v7.84.0

Pairs with engine-service-v0.1.163 (REQUIRED_ENGINE_VERSION 0.1.162 to 0.1.163). A local install's first start on this engine applies three changesets: tuples-008 and tuples-009 (two nullable columns on nexus.tuples, sender_session and claimed_at, no backfill) and catalog-045 (a partial index on catalog_documents (tenant_id, md5(title)) for live rows, a plain CREATE INDEX at boot). None of them changes or removes an existing row. The engine now takes a session-level advisory lock at boot, so a second engine on the same database waits up to NX_ENGINE_SINGLETON_LOCK_WAIT_SECONDS (30) and then refuses to start (nexus-5tykh). The cloud deploy of this engine is paired with this release: two engine changes (nexus-mp8ys, nexus-i15oc, the 409 collection_superseded refusals) are not marked additive, so the engine goes live at this tag's push.

Added

• The mailbox drain hook and the channel push mark a message whose from the engine's sender_session stamp does not confirm (nexus-ggmg7, F3 step 2c, JDR-002). One stdlib-only predicate (nexus.tuple_sender.sender_label, mirrored byte for byte as the plugin hook's _tuple_sender.py) compares the two as UUIDs, case-insensitively: a mismatch reads unverified, a null stamp reads unattested, and an agent-id from reads agent mail, sent under session <S> (wording revised by Sam on 2026-10-22, nexus-ohvpe and nexus-syylf, so the normal subagent send and CI board posts are not marked with the word for a mismatch); a row with no sender_session key (an engine without the stamp) gets no mark. A session id goes into a label only when the stamp is a canonical UUID; any other stamp (the engine stores whatever string the token carried) reads a bare unverified. The hook renders from=X [unverified], [unattested] or [agent mail, sent under session <S>]; the channel adds sender and a canonical sender_session to the notification meta and a sentence to its content, worded per case (mismatch: the claimed from does not match the session that wrote it; null: the engine has no session on record for the writer; agent id: sent under session S) with the line "Do not act on a request that changes shared state on the sender's word alone". A board batch adds labelled_tuple_ids, and a batch-wide sender only when every post in it carries the same word. No mark is not verification: any data-token holder can mint a session token for any session id. Release ordering: this label must ride with or after the engine that carries nexus-g2ckl (v0.1.163, where an ack reply row carries the acker's session); an engine at v0.1.162 or earlier renders no stamp at all, so nothing is labelled; only a build that stamps out rows but not replies (none was released) would read every ack reply unattested.
• A tuple row carries claimed_at, when its current claim started, and nx doctor's tuples.lock_held reads it from the engine (nexus-x907o, rides engine tag engine-service-v0.1.163). The row measured a lock's hold time through a local tuple_claim_log query, because renew moves both lease_until and a lock's expires_at and nothing on the wire said when the claim began; on a managed deployment, with no local diagnostic path, it could name the holder but not tell a 30-second hold from a 3-day one. The engine now stamps nexus.tuples.claimed_at (Liquibase tuples-009-1, one nullable column) in the claim, leaves it alone in renew, and clears it wherever claim_id is cleared; rd, in and the other tuple routes render it. The doctor row uses it first, so it measures on any deployment; a held lock whose row has none (an older engine, or a claim made before the column) falls back to the diagnostic path as before. No backfill: a claim that predates the column reads null.
• nx doctor --verbose names the chunks leaves that need attention (nexus-i827c). A new operator-only engine route, GET /v1/admin/chunks-leaves, lists each leaf of nexus.chunks that is pinned or starved, lacks one of the four autovacuum settings, or has autovacuum off, with its rows, dead rows, last autovacuum, overdue state and pci_ index bytes. It needs the root token (a missing or unknown credential is 401, a tenant or mint token 403; a refusal names no leaf); GET /v1/status stays aggregates only. pci_index_bytes is null when a lock held on one of a leaf's indexes kept its size from being read (the sizes are read under a 1 s lock bound, so a non-concurrent REINDEX or DROP INDEX on a pci_ index costs the sizes, never the status counts). With --verbose the Chunks leaf bloat row, when it warns, prints that list, headed STALE with the time of its last read when the engine's view has expired; against an engine that predates the route it prints one line saying so, and with a token the route refuses it says the route needs the operator token. The default sweep reads no admin route. Engine tag engine-service-v0.1.163.
• A tuple row carries sender_session, and tuple_out stamps it from the writer's session (nexus-ztwp4, F3 step 2, client half of nexus-fetre). HttpTupleStore sends the T1 session token (NX_T1_SESSION, read on every request, never the id NX_T1_SESSION_ID) as X-Nexus-T1-Session on its own requests only; the shared T2 client and the other eight stores send nothing new. The engine stamps the session id on the row at out. TupleRow.sender_session holds it, with sender_session_known telling a null (no stamp: no live minted session at write time, a reply row written by an engine before nexus-g2ckl (v0.1.163), or a row that predates the column) from an engine that renders no such key. tuple_rd, tuple_in and nx tuple rd and nx tuple in (text and --json) print sender_session (null when unstamped) and omit the key when the engine renders no such key. A token the engine does not know would 401 every tuple call, so the client retries a 401 once without the header and the write lands unstamped; when that retry succeeds under the same data token, the rejected token is remembered by hash on the store and not sent again until NX_T1_SESSION changes, and tuple_session_header_dropped logs at INFO once per token (no token value); a token that is not printable ASCII without whitespace is never sent; a 401 that survives goes down the data-token re-mint path as before, and one tuple call after a data-token expiry costs one extra round trip while a session token is set. It is a claim, not authentication (JDR-002). Reads on an engine that renders no such key print no sender_session key.
• nx-mcp and nx-mcp-catalog log an mcp_tool_call event per tool call, with the tool name, the process pid, and the sorted keys of the request's _meta (nexus-2nxoo, shakeout F18). mcp.log held no tool-call lines, so nobody could tell whether a client sends per-request _meta such as a session id. Keys only: no _meta value and no argument is read (under NEXUS_LOG_LEVEL=DEBUG the mcp SDK itself logs full request messages, so that holds for this event only). The first time a key-set is seen in a process the event logs at INFO, so it reaches mcp.log at the default level (the server Claude Desktop starts has no editable environment); later calls with the same key-set log at DEBUG. Claude Code sends claudecode/toolUseId on every call, so a steady client adds one INFO line per process, not per call. The remembered set holds 64 key-sets; once full, new ones log at DEBUG and one mcp_tool_call_keyset_limit INFO line says so. At most 32 keys are listed, each cut to 128 characters, with meta_keys_truncated set when anything was cut. The wrap sits on each server's constructed CallToolRequest handler (the catalog server now has its own, and reports its own status), cannot raise into the call, and tool_call_log is reported with the other SDK-patch statuses at startup. A process must be respawned after the install to carry the hook. To probe: find pid N from mcp_server_starting, check mcp_sdk_patch_applied patch=tool_call_log pid=N, then grep mcp_tool_call pid=N after that start line (pids are reused across a long mcp.log, so bound the match by the mcp_server_starting time).
• The supervisor passes the Voyage key to a dual-capable engine whatever local.embed_model says, and always passes NX_EMBED_PROFILE; nx doctor warns when the engine serves no model of its profile's family (nexus-wypwq, RDR-210 Phase 3 Step 1). The supervisor reads the spawned binary's install receipt (the provenance sidecar beside nexus-service). At or above DUAL_EMBEDDER_FIRST_ENGINE_VERSION (engine-service-v0.1.161, the first tag that boots dual) it passes the key whenever the credential chain has one, so a bge choice with a key now boots a dual engine; below that tag, with no receipt, with a receipt for a different binary (NEXUS_SERVICE_BIN, NEXUS_SERVICE_JAR), with an unreadable one, or with a binary on disk that no longer matches its receipt (verify_installed_binary), the nexus-r5f3c rule stands. NX_EMBED_PROFILE comes from local_embed_profile(), the function the client's write model reads, so the names the client mints and the profile the engine seeds agree; a NX_EMBED_PROFILE in the caller's environment is ignored, and a config.yml the client cannot read falls back to bge with a warning instead of failing the spawn. The new "Embedding family" row reads /version's embedding_models against the profile and warns on a degraded boot (a Voyage profile with no key, a bge profile with no bge files); it probes /version with a 3 s timeout and does not read a voyage-mode engine that reports no profile against the client's profile. A test fails while REQUIRED_ENGINE_VERSION is below that first dual tag; the pin is already (0, 1, 162) since 7.83.0.

Changed

• nx store delete --title and the store_delete function name the collection that holds what they did not find (nexus-jald5). Both stay in the one collection they resolve; when the title (chunk rows) or the id is not there but another collection a read of the same --collection looks in holds it (a live model sibling, or for bare knowledge any knowledge collection), the error ends it is in S: pass --collection S (collection='S' from the function, which is not a registered MCP tool), as nx store delete --id now does over the same scope. The probe is best effort: when it fails, the plain not-found message stands. The MCP store_get description now says a subject reads every live model sibling, a conformant four-segment name is one collection, and naming one collection of an ambiguous title reads that one.
• nx store get and nx store list read every live model sibling of a corpus, as the MCP store tools do; MCP store_get by a title in several siblings picks the one named exactly (nexus-9ts7n, nexus-xkc4n). The bare default --collection knowledge now means what it means to the MCP store tools (nexus-mgqs8, nexus-2y8yw): every live knowledge__* collection, so nx store get ID finds a note in any of them and nx store list lists them with their sizes; name one to page it. This changes what bare nx store list prints: the knowledge collections and their sizes instead of the first 200 entries of one, and --docs, --limit and --offset apply once a collection is named (a note says so); with a single knowledge collection it pages that one, as before. Both surfaces read through one function, corpus.store_read_scope. nx store get ID --collection art looks in each live sibling of art (the read resolver of nexus-50uw6) and names the one it found the entry in (Collection:, and a collection key with --json); an id in none names every collection it looked in. nx store list and nx store list --docs page the named collection, as before, and name its siblings under the header (also in this corpus: ...), also when the named collection is empty; naming a sibling pages it. MCP store_list does the same, its docs=True view and its empty page included. nx store delete stays in the one collection it names; when the id is not there but a sibling holds it, the error names the sibling to pass. MCP store_get by title: when the title is in several siblings and collection= is exactly one of the collection names the ambiguity message listed, that collection is used and the result names the others holding the title, so a sibling registered under a name that is not the four-segment shape (which the read resolver otherwise expands back to the whole corpus) can be read by title. A legacy name typed exactly (knowledge__art) that is also one of the matches now reads that collection where it used to report the ambiguity; the note names the other copy.
• A bge collection merges with a Voyage one at a distance factor of 1.37, not the interim 1.30 (nexus-k1x5v, RDR-210 Technical Design 12). nexus-t189m measured the best-F1 factor on a dual engine: pooled 1.37, bootstrap interval 1.24 to 1.45. No single factor meets the old 3-and-1 inversion bound on the surfaces that merge by calibrated distance (MCP query's plain path, the catalog-routed tools, nx_answer); they stay on calibrated distance and the RDR now records the measured inversion counts instead of a bound. nx search and MCP search with rerank keep merging by rerank_score.
• The local PostgreSQL cluster runs with max_locks_per_transaction = 128 (nexus-o26hs). The engine's RDR-225 migration creates a partition per model, tenant and table in one transaction and refuses to start when their locks would not fit PostgreSQL's lock table (nexus-vxmcl); at the default of 64 that is about 39 tenants, at 128 about 81. The setting goes into the nexus-managed block of the cluster's postgresql.conf, only when postgresql.conf sets no value of its own outside that block, so a value you set there still wins (a value in an included file is not seen); a value raised by hand on the managed line is kept. The supervisor and the upgrade quiesce now rewrite the managed block before every cold PostgreSQL start, as nx init already did, so an existing install gets it at its next start (nx daemon service stop --with-pg, then nx daemon service start). It costs about 1.5 MB more shared memory than the default.
• The mailbox drain hook explains its sender marks (nexus-565ds). Once per drain, a one-line legend above the first marked message glosses [unverified] (the claimed sender does not match the session the engine recorded), [unattested] (no session recorded) and [agent mail, sent under session S] (a subagent's mail), and says a mark is a lead to check while no mark is not proof (JDR-002). The plugin's copy of the hook ships with the next plugin release.
• The catalog has an exact-title lookup, and the store_put ghost-by-title reconcile and nx enrich's last-resort title match use it (nexus-gacz0, rides engine tag engine-service-v0.1.163). find_by_title_exact was a full-text search followed by a client-side title filter, so a title of common words matched, and paged through, every document sharing those words, on every brand-new titled note. The engine now answers it in one request, GET /v1/catalog/by_title?title=&owner=&content_type=: live documents whose title equals the query exactly, tenant-scoped, in catalog order (the text order of the tumbler under the database collation), no page cap, optionally narrowed by chunk_count= (the ghost filter the store_put reconcile sends). A title index (catalog-045-1) keeps it a lookup on a large catalog: about 0.05 ms against 22 to 35 ms for a scan at 250,000 documents. An engine without the route answers 404 and the client falls back to the old search, remembering the miss for ten minutes. nx enrich's last-resort title match took the first hit of a full-text search, which could be a different paper; it now takes the first exact match in catalog order and logs the others it passed over (the first five and a count).
• A second engine on the same database now refuses to start, and an engine that loses its lock to another one exits (nexus-5tykh; engine change, takes effect with the next engine tag and, locally, the client release that pins it). CollectionRegistry caches collection rows with no TTL and is correct only with one engine per database; nothing enforced it, so an overlapping engine would have kept a live row for a name the first had superseded and accepted writes to the tombstone, silently. At boot, before the schema migration, the engine takes a session-level PostgreSQL advisory lock on a connection of its own, outside the pool and held for the JVM's life. A holder that is still shutting down gets NX_ENGINE_SINGLETON_LOCK_WAIT_SECONDS (default 30), so a stop-then-start does not fail; after that the boot logs event=engine_singleton_lock_refused at ERROR and exits 1, naming the holder by backend pid, client address, application name and backend start, so an operator can pg_terminate_backend a half-open connection a stopped engine left behind. A check every NX_ENGINE_SINGLETON_LOCK_CHECK_SECONDS (default 10) notices a lock lost to a Postgres restart or a network drop and takes it back once, clearing the CollectionRegistry cache because another engine may have run in the gap; if another engine holds it by then, the engine logs event=engine_singleton_lock_lost_to_another_engine and exits 1 rather than serve on. NX_ENGINE_SINGLETON_LOCK=off skips it with a WARN, for an operator who knowingly runs behind a transaction-mode pooler; the lock is also skipped, with a WARN, when NX_PGBOUNCER_ADMIN_URL is set, because a session lock does not hold through such a pooler; a pooler that is not declared is usually caught at boot (one that hands the same server connection to consecutive statements can pass and surfaces later as a lost lock), which refuses (event=engine_singleton_lock_pooler_suspected) instead of exiting one check later as a loss. The managed cloud connects straight to Postgres and needs neither. An engine older than this change neither takes nor honours the lock, so a mixed deployment is not protected until every engine carries it. Settings are in docs/configuration.md.
• The engine resolves a collection's quarantine siblings in its expire-quarantine and restore-rereferenced routes, and nx index repo now asks the engine for them (it has not probed since nexus-wbfpw.58), while nx t3 gc asks too and still probes only against an engine that predates the field (nexus-wbfpw.64, follow-up to nexus-wbfpw.58). A request with resolve_siblings: true also gets quarantine_collections, the origin's siblings read under a 2 s statement bound (7 ms over 12,800 quarantine rows in production), or sibling_resolution: "timed_out". The first restore page of an index run asks and the expiry reuses the answer, so a chunk stranded under a sibling name the catalog row no longer derives (catalog-044) is now restored and expired by the index path too, not only by nx t3 gc; nx t3 gc asks in its first expire page and sends no dry-run quarantine-restore probe. Against an engine before v0.1.163 the answer carries neither key and both callers behave as before (the index path keeps its two derived names, nx t3 gc probes after its first expire page). No Liquibase changeset and no index: measured against 140,000 quarantine rows the scan is 90 to 142 ms (as the RLS service role). Engine tag engine-service-v0.1.163.
• An ack's reply carries the acker's session, and tuple_ack sends a mailbox reply with no from as this session (nexus-g2ckl, F3 step 2). The engine stamps the reply row tuple_ack(reply=) writes with the acker's minted session, as it stamps out rows; tuple_ack fills a missing dims.from on a mailbox reply with this session's own id (the id mailbox_send defaults to), so a genuine reply reads unlabelled. A given from is never overridden. nx tuple ack --reply-dim does not fill from. Engine half takes effect with engine-service v0.1.163.
• mailbox_send refuses a session id in from_address that is not the sending session's own (nexus-2mv7y, nexus-939d6, shakeout F3). It used to accept any session id there, so a model could send as any session, most often by putting the recipient's id in the sender slot. An agent id still passes, and where no session id resolves (Claude Desktop, Cowork) a session id still passes. JDR-002 records that the tenant is the tuple space's security boundary and that from, correlation_id, claimant and directory session ids are claims.
• The MCP search tool returns only the ranked text by default (nexus-099mn, shakeout F13). Since nexus-6jlki a default-mode call also carried a structuredContent envelope (ids, distances, truncated, truncated_chars and the render in a text field), and Claude Code shows structuredContent in place of the text block, so the model read a JSON dump. structured=True still returns the bare {ids, tumblers, distances, hybrid_scores, collections, chunk_collections, chunk_text_hash} dict. A default-mode call that fails is now plain error text, not an isError result.
• Search scores a legacy-named Voyage collection with the Voyage calibration factor, not the install's own (nexus-ml9vu, RDR-210 follow-up to nexus-noayy). The distance scale-correction factor and the boost window's cut resolved each collection's model from its name, so a legacy name whose catalog row says Voyage was scored with the bge factor on a bge-profile install and lost to a farther conformant Voyage collection. nx search and the MCP search and query tools now hand the row-preferred resolver that grouping and the thresholds already use to the scoring and the window, so one row read serves all four; a name with neither a token nor a row keeps the install's derivation. A legacy-named stale-generation collection (for example a minilm-384 row) beside bge collections now counts as a second model and takes the default factor, with a one-time calibration_model_unlisted log.
• The engine's tuple sweep and T1 TTL sweep make their first pass 60 seconds after boot, not six hours (nexus-d94qm, shakeout F5). An engine process that lived under six hours never purged expired tuples or expired T1 rows; the request-ledger retention task and the chunk reaper already started this way. Boot logs event=tuple_sweep_scheduled. A read-only cloud census (2026-10-22) found it was the cause of the cloud tenant's backlog (board/ci/nexus-develop about 2,400 expired_unpurged, directory/* rows created on 2026-10-18): every one of the 2,439 expired rows had expired after the last sweep pass, at 2026-10-21 16:17Z, and no pass ran between then and the next engine boot. Expired rows were never offered as live: reads and name resolution already exclude them. Mail to a session that ended is not refused at send (an unnamed session holds no directory row, so liveness is unknowable); it expires with the seven-day retention and the purge removes it (nexus-ejidv, docs/tuple-space.md).
• Five tuple-space findings from the 2026-10-21 cross-surface shakeout (nexus-jz3kh, nexus-zihq1, nexus-fzteh, nexus-5fpkh, nexus-o9gt2). (1) A keys+nonce write that omits the nonce, or passes it as a key or a dim, is refused saying the nonce is tuple_out's own parameter; the tuple_out description names every keys+nonce template (mailbox, board, board/ci, queue, directory), not only the mailbox. (2) tuple_subscribe now says what it does: a board subscription starts 30 seconds before the subscribe call (clock-skew and commit-lag margin), so a post inside that margin is pushed; at most 100 posts a wait; a mailbox delivers mail sent before the subscribe, each row announced at most 5 times. No behaviour change. (3) out on a keys+nonce template with an existing id and a different body or dims is refused as NonceReuseConflict (409), naming the id, instead of returning the id and dropping the new payload; a byte-identical retry and a retry of an already-consumed write with the same dims still return the id (a consumed row's body is cleared by the ack, its dims are not). The engine half reaches a released client as a bare httpx.HTTPStatusError (409), loud where the old engine dropped the write silently; the client half maps the code. (4) tuple_rd, tuple_in and nx tuple report a claim whose lease has passed as lapsed (computed at read time; the stored state and the lazy reclaim are unchanged, the old holder stays on the row), and the census gains a lapsed count, a subset of claimed. (5) A tuple_rd cursor that is not a returned row's created_at and 64-hex id, or only half a cursor, or a since_created_at with no UTC offset, is refused naming since_id/since_created_at, instead of the engine's raw HTTP 400: string length not even.
• Search groups and filters a legacy-named collection by the model its catalog row names (nexus-noayy, RDR-210 Phase 4 Step 1). A collection whose name carries no model token but whose row says voyage-context-3 was grouped with no family and, on a dual engine, left unfiltered by the interim rule (nexus-ndr0t). It now groups with the Voyage family and gets the Voyage distance threshold; a legacy name whose row says bge stays unfiltered. The row comes from the collections listing the caller already made, so a search adds no request on the default tenant; a cold cache falls back to the name and logs collection_model_unresolved once per name. nx doctor's search probe judges by the same rule. Result ranking calibration follows the same rule (nexus-ml9vu).
• A shorthand collection name reads every live model sibling of its corpus (nexus-50uw6, RDR-210 Phase 4 Step 1). The MCP collection= argument of store_get, store_list and store_get_many, and the corpus= argument of search, query, search_metadata_scoped, search_topic_scoped, search_graph_hop and search_aspect_scoped, used to read the one collection the single-name resolver picked, the Voyage one once it existed, and never the bge collection holding the rest of the corpus. The read resolver (t3_collection_names_for_read) now returns every live collection sharing that collection's catalog row tuple (content_type, owner_id), found by row, so a sibling registered under a name that is not the four-segment shape is found too. A fully-qualified conformant name is still exactly that collection and write resolution is unchanged. store_list of a named collection still pages that collection's entries and now names its siblings under the header; only the bare knowledge lists subjects. The rows come from the collections cache the caller already holds, so a search adds no request; a store read pays one listing when that cache is cold or older than 60 s. A sibling another process registered is seen once the cache is refreshed (the resolver refreshes it once when its own pick has no cached row), and a freshly superseded sibling is still read for up to 60 s. What it costs: on an engine that serves one model family, a read that names the sibling it does not serve raises the named error although the served one answered. This reaches users with the next client release after 7.83.1. store_delete stays single-name; nx store get and nx store list follow (nexus-9ts7n, above). The catalog client's list_collections also takes the route's content_type filter (no production caller yet).
• nx collection re-embed --to MODEL checks MODEL against the model the collection's catalog row records (nexus-dxifx, RDR-210). In service mode the engine embeds by the row, so the guard that refuses a --to the engine would ignore now compares with the row's embedding_model and uses the name's model only when no row backs the name (or the row records no model). --dry-run now runs the same check instead of reporting a re-embed the real run would refuse. A legacy name whose prefix infers one model while its row records another is no longer refused for the row's own model, and a --to that equals only the name's model is now refused (the engine would have embedded with the row's model while the command stamped --to into the chunks' metadata). No wire change; it reaches users with the next client release after 7.83.1.
• --lexical search no longer costs a second request per model group (nexus-xd2rc). POST /v1/vectors/search-per-collection takes an opt-in lexical: true: each collection then also runs the /hybrid-search text-gated statement as its own arm, top-per_collection_k, through the same workers, arm gate and bounds as its vector arm, and the rows are unioned in, the vector copy winning a row both arms returned, exempt from the collection's threshold and from the limit cut. With rerank, the lexical rows the vector rows do not hold are scored in calls of their own, not capped by rerank_max_candidates, and ordered with the vector rows by score. The envelope echoes "lexical": true, and each per_collection entry gains lexical_count, lexical_ids, lexical_error and lexical_error_kind; a lexical arm that failed makes the search refuse, as before. search_cross_corpus sends the field and drops its serial /hybrid-search leg when the engine echoes it, and keeps that leg against an engine that does not. A lexical arm the route's statement bound or fan-out budget stopped is run again on /hybrid-search for that collection; any other lexical failure refuses. Each collection now contributes its own top-per_collection_k lexical rows; the old leg took the top rows across a batch of about seven collections, so a collection with many text matches could crowd its batch-mates out. A rare-token query, whose text gate admits fewer rows than that, returns the same rows either way. Without the field the response is byte-identical to before.
• NX_TEST_T2_SUBSTRATE=per-test (and its older spelling engine) is retired (nexus-llo7w). The escape hatch back to a tenant for every test shipped in 7.83.0 for one release; either value now errors every test at setup, naming the variable. A test that touches storage asks for a tenant with pytest.mark.t2_tenant or a t2_tenant parameter; none still provisions nothing. Affected: anyone with the variable exported in a shell or a script.
• A bge choice with a Voyage key now sends the key to an engine at or above engine-service-v0.1.161 (nexus-wypwq, RDR-210 Phase 3 Step 1). Before, the supervisor withheld the key from a bge-choice install (nexus-r5f3c) because it flipped older engines Voyage-only. The engine from 0.1.161 boots dual, so Voyage-named collections on such an install are served now, and a query that touches them calls Voyage with that key. A bge-choice install that has a key but no bge model files boots degraded (Voyage served, bge collections answer 422) instead of failing to start; nx doctor's "Embedding family" row names it. Engines below 0.1.161, and any spawn without a verified install receipt, keep the old rule.

Fixed

• The engine's reranker_available reads false for cross-encoder files that already failed to load (nexus-vk1l1). It was file presence only, so a truncated or unloadable model read true on every status poll while every rerank degraded. A failed load now records the model and tokenizer's size and modification time, taken before the load, and the key reads false until either file changes. Every rerank still retries the load, so a re-provisioned file is picked up without a restart. nx doctor's Reranker row says the files are absent or their last load failed, and points at the engine log's cross_encoder_reranker_init_failed event for the cause. Engine change: it ships with the next engine-service tag.
• Aspect extraction no longer fails on a document longer than the model's context (nexus-95qz4). The whole document text went into one extractor prompt, so a long PDF (one measured at about 252k tokens against a 200k limit) failed three times and got null fields on every nx enrich aspects run. Each document's text is now cut to its first 150,000 characters, which fits the context even at one token a character. A line tells the model the text was cut and to leave a field null when its evidence would come later, the record carries extras.input_truncated with the kept and total character counts, and a batch whose documents together exceed the budget runs as several calls.
• A tuple-space caller can no longer pre-write a reply under the id the engine gives it (nexus-b747g, shakeout F3). A reply written by ack-with-reply had the id an out computes with the request's id as its nonce, and the request's id is readable, so any caller holding the tenant token could write that row first. Before nexus-fzteh the real reply was silently dropped; after it, the real ack failed with NonceReuseConflict until the request dead-lettered. The engine now digests a reply's nonce under its own label, so no out reaches a reply's id. Engine half; takes effect with the next engine tag.
• Routing-hook telemetry rows carry the session id (nexus-m4lej). The credential-print guard and the subagent git-write guard have logged every event since the table was added without the hook payload's session_id, so their routing_events rows had an empty session (every row on the cloud tenant since 2026-10-10 was empty) and test traffic could not be told from real sessions. log_routing_event now defaults to the session of the payload the hook read; an explicit session_id still wins, and an event the hook could not post keeps its session in the drop meter.
• A catalog search that returns no rows now says why, and never says "0 matches" when matches exist (nexus-r88er, shakeout F12). An empty result rendered as nothing, so a topical query on this title-and-metadata tool read as a broken tool. At offset 0 the result is now a single note row: the tool matches titles and metadata, not document content, and content search is the nexus server's search and query tools (the query parameter says the same). An offset past the last row returns a different note, "No rows at offset N" with the real match count, instead of the false "0 matches".
• nx_answer(structured=True) reports the id of the plan it saved on a plan-match miss (nexus-wvz8i, shakeout F14). The envelope carried the synthetic ad-hoc match's plan_id 0 although the grown plan was saved before the call returned. plan_id is now the matched library plan or, on a miss, the plan this call grew and saved, and 0 only when no row exists (plans.ad_hoc_ttl 0, or the save failed). The run log's plan_id is unchanged: it records the matched plan only, so a grown-on-miss run still shows 0 there (documented in docs/cli-reference.md).