v7.77.1

Pairs with engine-service-v0.1.160 (REQUIRED_ENGINE_VERSION moves from 0.1.159). Fixes only. nx daemon service stop no longer signals unrelated processes, nx daemon service start reports an engine that refuses to start, and indexing many PDFs no longer grows by a model load per file. The engine carries three fixes (a stop during a slow model load, ONNX threads under a CPU limit, Connection: close on a large unread body) and no schema change or wire change.

Fixed

• nx daemon service stop no longer signals processes that only mention the start command (nexus-mqfu0). On an install using the default config directory, stop sent SIGTERM to every process whose command line contained daemon service start and no --config-dir: the shell running nx daemon service stop && nx daemon service start, an ssh session, watch, an editor. The one-line restart killed its own shell with exit 143 before start ran, and the service stayed down. Stop now matches a flagless command line only when an nx entry point stands directly before the verb, and neither it nor the restart that follows an upgrade signals the process running it or that process's ancestors. A supervisor from a unit installed before units carried --config-dir, whose nx path contains a space, is no longer found in the process table and is stopped through its lease.
• nx daemon service start reports an engine that refuses to start when it happens, with the engine's reason (nexus-qk6p6). An engine setting outside its range (for example NX_SEARCH_PCI_SWEEP_SECONDS=10, valid 60..3600) makes the engine exit within a second, and the supervisor exits with it. The start command only polled for the service's lease, so it waited the full 60 seconds and then named logs/storage_service.log, which does not hold the reason. It now checks whether the supervisor is still running on each poll and fails as soon as it has exited, printing the engine's last ERROR line and the path of the engine log that holds it (logs/storage_service_native.log, or storage_service_jar.log for a jar launch). The supervisor's own error, which --foreground prints and storage_service.log records, carries the same line. When the supervisor reported its own error (PostgreSQL did not start, no engine binary), the start command prints that; credential values in either line are redacted. The 60-second timeout message, the migration-failed and migration-stalled errors and nx init's autostart not-ready message name the engine log as well. Any engine exit during start is reported this way, an out-of-range setting among them.
• The restart after a quiesced binary replacement no longer fails on an import (nexus-qk6p6). replace_quiesce.default_ops().start_service imported ensure_storage_supervisor from a module that does not define it, so the real restart raised ImportError; the tests all injected their own operations.
• A file deleted or renamed during an index run is no longer recorded as an extraction failure (nexus-233d3). The code and prose indexers reported a file that the walk listed and a commit then removed as cannot decode as UTF-8 text (FileNotFoundError): they fence-failed its document and wrote an index_failures row, and nx doctor failed on that row until it aged out or was cleared. Such a file is now skipped, and catalog housekeeping removes its document like any deleted file. A file that exists and cannot be read for another reason is still a recorded failure, and its reason now reads cannot read file (<error>). Rows already recorded stay until nx index failures --clear --run-id <id>.
• nx catalog owners --census can deactivate an owner whose root is not a git repository (nexus-0rjbm). An index run pointed at a directory of repositories instead of one of them registered that directory as an owner. nx doctor's git-hooks check then warned could not check (Not a git repository) on every run, and the census classed the root healthy because the directory exists and has content, so nothing could remove it. The census now has a not_a_repository bucket for a root with content that is not inside a git work tree. Its owners are eligible for --execute deactivate under the same gates as a vanished root: zero live documents, and a re-check immediately before the write. The doctor warning names the census for a catalog owner in that state.
• nx daemon restart-stale no longer reports started pid True for the aspect worker (nexus-g9kjz). The spawner returns whether a worker is up or starting, not a pid, and the line printed that boolean as one. It now reads restart initiated.
• Indexing many PDFs in one process no longer grows by a docling model load per file (nexus-l4kbc). Every PDF got a new PDFExtractor, and with it a new docling converter; a dropped converter does not return its memory. Six extractions of one PDF ended at 4.1 GB resident and still rising about 250 MB per file; they now level off near 3.1 GB, because the converter is built once per process for each configuration (fast or formula-enriched, and the NEXUS_DOCLING_ARTIFACTS_PATH in force) and shared.
• A request the engine refuses without reading a large body no longer costs the client its next request (nexus-632u4; engine change, in engine-service-v0.1.160). When a route answered before reading the request body (a retired route's 410, an unknown path's 404) and more than 64 KiB of body was still unread, the HTTP server closed the connection without saying so, and a keep-alive client's next request on it failed with no response. The response now carries Connection: close in that case, so the client opens a new connection.
• A local engine under a CPU limit sizes its ONNX threads to the limit (nexus-qe5y2; engine change, in engine-service-v0.1.160). ONNX Runtime sizes its thread pool from the host's cores and ignores a cpuset or CPU quota, so an engine in a 2-CPU container on a 64-CPU host started about 30 threads pinned to CPUs it could not use and logged pthread_setaffinity_np failed for each. When the engine may use fewer processors than the host has online it now sets the count to its own number (event=onnx_intra_op_threads_configured ... source=cpu_limit). With no limit, and on macOS and Windows, nothing changes, and NX_ONNX_INTRA_OP_THREADS still overrides.
• The engine no longer crashes when a stop arrives during a model load that outlasts the stop wait (nexus-y6aj0; engine change, in engine-service-v0.1.160). The engine holds a SIGTERM for up to 3 s (NX_ORT_INIT_SHUTDOWN_WAIT_MS) while ONNX Runtime work finishes. When the wait expired with a model load still running, it exited anyway and crashed inside ONNX Runtime (exit 134 and a crash file instead of 143); a loaded host makes the load slow enough for that. It now logs event=ort_init_shutdown_halt, stops the listener and ends its database backends, and leaves through libc _exit with the usual status, so neither the JVM's shutdown hooks nor the library's destructors run under the live load.