Finding a thing that does not use your words

Three pieces, and the first one is that they are all optional.

Extraction stops being constants. Upload size, image edge, JPEG quality, PDF
pages, extracted characters, orphan age and the text-extension list are settings
now, read through a process-level snapshot rather than a session -- `prepare` and
everything under it are called from routes, tool runners and the startup sweep,
and several of those have no session in hand. Two things deliberately stayed
constants: the decompression-bomb guard, which is a guard and not a preference,
and ORPHAN_AGE, which would have been evaluated at import if it stayed in the
signature and pinned the shipped 24 hours whatever anybody set.

An embedding model is picked from the models an administrator flagged for it, and
one that has since lost its flag is *named* rather than dropped from the picker:
a setting that vanishes is one nobody can tell from a setting never made. Nothing
here is required. Choosing none means no chunk rows, no requests, and
retrieval.search returning exactly what fts.search_ids returns in exactly that
order -- asserted, because it is what makes this safe to land on an instance that
never asked for it.

The two rankings are fused by reciprocal rank fusion: ranks and not scores,
because bm25 is a corpus-dependent negative and cosine is 0..1, and normalising
them onto one scale means picking a constant nobody can tune without a labelled
set they do not have. RRF's one constant is famously insensitive and degrades to
whichever list is non-empty -- which is what turns "no embedding model" into a
branch that does not exist.

A record scores as its best chunk rather than its average, or a long document
about something else outranks a short one that says the thing. Width and model
are stored beside every vector and a mismatch is skipped, because vectors from
two spaces score against each other perfectly happily and mean nothing -- a
search that works and is wrong is the worst failure this can have, and a model
change now leaves stale rows ignored rather than trusted.

Indexing is fired and forgotten, and how a change is noticed is a session event
rather than a call in each of the ten library writers. That is a departure from
this codebase's taste for explicit seams, for the reason tool_label is a Jinja
global: a step every writer has to remember is one that gets forgotten, and here
forgetting is silent -- the record saves, keyword search still finds it, and only
its recall goes stale. Chunks are embedded before anything is deleted, so a
failure leaves the old index rather than half a new one.

Also: `embeddings` joins the model capabilities, and the three tool flags that
had shipped with no checkbox -- canvas, scheduling and helpers -- have one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

PLAN.md

@@ -9,7 +9,7 @@ reasoning, tool calling with web search, custom HTTP tools and MCP servers,
 agent chats that work on a machine over SSH, a knowledge library, notes, memory
 and skills, speech in and out, image generation over ComfyUI, users and groups,
 model administration, installable as an app, reports, messages, and scheduled
-work that runs on its own. 1979 tests, `ruff` clean.
+work that runs on its own. 2024 tests, `ruff` clean.
 
 What remains before the first stable release is written out below, in phases,
 under [The road to 1.0.0](#the-road-to-100).
@@ -496,12 +496,29 @@ seen working.
       a content hash in the link so a save is not left to the browser's cache
 
 ### Phase 5 — extraction, embeddings and hybrid search (`0.9.5`)
-- [ ] **Extraction has settings** — upload size, image edge, PDF pages,
-      extracted characters, orphan age, which extensions count as text
-- [ ] **A dedicated embedding model**, chosen from the models flagged for it
-- [ ] **Search becomes hybrid** — FTS5 and vector recall fused, behind the one
-      call the retrieval service already is. No model chosen means exactly the
-      keyword search there is today
+- [x] **Extraction has settings** — upload size, image edge, JPEG quality, PDF
+      pages, extracted characters, orphan age, extra text extensions. Read
+      through a process-level snapshot, because `prepare` is called from places
+      with no session. The decompression-bomb guard stays a constant: it is a
+      guard, not a preference
+- [x] **A dedicated embedding model**, picked from the models flagged for it —
+      and a model that lost its flag is *named* rather than silently dropped
+      from the picker
+- [x] **Search becomes hybrid** — FTS5 and vector recall fused by reciprocal
+      rank fusion, behind the one call the stores already searched through.
+      Ranks rather than scores, because bm25 and cosine are not comparable and
+      normalising them means picking a constant nobody can tune
+- [x] **No model chosen means exactly the keyword search there is today** — no
+      rows, no requests, the same ids in the same order, asserted rather than
+      claimed
+- [x] Indexing is fired and forgotten and noticed by a session event, so no
+      writer has to remember it — forgetting would be silent, since only
+      semantic recall would go stale
+- [x] Vectors from two models never meet: width and model are stored beside
+      every vector and a mismatch is skipped, because scoring across two spaces
+      is a confident wrong answer rather than a missing one
+- [x] A rebuild that commits as it goes, reports itself, and stops polling when
+      it finishes
 
 ### Phase 6 — permissions, quotas and sharing (`0.9.6`)
 - [ ] **"What can this user actually do?"** answered on screen, from the
@@ -588,9 +605,12 @@ microphone is unavailable for the same reason.
 administrator's assertion, not something endpoints reliably advertise. Set it on
 a model that cannot, and its replies fail rather than degrade.
 
-**Library search is keyword, not semantic.** FTS5 ranks well and needs no
-dependency or embedding endpoint, but "how do I get paid" will not find a
-document that says "invoicing".
+**Library search is keyword-only until an embedding model is chosen.** FTS5 ranks
+well and needs no dependency, but "how do I get paid" will not find a document
+that says "invoicing". Choosing a model on **Extraction** adds a vector ranking
+fused with that one; choosing none is byte-for-byte the search that was always
+there. What that costs is an index that has to be rebuilt when the model changes,
+and stale vectors that are ignored until it is.
 
 **A model can write its own skills, and they take effect at once.** Marked as
 model-authored and fully revertible, but a model that has just read a hostile