diff --git a/src/kb/ingest/dedupe.ts b/src/kb/ingest/dedupe.ts
new file mode 100644
index 0000000..9a49027
--- /dev/null
+++ b/src/kb/ingest/dedupe.ts
@@ -0,0 +1,69 @@
+/**
+ * Ingest dedupe ledger — kb/.ingested.json, a flat `urlHash → slug` map.
+ *
+ * Sources are immutable (decision D2), so "ingest the same URL twice" must not
+ * silently pile up near-identical captures: the default is to return the
+ * existing slug, and only `force:true` writes a fresh capture (which then
+ * records `supersedes:` pointing at the one it replaces).
+ *
+ * The ledger is a cache, not a source of truth: every ingested source carries
+ * its own `hash:` frontmatter, so a missing or corrupt ledger is rebuilt from
+ * the sources dir. Writes happen inside the store's KB write path, so the file
+ * lives next to the entries it indexes (and travels with KB backups).
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { atomicWrite, pathExists } from "../../fs-utils.js";
+import { kbDir } from "../paths.js";
+import { listFullEntries } from "../store.js";
+
+export function ingestLedgerFile(): string {
+  return path.join(kbDir(), ".ingested.json");
+}
+
+type Ledger = Record<string, string>;
+
+async function rebuildFromSources(): Promise<Ledger> {
+  const ledger: Ledger = {};
+  for (const e of await listFullEntries("sources")) {
+    const hash = e.extra?.hash;
+    // listFullEntries is newest-first; first-write-wins means the NEWEST
+    // capture of a URL owns its hash — matching the live ledger, which is
+    // repointed to the fresh slug after every forced re-ingest.
+    if (hash && !(hash in ledger)) ledger[hash] = e.slug;
+  }
+  return ledger;
+}
+
+export async function readLedger(): Promise<Ledger> {
+  const file = ingestLedgerFile();
+  if (await pathExists(file)) {
+    try {
+      const parsed = JSON.parse(await fs.readFile(file, "utf8")) as unknown;
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        const ledger: Ledger = {};
+        for (const [k, v] of Object.entries(parsed)) {
+          if (typeof v === "string") ledger[k] = v;
+        }
+        return ledger;
+      }
+    } catch {
+      // corrupt → fall through to rebuild
+    }
+  }
+  const rebuilt = await rebuildFromSources();
+  await atomicWrite(file, JSON.stringify(rebuilt, null, 2) + "\n");
+  return rebuilt;
+}
+
+/** The slug previously ingested for this url-hash, if any. */
+export async function lookupIngested(hash: string): Promise<string | null> {
+  return (await readLedger())[hash] ?? null;
+}
+
+/** Record (or repoint, after a forced re-ingest) a hash → slug mapping. */
+export async function recordIngested(hash: string, slug: string): Promise<void> {
+  const ledger = await readLedger();
+  ledger[hash] = slug;
+  await atomicWrite(ingestLedgerFile(), JSON.stringify(ledger, null, 2) + "\n");
+}
diff --git a/src/kb/ingest/html-to-md.test.ts b/src/kb/ingest/html-to-md.test.ts
new file mode 100644
index 0000000..28b96fc
--- /dev/null
+++ b/src/kb/ingest/html-to-md.test.ts
@@ -0,0 +1,97 @@
+import { test, describe } from "node:test";
+import assert from "node:assert/strict";
+import { htmlToMarkdown, decodeEntities } from "./html-to-md.js";
+
+describe("htmlToMarkdown", () => {
+  test("headings and paragraphs", () => {
+    assert.equal(
+      htmlToMarkdown("<h1>Title</h1><p>One.</p><h2>Sub</h2><p>Two.</p>"),
+      "# Title\n\nOne.\n\n## Sub\n\nTwo.",
+    );
+  });
+
+  test("nested and ordered lists", () => {
+    const md = htmlToMarkdown(
+      "<ul><li>a<ul><li>a1</li><li>a2</li></ul></li><li>b</li></ul><ol><li>x</li><li>y</li></ol>",
+    );
+    assert.equal(md, "- a\n  - a1\n  - a2\n- b\n\n1. x\n2. y");
+  });
+
+  test("unclosed <li> (the real-world common case)", () => {
+    assert.equal(htmlToMarkdown("<ul><li>one<li>two</ul>"), "- one\n- two");
+  });
+
+  test("fenced code with language, fence-proof body", () => {
+    const md = htmlToMarkdown(
+      `<pre><code class="language-ts">const a = 1;\nif (a &lt; 2) {}</code></pre>`,
+    );
+    assert.equal(md, "```ts\nconst a = 1;\nif (a < 2) {}\n```");
+    // A body containing ``` must get a longer fence.
+    const evil = htmlToMarkdown("<pre><code>```\ninjection\n```</code></pre>");
+    assert.match(evil, /^````\n/);
+  });
+
+  test("inline code keeps backticks safe", () => {
+    assert.equal(htmlToMarkdown("<p>run <code>a`b</code> now</p>"), "run ``a`b`` now");
+  });
+
+  test("blockquote wraps nested markdown", () => {
+    assert.equal(
+      htmlToMarkdown("<blockquote><p>quoted</p><p>lines</p></blockquote>"),
+      "> quoted\n>\n> lines",
+    );
+  });
+
+  test("tables become pipe tables", () => {
+    const md = htmlToMarkdown(
+      "<table><thead><tr><th>A</th><th>B</th></tr></thead><tbody><tr><td>1</td><td>2</td></tr></tbody></table>",
+    );
+    assert.equal(md, "| A | B |\n| --- | --- |\n| 1 | 2 |");
+  });
+
+  test("links, images (incl. data-src lazy-loading), emphasis, hr", () => {
+    const md = htmlToMarkdown(
+      `<p><a href="https://x.dev">site</a> <strong>bold</strong> <em>it</em></p><hr><p><img data-src="https://img/x.png" alt="pic"></p>`,
+    );
+    assert.equal(md, "[site](https://x.dev) **bold** *it*\n\n---\n\n![pic](https://img/x.png)");
+  });
+
+  test("markdown special characters in prose are escaped — no syntax forgery", () => {
+    const md = htmlToMarkdown("<p>weight *not bold* and [[oauth]] and a|b</p>");
+    assert.equal(md, "weight \\*not bold\\* and \\[\\[oauth\\]\\] and a\\|b");
+  });
+
+  test("javascript: links render as plain text", () => {
+    assert.equal(htmlToMarkdown(`<p><a href="javascript:alert(1)">hi</a></p>`), "hi");
+  });
+
+  test("script/style/iframe contents are dropped, even with tricky bodies", () => {
+    const md = htmlToMarkdown(
+      `<p>keep</p><script>if (a < b) document.write("<p>evil</p>")</script><style>p{color:red}</style><p>also</p>`,
+    );
+    assert.equal(md, "keep\n\nalso");
+  });
+
+  test("a self-closing drop tag does not swallow the rest of the doc", () => {
+    // Self-closing <svg/>/<iframe/> have no matching close; the parser used to
+    // jump to EOF and silently discard everything after them.
+    assert.equal(htmlToMarkdown(`<p>before</p><svg/><p>after</p>`), "before\n\nafter");
+    assert.equal(htmlToMarkdown(`<p>before</p><iframe src="x"/><p>after</p>`), "before\n\nafter");
+    // A genuinely unclosed <script> (malformed) still drops to EOF — safer than
+    // leaking raw script source — so the tail is gone but "x=1" never leaks.
+    const md = htmlToMarkdown(`<p>before</p><script>x=1<p>after</p>`);
+    assert.equal(md, "before");
+    assert.ok(!md.includes("x=1"), "raw script source must not leak into output");
+  });
+
+  test("serializes from <body> when a full document is given", () => {
+    const md = htmlToMarkdown(
+      "<html><head><title>t</title></head><body><p>content</p></body></html>",
+    );
+    assert.equal(md, "content");
+  });
+
+  test("entities: named, decimal, hex", () => {
+    assert.equal(decodeEntities("a &amp; b &#65; &#x4e2d; &nbsp;"), "a & b A 中  ");
+  });
+});
diff --git a/src/kb/ingest/html-to-md.ts b/src/kb/ingest/html-to-md.ts
new file mode 100644
index 0000000..b0e2dd3
--- /dev/null
+++ b/src/kb/ingest/html-to-md.ts
@@ -0,0 +1,371 @@
+/**
+ * HTML → Markdown, zero-dependency (ingest decision D1: everything the user
+ * reads stays local — no remote reader service, no npm HTML pipeline with its
+ * own supply chain). A small lenient tree parser + a serializer covering the
+ * structures that actually occur in articles: headings, paragraphs, lists
+ * (nested), code (fenced + inline), blockquotes, tables, links, images,
+ * emphasis, rules.
+ *
+ * Ordering rule that keeps the output safe: TEXT IS ESCAPED FIRST, markdown
+ * syntax is added around it after — so a page whose prose contains `*` or
+ * `[[` cannot forge emphasis, links, or (worse) wikilinks into the KB entry.
+ */
+
+// ── lenient HTML tree ─────────────────────────────────────────────────
+
+export interface HtmlElement {
+  tag: string;
+  attrs: Record<string, string>;
+  children: HtmlNode[];
+}
+export type HtmlNode = HtmlElement | string;
+
+const VOID_TAGS = new Set([
+  "area", "base", "br", "col", "embed", "hr", "img", "input",
+  "link", "meta", "source", "track", "wbr",
+]);
+/** Contents dropped entirely — never useful in an article body. */
+const DROP_TAGS = new Set(["script", "style", "noscript", "template", "svg", "iframe", "head"]);
+
+const TAG_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<!DOCTYPE[^>]*>|<\/?([a-zA-Z][a-zA-Z0-9-]*)((?:"[^"]*"|'[^']*'|[^"'>])*)\/?>|[^<]+/g;
+const ATTR_RE = /([a-zA-Z_:][-a-zA-Z0-9_:.]*)\s*(?:=\s*("([^"]*)"|'([^']*)'|[^\s"'>]+))?/g;
+
+function parseAttrs(raw: string): Record<string, string> {
+  const attrs: Record<string, string> = {};
+  for (const m of raw.matchAll(ATTR_RE)) {
+    const val = m[3] ?? m[4] ?? (m[2] && !/^["']/.test(m[2]) ? m[2] : "");
+    attrs[m[1]!.toLowerCase()] = decodeEntities(val);
+  }
+  return attrs;
+}
+
+/**
+ * Parse HTML into a forgiving tree. Mismatched closes pop to the nearest open
+ * ancestor of that tag (or are ignored); unclosed tags close at EOF. Raw text
+ * (incl. markup-looking text) inside script/style/… is skipped via a raw-text
+ * scan so `<script>if (a < b)…</script>` can't derail the tokenizer.
+ */
+export function parseHtml(html: string): HtmlElement {
+  const root: HtmlElement = { tag: "#root", attrs: {}, children: [] };
+  const stack: HtmlElement[] = [root];
+  const top = (): HtmlElement => stack[stack.length - 1]!;
+
+  TAG_RE.lastIndex = 0;
+  let m: RegExpExecArray | null;
+  while ((m = TAG_RE.exec(html))) {
+    const token = m[0];
+    if (token.startsWith("<!") || token.startsWith("<![")) continue;
+    const tag = m[1]?.toLowerCase();
+    if (!tag) {
+      top().children.push(token);
+      continue;
+    }
+    if (token.startsWith("</")) {
+      const idx = stack.findLastIndex((el) => el.tag === tag);
+      if (idx > 0) stack.length = idx; // pop through unclosed children
+      continue;
+    }
+    if (DROP_TAGS.has(tag)) {
+      // A self-closing drop tag (<svg/>, <iframe/>) has no matching close and no
+      // content — skip just the tag. Previously these fell into the no-close
+      // branch below and jumped to EOF, silently discarding the rest of the doc.
+      if (token.endsWith("/>")) continue;
+      // Otherwise skip to this tag's real close without tokenizing its contents.
+      // A genuinely unclosed drop tag (malformed page) still drops to EOF rather
+      // than leak raw script/style source into the output.
+      const close = new RegExp(`</${tag}\\s*>`, "gi");
+      close.lastIndex = TAG_RE.lastIndex;
+      const c = close.exec(html);
+      TAG_RE.lastIndex = c ? close.lastIndex : html.length;
+      continue;
+    }
+    const el: HtmlElement = { tag, attrs: parseAttrs(m[2] ?? ""), children: [] };
+    // HTML5 implied closes — bounded by the enclosing container so a nested
+    // <ul> inside an <li> doesn't get its parent popped out from under it.
+    const implyClose = (targets: string[], stops: string[]): void => {
+      for (let i = stack.length - 1; i > 0; i--) {
+        const t = stack[i]!.tag;
+        if (targets.includes(t)) {
+          stack.length = i;
+          return;
+        }
+        if (stops.includes(t)) return;
+      }
+    };
+    if (tag === "li") implyClose(["li"], ["ul", "ol"]);
+    else if (tag === "tr") implyClose(["tr"], ["table", "thead", "tbody", "tfoot"]);
+    else if (tag === "td" || tag === "th") implyClose(["td", "th"], ["tr", "table"]);
+    else if (tag === "p")
+      implyClose(["p"], ["blockquote", "li", "td", "th", "section", "article", "div", "body"]);
+    top().children.push(el);
+    if (!VOID_TAGS.has(tag) && !token.endsWith("/>")) stack.push(el);
+  }
+  return root;
+}
+
+// ── entities + escaping ───────────────────────────────────────────────
+
+const NAMED_ENTITIES: Record<string, string> = {
+  amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " ",
+  mdash: "—", ndash: "–", hellip: "…", ldquo: "“", rdquo: "”",
+  lsquo: "‘", rsquo: "’", middot: "·", times: "×", laquo: "«", raquo: "»",
+  copy: "©", reg: "®", trade: "™", deg: "°", sect: "§", para: "¶", bull: "•",
+};
+
+export function decodeEntities(text: string): string {
+  return text.replace(/&(#x?[0-9a-fA-F]+|[a-zA-Z]+);/g, (whole, body: string) => {
+    if (body[0] === "#") {
+      const code = body[1] === "x" || body[1] === "X"
+        ? parseInt(body.slice(2), 16)
+        : parseInt(body.slice(1), 10);
+      return Number.isFinite(code) && code > 0 && code <= 0x10ffff
+        ? String.fromCodePoint(code)
+        : whole;
+    }
+    return NAMED_ENTITIES[body] ?? NAMED_ENTITIES[body.toLowerCase()] ?? whole;
+  });
+}
+
+/** Escape characters that would read as markdown syntax in prose. */
+function escapeMd(text: string): string {
+  return text
+    .replace(/([\\`*_[\]])/g, "\\$1")
+    // `[[` is already dead via `[` escaping, but pipes forge table cells.
+    .replace(/\|/g, "\\|");
+}
+
+// ── serialization ─────────────────────────────────────────────────────
+
+const INLINE_TAGS = new Set([
+  "a", "abbr", "b", "bdi", "bdo", "cite", "code", "data", "dfn", "em", "font",
+  "i", "img", "ins", "kbd", "mark", "q", "s", "samp", "small", "span", "strike",
+  "strong", "sub", "sup", "time", "u", "var", "wbr", "br", "del",
+]);
+
+function isElement(n: HtmlNode): n is HtmlElement {
+  return typeof n !== "string";
+}
+
+/** Inline content of a node: text + inline markup, whitespace collapsed. */
+function inline(nodes: HtmlNode[]): string {
+  let out = "";
+  for (const n of nodes) {
+    if (!isElement(n)) {
+      out += escapeMd(decodeEntities(n)).replace(/\s+/g, " ");
+      continue;
+    }
+    switch (n.tag) {
+      case "br":
+        out += "\n";
+        break;
+      case "img": {
+        const alt = escapeMd(n.attrs.alt ?? "");
+        // WeChat and other lazy-loaders park the real URL in data-src.
+        const src = n.attrs.src || n.attrs["data-src"] || "";
+        if (src) out += `![${alt}](${src})`;
+        break;
+      }
+      case "a": {
+        const text = inline(n.children).trim() || n.attrs.href || "";
+        const href = n.attrs.href ?? "";
+        out += href && !href.startsWith("javascript:") ? `[${text}](${href})` : text;
+        break;
+      }
+      case "strong":
+      case "b": {
+        const t = inline(n.children).trim();
+        out += t ? `**${t}**` : "";
+        break;
+      }
+      case "em":
+      case "i": {
+        const t = inline(n.children).trim();
+        out += t ? `*${t}*` : "";
+        break;
+      }
+      case "del":
+      case "s":
+      case "strike": {
+        const t = inline(n.children).trim();
+        out += t ? `~~${t}~~` : "";
+        break;
+      }
+      case "code":
+      case "kbd":
+      case "samp": {
+        const raw = textOf(n).trim();
+        if (raw) {
+          // A backtick inside inline code needs a longer fence and padding.
+          const fence = raw.includes("`") ? "``" : "`";
+          out += `${fence}${raw}${fence}`;
+        }
+        break;
+      }
+      default:
+        out += inline(n.children);
+    }
+  }
+  return out;
+}
+
+/** Raw text content (entities decoded, no markdown escaping) — for code. */
+function textOf(node: HtmlElement): string {
+  let out = "";
+  for (const n of node.children) {
+    out += isElement(n) ? (n.tag === "br" ? "\n" : textOf(n)) : decodeEntities(n);
+  }
+  return out;
+}
+
+function listItems(el: HtmlElement, ordered: boolean, depth: number): string[] {
+  const items: string[] = [];
+  let i = 1;
+  for (const child of el.children) {
+    if (!isElement(child) || child.tag !== "li") continue;
+    const marker = ordered ? `${i++}.` : "-";
+    // Split the li into its own inline content and nested blocks (sub-lists…).
+    const inlineNodes: HtmlNode[] = [];
+    const blockNodes: HtmlElement[] = [];
+    for (const n of child.children) {
+      if (isElement(n) && !INLINE_TAGS.has(n.tag)) blockNodes.push(n);
+      else inlineNodes.push(n);
+    }
+    const head = inline(inlineNodes).trim();
+    const indent = "  ".repeat(depth);
+    let item = `${indent}${marker} ${head}`;
+    for (const b of blockNodes) {
+      const sub = serializeBlock(b, depth + 1).trimEnd();
+      if (sub) item += `\n${sub}`;
+    }
+    items.push(item);
+  }
+  return items;
+}
+
+function tableToMd(el: HtmlElement): string {
+  const rows: string[][] = [];
+  const walkRows = (node: HtmlElement): void => {
+    for (const child of node.children) {
+      if (!isElement(child)) continue;
+      if (child.tag === "tr") {
+        const cells = child.children
+          .filter(isElement)
+          .filter((c) => c.tag === "td" || c.tag === "th")
+          .map((c) => inline(c.children).trim().replace(/\n/g, " "));
+        if (cells.length) rows.push(cells);
+      } else {
+        walkRows(child);
+      }
+    }
+  };
+  walkRows(el);
+  if (rows.length === 0) return "";
+  const width = Math.max(...rows.map((r) => r.length));
+  const pad = (r: string[]): string[] => [...r, ...Array(width - r.length).fill("")];
+  const line = (r: string[]): string => `| ${pad(r).join(" | ")} |`;
+  const [head, ...body] = rows;
+  return [line(head!), `| ${Array(width).fill("---").join(" | ")} |`, ...body.map(line)].join("\n");
+}
+
+function codeBlock(el: HtmlElement): string {
+  // <pre><code class="language-ts"> is the common convention.
+  const code = el.children.find((n): n is HtmlElement => isElement(n) && n.tag === "code");
+  const cls = (code ?? el).attrs.class ?? "";
+  const lang = /(?:language|lang)-([\w+-]+)/.exec(cls)?.[1] ?? "";
+  const raw = textOf(code ?? el).replace(/^\n/, "").trimEnd();
+  // The body must not be able to terminate its own fence.
+  const fence = /^```/m.test(raw) ? "````" : "```";
+  return `${fence}${lang}\n${raw}\n${fence}`;
+}
+
+function serializeBlock(el: HtmlElement, listDepth: number): string {
+  switch (el.tag) {
+    case "h1": case "h2": case "h3": case "h4": case "h5": case "h6": {
+      const level = Number(el.tag[1]);
+      const t = inline(el.children).trim().replace(/\n/g, " ");
+      return t ? `${"#".repeat(level)} ${t}\n\n` : "";
+    }
+    case "p": {
+      const t = inline(el.children).trim();
+      return t ? `${t}\n\n` : "";
+    }
+    case "ul":
+    case "ol": {
+      const items = listItems(el, el.tag === "ol", listDepth);
+      return items.length ? items.join("\n") + "\n\n" : "";
+    }
+    case "pre":
+      return codeBlock(el) + "\n\n";
+    case "blockquote": {
+      const innerMd = serializeChildren(el.children, 0).trim();
+      if (!innerMd) return "";
+      return innerMd.split("\n").map((l) => (l ? `> ${l}` : ">")).join("\n") + "\n\n";
+    }
+    case "table": {
+      const t = tableToMd(el);
+      return t ? t + "\n\n" : "";
+    }
+    case "hr":
+      return "---\n\n";
+    case "figure": {
+      const body = serializeChildren(el.children, listDepth).trim();
+      return body ? body + "\n\n" : "";
+    }
+    case "figcaption": {
+      const t = inline(el.children).trim();
+      return t ? `*${t}*\n\n` : "";
+    }
+    case "br":
+      return "";
+    default: {
+      // Unknown / container block (div, section, article, main, …): recurse.
+      return serializeChildren(el.children, listDepth);
+    }
+  }
+}
+
+function serializeChildren(nodes: HtmlNode[], listDepth: number): string {
+  let out = "";
+  let inlineRun: HtmlNode[] = [];
+  const flush = (): void => {
+    const t = inline(inlineRun).trim();
+    if (t) out += `${t}\n\n`;
+    inlineRun = [];
+  };
+  for (const n of nodes) {
+    if (!isElement(n) || INLINE_TAGS.has(n.tag)) {
+      inlineRun.push(n);
+    } else {
+      flush();
+      out += serializeBlock(n, listDepth);
+    }
+  }
+  flush();
+  return out;
+}
+
+/** Serialize a parsed element's contents (readability hands us a subtree). */
+export function elementToMarkdown(el: HtmlElement): string {
+  return serializeChildren(el.children, 0)
+    .replace(/\n{3,}/g, "\n\n")
+    .trim();
+}
+
+/** Convert an HTML fragment (or document) to markdown. */
+export function htmlToMarkdown(html: string): string {
+  const root = parseHtml(html);
+  // If there's a <body>, serialize from there; else from the root.
+  const findBody = (el: HtmlElement): HtmlElement | null => {
+    for (const n of el.children) {
+      if (!isElement(n)) continue;
+      if (n.tag === "body") return n;
+      const found = findBody(n);
+      if (found) return found;
+    }
+    return null;
+  };
+  const start = findBody(root) ?? root;
+  return serializeChildren(start.children, 0)
+    .replace(/\n{3,}/g, "\n\n")
+    .trim();
+}
diff --git a/src/kb/ingest/index.ts b/src/kb/ingest/index.ts
new file mode 100644
index 0000000..8fda994
--- /dev/null
+++ b/src/kb/ingest/index.ts
@@ -0,0 +1,202 @@
+/**
+ * `ingestUrl` — the orchestration for "save this link into the KB":
+ *
+ *   adapter routing → fetch (SSRF-guarded) → main-content extraction →
+ *   markdown conversion → provenance frontmatter → dedupe → addSource
+ *
+ * Adapters (K-F: WeChat, Bilibili, YouTube) take over fetch+extract for hosts
+ * whose content isn't reachable as plain article HTML; everything else goes
+ * through the generic readability path. All fetching funnels through
+ * web_fetch's fetchFollowingSafeRedirects — the per-hop private-host check
+ * lives there, and a second fetch path would mean a second SSRF surface
+ * (handoff hard rule).
+ */
+import { fetchFollowingSafeRedirects, assertAllowedUrl } from "../../tools/web_fetch.js";
+import { canonicalUrl, shortHash } from "../slug.js";
+import { addSource, readEntry, type KbEntry } from "../store.js";
+import { elementToMarkdown } from "./html-to-md.js";
+import { extractContent } from "./readability.js";
+import { extractProvenance } from "./provenance.js";
+import { lookupIngested, recordIngested } from "./dedupe.js";
+
+/** What a fetch (generic or adapter) must deliver for the write step. */
+export interface IngestedContent {
+  /** Markdown body. */
+  body: string;
+  title?: string;
+  /** Extra provenance frontmatter beyond url/hash/via (site/author/published/lang…). */
+  extra?: Record<string, string>;
+}
+
+export interface IngestContext {
+  fetchImpl: (url: string) => Promise<Response>;
+  signal?: AbortSignal;
+}
+
+/**
+ * A site adapter. `match` is consulted in order; the first hit owns the URL.
+ * Adapters may fetch multiple resources (APIs, subtitle tracks) but must use
+ * ctx.fetchImpl for every request — see the SSRF note above.
+ */
+export interface IngestAdapter {
+  name: string;
+  match(url: URL): boolean;
+  fetch(url: URL, ctx: IngestContext): Promise<IngestedContent>;
+}
+
+/** Populated in K-F (wechat / bilibili / youtube). Order matters. */
+export const ADAPTERS: IngestAdapter[] = [];
+
+export interface IngestOptions {
+  title?: string;
+  tags?: string[];
+  /** Re-ingest even if this URL was captured before (new entry + supersedes). */
+  force?: boolean;
+  signal?: AbortSignal;
+  /** Test seam; defaults to the SSRF-guarded fetch. */
+  fetchImpl?: (url: string) => Promise<Response>;
+}
+
+export interface IngestResult {
+  entry: KbEntry;
+  /** True when an existing capture was returned instead of a new fetch. */
+  deduped: boolean;
+  /** Adapter that handled the URL, or "generic". */
+  via: string;
+}
+
+const MAX_HTML_BYTES = 2_000_000;
+/** Below this many characters of markdown, an extraction "worked" but captured nothing. */
+const MIN_BODY_CHARS = 80;
+
+export async function ingestUrl(rawUrl: string, opts: IngestOptions = {}): Promise<IngestResult> {
+  let url: URL;
+  try {
+    url = new URL(rawUrl.trim());
+  } catch {
+    throw new Error(`not a valid URL: ${rawUrl}`);
+  }
+  // Reject private/loopback targets up front — before dedupe, before adapters,
+  // and independently of the per-hop check inside the fetcher.
+  assertAllowedUrl(url);
+
+  const canonical = canonicalUrl(url.toString());
+  const hash = shortHash(canonical);
+
+  if (!opts.force) {
+    const existingSlug = await lookupIngested(hash);
+    if (existingSlug) {
+      const existing = await readEntry("sources", existingSlug);
+      // A stale ledger entry (source deleted by the user) falls through to a
+      // fresh ingest rather than erroring.
+      if (existing) return { entry: existing, deduped: true, via: "ledger" };
+    }
+  }
+
+  const ctx: IngestContext = {
+    fetchImpl:
+      opts.fetchImpl ?? ((u: string) => fetchFollowingSafeRedirects(u, opts.signal)),
+    signal: opts.signal,
+  };
+
+  const adapter = ADAPTERS.find((a) => a.match(url));
+  const content = adapter ? await adapter.fetch(url, ctx) : await genericFetch(url, ctx);
+  const via = adapter?.name ?? "generic";
+
+  const body = content.body.trim();
+  if (body.length < MIN_BODY_CHARS) {
+    throw new Error(
+      `could not extract readable content from ${url.hostname} — ` +
+        `the page may be login-walled or script-rendered. ` +
+        `You can paste the text directly with kb_add instead.`,
+    );
+  }
+
+  const supersedes = opts.force ? await lookupIngested(hash) : null;
+  const extra: Record<string, string> = {
+    url: canonical,
+    hash,
+    via,
+    ...(content.extra ?? {}),
+    ...(supersedes ? { supersedes } : {}),
+  };
+
+  const entry = await addSource({
+    title: (opts.title ?? content.title ?? url.hostname).trim() || url.hostname,
+    body,
+    tags: opts.tags,
+    origin: "web",
+    extra,
+  });
+  await recordIngested(hash, entry.slug);
+  return { entry, deduped: false, via };
+}
+
+/** Read a response body as UTF-8, stopping once `cap` bytes have been buffered. */
+async function readBodyCapped(res: Response, cap: number): Promise<string> {
+  const reader = res.body?.getReader();
+  if (!reader) return (await res.text()).slice(0, cap);
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      const room = cap - total;
+      chunks.push(value.length > room ? value.subarray(0, room) : value);
+      total += value.length;
+      if (total >= cap) break; // stop pulling — a hostile server can't grow the buffer past cap
+    }
+  } finally {
+    await reader.cancel().catch(() => {});
+  }
+  const buf = new Uint8Array(Math.min(total, cap));
+  let off = 0;
+  for (const c of chunks) {
+    buf.set(c, off);
+    off += c.length;
+  }
+  return new TextDecoder().decode(buf);
+}
+
+/** The default path: fetch HTML, pick the content subtree, convert, annotate. */
+async function genericFetch(url: URL, ctx: IngestContext): Promise<IngestedContent> {
+  const res = await ctx.fetchImpl(url.toString());
+  if (!res.ok) {
+    throw new Error(`fetch failed: HTTP ${res.status} ${res.statusText} for ${url}`);
+  }
+  const type = res.headers.get("content-type") ?? "";
+  // Reject unsupported types from the header before buffering — no point pulling
+  // down a video/PDF just to reject it. Empty type is allowed (treated as HTML).
+  if (type && !/html|xml|text\/(?:plain|markdown)/i.test(type)) {
+    await res.body?.cancel().catch(() => {});
+    throw new Error(`unsupported content-type "${type}" — only HTML and text pages can be ingested`);
+  }
+  // Reject an oversized body up front when the server declares its length, and
+  // cap the actual read so a chunked/undeclared response can't exhaust memory
+  // (ingest runs unattended once the daily brief lands).
+  const declared = Number(res.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > MAX_HTML_BYTES) {
+    await res.body?.cancel().catch(() => {});
+    throw new Error(`page too large: ${declared} bytes exceeds the ${MAX_HTML_BYTES}-byte cap`);
+  }
+  const raw = await readBodyCapped(res, MAX_HTML_BYTES);
+
+  // Plain text / markdown responses skip the HTML pipeline entirely.
+  if (/text\/(?:plain|markdown)/i.test(type)) {
+    return { body: raw.trim() };
+  }
+
+  const prov = extractProvenance(raw);
+  const { content } = extractContent(raw);
+  const body = elementToMarkdown(content);
+
+  const extra: Record<string, string> = {};
+  if (prov.site) extra.site = prov.site;
+  if (prov.author) extra.author = prov.author;
+  if (prov.published) extra.published = prov.published;
+  if (prov.lang) extra.lang = prov.lang;
+
+  return { body, title: prov.title, extra };
+}
diff --git a/src/kb/ingest/ingest.test.ts b/src/kb/ingest/ingest.test.ts
new file mode 100644
index 0000000..24f72a5
--- /dev/null
+++ b/src/kb/ingest/ingest.test.ts
@@ -0,0 +1,186 @@
+import { test, describe, after } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TMP = mkdtempSync(path.join(os.tmpdir(), "lisa-kb-ingest-"));
+process.env.LISA_HOME = TMP;
+process.env.LISA_KB_NO_GIT = "1";
+
+const { ingestUrl } = await import("./index.js");
+const { extractContent } = await import("./readability.js");
+const { elementToMarkdown } = await import("./html-to-md.js");
+const { extractProvenance } = await import("./provenance.js");
+const { readLedger, ingestLedgerFile } = await import("./dedupe.js");
+const store = await import("../store.js");
+
+after(() => rmSync(TMP, { recursive: true, force: true }));
+
+// ── offline fixtures (handoff rule: never hit the network in tests) ───
+
+const ARTICLE_HTML = `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+  <title>Fallback title</title>
+  <meta property="og:title" content="向量检索实践">
+  <meta property="og:site_name" content="Example Blog">
+  <meta property="article:published_time" content="2026-07-01T08:00:00Z">
+  <link rel="canonical" href="https://blog.example.com/vector-search">
+  <script type="application/ld+json">{"@type":"BlogPosting","headline":"向量检索实践","author":{"@type":"Person","name":"Ada"}}</script>
+</head>
+<body>
+  <nav class="navbar"><a href="/">Home</a><a href="/about">About</a><a href="/tags">Tags</a></nav>
+  <div class="sidebar"><a href="/a">l1</a><a href="/b">l2</a><a href="/c">l3</a><a href="/d">l4</a></div>
+  <article class="post-content">
+    <h1>向量检索实践</h1>
+    <p>${"正文第一段，讲 TF-IDF 与 bigram 的取舍。".repeat(4)}</p>
+    <p>${"第二段介绍倒排索引的构建流程与缓存策略。".repeat(4)}</p>
+    <pre><code class="language-ts">const idx = build(docs);</code></pre>
+  </article>
+  <footer class="footer"><p>© 2026 Example · <a href="/rss">RSS</a> · <a href="/privacy">Privacy</a></p></footer>
+</body>
+</html>`;
+
+const htmlResponse = (body: string, type = "text/html; charset=utf-8"): Response =>
+  new Response(body, { status: 200, headers: { "content-type": type } });
+
+function stubFetch(map: Record<string, Response | (() => Response)>) {
+  const calls: string[] = [];
+  const impl = async (url: string): Promise<Response> => {
+    calls.push(url);
+    const hit = map[url];
+    if (!hit) throw new Error(`unexpected fetch: ${url}`);
+    return typeof hit === "function" ? hit() : hit.clone();
+  };
+  return { impl, calls };
+}
+
+describe("readability + provenance (offline fixtures)", () => {
+  test("extracts the article subtree, dropping nav/sidebar/footer", () => {
+    const { content } = extractContent(ARTICLE_HTML);
+    const md = elementToMarkdown(content);
+    assert.match(md, /TF-IDF/);
+    assert.match(md, /```ts/);
+    assert.doesNotMatch(md, /Privacy|About|Home/, "chrome removed");
+  });
+
+  test("falls back to body when no candidate scores", () => {
+    const { content } = extractContent("<html><body><p>tiny page</p></body></html>");
+    assert.equal(elementToMarkdown(content), "tiny page");
+  });
+
+  test("provenance: og/JSON-LD/link/lang all land", () => {
+    const p = extractProvenance(ARTICLE_HTML);
+    assert.equal(p.title, "向量检索实践");
+    assert.equal(p.site, "Example Blog");
+    assert.equal(p.author, "Ada");
+    assert.equal(p.published, "2026-07-01T08:00:00Z");
+    assert.equal(p.lang, "zh-CN");
+    assert.equal(p.canonical, "https://blog.example.com/vector-search");
+  });
+
+  test("provenance falls back to <title> and survives malformed JSON-LD", () => {
+    const p = extractProvenance(
+      `<html><head><title> Plain &amp; Simple </title><script type="application/ld+json">{"@type":"NewsArticle", broken</script></head></html>`,
+    );
+    assert.equal(p.title, "Plain & Simple");
+  });
+});
+
+describe("ingestUrl (stubbed fetch)", () => {
+  const URL_A = "https://blog.example.com/vector-search?utm_source=tw";
+
+  test("writes a provenance-stamped Layer-1 source", async () => {
+    const { impl } = stubFetch({
+      "https://blog.example.com/vector-search?utm_source=tw": htmlResponse(ARTICLE_HTML),
+    });
+    const res = await ingestUrl(URL_A, { fetchImpl: impl, tags: ["search"] });
+    assert.equal(res.deduped, false);
+    assert.equal(res.via, "generic");
+    assert.equal(res.entry.title, "向量检索实践");
+    assert.equal(res.entry.origin, "web");
+    // canonicalUrl strips the utm_* param before hashing/storing.
+    assert.equal(res.entry.extra?.url, "https://blog.example.com/vector-search");
+    assert.match(res.entry.extra?.hash ?? "", /^[0-9a-f]{8}$/);
+    assert.equal(res.entry.extra?.site, "Example Blog");
+    assert.equal(res.entry.extra?.author, "Ada");
+    assert.equal(res.entry.extra?.lang, "zh-CN");
+    assert.match(res.entry.body, /TF-IDF/);
+  });
+
+  test("same URL (even with different tracking params) dedupes to the existing slug", async () => {
+    const { impl, calls } = stubFetch({});
+    const res = await ingestUrl("https://blog.example.com/vector-search?utm_medium=x", {
+      fetchImpl: impl,
+    });
+    assert.equal(res.deduped, true);
+    assert.equal(res.entry.title, "向量检索实践");
+    assert.equal(calls.length, 0, "no network on dedupe hit");
+  });
+
+  test("force=true re-ingests and records supersedes", async () => {
+    const { impl } = stubFetch({
+      "https://blog.example.com/vector-search": htmlResponse(ARTICLE_HTML),
+    });
+    const first = await ingestUrl(URL_A, { fetchImpl: async () => htmlResponse(ARTICLE_HTML) });
+    const res = await ingestUrl("https://blog.example.com/vector-search", {
+      fetchImpl: impl,
+      force: true,
+    });
+    assert.equal(res.deduped, false);
+    assert.equal(res.entry.extra?.supersedes, first.entry.slug);
+    // The ledger now points at the fresh capture.
+    const again = await ingestUrl(URL_A, { fetchImpl: impl });
+    assert.equal(again.entry.slug, res.entry.slug);
+  });
+
+  test("private/loopback URLs are rejected before any fetch", async () => {
+    const { impl, calls } = stubFetch({});
+    for (const bad of ["http://127.0.0.1/x", "http://192.168.1.4/x", "http://localhost:8000/"]) {
+      await assert.rejects(() => ingestUrl(bad, { fetchImpl: impl }), /private|loopback/i);
+    }
+    assert.equal(calls.length, 0);
+  });
+
+  test("non-HTML content types are refused; text/plain is captured as-is", async () => {
+    await assert.rejects(
+      () =>
+        ingestUrl("https://cdn.example.com/app.bin", {
+          fetchImpl: async () => htmlResponse("binary", "application/octet-stream"),
+        }),
+      /unsupported content-type/,
+    );
+    const txt = await ingestUrl("https://cdn.example.com/notes.txt", {
+      fetchImpl: async () =>
+        htmlResponse("plain text notes, comfortably long enough to pass the minimum body length gate for a capture.", "text/plain"),
+      title: "Notes",
+    });
+    assert.match(txt.entry.body, /plain text notes/);
+  });
+
+  test("pages with no extractable content raise a helpful error", async () => {
+    await assert.rejects(
+      () =>
+        ingestUrl("https://spa.example.com/app", {
+          fetchImpl: async () => htmlResponse("<html><body><div id=root></div></body></html>"),
+        }),
+      /could not extract readable content/,
+    );
+  });
+
+  test("a corrupt ledger is rebuilt from the sources' hash frontmatter", async () => {
+    writeFileSync(ingestLedgerFile(), "{not json");
+    const ledger = await readLedger();
+    const entries = await store.listFullEntries("sources");
+    const hashes = new Set(entries.map((e) => e.extra?.hash).filter(Boolean));
+    for (const h of hashes) {
+      assert.ok(ledger[h as string], `hash ${h} recovered`);
+    }
+    // And dedupe works again without a fetch.
+    const { impl, calls } = stubFetch({});
+    const res = await ingestUrl(URL_A, { fetchImpl: impl });
+    assert.equal(res.deduped, true);
+    assert.equal(calls.length, 0);
+  });
+});
diff --git a/src/kb/ingest/provenance.ts b/src/kb/ingest/provenance.ts
new file mode 100644
index 0000000..d351317
--- /dev/null
+++ b/src/kb/ingest/provenance.ts
@@ -0,0 +1,120 @@
+/**
+ * Provenance metadata for an ingested page — the frontmatter that makes a
+ * Layer-1 capture citeable later ("where did this come from, who wrote it,
+ * when"). Sources checked in rough order of reliability: OpenGraph /
+ * article:* meta, JSON-LD (Article types), then plain <title> / <html lang> /
+ * rel=canonical. All fields optional; absence is recorded by omission.
+ */
+import { decodeEntities } from "./html-to-md.js";
+
+export interface Provenance {
+  title?: string;
+  site?: string;
+  author?: string;
+  /** ISO date (as found; not re-validated beyond a sanity parse). */
+  published?: string;
+  lang?: string;
+  canonical?: string;
+}
+
+/** All <meta> name/property → content pairs, lowercased keys. */
+function metaTags(html: string): Map<string, string> {
+  const out = new Map<string, string>();
+  for (const m of html.matchAll(/<meta\s+((?:"[^"]*"|'[^']*'|[^"'>])*)>/gi)) {
+    const attrs = m[1]!;
+    const key =
+      /(?:name|property|itemprop)\s*=\s*["']?([^"'\s>]+)/i.exec(attrs)?.[1]?.toLowerCase();
+    const content = /content\s*=\s*(?:"([^"]*)"|'([^']*)')/i.exec(attrs);
+    const val = content?.[1] ?? content?.[2];
+    if (key && val && !out.has(key)) out.set(key, decodeEntities(val).trim());
+  }
+  return out;
+}
+
+/** First JSON-LD block of an Article-ish @type, parsed leniently. */
+function articleJsonLd(html: string): Record<string, unknown> | null {
+  const ARTICLE_TYPES = /"@type"\s*:\s*"(?:News|Blog|Scholarly|Tech|Report(?:age)?)?(?:Article|Posting)"/;
+  for (const m of html.matchAll(
+    /<script[^>]*type\s*=\s*["']application\/ld\+json["'][^>]*>([\s\S]*?)<\/script>/gi,
+  )) {
+    const raw = m[1]!.trim();
+    if (!ARTICLE_TYPES.test(raw)) continue;
+    try {
+      const parsed = JSON.parse(raw) as unknown;
+      const list = Array.isArray(parsed)
+        ? parsed
+        : [parsed, ...(((parsed as Record<string, unknown>)["@graph"] as unknown[]) ?? [])];
+      for (const item of list) {
+        const obj = item as Record<string, unknown>;
+        if (typeof obj?.["@type"] === "string" && /Article|Posting/.test(obj["@type"])) {
+          return obj;
+        }
+      }
+    } catch {
+      // malformed JSON-LD is routine — ignore the block
+    }
+  }
+  return null;
+}
+
+function jsonLdAuthor(obj: Record<string, unknown>): string | undefined {
+  const a = obj.author;
+  if (typeof a === "string") return a;
+  if (Array.isArray(a)) {
+    const names = a
+      .map((x) => (typeof x === "string" ? x : (x as Record<string, unknown>)?.name))
+      .filter((n): n is string => typeof n === "string" && n.length > 0);
+    if (names.length) return names.join(", ");
+  }
+  if (a && typeof a === "object") {
+    const name = (a as Record<string, unknown>).name;
+    if (typeof name === "string") return name;
+  }
+  return undefined;
+}
+
+function sane(val: string | undefined, max = 300): string | undefined {
+  const v = val?.trim();
+  return v ? v.slice(0, max) : undefined;
+}
+
+/** A published date is only kept if it parses to a plausible time. */
+function saneDate(val: string | undefined): string | undefined {
+  const v = sane(val, 40);
+  if (!v) return undefined;
+  const t = Date.parse(v);
+  return Number.isFinite(t) && t > Date.parse("1990-01-01") ? v : undefined;
+}
+
+export function extractProvenance(html: string): Provenance {
+  const meta = metaTags(html);
+  const ld = articleJsonLd(html);
+
+  const titleTag = /<title[^>]*>([\s\S]*?)<\/title>/i.exec(html)?.[1];
+  const canonical =
+    /<link\s+[^>]*rel\s*=\s*["']canonical["'][^>]*href\s*=\s*["']([^"']+)["']/i.exec(html)?.[1] ??
+    /<link\s+[^>]*href\s*=\s*["']([^"']+)["'][^>]*rel\s*=\s*["']canonical["']/i.exec(html)?.[1];
+  const lang = /<html[^>]*\slang\s*=\s*["']?([a-zA-Z-]+)/i.exec(html)?.[1];
+
+  return {
+    title: sane(
+      meta.get("og:title") ??
+        (typeof ld?.headline === "string" ? ld.headline : undefined) ??
+        meta.get("twitter:title") ??
+        (titleTag ? decodeEntities(titleTag).trim() : undefined),
+    ),
+    site: sane(meta.get("og:site_name")),
+    author: sane(
+      (ld ? jsonLdAuthor(ld) : undefined) ??
+        meta.get("article:author") ??
+        meta.get("author"),
+    ),
+    published: saneDate(
+      meta.get("article:published_time") ??
+        (typeof ld?.datePublished === "string" ? ld.datePublished : undefined) ??
+        meta.get("og:article:published_time"),
+    ),
+    lang: sane(lang, 20),
+    canonical: sane(canonical, 2000),
+  };
+}
diff --git a/src/kb/ingest/readability.ts b/src/kb/ingest/readability.ts
new file mode 100644
index 0000000..7ad0601
--- /dev/null
+++ b/src/kb/ingest/readability.ts
@@ -0,0 +1,118 @@
+/**
+ * Main-content extraction — a deliberately small Readability: score candidate
+ * container elements on text mass, paragraph count, link density, and
+ * class/id hints, then keep the best subtree. The full Readability algorithm
+ * earns its complexity on the long tail of weird pages; an ingest pipeline
+ * that FALLS BACK TO <body> when unsure doesn't need the tail — a slightly
+ * noisy capture is still searchable and distillable, a wrongly-clipped one
+ * loses content.
+ *
+ * Works on the html-to-md.ts tree so there is exactly one HTML parser in the
+ * pipeline.
+ */
+import { parseHtml, type HtmlElement, type HtmlNode } from "./html-to-md.js";
+
+const CANDIDATE_TAGS = new Set(["article", "main", "section", "div", "td", "body"]);
+
+const POSITIVE_HINT = /article|content|post|entry|main|body|text|story|blog/i;
+const NEGATIVE_HINT =
+  /\bnav\b|navbar|footer|comment|sidebar|side-bar|menu|share|social|related|promo|banner|breadcrumb|masthead|advert|\bad\b|ad-|sponsor|widget|meta|pager|pagination/i;
+
+function isElement(n: HtmlNode): n is HtmlElement {
+  return typeof n !== "string";
+}
+
+function textLength(el: HtmlElement): number {
+  let len = 0;
+  for (const n of el.children) {
+    len += isElement(n) ? textLength(n) : n.replace(/\s+/g, " ").trim().length;
+  }
+  return len;
+}
+
+function countTag(el: HtmlElement, tag: string): number {
+  let count = 0;
+  for (const n of el.children) {
+    if (!isElement(n)) continue;
+    if (n.tag === tag) count++;
+    count += countTag(n, tag);
+  }
+  return count;
+}
+
+function linkTextLength(el: HtmlElement): number {
+  let len = 0;
+  for (const n of el.children) {
+    if (!isElement(n)) continue;
+    len += n.tag === "a" ? textLength(n) : linkTextLength(n);
+  }
+  return len;
+}
+
+function hintOf(el: HtmlElement): string {
+  return `${el.attrs.class ?? ""} ${el.attrs.id ?? ""}`;
+}
+
+interface Candidate {
+  el: HtmlElement;
+  score: number;
+}
+
+function collectCandidates(el: HtmlElement, out: Candidate[]): void {
+  for (const n of el.children) {
+    if (!isElement(n)) continue;
+    if (CANDIDATE_TAGS.has(n.tag)) {
+      const text = textLength(n);
+      if (text >= 140) {
+        const links = linkTextLength(n);
+        const linkDensity = text > 0 ? links / text : 1;
+        const hint = hintOf(n);
+        let score = Math.min(text, 8_000) / 40 + countTag(n, "p") * 25;
+        if (n.tag === "article" || n.tag === "main") score += 120;
+        if (POSITIVE_HINT.test(hint)) score += 100;
+        if (NEGATIVE_HINT.test(hint)) score -= 220;
+        // Link farms (navs, "related posts") are mostly anchor text.
+        score *= 1 - Math.min(linkDensity, 0.9);
+        out.push({ el: n, score });
+      }
+    }
+    collectCandidates(n, out);
+  }
+}
+
+/**
+ * The element to hand to the markdown serializer. Falls back to <body> (or
+ * the whole tree) when nothing scores clearly.
+ */
+export function extractContentRoot(root: HtmlElement): HtmlElement {
+  const candidates: Candidate[] = [];
+  collectCandidates(root, candidates);
+  candidates.sort((a, b) => b.score - a.score);
+  const best = candidates[0];
+  const body = findTag(root, "body");
+  // "Clearly better than just taking everything": beat a floor AND carry a
+  // meaningful share of the page's text (clipping to a tiny subtree loses the
+  // article; noise is recoverable, missing text is not).
+  if (best && best.score >= 60 && body) {
+    const share = textLength(best.el) / Math.max(1, textLength(body));
+    if (share >= 0.2) return best.el;
+  }
+  if (best && best.score >= 60 && !body) return best.el;
+  return body ?? root;
+}
+
+export function findTag(el: HtmlElement, tag: string): HtmlElement | null {
+  for (const n of el.children) {
+    if (!isElement(n)) continue;
+    if (n.tag === tag) return n;
+    const found = findTag(n, tag);
+    if (found) return found;
+  }
+  return null;
+}
+
+/** Convenience: parse + pick in one step (used by ingest and tests). */
+export function extractContent(html: string): { root: HtmlElement; content: HtmlElement } {
+  const root = parseHtml(html);
+  return { root, content: extractContentRoot(root) };
+}
diff --git a/src/kb/tool.ts b/src/kb/tool.ts
index 090ea2b..25dce57 100644
--- a/src/kb/tool.ts
+++ b/src/kb/tool.ts
@@ -12,6 +12,7 @@ import { addSource, listEntries, listFullEntries, readEntry, writeWiki } from ".
 import { buildGraph, kbKey, resolveRef } from "./links.js";
 import { autolink } from "./autolink.js";
 import { kbSlug } from "./slug.js";
+import { ingestUrl } from "./ingest/index.js";
 import type { KbLayer } from "./paths.js";
 
 const kbSearch: ToolDefinition<{ query: string; limit?: number }, string> = {
@@ -227,6 +228,48 @@ const kbWrite: ToolDefinition<
   },
 };
 
+const kbIngest: ToolDefinition<
+  { url: string; title?: string; tags?: string[]; force?: boolean },
+  string
+> = {
+  name: "kb_ingest",
+  description:
+    "Save a web page into the knowledge base as a SOURCE (Layer 1): fetches the URL, extracts the " +
+    "main content, converts it to markdown, and records provenance (site/author/date) in frontmatter. " +
+    "A URL that was already ingested returns the existing entry — pass force=true to capture a fresh " +
+    "copy (recorded as superseding the old one). For paywalled/script-only pages that fail, ask the " +
+    "user to paste the text and use kb_add.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      url: { type: "string", description: "Absolute http(s) URL" },
+      title: { type: "string", description: "Override the extracted title" },
+      tags: { type: "array", items: { type: "string" } },
+      force: { type: "boolean", description: "Re-ingest even if this URL was captured before" },
+    },
+    required: ["url"],
+  },
+  async execute(input, ctx) {
+    const res = await ingestUrl(input.url, {
+      title: input.title,
+      tags: input.tags,
+      force: input.force,
+      signal: ctx?.signal,
+    });
+    if (res.deduped) {
+      return `Already in the knowledge base: "${res.entry.title}" (sources/${res.entry.slug}). Pass force=true to re-capture.`;
+    }
+    const meta = [
+      res.entry.extra?.site,
+      res.entry.extra?.author,
+      res.entry.extra?.published,
+    ]
+      .filter(Boolean)
+      .join(" · ");
+    return `Ingested "${res.entry.title}" (sources/${res.entry.slug}, via ${res.via})${meta ? ` — ${meta}` : ""}.`;
+  },
+};
+
 /** All KB tools (read tools first). Registered in tools/registry.ts. */
 export const kbTools: ToolDefinition[] = [
   kbSearch as ToolDefinition,
@@ -235,4 +278,5 @@ export const kbTools: ToolDefinition[] = [
   kbLinks as ToolDefinition,
   kbAdd as ToolDefinition,
   kbWrite as ToolDefinition,
+  kbIngest as ToolDefinition,
 ];
diff --git a/src/tools/registry.ts b/src/tools/registry.ts
index dd66f82..8268e5f 100644
--- a/src/tools/registry.ts
+++ b/src/tools/registry.ts
@@ -204,6 +204,11 @@ export const REMOTE_BLOCKED_TOOL_NAMES = new Set([
   // exactly where Lisa tends the wiki (kb_add/kb_write are path-jailed to ~/.lisa/kb).
   "kb_add",
   "kb_write",
+  // kb_ingest additionally FETCHES a remote URL of the sender's choosing before
+  // writing — doubly off-limits for remote surfaces. Deliberately NOT
+  // autonomous-blocked: K-I constrains autonomous ingestion to the feeds.json
+  // domain watchlist instead of a blanket ban.
+  "kb_ingest",
 ]);
 
 export function remoteSafeSubset(tools: ToolDefinition[]): ToolDefinition[] {