owned conn(FK ON)에서 도므로 chunks 의
-//! `doc_id REFERENCES documents(doc_id)` FK 를 만족시키려면 asset +
-//! document 그래프가 먼저 있어야 한다. 헬퍼는 `idempotency.rs` 패턴 복제.
-//! 인덱싱 검증은 side-channel `env.with_conn` 으로 chunk_aliases_fts 를 직접
-//! MATCH 한다(같은 established 패턴).
-
-use std::path::PathBuf;
-
-use kebab_core::{
-    AssetId, AssetStorage, Block, CanonicalDocument, Checksum, Chunk, ChunkerVersion, CommonBlock,
-    DocumentId, DocumentStore, HeadingBlock, Lang, MediaType, Metadata, ParserVersion, Provenance,
-    SourceSpan, SourceType, SourceUri, TextBlock, TrustLevel, WorkspacePath,
-};
-use kebab_store_sqlite::SqliteStore;
-use time::OffsetDateTime;
-
-mod common;
-
-fn make_asset() -> kebab_core::RawAsset {
-    let bytes = b"dummy";
-    kebab_core::RawAsset {
-        asset_id: AssetId("a".repeat(32)),
-        source_uri: SourceUri::File(PathBuf::from("/tmp/foo.md")),
-        workspace_path: WorkspacePath::new("notes/foo.md".into()).unwrap(),
-        media_type: MediaType::Markdown,
-        byte_len: bytes.len() as u64,
-        checksum: Checksum(blake3::hash(bytes).to_hex().to_string()),
-        discovered_at: OffsetDateTime::from_unix_timestamp(1_700_000_000).unwrap(),
-        stored: AssetStorage::Reference {
-            path: PathBuf::from("/tmp/foo.md"),
-            sha: Checksum(blake3::hash(bytes).to_hex().to_string()),
-        },
-    }
-}
-
-fn make_metadata() -> Metadata {
-    Metadata {
-        aliases: vec![],
-        tags: vec![],
-        created_at: OffsetDateTime::from_unix_timestamp(1_700_000_000).unwrap(),
-        updated_at: OffsetDateTime::from_unix_timestamp(1_700_000_000).unwrap(),
-        source_type: SourceType::Markdown,
-        trust_level: TrustLevel::Primary,
-        user_id_alias: None,
-        user: Default::default(),
-        repo: None,
-        git_branch: None,
-        git_commit: None,
-        code_lang: None,
-    }
-}
-
-fn make_doc() -> CanonicalDocument {
-    let doc_id = DocumentId("d".repeat(32));
-    let span = SourceSpan::Line { start: 1, end: 1 };
-    let block = Block::Heading(HeadingBlock {
-        common: CommonBlock {
-            block_id: kebab_core::BlockId("b".repeat(32)),
-            heading_path: vec![],
-            source_span: span.clone(),
-        },
-        level: 1,
-        text: "Title".into(),
-    });
-    let para = Block::Paragraph(TextBlock {
-        common: CommonBlock {
-            block_id: kebab_core::BlockId("c".repeat(32)),
-            heading_path: vec!["Title".into()],
-            source_span: span,
-        },
-        text: "body".into(),
-        inlines: vec![],
-    });
-    CanonicalDocument {
-        doc_id,
-        source_asset_id: AssetId("a".repeat(32)),
-        workspace_path: WorkspacePath::new("notes/foo.md".into()).unwrap(),
-        title: "Title".into(),
-        lang: Lang("en".into()),
-        blocks: vec![block, para],
-        metadata: make_metadata(),
-        provenance: Provenance { events: vec![] },
-        parser_version: ParserVersion("test-parser".into()),
-        schema_version: 1,
-        doc_version: 1,
-        last_chunker_version: None,
-        last_embedding_version: None,
-    }
-}
-
-/// 단일 청크 생성. `aliases` 만 호출측이 지정.
-fn base_chunk(chunk_id: &str, doc_id: &DocumentId, aliases: Option<String>) -> Chunk {
-    Chunk {
-        chunk_id: kebab_core::ChunkId(chunk_id.into()),
-        doc_id: doc_id.clone(),
-        block_ids: vec![kebab_core::BlockId("b".repeat(32))],
-        text: "Rust ownership and borrowing".into(),
-        heading_path: vec!["Title".into()],
-        source_spans: vec![SourceSpan::Line { start: 1, end: 1 }],
-        token_estimate: 5,
-        chunker_version: ChunkerVersion("md-heading-v1".into()),
-        policy_hash: "h".into(),
-        tokenized_korean_text: None,
-        aliases,
-    }
-}
-
-/// asset + document 그래프를 깔고 마이그레이션된 store 를 돌려준다.
-fn open_store_with_document(env: &common::TestEnv) -> SqliteStore {
-    let store = SqliteStore::open(&env.config()).unwrap();
-    store.run_migrations().unwrap();
-    store.put_asset(&make_asset()).expect("put_asset");
-    store.put_document(&make_doc()).expect("put_document");
-    store
-}
-
-#[test]
-fn aliases_indexed_into_chunk_aliases_fts() {
-    let env = common::TestEnv::new();
-    let store = open_store_with_document(&env);
-    let doc = DocumentId("d".repeat(32));
-    let chunk = base_chunk(
-        &"e".repeat(32),
-        &doc,
-        Some("메모리 안전성\nwho owns the value".into()),
-    );
-    store.put_chunks(&doc, &[chunk]).unwrap();
-
-    // 별칭에만 있는 한국어 term 으로 chunk_aliases_fts 검색 → 청크 회수.
-    let n: i64 = env.with_conn(|c| {
-        c.query_row(
-            "SELECT count(*) FROM chunk_aliases_fts \
-             WHERE chunk_aliases_fts MATCH 'aliases : (\"메모리\")'",
-            [],
-            |r| r.get(0),
-        )
-    });
-    assert_eq!(
-        n, 1,
-        "aliases 의 한국어 term 이 chunk_aliases_fts 에 색인돼야 한다"
-    );
-}
-
-#[test]
-fn none_aliases_not_indexed() {
-    let env = common::TestEnv::new();
-    let store = open_store_with_document(&env);
-    let doc = DocumentId("d".repeat(32));
-    let chunk = base_chunk(&"e".repeat(32), &doc, None);
-    store.put_chunks(&doc, &[chunk]).unwrap();
-
-    let n: i64 = env.with_conn(|c| {
-        c.query_row("SELECT count(*) FROM chunk_aliases_fts", [], |r| r.get(0))
-    });
-    assert_eq!(
-        n, 0,
-        "aliases=None 이면 chunk_aliases_fts 에 행이 없어야 한다"
-    );
-}
-
-/// Task 2 리뷰 M2: 같은 doc 을 두 번 `put_chunks` 해도 `chunk_aliases_fts`
-/// 행이 중복되지 않아야 한다. put_chunks 의 DELETE-then-INSERT 가
-/// chunk_aliases_ad → chunk_aliases_ai 를 발화해 멱등 재동기화하는지 검증.
-#[test]
-fn reput_keeps_single_alias_row() {
-    let env = common::TestEnv::new();
-    let store = open_store_with_document(&env);
-    let doc = DocumentId("d".repeat(32));
-    let mk = || base_chunk(&"e".repeat(32), &doc, Some("메모리 안전성".into()));
-
-    store.put_chunks(&doc, &[mk()]).unwrap();
-    store.put_chunks(&doc, &[mk()]).unwrap(); // 같은 doc 재-put
-
-    let n: i64 = env.with_conn(|c| {
-        c.query_row("SELECT count(*) FROM chunk_aliases_fts", [], |r| r.get(0))
-    });
-    assert_eq!(n, 1, "재색인 후에도 별칭 행은 1개여야 한다 (중복/누락 없음)");
-}
-
-/// Task 2 리뷰 N1: 별칭 term 이 본문 `chunks_fts` 로 새지 않아야 한다(§3.3 격리).
-/// 본문엔 없고 별칭에만 있는 한국어 term 으로 chunks_fts 를 MATCH 하면 0행.
-#[test]
-fn aliases_dont_leak_into_body_fts() {
-    let env = common::TestEnv::new();
-    let store = open_store_with_document(&env);
-    let doc = DocumentId("d".repeat(32));
-    // 본문 "Rust ownership and borrowing" 에 "메모리" 없음, 별칭에만 있음.
-    let chunk = base_chunk(&"e".repeat(32), &doc, Some("메모리 안전성".into()));
-    store.put_chunks(&doc, &[chunk]).unwrap();
-
-    let body_hits: i64 = env.with_conn(|c| {
-        c.query_row(
-            "SELECT count(*) FROM chunks_fts WHERE chunks_fts MATCH 'text : (\"메모리\")'",
-            [],
-            |r| r.get(0),
-        )
-    });
-    assert_eq!(body_hits, 0, "별칭 term 이 본문 chunks_fts 로 누출되면 안 된다");
-}
-
-/// Task 2 리뷰 M1: 빈 문자열 별칭은 색인하지 않는다(trigger 가드
-/// `AND new.aliases <> ''`). producer 가 Some("") 를 넘겨도 무용한 행이
-/// chunk_aliases_fts 에 쌓이지 않아야 한다.
-#[test]
-fn empty_string_alias_not_indexed() {
-    let env = common::TestEnv::new();
-    let store = open_store_with_document(&env);
-    let doc = DocumentId("d".repeat(32));
-    let chunk = base_chunk(&"e".repeat(32), &doc, Some(String::new()));
-    store.put_chunks(&doc, &[chunk]).unwrap();
-
-    let n: i64 = env.with_conn(|c| {
-        c.query_row("SELECT count(*) FROM chunk_aliases_fts", [], |r| r.get(0))
-    });
-    assert_eq!(n, 0, "빈 문자열 별칭은 chunk_aliases_fts 에 색인되면 안 된다");
-}

crates/kebab-store-sqlite/tests/corpus_revision.rs

@@ -23,6 +23,8 @@ fn open_store(tmp: &TempDir) -> SqliteStore {
 /// Fresh store baseline: V004 seeds `corpus_revision = 0`, then V009,
 /// V010, and V011 migrations bump it by one each to invalidate any stale
 /// LRU cache — so a fresh store after `run_migrations()` reads back as `3`.
+/// (V012 derivation_cache + V013 drop-chunk-aliases are structural/additive
+/// and do NOT bump corpus_revision.)
 #[test]
 fn fresh_store_starts_at_post_migration_baseline() {
     let tmp = TempDir::new().unwrap();

crates/kebab-store-sqlite/tests/embedding_records_fk.rs

@@ -160,7 +160,6 @@ fn put_chunks_cleans_original_and_sentinel_embeddings() {
         chunker_version: ChunkerVersion("v1".to_string()),
         policy_hash: "h".to_string(),
         tokenized_korean_text: None,
-        aliases: None,
     };
     store.put_chunks(&doc_id, std::slice::from_ref(&chunk)).unwrap();
 
@@ -270,7 +269,6 @@ fn put_chunks_cleans_per_alias_sentinel_embeddings() {
         chunker_version: ChunkerVersion("v1".to_string()),
         policy_hash: "h".to_string(),
         tokenized_korean_text: None,
-        aliases: None,
     };
     store.put_chunks(&doc_id, std::slice::from_ref(&chunk)).unwrap();
 

crates/kebab-store-sqlite/tests/idempotency.rs

@@ -98,7 +98,6 @@ fn make_chunks(doc_id: &DocumentId) -> Vec<Chunk> {
         chunker_version: ChunkerVersion("md-heading-v1".into()),
         policy_hash: "deadbeefdeadbeef".into(),
         tokenized_korean_text: None,
-        aliases: None,
     }]
 }
 

crates/kebab-tui/src/ingest_progress.rs

@@ -154,7 +154,17 @@ fn apply_event(state: &mut IngestState, event: IngestEvent) {
         }
         // v0.20.0 sub-item 1: per-page PDF OCR events — TUI does not
         // surface per-page OCR progress in v1; no counter to update.
-        IngestEvent::PdfOcrStarted { .. } | IngestEvent::PdfOcrFinished { .. } => {}
+        IngestEvent::PdfOcrStarted { .. }
+        | IngestEvent::PdfOcrFinished { .. }
+        // v0.24.0 asset-internal phase events: the status-bar reducer tracks
+        // per-asset counters, not sub-asset phase progress, so these are
+        // no-ops here (the CLI / --json surfaces render them).
+        | IngestEvent::AssetChunked { .. }
+        | IngestEvent::AssetTimings { .. }
+        // v0.26.1 slow-phase hint (ocr / caption / embed): the CLI bar uses
+        // it for a live phase message; the TUI status-bar reducer tracks only
+        // per-asset counters, so it's a no-op here.
+        | IngestEvent::AssetPhase { .. } => {}
     }
 }
 

crates/kebab-tui/tests/inspect.rs

@@ -114,7 +114,6 @@ fn make_chunk() -> Chunk {
         chunker_version: ChunkerVersion("md-heading-v1".into()),
         policy_hash: "deadbeefdeadbeef".into(),
         tokenized_korean_text: None,
-        aliases: None,
     }
 }
 

docs/ARCHITECTURE.md

@@ -16,11 +16,11 @@ Cargo workspace, 함수 호출 기반 모듈러 모놀리스. UI binary (`kebab-
 | metadata | SQLite + FTS5 (lexical search + v0.20.1 한국어 형태소 tokenizer via lindera-ko-dic) |
 | vector | LanceDB (embedded, model 별 분리 table) |
 | Markdown parser | `pulldown-cmark`. frontmatter 에 title 없으면 첫 H1 → H2 → 첫 paragraph 80 자 → 파일명 순으로 자동 채움 (`parser_version = md-frontmatter-v2`, 기존 doc 도 다음 ingest 에서 갱신) |
-| embedding | `fastembed-rs` (`multilingual-e5-large`, 1024d, v0.18.0부터 default 업그레이드) |
+| embedding | `fastembed-rs` (`multilingual-e5-large`, 1024d, v0.18.0부터 default 업그레이드). opt-in 대안: candle (e5 또는 `snowflake-arctic-embed-l-v2.0`) / Ollama `/api/embed`. arctic = 설명형 query recall 보강 (v0.26.0, 아래 결정표) |
 | 한국어 형태소분석 | `lindera-ko-dic` (FTS5 외부 tokenizer, v0.20.1) — 2자 이상 한국어 query 지원 |
 | LLM | Ollama HTTP (default `gemma4:e4b` ─ OCR / caption 와 family 통일. 사용자가 더 큰 variant `gemma4:26b` 등으로 override 가능) |
 | 음성 ASR | `whisper.cpp` (via `whisper-rs`) — P8 보류, 시스템 dep brainstorm 후 |
-| OCR (image) | Ollama vision LM (default `gemma4:e4b`) — `OcrEngine` trait 으로 Tesseract / Apple Vision 등 future swap (HOTFIXES P6-2) |
+| OCR (image) | `OcrEngine` trait, 2 백엔드: **`ollama-vision`** (default, `gemma4:e4b`) / **`paddle-onnx`** (v0.27.0 — PP-OCRv5 ONNX in-process via `ort` =2.0.0-rc.9, DBNet det + CTC rec, 후처리 min-area rect/unclip pure-Rust, Python 런타임 0). engine 선택은 `[image.ocr] engine`, 팩토리는 `kebab-app::build_image_ocr_engine`. e2e CER 0.005 / 큰 페이지 <4초. (HOTFIXES P6-2, 2026-06-04) |
 | OCR (PDF, v0.20.0+) | Ollama vision LM (default `qwen2.5vl:3b`) — post-extract enrichment via `kebab-app::pdf_ocr_apply` (H-1 resolution). DCTDecode-only v1 (FlateDecode/CCITTFax skip + warning). family asymmetry vs image OCR: PoC alnum 94.79% (qwen2.5vl) >> 27% (gemma4:e4b 받침), 본 단계에서 PDF OCR 만 qwen2.5vl. |
 | Image caption | Ollama vision LM, runtime gate `image.caption.enabled` (default OFF) |
 | RAG groundedness 검증 | `kebab-nli` 의 mDeBERTa-v3 XNLI 가 `(packed_chunks, generated_answer)` entailment 검사 (fb-41). `[rag] nli_threshold > 0` (default 0 = disabled, production 권장 0.5) 일 때 활성 — 미달 시 `refusal_reason = nli_verification_failed` (LLM self-judge ceiling 보완). 첫 호출 시 ~280 MB ONNX 자동 다운로드 |
@@ -32,8 +32,8 @@ Cargo workspace, 함수 호출 기반 모듈러 모놀리스. UI binary (`kebab-
 | citation 형식 | URI fragment (`path#L12-L34` / `path#p=12` / `path#xywh=0,0,100,50`, W3C Media Fragments) |
 | ID 생성 | `blake3(canonical_json(tuple))[..32]` hex |
 | RRF fusion_score | `[0, 1]` 정규화 — `2 / (k_rrf + 1)` 로 나눠 mode 간 비교 가능 (post-merge hotfix) |
-| doc-side expansion 별칭 (v0.21.0) | 색인 시 LLM 이 청크별 "같은 의미 다른 표현" 별칭 생성. 별칭은 줄별 **개별 dense 벡터**(sentinel `{chunk}#alias#N`)로 색인하고 본문 벡터는 그대로 둠 (묶음 1벡터는 평균화로 희석 → 회귀, HOTFIXES 2026-05-31). boilerplate 청크는 별칭 skip. 검색 시 별칭 hit 는 `kebab-core::strip_alias_suffix` 로 원본 chunk_id 에 매핑. `[ingest.expansion]` default off (opt-in, 청크당 LLM 비용). |
-| 파생물 캐시 `derivation_cache` (V012, v0.21.0) | 비싼 ingest 파생물(embedding 벡터 / 별칭 LLM 결과)을 청크 **내용 해시** 키로 SQLite 에 캐싱 → 재색인 시 내용 불변 청크는 재계산 skip. `cache_key = blake3(kind ‖ text_blake3 ‖ version_key)[:32]`; version_key 에 model/prompt/dimensions 포함 → §9 cascade 와 정합(버전 bump 시 자동 miss). 위치 기반 `chunk_id` 와 달리 내용이 같으면 문서·위치 무관 동일 키. 순수 가산 — `corpus_revision` bump 안 함, 손상/삭제돼도 정확성 영향 0(miss → 재계산). search/ask 는 `kebab.sqlite`+`lancedb` 만으로 동작하므로 외부 서버 색인 후 DB 만 복사하는 이식 워크플로 가능 (HOTFIXES 2026-05-31). |
+| ~~doc-side expansion 별칭 (v0.21.0)~~ | **제거됨 (v0.25.0, HOTFIXES 2026-06-03)** — 색인-시 청크당 LLM 별칭 생성 + 별칭 검색 채널을 완전히 제거. 별칭 ROI 음수(cross-lingual 은 e5-large 단독으로 충분, 기여는 설명형 +2 그룹뿐인데 대가가 청크당 색인-시 LLM). V013 마이그레이션이 `chunk_aliases_fts` + `chunks.aliases` DROP. 기존 KB 의 잔존 별칭 벡터는 검색 시 `strip_alias_suffix` 로 본문 chunk 에 매핑(graceful)되거나 `kebab reset` 으로 정리. spec: `docs/superpowers/specs/2026-06-03-remove-doc-expansion-spec.md`. |
+| 파생물 캐시 `derivation_cache` (V012, v0.21.0) | 비싼 ingest 파생물(embedding 벡터)을 청크 **내용 해시** 키로 SQLite 에 캐싱 → 재색인 시 내용 불변 청크는 재계산 skip. `cache_key = blake3(kind ‖ text_blake3 ‖ version_key)[:32]`; version_key 에 model/dimensions 포함 → §9 cascade 와 정합(버전 bump 시 자동 miss). 위치 기반 `chunk_id` 와 달리 내용이 같으면 문서·위치 무관 동일 키. 순수 가산 — `corpus_revision` bump 안 함, 손상/삭제돼도 정확성 영향 0(miss → 재계산). search/ask 는 `kebab.sqlite`+`lancedb` 만으로 동작하므로 외부 서버 색인 후 DB 만 복사하는 이식 워크플로 가능 (HOTFIXES 2026-05-31). (별칭 LLM 캐싱 kind 는 v0.25.0 에서 제거 — embedding kind 만 남음.) |
 | layout | XDG (`~/.local/share/kebab/`, `~/.config/kebab/`, …) |
 
 전체 frozen 설계는 [docs/superpowers/specs/2026-04-27-kebab-final-form-design.md](superpowers/specs/2026-04-27-kebab-final-form-design.md) 12 sections 참조.
@@ -66,7 +66,9 @@ flowchart TB
     end
     subgraph Adapters ["traits + adapters"]
         embed["kebab-embed<br/>(trait)"]
-        embedlocal["kebab-embed-local<br/>(fastembed)"]
+        embedlocal["kebab-embed-local<br/>(fastembed, default)"]
+        embedcandle["kebab-embed-candle<br/>(candle, e5+arctic, NUMA-safe opt-in)"]
+        embedollama["kebab-embed-ollama<br/>(Ollama /api/embed, opt-in)"]
         llm["kebab-llm<br/>(trait)"]
         llmlocal["kebab-llm-local<br/>(Ollama)"]
         search["kebab-search"]
@@ -92,6 +94,8 @@ flowchart TB
     app --> sqlite
     app --> vector
     app --> embedlocal
+    app --> embedcandle
+    app --> embedollama
     app --> llmlocal
     app --> search
     app --> rag
@@ -104,6 +108,10 @@ flowchart TB
     paud --> core
     pcode --> core
     embedlocal --> embed
+    embedcandle --> core
+    embedcandle --> config
+    embedollama --> core
+    embedollama --> config
     llmlocal --> llm
     rag --> search
     rag --> llm
@@ -132,6 +140,23 @@ UI → store/llm/parse 직접 의존 금지. 모든 user-facing 진입은 `kebab
 
 `kebab-parse-code` 의 외부 tree-sitter grammar crate 의존: P10-1A-2 에서 `tree-sitter-rust` 추가, P10-1B 에서 `tree-sitter-python` / `tree-sitter-typescript` / `tree-sitter-javascript` 추가, P10-1C-Go 에서 `tree-sitter-go` 추가, P10-1C-JK 에서 `tree-sitter-java` / `tree-sitter-kotlin-ng` 추가, P10-1D 에서 `tree-sitter-c` / `tree-sitter-cpp` 추가. 모두 `kebab-parse-code` 에만 격리 (facade 룰 — UI crate / chunker 가 직접 import 금지). Kotlin 은 `tree-sitter-kotlin-ng` 사용 (bare `tree-sitter-kotlin` 은 tree-sitter 0.21–0.23 에 고착 — 사용 불가). v0.18.0+ 부터 `kebab-source-fs` 는 자체 `code_meta` 모듈 (lang detect + skip helpers + BUILTIN_BLACKLIST) 을 보유, kebab-parse-code 와 분리 (refactor 2026-05-26). v0.19.0 부터 `kebab-parse-md` 가 `kebab-parse-types` (parser intermediate types) + `kebab-normalize` (CanonicalDocument lift) 두 crate 를 흡수 — 24 → 22 crates, design §3.7b 재작성 (HOTFIXES 2026-05-26). v0.20.1 부터 `kebab-search` 가 `lindera-ko-dic` 를 의존해 한국어 FTS5 형태소 tokenizer 지원 — V009 migration 으로 2자 이상 한국어 query 매칭 (Bug #8 closure).
 
+### 임베딩 백엔드 결정표 (v0.26.0)
+
+| provider | 모델 | pooling / prefix | 위치 | 언제 |
+|---|---|---|---|---|
+| `fastembed` (기본) | `multilingual-e5-large` | mean / `query:`·`passage:` | in-process (onnxruntime) | 기본. 단일 소켓 호스트 |
+| `candle` | e5 또는 `snowflake-arctic-embed-l-v2.0` | 모델별 (e5=mean, arctic=CLS) / arctic=`query:`·무접두어 | in-process (pure Rust) | NUMA 서버 (onnxruntime 48-스레드 double-free 회피), Apple Silicon Metal GPU |
+| `ollama` | `snowflake-arctic-embed2` 등 | 모델 태그로 추론 / arctic=`query:`·무접두어 | 원격 HTTP (`/api/embed`) | candle 폴백, 측정에 쓴 경로 그대로 재현 |
+
+**arctic-embed-l-v2.0 채택 근거**: 별칭(doc-side expansion) 제거(v0.25.0) 후 설명형
+query 의 recall 보강책. 측정(`/build/dogfood/logs/2026-06-03-method-measurements.md`)에서
+arctic = recall@10 130/132 (e5 대비 +7, 색인 1회·per-query 0·LLM 0, 용어 무손실).
+candle 이 주 백엔드(in-process, NUMA 안전), Ollama 가 폴백(측정 경로 재현). 두 경로의
+pooling/prefix 정확성은 `kebab-embed-candle/tests/arctic_ollama_parity.rs`
+(candle arctic vs Ollama arctic 코사인>0.99, `#[ignore]`) 로 고정. e5 → arctic 전환은
+`embedding_version` cascade (모델별 벡터 상이) → 재색인 필요. 기본값 e5 유지라 기존
+사용자 무영향. 자세한 내용: [tasks/HOTFIXES.md](../tasks/HOTFIXES.md) 2026-06-03 arctic entry.
+
 ## 디렉토리 구조
 
 ```text
@@ -180,15 +205,17 @@ kebab/
 │   ├── kebab-store-sqlite/                            # SQLite + FTS5 (V001/V002/V003) (P1-6, P2-1, P3-3). src/derivation_cache.rs = derivation_cache 테이블 저장소 (V012, v0.21.0)
 │   ├── kebab-search/                                  # Lexical + Vector + Hybrid retriever (P2-2, P3-4)
 │   ├── kebab-embed/  kebab-embed-local/                  # Embedder trait + fastembed adapter (P3-1, P3-2)
+│   ├── kebab-embed-candle/                             # candle (pure-Rust) Embedder, 모델 레지스트리(e5 mean + arctic CLS), NUMA-safe opt-in provider=candle (Track 1, v0.22.0; arctic v0.26.0)
+│   ├── kebab-embed-ollama/                             # Ollama /api/embed Embedder, opt-in provider=ollama (arctic 폴백 경로, v0.26.0)
 │   ├── kebab-store-vector/                            # LanceDB VectorStore (P3-3, P7-3 follow-up)
 │   ├── kebab-llm/  kebab-llm-local/                      # LanguageModel trait + Ollama adapter (P4-1, P4-2)
 │   ├── kebab-rag/                                     # RAG pipeline (P4-3)
 │   ├── kebab-nli/                                     # NLI verifier (mDeBERTa-v3 XNLI, fb-41 PR-9a/9b/9c-1)
 │   ├── kebab-eval/                                    # golden query runner + metrics (P5-1, P5-2)
-│   ├── kebab-parse-image/                             # ImageExtractor + Ollama OCR + caption (P6)
+│   ├── kebab-parse-image/                             # ImageExtractor + OCR (ollama-vision + paddle-onnx ONNX) + caption (P6)
 │   ├── kebab-parse-pdf/                               # lopdf per-page text extractor (P7-1)
 │   ├── kebab-parse-code/                              # tree-sitter AST extractors: Rust (P10-1A-2), Python + TypeScript + JavaScript (P10-1B), Go (P10-1C-Go), Java + Kotlin (P10-1C-JK — java.rs + kotlin.rs), C + C++ (P10-1D — c.rs + cpp.rs); chunker lives in kebab-chunk
-│   ├── kebab-app/                                     # facade (P0 시그니처 + P3-5/P6-4/P7-3 본체). src/expansion.rs = 별칭 생성, src/derivation_payload.rs = 캐시 payload 인코딩 (v0.21.0)
+│   ├── kebab-app/                                     # facade (P0 시그니처 + P3-5/P6-4/P7-3 본체). src/derivation_payload.rs = 캐시 payload 인코딩 (v0.21.0)
 │   ├── kebab-tui/                                     # Ratatui shell + Library 패널 (P9-1)
 │   ├── kebab-mcp/                                     # stdio MCP server — tools: schema, doctor, search, ask (P9-FB-30)
 │   └── kebab-cli/                                     # binary (P0 → 핫픽스로 --config flag wiring 강화)

docs/DOGFOOD.md

@@ -683,6 +683,20 @@ ajv-cli validate -s docs/wire-schema/v1/<schema>.schema.json -d <output>
 
 ---
 
+### config migrate (스키마 마이그레이션, v0.21.1)
+
+```bash
+# 옛 스키마 흉내(섹션 누락 + deprecated) 후 migrate.
+printf 'schema_version = 1\n\n[workspace]\nroot = "~/MyNotes"\ninclude = ["*.md"]\n\n[search]\ndefault_k = 25\n' \
+  > "$DOGFOOD/old.toml"
+"$RELEASE_BIN" --config "$DOGFOOD/old.toml" config migrate --dry-run    # 미리보기, 파일 미수정
+"$RELEASE_BIN" --config "$DOGFOOD/old.toml" config migrate              # .bak + 빠진 섹션 주석과 함께 추가
+"$RELEASE_BIN" --config "$DOGFOOD/old.toml" config migrate              # 멱등
+"$RELEASE_BIN" --config "$DOGFOOD/old.toml" doctor | grep config_migration  # ok 확인
+```
+
+기대: dry-run 파일 미수정 → apply 시 `old.toml.bak`(원본 byte-identical) + `[ingest.code]`·`[logging]`·`[pdf.ocr]` 가시화 + 손본 `default_k`/주석 보존 + `workspace.include` 제거 → 재실행 멱등 → doctor `config_migration` ok. v0.21.1 evidence 는 `tasks/HOTFIXES.md` 2026-05-31.
+
 ## §10 Eval (P5)
 
 ### §10.1 Basic eval run

docs/SMOKE.md

@@ -95,23 +95,32 @@ model_dir = "{data_dir}/models"
 runs_dir = "{data_dir}/runs"
 copy_threshold_mb = 100
 
-[indexing]
+# v0.28.0: 모든 형식 ingest 설정의 우산. 병렬도(← 옛 [indexing])는 [ingest] 스칼라로,
+# chunking/code/image/pdf 는 [ingest.*] 하위로 통합. 옛 v2 파일은 로드 시 자동 변환됨.
+[ingest]
 max_parallel_extractors = 2
 max_parallel_embeddings = 1
 watch_filesystem = false
 
-[chunking]
+[ingest.chunking]
 target_tokens = 500
 overlap_tokens = 80
 respect_markdown_headings = true
 chunker_version = "md-heading-v1"
 
 [models.embedding]
-provider = "fastembed"               # "none" 으로 두면 lexical-only — Ollama 불필요
-model = "multilingual-e5-small"
+provider = "fastembed"               # "fastembed"(기본, onnxruntime) / "candle"(순수 Rust, NUMA-안전)
+                                     # / "ollama"(원격 HTTP /api/embed) / "none"(lexical-only — Ollama 불필요)
+                                     # ⚠ provider/model 변경 시 아래 dimensions 도 맞춰야 함.
+model = "multilingual-e5-small"      # candle/ollama 는 "snowflake-arctic-embed-l-v2.0"
+                                     # (ollama 태그 "snowflake-arctic-embed2", 1024-dim) 도 지원 —
+                                     # 설명형 query recall 보강. e5↔arctic 전환은
+                                     # embedding_version cascade (재색인 필요).
 version = "v1"
-dimensions = 384
+dimensions = 384                     # arctic / e5-large 는 1024.
 batch_size = 64
+num_threads = 0                      # candle 전용 CPU 스레드 캡 (0=auto). env KEBAB_EMBED_THREADS 우선.
+# endpoint = "http://127.0.0.1:11434"  # provider="ollama" 전용; 생략 시 [models.llm].endpoint fallback.
 
 [models.llm]
 provider = "ollama"
@@ -322,7 +331,7 @@ MCP tool 동등:
 [workspace]
 include = ["**/*.md", "**/*.png", "**/*.jpg"]
 
-[image.ocr]
+[ingest.image.ocr]
 enabled = true                        # vision LM 으로 이미지 안 텍스트 전사
 engine = "ollama-vision"
 model = "gemma4:e4b"                  # 사용자 환경의 비전 모델
@@ -330,12 +339,12 @@ endpoint = "http://192.168.0.47:11434"  # 비우면 models.llm.endpoint fallback
 languages = ["eng", "kor"]
 max_pixels = 1600                     # long-edge cap
 
-[image.caption]
+[ingest.image.caption]
 enabled = true                        # vision LM 으로 한 문장 객관 설명 생성
 max_pixels = 768
 prompt_template_version = "caption-v1"
 
-[pdf.ocr]
+[ingest.pdf.ocr]
 enabled = true               # smoke test 의 OCR path 활성화 (manual invoke)
 always_on = false
 engine = "ollama-vision"
@@ -351,6 +360,24 @@ lang_hint = "kor"
 
 이미지 자산 한 장당 OCR 1 호출 + Caption 1 호출 → ~3-6초 (`gemma4:e4b` 기준). 다이어그램 / 카메라 사진 / 스크린샷 위주 워크스페이스에 권장. 책 / 스캔본은 P7 PDF 라인으로.
 
+**v0.27.0 — paddle-onnx 엔진 (오프라인, Ollama 불필요).** `[ingest.image.ocr] engine = "paddle-onnx"` 로 바꾸면 PP-OCRv5 ONNX 를 in-process 로 실행한다 (원격 vision LM 불필요, 큰 페이지 CPU <4초). embedding 까지 끄려면 `[models.embedding] provider = "none"` (lexical-only) 로 두면 Ollama 없이 OCR→FTS5 검색 전체 경로를 스모크할 수 있다:
+
+```toml
+[models.embedding]
+provider = "none"            # lexical-only — Ollama 불필요
+
+[ingest.image.ocr]
+enabled = true
+engine = "paddle-onnx"       # PP-OCRv5 ONNX in-process (Python/원격 0)
+model = "ppocrv5-mobile-kor"
+languages = ["kor", "eng"]
+max_pixels = 1600
+# det_model / rec_model / dict 로 번들 모델 경로 override 가능 (생략 시 번들 사용)
+# score_thresh = 0.3 / unclip_ratio = 1.5 / max_boxes = 1000 으로 검출 튜닝
+```
+
+스모크: `kebab ingest --config <cfg>` 후 `kebab search --config <cfg> --mode lexical "<이미지 안 한국어 단어>"` 가 그 image chunk 를 반환하면 OCR→FTS5 wiring 정상. engine 또는 모델을 바꾸면 다음 ingest 가 영향 이미지를 자동 재색인한다.
+
 ## P7-3 PDF ingestion
 
 `config.toml` 의 `[workspace] include` 에 `**/*.pdf` 를 추가하면 `kebab ingest` 가 텍스트 PDF 자산도 색인합니다. 외부 service 의존 없음 — `kebab-parse-pdf` 가 lopdf 로 페이지 단위 텍스트 추출, `kebab-chunk::PdfPageV1Chunker` 가 페이지 경계를 절대 넘지 않는 chunk 생성.
@@ -690,6 +717,20 @@ KB --json schema | jq '.stats.code_lang_breakdown'
 - OCR / caption 부분 실패는 `errors` 카운터 미증가 — `kebab inspect doc <id>` 의 Provenance Warning 이벤트 또는 `--debug` 로그에서만 확인.
 - (P7-3) `*.pdf` 자산을 워크스페이스에 두면 `kebab ingest` 출력에 PDF 도 `new` 카운터에 포함. `kebab inspect doc <pdf_doc_id>` 가 `parser_version = "pdf-text-v1"` + 페이지마다 `Block::Paragraph` + `SourceSpan::Page { page, char_start, char_end }`. 본문에 등장하는 단어로 `kebab search --mode hybrid` 시 PDF chunk 가 결과에 포함되고 `source_span.kind = "page"` 면 wiring 정상. 암호화 PDF 는 `errors+=1` 로 분류되며 `error` 필드에 `qpdf --decrypt` 안내 보존. 빈/스캔 페이지 (PDF 가 텍스트를 추출하지 못한 페이지) 는 0 chunk + `Provenance::Warning` ("scanned candidate") 로 표시 — P+ scanned-PDF OCR fallback 까지는 검색 불가.
 
+## config migrate (마이그레이션)
+
+```bash
+# 옛 스키마처럼 섹션이 빠진 config 를 흉내내 migrate 동작 확인.
+printf 'schema_version = 1\n\n[workspace]\nroot = "/tmp/kb"\ninclude = ["*.md"]\n' \
+  > /tmp/kebab-smoke/old.toml
+kebab --config /tmp/kebab-smoke/old.toml config migrate --dry-run   # 변경 미리보기 (파일 미수정)
+kebab --config /tmp/kebab-smoke/old.toml config migrate             # 적용 (.bak 백업)
+kebab --config /tmp/kebab-smoke/old.toml config migrate             # 멱등: "config 이미 최신입니다"
+kebab --config /tmp/kebab-smoke/old.toml --json config migrate --dry-run | jq .schema_version
+```
+
+기대: dry-run 은 추가될 섹션(`[ingest.code]`·`[logging]` 등)과 제거될 `workspace.include` 를 출력하고 **파일을 수정하지 않는다**. 적용 시 `old.toml.bak`(원본과 동일)이 생기고 빠진 섹션이 주석과 함께 추가되며 사용자가 손본 값·주석은 보존된다. 재실행은 멱등(`config 이미 최신입니다`), `--json` 은 `config_migration.v1`.
+
 ## 정리
 
 ```bash

docs/release-notes/v0.22.0-draft.md

@@ -0,0 +1,97 @@
+---
+title: kebab v0.22.0 release notes (draft)
+created: 2026-06-01
+status: draft
+release_trigger:
+  - 신규 config surface (provider=candle, num_threads / KEBAB_EMBED_THREADS) — pre-1.0 minor bump
+  - 임베딩 백엔드 다변화 (NUMA-안전 candle provider 추가, opt-in)
+---
+
+# kebab v0.22.0 — candle 임베딩 provider (NUMA-안전, opt-in)
+
+v0.21.1 (config 마이그레이션) 후속 minor release. 듀얼소켓 NUMA 서버에서
+onnxruntime 의 스레드 하드코딩이 일으키던 ingest 크래시를 피하기 위해, 같은
+임베딩 모델을 **순수 Rust(candle)** 로 돌리는 opt-in provider 를 추가한다.
+**기본 동작은 그대로다** — 기존 사용자는 아무것도 바꿀 필요가 없다.
+
+---
+
+## 핵심 변경
+
+### candle 임베딩 provider (`provider = "candle"`)
+
+**변경 사실.** `[models.embedding].provider` 에 `"candle"` 값이 추가됐다.
+`"fastembed"`(기본, onnxruntime) / `"candle"`(순수 Rust) / `"none"`(lexical-only)
+중 하나를 고를 수 있다. candle provider 는 fastembed 와 **완전히 같은 모델**
+(`intfloat/multilingual-e5-large`, 1024-dim)을 쓰고, e5 prefix → mean pooling
+→ L2 정규화 파이프라인도 동일하다. 첫 사용 시 safetensors(~2GB)를
+`{model_dir}/candle/` 아래로 자동 다운로드한다.
+
+```toml
+[models.embedding]
+provider = "candle"     # 기본은 "fastembed" — NUMA 서버에서만 candle 권장
+num_threads = 8         # candle CPU 스레드 캡 (0 = auto = #cores)
+```
+
+```bash
+# env 로도 캡 가능 (config 보다 우선)
+KEBAB_EMBED_THREADS=8 kebab ingest
+```
+
+**Trade-off.** candle 는 순수 Rust 라 onnxruntime 의 네이티브 SIMD 커널보다
+CPU latency 가 느리다 (Phase 0 스파이크 측정 ~4×). 그래서 **기본값은
+fastembed 를 유지**하고, candle 은 onnxruntime 가 죽는 NUMA 환경에서만 켜는
+opt-in 으로 둔다. 단일 워크스테이션 사용자는 fastembed 가 더 빠르다.
+
+**Mitigation (왜 안전한가).** candle 의 CPU 백엔드는 글로벌 rayon 풀 크기로
+스레드를 정한다. `num_threads`(또는 env `KEBAB_EMBED_THREADS`)가 그 풀을 한 번
+캡하므로, onnxruntime 가 하드코딩하던 48 intra-op 스레드 → NUMA 힙 손상 →
+double-free 경로를 원천 차단한다. NUMA 노드 바인딩이 더 필요하면 `numactl`
+과 조합한다.
+
+**Upgrade 절차.** 재색인 **불필요**. candle 과 fastembed 의 벡터는 사실상
+동일(Phase 0 스파이크 코사인 1.000000)해서 `embedding_version` 을 유지했고,
+기존 LanceDB 색인을 그대로 재사용한다. provider 를 바꿔도 검색 결과는
+바뀌지 않는다. 기존 `config.toml` 은 `num_threads` 가 자동으로 `0`(auto)으로
+채워져 그대로 로드된다 — `kebab config migrate` 도, 수동 편집도 필요 없다.
+
+---
+
+## 그 외
+
+- 신규 crate `kebab-embed-candle` (candle 의존성 트리를 이 crate 에 격리,
+  `kebab-core`/`kebab-config` 외 다른 kebab-* 의존 없음).
+- Phase 0 feasibility 스파이크(`spike-embed-candle`)는 production 흡수 후 제거.
+- 문서: README Configuration, `docs/SMOKE.md` config 예시, `docs/ARCHITECTURE.md`
+  crate 그래프/트리에 candle provider 반영.
+
+## 검증 / 도그푸딩
+
+- **패리티 (candle vs onnxruntime)**: 동일 e5-large 가중치로 cosine_min =
+  1.000000, 차원별 max 절대오차 = **2.01e-7**. 벡터가 사실상 동일 →
+  `embedding_version` 유지(재색인 0). 재현: `crates/kebab-embed-candle/tests/parity.rs`
+  (`--ignored`).
+- **전체 도그푸딩 (2026-06-02)**: `provider=candle` 로 도그푸딩 코퍼스 전체
+  재색인 — **997 docs / 23,151 chunks, 에러 0** 완주 (≈9.5 h, 단일소켓 VM).
+  candle 가 23k+ 청크를 메모리 오류 없이 처리함을 확인.
+- **A1(taskset/numactl) 반증**: NUMA 서버에서 `taskset -c 0-3` 으로 스레드를
+  4개로 묶어도 onnxruntime 은 그대로 죽었다(6/5150 segfault). 스레드 축소는
+  해법이 아니며, **`provider=candle` 만이 실 해법**이다 (candle 은 onnxruntime 을
+  호출하지 않음).
+- **최종 인수 게이트 (사용자)**: 그 듀얼소켓 NUMA 서버에서 `provider=candle` 로
+  ingest 가 EXIT=0 완주 — 배포·실사용이 이 검증을 겸한다.
+
+## 성능 노트 (중요)
+
+candle CPU 임베딩은 onnxruntime 대비 약 **3~4× 느리다** (e5-large/512-tok 의
+순수-Rust 커널 비용). 측정상 ~1.86 s/chunk, CPU 약 4코어 활용. **이는 의도된
+트레이드오프** — onnxruntime 이 전 코어를 AVX-512 로 빡빡하게 굴리는 바로 그
+경로가 NUMA 에서 힙을 손상시켜 죽기 때문이다. "느려도 완주" > "빨라도 크래시".
+
+- Intel **MKL 가속을 실험했으나 부정 결과**: MKL 은 코어를 더 쓰지만(8~9코어)
+  오히려 38~50% 느렸다(과다구독 + MKL 2020.1 오버헤드). 채택하지 않음.
+- 더 많은 코어/스레드로는 빨라지지 않는다(병목이 코어 수가 아님). 속도가
+  critical 하면 청크 길이 단축 / 더 작은 모델 / GPU 가 레버다(별도 검토).
+- 9.5 h 는 **최초 전체 색인 1회 비용**이며, 이후 증분 ingest 는 새/변경 문서만
+  처리해 저렴하다. 단일 워크스테이션(비-NUMA)에서는 기본 `fastembed` 가 더 빠르니
+  candle 은 NUMA 호스트 전용 opt-in 으로 둔다.

docs/release-notes/v0.28.0-draft.md

@@ -0,0 +1,66 @@
+---
+title: kebab v0.28.0 release notes (draft)
+created: 2026-06-04
+status: draft
+release_trigger:
+  - config 스키마 v2→v3 재편 (config 레이아웃 rename + 신규 env) — pre-1.0 minor bump
+  - frozen 설계 변경 (2026-06-04-config-schema-reorg-design)
+---
+
+# kebab v0.28.0 — config 스키마 v2→v3: 미디어 ingest 통합
+
+v0.27.0(PP-OCRv5 ONNX OCR) 후속 minor release. `config.toml` 에 흩어져
+있던 미디어 형식 설정을 **`[ingest.*]` 우산** 하나로 모은다. **기존 사용자는
+아무것도 손대지 않아도 된다** — 옛 v2 파일은 로드 시 메모리에서 자동 변환되고,
+검색·색인 결과는 바이트 단위로 동일하다(재색인 0).
+
+---
+
+## 변경 사실
+
+미디어 형식 설정이 top-level 에서 `[ingest.*]` 하위로 이동했다.
+
+| v2 (top-level) | v3 (`[ingest.*]`) |
+|---|---|
+| `[indexing]` (스칼라) | `[ingest]` 스칼라 (`max_parallel_extractors` 등) |
+| `[chunking]` | `[ingest.chunking]` |
+| `[image.ocr]` | `[ingest.image.ocr]` |
+| `[image.caption]` | `[ingest.image.caption]` |
+| `[pdf.ocr]` | `[ingest.pdf.ocr]` |
+| `[ingest.code]` | `[ingest.code]` (변화 없음) |
+
+부수적으로 `[ingest.pdf.ocr]` 가 paddle-onnx 모델 경로 키(`det_model`/`rec_model`/
+`dict`/`score_thresh`/`unclip_ratio`/`max_boxes`)를 PDF 자체적으로 가질 수 있게
+됐다(v2 는 image.ocr 의 값을 빌려썼다). 신규 env `KEBAB_PDF_OCR_*` 6키.
+
+## Trade-off
+
+비-additive **rename** 마이그레이션이라(첫 사례), 옛 섹션 이름을 그대로 두면
+serde 가 모르는 키로 무시될 수 있다. 이를 피하려고 두 겹의 안전장치를 깔았다:
+(1) `Config::from_file` 이 load 시 메모리에서 v3 로 자동 변환 — 미변환 v2 파일도
+설정 유실 0. (2) `kebab config migrate` 가 디스크 파일을 새 레이아웃으로 갱신하되
+값·주석·대안(commented) 줄을 전부 보존하고 멱등이다.
+
+env override 이름(예 `KEBAB_CHUNKING_TARGET_TOKENS`,
+`KEBAB_INDEXING_MAX_PARALLEL_EXTRACTORS`)은 **그대로 유지**된다 — 대입 대상만
+새 경로로 바뀌므로 기존 `KEBAB_*` 스크립트는 손댈 필요가 없다.
+
+## Mitigation — 재색인 0 보장
+
+`ingest_config_signature` 는 값 기반이라 struct 경로가 바뀌어도 출력 문자열이
+v2 와 **바이트 동일**하다. paddle 모델 경로는 미디어별(image/pdf)로 호출자가
+넘기도록 인자화했고, 마이그레이션이 v2 의 image↔pdf paddle 비대칭을 값 복사로
+보존한다. 도그푸딩(v0.28.0 release 빌드)에서 v2 config 로 first ingest 후
+(a) 동일 v2 config 재ingest(자동변환), (b) v3 로 `config migrate` 후 재ingest
+모두 `new=0 updated=0 unchanged=2` — 업그레이드 시 재색인이 발생하지 않음을
+실증했다.
+
+## Upgrade 절차
+
+1. 아무것도 안 해도 된다 — 옛 `config.toml` 은 그대로 로드된다(자동 변환,
+   디스크 미변경, 일회성 warn 으로 안내).
+2. 파일을 새 레이아웃으로 정리하려면: `kebab config migrate` (자동 `.bak` 백업,
+   `--dry-run` 으로 미리보기). `kebab doctor` 가 갱신 필요 시 안내한다.
+3. `kebab init` 으로 새로 만드는 config 는 v3 레이아웃 + per-option 주석 포함.
+
+검색·RAG 결과와 색인은 변하지 않는다.

docs/superpowers/plans/2026-06-03-arctic-embedder-plan.md

@@ -0,0 +1,33 @@
+# Plan: arctic-embed-l-v2.0 임베더 통합 구현
+
+spec: `docs/superpowers/specs/2026-06-03-arctic-embedder-spec.md`. 브랜치 `feat/arctic-embedder`. 빌드 `CARGO_TARGET_DIR=/build/out/cargo-target`, `-j 4`(전체 test `-j 1`). cli 통합테스트용 `target` 심링크 필요 후 정리.
+
+## Task 1 — kebab-embed-candle 모델 레지스트리
+- e5 하드코딩(`HF_MODEL`/`SUPPORTED_MODEL`/mean pool/`query:`+`passage:`) → 레지스트리 구조체 `EmbedModelSpec { name, hf_repo, pooling: Pooling, query_prefix, doc_prefix, dim }`.
+- 등록: e5(`intfloat/multilingual-e5-large`, Mean, `query: `/`passage: `, 1024) + arctic(`Snowflake/snowflake-arctic-embed-l-v2.0`, Cls, `query: `/``, 1024). **arctic pooling 은 모델 `1_Pooling/config.json` 로 확인 후 확정(CLS 추정).**
+- `embed_batch` pooling 분기: Mean=기존 attention-mask-weighted, Cls=hidden_state[:,0,:]. tokenize/forward/L2 공유.
+- `CandleEmbedder::new` 가 config model 로 spec 조회, 없으면 에러. `model_id`/`model_version` 에 모델명 반영.
+- 단위테스트: 레지스트리 조회, prefix 적용, (가능하면) CLS vs mean pooling shape.
+
+## Task 2 — kebab-embed-ollama 신규 크레이트
+- `Cargo.toml`(workspace member), `Embedder` 구현. `reqwest::blocking` POST `/api/embed`.
+- 배치(48) + fail-soft 재시도(3). query/doc prefix 모델별. L2 normalize. dim 검증(config 와 일치).
+- endpoint = config.models.embedding.endpoint ?? models.llm.endpoint. model_version=`ollama:{model}`.
+- 단위테스트: wiremock 으로 /api/embed mock → dim·정규화·prefix 검증.
+
+## Task 3 — config + app 배선
+- `kebab-config`: `EmbeddingCfg.provider` 문서/검증에 `ollama` 추가, `endpoint: Option<String>` 필드(serde default None). migrate.rs 주석.
+- `kebab-app` `embedder()`(또는 해당 선택부, lib.rs ~836): provider match → fastembed | candle(레지스트리) | ollama. facade 통해 cfg 주입.
+- config 직렬화/round-trip 테스트 갱신.
+
+## Task 4 — correctness 검증 테스트 (핵심)
+- candle arctic vs Ollama arctic 코사인>0.99 테스트: 테스트 문장 임베딩을 candle(arctic spec)로 1개 + Ollama(`snowflake-arctic-embed2` @192.168.0.47)로 1개 → cos>0.99 assert. live Ollama 의존이라 `#[ignore]`(이유: 외부 Ollama), 수동 실행 절차를 테스트 doc + HOTFIXES 에 기록. (CI 무인 환경 회피.)
+- 단, **리더가 머지 전 이 테스트를 수동 실행해 통과 확인**(pooling/prefix 정확성 게이트).
+
+## Task 5 — 검증 + 문서
+- clippy 0 / 전체 test 통과(기존 e5 회귀 0).
+- provider=candle+arctic, ollama+arctic, fastembed+e5(기본) 각 로드 스모크.
+- 문서: README Configuration(provider candle/ollama + arctic + endpoint + metal), ARCHITECTURE(백엔드 그래프 + kebab-embed-ollama 크레이트 + 결정표), HANDOFF 1줄, HOTFIXES dated, Cargo.toml members + version minor bump(+Cargo.lock).
+
+## 리뷰 루프
+구현 완료 → 리더가 (a) clippy/test 독립 재확인 (b) **candle≈Ollama 코사인>0.99 수동 검증** → `gitea-pr`(title `feat(embed): arctic-embed-l-v2.0 임베더(candle+ollama)`) → 리뷰 루프 → 사용자 머지. 머지 후 Mac Metal 도그푸딩(recall 130 재현).

docs/superpowers/plans/2026-06-03-config-invalidation-plan.md

@@ -0,0 +1,37 @@
+# Plan: ingest 설정 변경 자동 재색인 구현
+
+spec: `docs/superpowers/specs/2026-06-03-ocr-toggle-invalidation-spec.md`. 브랜치 `fix/ingest-config-invalidation`. 빌드 `CARGO_TARGET_DIR=/build/out/cargo-target`, **테스트 `-j 8`**(절대 `-j 1` 금지), cli 통합테스트용 `target` 심링크 후 정리.
+
+## Task 1 — ingest_config_signature 헬퍼 (kebab-app)
+- `fn ingest_config_signature(config: &Config, media: &MediaType) -> String` 추가.
+- 공통: `[chunking]` target_tokens, overlap_tokens, respect_markdown_headings, chunker_version.
+- image: + image.ocr.enabled (+model if enabled) + image.caption.enabled (+prompt_template_version if enabled).
+- pdf: + pdf.ocr.enabled (+model, always_on if enabled).
+- code: + ingest.code.{skip_generated_header, max_file_bytes, max_file_lines, extra_skip_globs(join), ast_chunk_max_lines, fallback_lines_per_chunk, fallback_lines_overlap}.
+- markdown: 공통만.
+- 결정적(필드 순서 고정). 단위테스트: 같은 config→같은 서명, 관련 필드 변경→서명 변경, 무관 필드(search 등)→불변.
+
+## Task 2 — 4개 ingest 경로에 composite parser_version 적용 (kebab-app/lib.rs)
+- md(~351), image(~1532), pdf(~2109), code 경로: `*_parser_version` = `ParserVersion(format!("{base}|{}", ingest_config_signature(config, media)))` (base = 각 extractor PARSER_VERSION).
+- 이 composite 를 (1) `try_skip_unchanged` 의 `current_parser_version` 으로 전달, (2) **persist 전 `canonical.parser_version` override** 로 저장. 두 곳 동일 보장.
+- doc_id 파생은 손대지 않음(workspace_path 조회).
+- markdown/code/image/pdf 각 경로에서 동일 패턴 적용 — 누락 없게.
+
+## Task 3 — 테스트
+- image.ocr off→on, caption off→on: 재색인(skip 아님). off→off / 동일 설정: skip 유지.
+- pdf.ocr off→on: 재색인. 동일: skip.
+- chunking target_tokens 변경: 전 타입 재색인. 무변경: skip.
+- ingest.code 변경: 코드 자산만 재색인.
+- **search/rag/ui 변경: 재색인 0** (회귀 가드).
+- 동일 config 재실행: 전 자산 skip (불필요 재색인 0).
+- 기존 skip 테스트(markdown unchanged 등) 회귀 0.
+
+## Task 4 — 검증 + 문서
+- `cargo clippy --workspace --all-targets -j 8 -- -D warnings` 0.
+- `cargo test -p kebab-app -p kebab-parse-image -p kebab-parse-pdf -p kebab-parse-code -p kebab-chunk -j 8` 통과(touched 크레이트 타깃; 전체 -j1 금지).
+- 스모크: 이미지 ocr off 색인 → config ocr on → `kebab ingest`(force 없이) → 그 이미지 재색인 확인.
+- tasks/HOTFIXES dated entry(일반화 + 업그레이드 1회 재색인 안내), Cargo.toml version **0.26.1 → 0.26.2**(+Cargo.lock), HANDOFF 1줄. README/wire 변화 없음.
+- 결과 요약 `/tmp/cfginval-result.md`(게이트 + 스모크 캡처).
+
+## 리뷰 루프
+완료 → 리더 clippy/타깃테스트(-j8) 독립 재확인 + 토글 스모크 → `gitea-pr`(title `fix(ingest): ingest 설정 변경 시 영향 자산 자동 재색인`) → 리뷰 루프 → 사용자 머지.

docs/superpowers/plans/2026-06-03-ingest-log-improve-plan.md

@@ -0,0 +1,33 @@
+# Plan: ingest 로그 개선 구현
+
+spec: `docs/superpowers/specs/2026-06-03-ingest-log-improve-spec.md`. 브랜치 `feat/ingest-log-improve`. 빌드 `CARGO_TARGET_DIR=/build/out/cargo-target -j 4`(전체 test `-j 1`). cli 통합테스트용 `target` 심링크 후 정리.
+
+## Task 1 — wire 이벤트 (kebab-app/src/ingest_progress.rs)
+- `IngestEvent` 에 `AssetPhase { idx: u32, total: u32, phase: String, model: Option<String> }` variant 추가(serde tag 규약 기존과 동일, snake `asset_phase`).
+- `AssetTimings` 에 `ocr_ms: u64`, `caption_ms: u64` 필드 추가(기존 필드 뒤, serde default 0 → 구 소비자 호환).
+- 직렬화 테스트 추가(asset_phase, 확장 timings).
+
+## Task 2 — emit 지점 (kebab-app/src/lib.rs)
+- 이미지 경로: `apply_ocr` 직전 `AssetPhase{phase:"ocr", model: <ocr model>}`, `apply_caption` 직전 `AssetPhase{phase:"caption", model: <llm model>}` emit. 각 호출 시간 측정 → `ocr_ms`/`caption_ms`.
+- 임베딩 루프 진입 직전 `AssetPhase{phase:"embed", model: embedder.model_id}` emit(텍스트 포함 전 asset).
+- `AssetTimings` 생성부에 ocr_ms/caption_ms 전달.
+- 짧은 phase(parse/chunk/store)는 emit 안 함.
+
+## Task 3 — CLI 렌더 (kebab-cli/src/progress.rs)
+- **파일명**: AssetStarted TTY 핸들러 `bar.set_message(<path>)` (현재 위치-only 주석/로직 교체; path 길면 말미 축약). 비-TTY 줄 유지.
+- **phase+모델**: AssetPhase 수신 → `bar.set_message(format!("{path} · {phase}({model})…"))`. 현재 path 를 핸들러 상태로 보관(AssetStarted 에서 저장).
+- **heartbeat**: AssetStarted 에서 `Instant::now()` 보관 + `bar.enable_steady_tick(1s)` + 메시지 렌더에 경과초 `(Ns)`. AssetFinished/다음 AssetStarted 에서 리셋. (indicatif steady-tick + 커스텀 메시지.)
+- **slowest 요약**: 핸들러에 `Vec<(path, total_ms)>` 누적 — AssetStarted 로 idx→path, AssetTimings 로 idx→sum(parse+chunk+embed+store+ocr+caption). `Completed` 수신 시 상위 5개 stderr 표 출력(`⏱ 최장 소요:`). `--json` 모드 미출력, quiet 여도 요약은 출력.
+- `fmt_ms`(기존) 재사용.
+
+## Task 4 — wire schema + 문서
+- `docs/wire-schema/v1/ingest_progress.schema.json`: `asset_phase` kind(phase enum, model) + `ocr_ms`/`caption_ms` 필드 추가(additive). verbatim 일치.
+- README(있으면 진행 표시 한 줄), HANDOFF 1줄, tasks/HOTFIXES dated entry, Cargo.toml version minor bump(+Cargo.lock).
+
+## Task 5 — 검증
+- clippy 0, 전체 test 통과(기존 progress 테스트 갱신).
+- 스모크: 이미지/PDF 포함 임시 폴더 ingest → TTY 파일명+phase+모델+경과, 종료 top-N. 비-TTY 줄+요약. `--json` ndjson(asset_phase/ocr_ms) 확인, 사람텍스트 미혼입.
+- 결과 요약 `/tmp/ingestlog-result.md`(게이트 + 스모크 캡처).
+
+## 리뷰 루프
+완료 → 리더 clippy/test 독립 재확인 → `gitea-pr`(title `feat(ingest): 진행 로그 개선 — 파일명/phase/heartbeat/slowest 요약`) → 리뷰 루프 → 사용자 머지. 머지 후 Obsidian 볼트 도그푸딩.

docs/superpowers/plans/2026-06-03-remove-doc-expansion-plan.md

@@ -0,0 +1,49 @@
+# Plan: doc-side expansion(별칭) 제거 구현
+
+spec: `docs/superpowers/specs/2026-06-03-remove-doc-expansion-spec.md`. 브랜치 `refactor/remove-doc-expansion`. 빌드 `CARGO_TARGET_DIR=/build/out/cargo-target`, 직렬 `-j 4`(전체 테스트는 `-j 1`).
+
+원칙: 작은 단위로 컴파일 가능 상태 유지. 각 단계 후 `cargo build -p <crate> -j 4`. 최종 clippy+test.
+
+## Task 1 — kebab-core: Chunk.aliases 필드 제거
+- `chunk.rs`: `pub aliases: Option<String>` + serde default + `aliases_defaults_to_none_on_deserialize` 테스트 제거.
+- **금지**: `metadata.rs` `Metadata.aliases`(Vec) 는 손대지 않음.
+- 컴파일 깨짐 → Task 2~ 에서 Chunk 리터럴 정리하며 해소.
+
+## Task 2 — Chunk 리터럴 정리 (kebab-chunk/*, kebab-parse-*/*, store-sqlite, app)
+- `grep -rn "aliases: None" crates/*/src` 로 Chunk 생성부 전수 → `aliases: None,` 줄 삭제.
+- store-sqlite `documents.rs`: chunks INSERT 컬럼리스트/바인딩에서 `aliases` 제거(line ~126/156), SELECT 매핑의 aliases 제거, `aliases: None`(271) 제거.
+
+## Task 3 — kebab-app: expansion 모듈 + 루프 제거
+- `lib.rs`: `pub mod expansion;` 삭제, `expansion.rs` 파일 삭제.
+- ingest_one_asset: expansion 블록 전체(`if app.config.ingest.expansion.enabled { … }` + `alias_version_key`/`alias_cache_*`/`alias_touch_keys`/embed_aliases 임베딩/sentinel 벡터 생성) 제거. `expansion_ms` 타이밍은 0 고정 또는 AssetTimings 에서 필드 유지하되 항상 0 — **AssetTimings 의 expansion_ms 필드는 유지(wire 호환)**, 값 0.
+- alias sentinel 벡터 upsert 경로 제거, purge_vector_orphans 는 본문 벡터 정리로 유지.
+
+## Task 4 — kebab-config: ExpansionCfg 제거
+- `lib.rs`: `ExpansionCfg` struct + `IngestCfg.expansion` 필드 + Default 제거.
+- `migrate.rs`: `[ingest.expansion]` 처리/주석 제거.
+- config 직렬화 테스트에서 expansion 기대 제거.
+
+## Task 5 — kebab-search: alias lexical arm 제거
+- `lexical.rs`: `run_alias_query`, `merge_body_alias`, alias 분기 제거. body_rows 직접 사용으로 단순화. alias 관련 테스트 제거/갱신.
+
+## Task 6 — wire/progress 정리
+- `kebab-app/ingest_progress.rs`: `IngestEvent::ExpansionProgress` variant + 직렬화 테스트 제거. AssetChunked/AssetTimings 유지.
+- `kebab-cli/progress.rs`, `kebab-tui/ingest_progress.rs`: ExpansionProgress 매치/렌더 제거.
+- `kebab-tui/inspect.rs`: 별칭 표시 제거.
+- `docs/wire-schema/v1/ingest_progress.schema.json`: expansion_progress kind 제거.
+
+## Task 7 — sqlite 마이그레이션: DROP chunk_aliases_fts + chunks.aliases
+- `schema.rs`(refinery 마이그레이션 등록부) 확인 → 신규 forward 마이그레이션 추가: `DROP TABLE IF EXISTS chunk_aliases_fts` (+ 관련 트리거/shadow 테이블 chunk_aliases_fts_*), `ALTER TABLE chunks DROP COLUMN aliases`.
+- chunk_aliases_fts 를 만들던 기존 마이그레이션은 **수정 금지**(과거 마이그레이션 freeze) — 새 마이그레이션으로 덮어 제거.
+- `tests/chunk_aliases.rs` 삭제. `tests/migration.rs` 신규 마이그레이션 반영.
+- 번들 sqlite DROP COLUMN 지원 확인(3.35+); 미지원이면 테이블 재생성 패턴.
+
+## Task 8 — 검증 + 문서
+- `cargo clippy --workspace --all-targets -j 4 -- -D warnings`.
+- `cargo test --workspace --no-fail-fast -j 1`.
+- fresh KB `.schema` 로 chunk_aliases_fts/aliases 부재 확인. `kebab ingest` 스모크(별칭 config 없이).
+- grep 잔존 0 (spec Acceptance 의 정규식).
+- 문서: HOTFIXES dated entry, 2026-05-30 doc-expansion-design spec Risks/notes cross-link, HANDOFF 1줄, wire schema, design 본문 removed 주석, Cargo.toml version bump.
+
+## 리뷰 루프
+구현 완료 → `gitea-pr`(title `refactor(app): doc-side expansion(별칭) 제거`, body 요약/검증) → gitea-pr 리뷰 루프(actionable 해소까지) → 사용자 머지.