v7.78.0

Pairs with engine-service-v0.1.160 (REQUIRED_ENGINE_VERSION unchanged). Fixes, most of them for Windows. nx daemon service stop no longer also stops a PostgreSQL the supervisor started, and nx, the hooks, the indexer and the daemons no longer run a git.exe, bd.exe or claude.exe planted in the working directory. A docling that cannot be imported now fails the PDF and has an nx doctor row. No engine change, no schema change and no wire change.

Fixed

• A docling that cannot be imported fails the PDF instead of quietly switching to plain PyMuPDF text, and nx doctor reports it. A docling failure on one PDF still falls back to PyMuPDF. An import failure is a broken install: before, every PDF without formulas then came back as plain text (no layout-aware reading order, headings or tables) with one progress line to show for it. Indexing now stops with the missing module's name and the reinstall command, and nx doctor has a PDF extraction (docling) row that checks the modules docling's PDF pipeline imports are present.

• nx daemon service status names the log the engine actually writes. It named storage_service_native.log for every launch; an engine started from a jar (development and tests) writes storage_service_jar.log. (nexus-gu3ma)

• nx agents install --help no longer recommends allowing mcp__serena-wt__* wholesale. That wildcard also allows the IDE debugger tool and every writer with no prompt. The help now says to name the tools, as docs/cli-reference.md already did. (nexus-r2e6t)

• nx index pdf --dry-run no longer fails at random with dictionary changed size during iteration. A dry run buffers pages in memory, and its extractor thread wrote that buffer while its chunker thread read it with no lock. The buffer now serves one request at a time.

• On Windows, nx daemon service stop no longer also stops PostgreSQL when the supervisor started it (nexus-f9bgu.54). After a logon-task start, a plain stop shut PostgreSQL down as well (cleanly, with a checkpoint). The stop's break signal reached every process on the supervisor's console. PostgreSQL now starts on a console of its own; --with-pg still stops it. Found by the Windows gate on 7.77.1.

• The nx-hook verbs no longer run a git.exe or bd.exe planted in the project on Windows (nexus-f9bgu.37). Hooks run with the project as their working directory, and on Windows CreateProcess searches that directory before PATH, so the session-context, rdr, subagent-start and preflight verbs ran a planted git.exe or bd.exe as the user. They now spawn the PATH hit as an absolute path (nexus.util.nx_argv.argv_off_cwd) and treat a tool found only in the project as not installed. POSIX is unchanged. A lint now covers every tool and every spawn under src/nexus/hooks. Not verified on a Windows host.

• nx commands, the indexer and the daemons no longer run a git.exe, bd.exe or claude.exe planted in the working directory on Windows (nexus-f9bgu.37). The same hole as the hook verbs, one layer out: nx runs in the user's clone, and CreateProcess searches that directory before PATH. run_bounded, which carries about 60 call sites, now resolves its argv head off the working directory, so every caller is covered, the injected run=run_bounded defaults included. The spawns that bypass it resolve their own: the RDR preamble, nx self, the aspect extractor's and operator dispatch's claude, and the java, ss and mineru-api lookups. The ps calls in nx doctor and session.py are converted too, but they sit behind existing Windows early returns, so that change is defensive and fixes nothing live. nx self install's stdlib-only generation_core does it for uv with a copy of the helper, since it runs with nexus absent; a test runs both over the same cases so they cannot drift. A tool found only in the working directory counts as not installed, and a planted copy no longer hides the installed one. A .cmd or .bat hit is not returned either: a bare git or bd spawn only ever found an .exe, and a batch file runs through cmd.exe with quoting that CPython does not escape for it. The one site that runs a .cmd shim on purpose, the plugin lockstep's claude (an npm install), opts back in. A head with a directory part or a drive (.\tools\x, C:\x\y.exe) is an explicit path and is left alone. POSIX is unchanged. The lint in tests/test_nx_bare_exec_lint.py now covers all of src/nexus, including a spawner imported by name, with a reason recorded for every exception. Not verified on a Windows host.

Changed

• nx t3 gc leaves the fraction floor to the engine. The verb used to check the floor itself against its advisory listing before asking the engine, because an older engine moved without judging it. Every supported engine now judges the floor under its own lock, so the client copy is gone. A refusal still exits 1, moves nothing, and names NX_GC_FLOOR_FRACTION and NX_GC_FORCE=1. It now arrives only with the move, so --dry-run no longer predicts it. (nexus-teduy)

Removed

• NX_WRITE_PRIORITY and the catalog write-fairness code behind it. Nothing has yielded on it since the catalog moved to the engine: the writer always reported no interactive write pending. Setting the variable has no effect and it is no longer documented. (nexus-yp99m)