v7.26.0

Paired release with engine-service-v0.1.93 (tagged on 9edad9ea6;
REQUIRED_ENGINE_VERSION bumped in this release). Zero Liquibase changesets
in the engine delta and an all-[additive] wire ledger, so the engine
deployed BEFORE this release's tag (nexus-1emxn choreography (a)) — cloud
was live and gated on v0.1.93 before any client could require it.

Added

• nx catalog export / nx catalog import — the recovery bundle
  (nexus-xn3fr, GH #1419 Issue 9). One paired verb carries the catalog
  link graph plus store_put-origin knowledge content across a full
  reinstall: source_uri identity, no embeddings in the bundle, idempotent
  re-import, fail-loud summary. Imports re-derive collection identity
  across an embedding-mode change (the recorded model-bearing name is
  reduced to its mode-independent base and resolved under the target), and
  chroma-URI link endpoints re-derive the same way. Vanished chash: spans
  are stripped and counted rather than failing the link. TTLs are not
  carried; see docs/migration-runbook.md.

Fixed

• Engine v0.1.93: serving hnsw.ef_search floor (nexus-4ktfm).
  SET LOCAL hnsw.ef_search = clamp(max(200, n_results), 1, 1000) on all
  five vector-ranked paths ends shared-HNSW cross-tenant crowd-out: all ten
  crowded gate queries recovered to Jaccard 1.000 (rdr-analytical-003
  0.538 → 1.000, settling nexus-x9mly as crowding, not ranking). Floor is
  env-tunable via NX_HNSW_EF_SEARCH, validated at engine boot. The
  measured cost — plain /v1/vectors/search p95 rising to the new steady
  state — is held-by-decision at floor 200 (hybrid p95 unaffected).
• Engine v0.1.93: budget-bounded 429 absorption with honest Retry-After
  (nexus-99r7y). Voyage rate-limit 429s are absorbed under a shared
  20-second per-embed-request deadline instead of retrying unbounded;
  VectorHandler and CatalogHandler surface an honest 429 + Retry-After
  rather than a 5xx when the budget exhausts.
• Client: edge/WAF refusals surface structured errors (nexus-cmzib).
  An edge or WAF refusal on T1/T2/T3 paths now raises a structured,
  actionable error instead of leaking raw HTML into tracebacks; the cloud
  gate's leg E pins the passthrough as a regression tripwire.
• T2: 401 remint carve-out on claim_batch (nexus-ig3qe). A 401 on the
  aspect worker's claim path remints the data token and retries once —
  the carve-out is 401-only; transport-shaped failures stay single-attempt
  (nexus-tjvgf).
• DT: web-archive boilerplate stripped in the --dt-content writer
  (nexus-mok9x). Navigation chrome, cookie banners, and footers no longer
  pollute dt_content chunks.
• Release machinery: PyPI propagation window closed (nexus-r433b).
  release.yml waits on the simple index with --require-served, the
  .mcpb bootstrap resolve-retries, and the fresh-install MVV
  wait-and-retries — a fresh install seconds after publish no longer races
  the index.

Paired release with engine-service-v0.1.92 (tagged on 14bd80442;
REQUIRED_ENGINE_VERSION bumped in this release). The engine delta carries
zero Liquibase changesets, and every wire-ledger entry was [additive], so
the engine deployed BEFORE this release's tag (nexus-1emxn choreography (a))
— no refusal window can open.

Added

• nx self install --extras <name> (nexus-pffc4). Add an extra (e.g.
  local) to an existing generation install: repeatable / comma-separated,
  PEP 685-normalized dedupe against the install receipt, MERGE never replace,
  junk names refused at the CLI; off-generation installs get a refusal naming
  the right next step for each non-generation shape. The degraded-bge and
  MinerU health remedies now route through it.

Fixed

• ONNX model root on HOME-override boxes (nexus-ogccs — closes 7.24.1's
  known issue). The engine resolves its ONNX model root
  NX_ONNX_MODEL_DIR → HOME → passwd user.home (OnnxModelPaths,
  engine-service-v0.1.92), and the client supervisor pins the resolved root
  in the engine spawn env — a HOME override no longer yields a green
  nx init followed by an engine crash at first boot.
• schema_migration_complete reports the walk's real counts
  (nexus-x0s52). new_changesets / reexecuted_changesets /
  pending_at_start replace applied_changesets, which logged the
  pre-update pending count (a 12x overstatement on the v0.1.86 fork walk).
  The old field name is deliberately gone so stale greps fail loud rather
  than silently matching new semantics.
• purge-trash documentation caught up to catalog-026 (nexus-kcm6c).
  Both reported counts honor --older-than-days — row, manifest, and
  chunks survive the grace window together. Seven client surfaces that
  still documented the retired catalog-003 semantics are rewritten; the
  engine counter was never wrong.
• pytest collection no longer depends on the network (nexus-v460j).
  Engine-binary resolution is lazy under an import-time ambient env
  snapshot; CI's test-lint job gained the pinned-PG-bundle cache step it
  never had.
• Bead-close review gate is T1-only (nexus-fgekf, plugin surface). The
  T2 memory-marker leg is retired: a durable marker no longer satisfies a
  close in a session that performed no review. T1 reachable-and-empty
  denies; T1 unreachable is a loud allow with verification=unverified.
  Live once this release's plugin pin is installed.

Infrastructure

• Paired-release choreography hardened (nexus-1emxn). Wire-ledger
  entries lead with an [additive] / [not-additive] direction-safety
  token (anchored parser, contradiction fails safe, lint requires the
  reasoning prose); an all-additive Unshipped section authorizes deploying
  the engine before the client tag by name. Release skill Step 9 arming
  gate + Step 12 exit-code table; the mechanical arming attestation for
  non-additive pairings is tracked as nexus-h0fo3.
• RDR-197 closed (nexus-a2wmi). The plugin-only release channel is
  delivered: first real cut shipped (plugin-v7.24.0-1), rehearsal mandatory
  before every cut, runbook drift fixed in docs/contributing.md.
• The raw-SQL gate sanctions the x0s52 Liquibase-connection reads
  (databasechangelog counts + now() on Liquibase's own connection,
  outside jOOQ codegen — the gate's designed escape hatch).