conexus 7.77.0__tar.gz → 7.78.0__tar.gz

{conexus-7.77.0 → conexus-7.78.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: conexus
-Version: 7.77.0
+Version: 7.78.0
 Summary: Self-hosted semantic search and knowledge management for LLM-driven development
 Project-URL: Homepage, https://hellblazer.github.io/nexus/
 Project-URL: Repository, https://github.com/Hellblazer/nexus

{conexus-7.77.0 → conexus-7.78.0}/docs/rdr/README.md

@@ -244,7 +244,7 @@ An RDR (Research-Design-Review) is a short document that records a technical dec
 | [RDR-224](rdr-224-native-windows-support.md) | Native Windows Support: Windows x64 Engine, PostgreSQL Bundle and Client | Architecture | Accepted | 2026-09-30 |
 | [RDR-225](rdr-225-vector-tables-per-embedding-model.md) | One Vector Table per Embedding Model, with Tenant Isolation | Architecture | Accepted | 2026-10-05 |
 | [RDR-226](rdr-226-one-statement-per-leaf-search.md) | Per-Collection Search in One Statement per Leaf | Architecture | Abandoned | 2026-10-08 |
-| [RDR-227](rdr-227-per-collection-hnsw-above-the-router-threshold.md) | Per-Collection HNSW Indexes Above the Router Threshold | Architecture | Accepted | 2026-10-09 |
+| [RDR-227](rdr-227-per-collection-hnsw-above-the-router-threshold.md) | Per-Collection HNSW Indexes Above the Router Threshold | Architecture | Closed | 2026-10-09 |
 
 > RDR-216 is unused on `develop`: drafted, gated BLOCKED, then abandoned 2026-09-19 without landing. Its measurements survive in T2 as `nexus_rdr/216-research-1` through `-19` and in `nexus/manticore-auto-chunking-analysis-2026-09-19`; the record itself never merged.
 

{conexus-7.77.0 → conexus-7.78.0}/mcpb/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "conexus-mcpb"
-version = "7.77.0"
+version = "7.78.0"
 description = "Conexus packaged as Claude Desktop .mcpb (Desktop Extension)"
 requires-python = ">=3.12,<3.14"
 dependencies = [
@@ -12,7 +12,7 @@ dependencies = [
     # the extension's plan cache picked a different embedder than the plugin's
     # and downloaded its own bge copy. Pinned by
     # tests/test_plugin_structure.py::test_mcpb_pins_bare_conexus.
-    "conexus>=7.77.0",
+    "conexus>=7.78.0",
 ]
 
 [tool.uv]

{conexus-7.77.0 → conexus-7.78.0}/pyproject.toml

@@ -12,7 +12,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "conexus"
-version = "7.77.0"
+version = "7.78.0"
 description = "Self-hosted semantic search and knowledge management for LLM-driven development"
 readme = { file = "README.md", content-type = "text/markdown" }
 requires-python = ">=3.12,<3.14"

{conexus-7.77.0 → conexus-7.78.0}/service/src/main/java/dev/nexus/service/Main.java

@@ -455,8 +455,12 @@ public final class Main {
         // CREATE INDEX CONCURRENTLY is ended by the builder reaper below, not waited for).
         Runnable stopPciReconciler = pciReconciler::stop;
 
-        Runtime.getRuntime().addShutdownHook(new Thread(() -> {
-            log.info("event=shutdown_signal");
+        // Everything the shutdown hook does that does not touch ONNX Runtime. Also the whole
+        // cleanup on the gate's expired-bound path (nexus-y6aj0), which ends in libc _exit
+        // and so runs no hook: native model work is still live there, so the embedder
+        // closes are skipped, and so is ds.close(), which can stall about 30 s on a dead PG
+        // (process exit closes the sockets, and the reaper has already ended the backends).
+        Runnable stopAllButEmbedders = () -> {
             service.stop();
             stopPciReconciler.run();
             // nexus-g17tf: right after the listener stops and the reconciler's stop
@@ -483,6 +487,12 @@ public final class Main {
             // never waiting: a read on a silent socket ignores the interrupt, and the reaper has a 10 s grace to
             // keep; closing the pool below aborts that socket.
             pciSweep.stop();
+        };
+        OrtInitGate.process().onBoundExpired(stopAllButEmbedders);
+
+        Runtime.getRuntime().addShutdownHook(new Thread(() -> {
+            log.info("event=shutdown_signal");
+            stopAllButEmbedders.run();
             // doc and qry routers each hold their OWN AdmissionControlledEmbedder
             // (different acquisition policy — see LocalOnnxAdmission), but both
             // wrap the SAME underlying "bge" delegate, so closing either

{conexus-7.77.0 → conexus-7.78.0}/service/src/main/java/dev/nexus/service/http/HttpUtil.java

@@ -92,6 +92,39 @@ public final class HttpUtil {
      * transfer). A client that does not ask gets the identity body, byte for byte as before. The compressed
      * length is known before the headers go, so {@code Content-Length} is exact and nothing is chunked.
      */
+    /**
+     * How much unread request body {@link #send} takes off the connection before answering: the JDK
+     * server's own drain amount ({@code sun.net.httpserver.drainAmount}, 64 KiB).
+     */
+    static final long UNREAD_BODY_DRAIN_CAP_BYTES = 64L * 1024;
+
+    /**
+     * A handler that answers before reading the request body (a retired route's 410, an unknown path's
+     * 404, a refusal made on the headers) leaves that body on the connection. The JDK server takes up to
+     * its drain amount when the exchange ends and silently CLOSES the connection if more remains, with
+     * no {@code Connection: close} on the response already sent; a keep-alive client then sends its
+     * next request into a closed socket. Take the same amount here, before the headers go, and when
+     * more remains say so, so the client opens a new connection instead (found reading nexus-632u4;
+     * not shown to be that bead's cause).
+     */
+    private static void settleUnreadRequestBody(HttpExchange exchange) {
+        try {
+            java.io.InputStream in = exchange.getRequestBody();
+            byte[] buf = new byte[8192];
+            long left = UNREAD_BODY_DRAIN_CAP_BYTES;
+            while (left > 0) {
+                int n = in.read(buf, 0, (int) Math.min(buf.length, left));
+                if (n < 0) return;
+                left -= n;
+            }
+            if (in.read() >= 0) {
+                exchange.getResponseHeaders().set("Connection", "close");
+            }
+        } catch (IOException e) {
+            // The handler already closed the stream, or the client went away: nothing left to settle.
+        }
+    }
+
     public static void send(HttpExchange exchange, int status, String body) throws IOException {
         byte[] bytes = body.getBytes(StandardCharsets.UTF_8);
         exchange.getResponseHeaders().set("Content-Type", "application/json; charset=utf-8");
@@ -116,6 +149,7 @@ public final class HttpUtil {
                 }
             }
         }
+        settleUnreadRequestBody(exchange);
         exchange.sendResponseHeaders(status, bytes.length);
         try (OutputStream os = exchange.getResponseBody()) {
             os.write(bytes);

conexus-7.78.0/service/src/main/java/dev/nexus/service/vectors/ImmediateExit.java

@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (c) 2026 Hal Hildebrand. All rights reserved.
+package dev.nexus.service.vectors;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.lang.foreign.FunctionDescriptor;
+import java.lang.foreign.Linker;
+import java.lang.foreign.ValueLayout;
+import java.lang.invoke.MethodHandle;
+
+/**
+ * nexus-y6aj0 — end the process with a status and nothing else: libc {@code _exit}.
+ *
+ * <p>{@code Runtime.halt} is not that. It skips Java shutdown hooks, but HotSpot's
+ * halt ends in libc {@code exit}, which runs {@code atexit} handlers and the static
+ * destructors of every loaded library. With a thread still inside ONNX Runtime
+ * that tears the library's globals down under it. Measured on Linux amd64
+ * (OpenJDK 25.0.4, ORT 1.20.0): a halt during {@code OrtSession} creation exited
+ * 143 and still wrote an {@code hs_err} file (SIGSEGV in libonnxruntime on the
+ * creating thread) in 2 of 3 eleven-point sweeps. {@code _exit} runs none of it.
+ *
+ * <p>The call goes through {@code java.lang.foreign}. Where that is unavailable (a
+ * native image built without the downcall registered, a platform with no linker,
+ * a missing symbol) it logs {@code event=ort_init_immediate_exit_fallback} and
+ * falls back to {@code Runtime.halt}.
+ */
+final class ImmediateExit {
+
+    private static final Logger log = LoggerFactory.getLogger(ImmediateExit.class);
+
+    private ImmediateExit() {}
+
+    /** Does not return. */
+    static void exit(int status) {
+        try {
+            Linker linker = Linker.nativeLinker();
+            MethodHandle underscoreExit = linker.downcallHandle(
+                    linker.defaultLookup().find("_exit").orElseThrow(),
+                    FunctionDescriptor.ofVoid(ValueLayout.JAVA_INT));
+            underscoreExit.invokeExact(status);
+        } catch (Throwable t) {
+            log.warn("event=ort_init_immediate_exit_fallback using=runtime_halt error=\"{}\"", t.toString());
+        }
+        Runtime.getRuntime().halt(status);
+    }
+}

{conexus-7.77.0 → conexus-7.78.0}/service/src/main/java/dev/nexus/service/vectors/OnnxThreadPolicy.java

@@ -43,6 +43,19 @@ import java.util.function.Function;
  * refused at zero, negative, or non-numeric, same discipline as {@link
  * LocalOnnxAdmission#permitsFromEnv}.
  *
+ * <p><b>One case where the default is not ORT's: a CPU limit (nexus-qe5y2).</b>
+ * ORT sizes that default from the HOST's cores and pins its threads to them; it
+ * does not read a cpuset or a CPU quota. In a 6-CPU cgroup on a 64-thread host
+ * each engine started about 32 intra-op threads on 6 CPUs and logged
+ * {@code pthread_setaffinity_np failed ... error code: 22} for masks naming CPUs
+ * outside the set; model load under that oversubscription outlasted the engine's
+ * 3 s shutdown wait (nexus-y6aj0). So when the JVM can use fewer processors than
+ * the host has online, the count is the JVM's number. This is not the v0.1.99
+ * arithmetic: nothing is divided by permits, and on a host with no limit, where
+ * the two numbers are equal, ORT's default stays. The host count is read on Linux
+ * only ({@code /sys/devices/system/cpu/online}); elsewhere, or when the file
+ * cannot be read, nothing is derived.
+ *
  * <p><b>Unmeasured (critic finding 3).</b> This class does not claim a
  * specific query-path latency effect from the intra-op cap — see {@link
  * LocalOnnxAdmission}'s javadoc.
@@ -66,22 +79,72 @@ final class OnnxThreadPolicy {
      * which applies without reading the code.
      */
     static OptionalInt intraOpThreads() {
-        OptionalInt threads = intraOpThreads(System::getenv);
-        if (threads.isPresent()) {
+        OptionalInt explicit = intraOpThreads(System::getenv);
+        if (explicit.isPresent()) {
             log.info("event=onnx_intra_op_threads_configured threads={} source=env shared_session=true",
-                    threads.getAsInt());
+                    explicit.getAsInt());
+            return explicit;
+        }
+        int available = Runtime.getRuntime().availableProcessors();
+        OptionalInt host = hostProcessors(HOST_CPUS_ONLINE);
+        OptionalInt limited = underCpuLimit(available, host);
+        if (limited.isPresent()) {
+            log.info("event=onnx_intra_op_threads_configured threads={} source=cpu_limit host_processors={} "
+                    + "shared_session=true", limited.getAsInt(), host.getAsInt());
         } else {
             log.info("event=onnx_intra_op_threads_configured threads=ort_default source=default shared_session=true");
         }
-        return threads;
+        return limited;
+    }
+
+    /** Linux: the CPUs online on the host, whatever cpuset or quota this process runs under. */
+    static final java.nio.file.Path HOST_CPUS_ONLINE = java.nio.file.Path.of("/sys/devices/system/cpu/online");
+
+    /**
+     * The intra-op count for a process that may use fewer processors than its host has
+     * ({@code available < host}): {@code available}. Empty when there is no limit or the host
+     * count is unknown, so the session keeps ORT's default.
+     */
+    static OptionalInt underCpuLimit(int available, OptionalInt host) {
+        if (host.isPresent() && available > 0 && available < host.getAsInt()) {
+            return OptionalInt.of(available);
+        }
+        return OptionalInt.empty();
+    }
+
+    /** The number of CPUs listed in a kernel CPU-list file such as {@code online}; empty if unreadable. */
+    static OptionalInt hostProcessors(java.nio.file.Path cpuListFile) {
+        try {
+            return cpuListCount(java.nio.file.Files.readString(cpuListFile));
+        } catch (java.io.IOException | RuntimeException e) {
+            return OptionalInt.empty();
+        }
+    }
+
+    /** Counts a kernel CPU list ({@code "0-63"}, {@code "0-3,8-11"}, {@code "5"}); empty when it is not one. */
+    static OptionalInt cpuListCount(String list) {
+        if (list == null || list.isBlank()) return OptionalInt.empty();
+        int count = 0;
+        for (String part : list.trim().split(",")) {
+            String[] ends = part.trim().split("-", -1);
+            try {
+                int lo = Integer.parseInt(ends[0].trim());
+                int hi = ends.length == 2 ? Integer.parseInt(ends[1].trim()) : lo;
+                if (ends.length > 2 || lo < 0 || hi < lo) return OptionalInt.empty();
+                count += hi - lo + 1;
+            } catch (NumberFormatException e) {
+                return OptionalInt.empty();
+            }
+        }
+        return count > 0 ? OptionalInt.of(count) : OptionalInt.empty();
     }
 
     /**
      * Env-injectable resolver (tests never mutate real process env).
      *
-     * <p>Empty when {@code NX_ONNX_INTRA_OP_THREADS} is unset or blank: the
-     * session keeps ORT's default, see the class javadoc for why it is never
-     * derived from cores or permits here. A set value is applied verbatim; a
+     * <p>Empty when {@code NX_ONNX_INTRA_OP_THREADS} is unset or blank: no
+     * operator override. The no-arg entry point then applies the CPU-limit
+     * rule or keeps ORT's default (class javadoc). A set value is applied verbatim; a
      * non-positive or non-numeric value is REFUSED loudly
      * (no-silent-fallbacks-for-correctness).
      */

{conexus-7.77.0 → conexus-7.78.0}/service/src/main/java/dev/nexus/service/vectors/OrtInitGate.java

@@ -74,14 +74,24 @@ import java.util.function.UnaryOperator;
  * init on hellmini (M-series, external NVMe): 0.56 to 0.60 s warm (4 runs); after
  * {@code purge} 0.73, 0.73, 0.80, 0.94, 2.08, 4.83 and 4.97 s (7 runs). So 3 s
  * covers warm and most cold starts, and the worst cold start (about 5 s) does NOT
- * fit any bound that also fits a 5 s grace: there the wait expires and exit can
- * still crash. Raise the bound and the stop grace together on such hosts. On expiry
- * exit proceeds anyway and
- * logs {@code event=ort_init_shutdown_wait_timeout}; an operator whose disk makes
- * init slower than the bound can raise it together with the stop grace.
+ * fit any bound that also fits a 5 s grace. An operator whose disk makes init
+ * slower than the bound can raise it together with the stop grace.
  * {@code tests/test_ort_init_gate_bound_lint.py} fails if the default reaches the
  * supervisor's grace.
  *
+ * <p><b>When the bound expires</b> (nexus-y6aj0) native work is still live, so the
+ * hook phase must not start at all: {@code System.exit} there is the original
+ * crash (observed on a 6-CPU cgroup with five suites running:
+ * {@code ort_init_shutdown_wait_timeout in_flight=1 bound_ms=3000}, then SIGSEGV
+ * in libonnxruntime). The deferred-exit thread instead logs
+ * {@code event=ort_init_shutdown_halt}, runs the {@link #onBoundExpired cleanup
+ * the application registered} (the parts of its shutdown hook that do not touch
+ * ORT), and ends the process with {@link ImmediateExit libc _exit(128+n)}. No Java
+ * hook runs, so onnxruntime-java's closer never releases the environment under
+ * the live work; no static destructor runs either, which {@code Runtime.halt} does
+ * not give (measured: see {@link ImmediateExit}). The exit status is the one a
+ * clean stop gives. Sessions are not closed; the process is ending.
+ *
  * <p>Not covered: a {@code System.exit} called from application code while a
  * lazy init is in flight (the only callers are boot-time failure paths, which
  * run on the thread that would be initialising), and {@code Runtime.halt}
@@ -210,11 +220,16 @@ public final class OrtInitGate {
     private final long waitMillis;
     private final SignalInstaller signals;
     private final IntConsumer exitAction;
+    private final IntConsumer haltAction;
     private final List<String> exitSignals;
+    /** Application cleanup for the expired-bound path; see {@link #onBoundExpired}. */
+    private volatile Runnable boundExpiredCleanup;
+    /** One expired-bound exit per process: a second signal must not cut the first one's cleanup short. */
+    private final AtomicBoolean halting = new AtomicBoolean();
 
     OrtInitGate() {
         this(resolveWaitMillis(System::getenv), OrtInitGate::installJvmSignal, System::exit,
-                System.getProperty("os.name"));
+                ImmediateExit::exit, System.getProperty("os.name"));
     }
 
     /** Test seam: explicit bound, signal installer and exit action, on this JVM's own OS. */
@@ -224,12 +239,31 @@ public final class OrtInitGate {
 
     /** Test seam: as above with the OS name injected, so the Windows signal set runs on any host. */
     OrtInitGate(long waitMillis, SignalInstaller signals, IntConsumer exitAction, String osName) {
+        this(waitMillis, signals, exitAction, status -> { }, osName);
+    }
+
+    /** Test seam: as above with the expired-bound halt injected too. */
+    OrtInitGate(long waitMillis, SignalInstaller signals, IntConsumer exitAction, IntConsumer haltAction,
+                String osName) {
         this.waitMillis = waitMillis;
         this.signals = signals;
         this.exitAction = exitAction;
+        this.haltAction = haltAction;
         this.exitSignals = exitSignals(osName);
     }
 
+    /**
+     * Register what the application must still do when the wait bound expires with
+     * native work in flight (nexus-y6aj0). That path ends in {@link ImmediateExit},
+     * so no shutdown hook runs; this is the hook's replacement there. It must not
+     * close an ORT session or the environment (the reason hooks are skipped). It
+     * must be bounded: nothing else ends the process while it runs, and the stop
+     * grace keeps counting, so a slow cleanup is answered by SIGKILL.
+     */
+    public void onBoundExpired(Runnable cleanup) {
+        this.boundExpiredCleanup = cleanup;
+    }
+
     /** {@value #WAIT_ENV} as milliseconds, or {@link #DEFAULT_WAIT_MILLIS} when unset or invalid. */
     static long resolveWaitMillis(UnaryOperator<String> env) {
         String raw = env.apply(WAIT_ENV);
@@ -270,12 +304,37 @@ public final class OrtInitGate {
     /** Runs on the JVM's signal thread: hand the wait to a fresh thread, never block dispatch. */
     private void onExitSignal(int exitStatus) {
         Thread t = new Thread(() -> {
-            quiesce(waitMillis);
-            exitAction.accept(exitStatus);
+            if (quiesce(waitMillis)) {
+                // A later signal can find the work drained while an earlier one's expired-bound
+                // cleanup still runs; starting the hook phase beside it would run it twice.
+                if (!halting.get()) exitAction.accept(exitStatus);
+            } else {
+                haltWithNativeWorkInFlight(exitStatus);
+            }
         }, "ort-init-deferred-exit");
         t.start();
     }
 
+    /**
+     * The bound expired (or the wait was interrupted) with native work still live.
+     * {@code System.exit} would start onnxruntime-java's hook under it, so run the
+     * application's own cleanup and leave without the hook phase.
+     */
+    private void haltWithNativeWorkInFlight(int exitStatus) {
+        if (!halting.compareAndSet(false, true)) return;
+        Runnable cleanup = boundExpiredCleanup;
+        log.warn("event=ort_init_shutdown_halt status={} cleanup={} reason=native_work_in_flight",
+                exitStatus, cleanup != null);
+        if (cleanup != null) {
+            try {
+                cleanup.run();
+            } catch (Throwable t) {
+                log.warn("event=ort_init_shutdown_halt_cleanup_failed error=\"{}\"", t.toString());
+            }
+        }
+        haltAction.accept(exitStatus);
+    }
+
     /**
      * Mark one native model initialisation as in flight. Close the returned
      * scope in a {@code finally} once the init has returned or failed.
@@ -320,7 +379,8 @@ public final class OrtInitGate {
      * {@code timeoutMillis} for all in-flight work to return. Inits have no
      * canceller and are waited for.
      *
-     * @return true when nothing is in flight on return; false on timeout or interrupt
+     * @return true when nothing is in flight on return; false on timeout or interrupt,
+     *         in which case the caller must not start the JVM's hook phase
      */
     public boolean quiesce(long timeoutMillis) {
         long deadline = System.nanoTime() + TimeUnit.MILLISECONDS.toNanos(timeoutMillis);

{conexus-7.77.0 → conexus-7.78.0}/service/src/main/resources/META-INF/native-image/README.md

@@ -34,6 +34,13 @@ descriptor's `name`.
   (`GatedRun`); without the entry the native binary could not raise the
   exception the gate maps to a 503.
 
+- **`foreign.downcalls`: `void (jint)`** (hand-added, nexus-y6aj0)
+  The downcall `ImmediateExit` makes to libc `_exit(int)` through
+  `java.lang.foreign` when a stop's wait bound expires with ONNX Runtime work
+  still in flight. A trace never takes that path. Without the entry the native
+  binary logs `event=ort_init_immediate_exit_fallback` and leaves through
+  `Runtime.halt`. A re-trace drops this section; add it again.
+
 ## reflect-config.json
 
 - **`ch.qos.logback.classic.spi.LogbackServiceProvider`**

{conexus-7.77.0 → conexus-7.78.0}/service/src/main/resources/META-INF/native-image/traced/reachability-metadata.json

@@ -1,4 +1,14 @@
 {
+  "foreign": {
+    "downcalls": [
+      {
+        "returnType": "void",
+        "parameterTypes": [
+          "jint"
+        ]
+      }
+    ]
+  },
   "reflection": [
     {
       "type": "ai.djl.huggingface.tokenizers.jni.CharSpan",

{conexus-7.77.0 → conexus-7.78.0}/service/src/test/java/dev/nexus/service/MainPciWiringTest.java

@@ -38,7 +38,7 @@ class MainPciWiringTest {
         String src = code(main());
         int serviceStart = src.indexOf("service.start();");
         int sweepStart = src.indexOf("pciSweep.start();");
-        int hook = src.indexOf("Runtime.getRuntime().addShutdownHook");
+        int hook = shutdownSteps(src);
         int listenerStop = src.indexOf("service.stop();", hook);
         // nexus-43ulx.17: the pool's reaper and the builder's run together inside terminateAtShutdown.
         int reaper = src.indexOf("BackendReaper.terminateAtShutdown(", hook);
@@ -73,6 +73,40 @@ class MainPciWiringTest {
             .isIn(";", "}");
     }
 
+    /**
+     * nexus-y6aj0: the shutdown steps that do not touch ONNX Runtime live in one Runnable, because two paths run
+     * them: the shutdown hook, and the gate's expired-bound path, which leaves without the hook phase. The order
+     * pins in this class read that block.
+     */
+    private static int shutdownSteps(String src) {
+        int block = src.indexOf("Runnable stopAllButEmbedders = () -> {");
+        assertThat(block).as("the shared shutdown steps").isPositive();
+        return block;
+    }
+
+    @Test
+    void theHookAndTheExpiredBoundPathBothRunTheSharedSteps_andOnlyTheHookClosesEmbeddersAndThePool() throws Exception {
+        String src = code(main());
+        int block = shutdownSteps(src);
+        int blockEnd = matchingClose(src, src.indexOf('{', block));
+        int expired = src.indexOf("OrtInitGate.process().onBoundExpired(stopAllButEmbedders);");
+        int hook = src.indexOf("Runtime.getRuntime().addShutdownHook");
+        int hookRuns = src.indexOf("stopAllButEmbedders.run();", hook);
+        int embedders = src.indexOf("docEmbedRouter.close();", hook);
+        int poolClose = src.indexOf("ds.close();", hook);
+
+        assertThat(expired).as("the expired-bound path is handed the shared steps, nothing more").isGreaterThan(blockEnd);
+        assertThat(hook).isGreaterThan(blockEnd);
+        assertThat(hookRuns).as("the hook runs the shared steps first").isGreaterThan(hook);
+        assertThat(embedders).as("then closes the embedders").isGreaterThan(hookRuns);
+        assertThat(poolClose).as("then the pool").isGreaterThan(embedders);
+        String steps = src.substring(block, blockEnd);
+        assertThat(steps).as("the shared steps run with native model work possibly live: no session close, and no"
+            + " pool close, which can stall on a dead PG with nothing left to end the process")
+            .doesNotContain("EmbedRouter.close()").doesNotContain("ds.close()");
+        assertThat(src.indexOf("stopAllButEmbedders.run();", hookRuns + 1)).as("run once by the hook").isNegative();
+    }
+
     /** The validation catch must end the process; without it a refused boot runs on into the schema migration. */
     @Test
     void theValidationCatchReportsTheEvent_unwrapsTheInitializerError_andExitsOne() throws Exception {
@@ -118,7 +152,7 @@ class MainPciWiringTest {
         int sweepStart = src.indexOf("pciSweep.start();");
         int create = src.indexOf("PciReconciler.create(ds, adminConnection, pciBootNonce, pciSweep,");
         int reconcilerStart = src.indexOf("pciReconciler.start();");
-        int hook = src.indexOf("Runtime.getRuntime().addShutdownHook");
+        int hook = shutdownSteps(src);
         int stopBinding = src.indexOf("Runnable stopPciReconciler = pciReconciler::stop;");
         int listenerStop = src.indexOf("service.stop();", hook);
         int reconcilerStop = src.indexOf("stopPciReconciler.run();", hook);
@@ -166,7 +200,7 @@ class MainPciWiringTest {
     @Test
     void theShutdownReaperIsHandedTheAdminValuesAndThisBootsBuilderName() throws Exception {
         String src = code(main());
-        int hook = src.indexOf("Runtime.getRuntime().addShutdownHook");
+        int hook = shutdownSteps(src);
 
         assertThat(src.substring(hook)).as("inside the hook, the one seven-argument call")
             .containsPattern("BackendReaper\\.terminateAtShutdown\\(\\s*dbUrl,\\s*dbUser,\\s*dbPass,\\s*"

{conexus-7.77.0 → conexus-7.78.0}/service/src/test/java/dev/nexus/service/ReadPathLeafPruningIntegrationTest.java

@@ -656,10 +656,19 @@ class ReadPathLeafPruningIntegrationTest {
      * Each figure, at 2 tenants and at 300, is the best (lowest) p95 of this many sets, so both phases are read
      * with the same statistic. A box that is also running a build or another suite inflates single sets by 5x and
      * more in either phase; a planning cost that GROWS with the tenant count shows in every set, so the minimum
-     * keeps the signal and drops the load. The bound itself is the RDR's, unchanged: p95 at 300 tenants at most
-     * 2x the 2-tenant p95 and at most 25 ms, no floor.
+     * keeps the signal and drops the load. The bound is the RDR's: p95 at 300 tenants at most 2x the 2-tenant p95
+     * (see {@link #TS2_RATIO_MIN_DIFF_MS}) and at most 25 ms.
      */
     private static final int TS2_ATTEMPTS = 5;
+    /**
+     * The 2x rule fails a family only when the 300-tenant p95 is also more than this many ms above the 2-tenant
+     * p95 (RDR-225 amendment of 2026-10-12). A family that plans in 0.6 ms moves by 0.6 ms from one phase to the
+     * next on a shared box, in either direction, and that alone is 2x: on develop aa226556f assign_from_chashes
+     * 1024 read 1.232 ms against 0.600 ms (2.05x) while text_gate_probe 768 went from 1.326 ms DOWN to 0.669 ms.
+     * A planning cost that grows with the tenant count is far above this: the control, plain_search_1024 with its
+     * tenant predicate removed, reads 15.4 ms against 0.9 ms. The 25 ms cap has no such allowance.
+     */
+    private static final double TS2_RATIO_MIN_DIFF_MS = 2.0;
 
     /** Families whose body is not inlined into the caller's statement: the call is timed, with its inner planning. */
     private static final Set<String> TS2_OPAQUE = Set.of("text_gate_probe", "assign_from_chashes", "cross_preview");
@@ -667,6 +676,23 @@ class ReadPathLeafPruningIntegrationTest {
     /** The pool TS2 times on: its sessions were opened with auto_explain off (see the test). */
     private TenantScope ts2Scope;
 
+    /** The TS2 rule on one family's two figures, in ms. */
+    static boolean ts2Violates(double p2, double p300) {
+        boolean overRatio = p300 > 2 * p2 && p300 - p2 > TS2_RATIO_MIN_DIFF_MS;
+        return overRatio || p300 > 25.0;
+    }
+
+    /** The rule on recorded figures: the row that failed on noise passes, and the pruning control still fails. */
+    @Test
+    void ts2Rule_passesSubMillisecondNoise_andFailsThePruningControlAndTheCap() {
+        assertThat(ts2Violates(0.600, 1.232)).as("assign_from_chashes 1024 on develop aa226556f, 2.05x").isFalse();
+        assertThat(ts2Violates(0.9, 15.4)).as("plain_search_1024 with its tenant predicate removed").isTrue();
+        assertThat(ts2Violates(0.9, 3.0)).as("over 2x and 2.1 ms apart").isTrue();
+        assertThat(ts2Violates(0.9, 2.8)).as("over 2x but 1.9 ms apart").isFalse();
+        assertThat(ts2Violates(5.0, 9.0)).as("4 ms apart but under 2x").isFalse();
+        assertThat(ts2Violates(24.0, 25.5)).as("over the 25 ms cap, which has no allowance").isTrue();
+    }
+
     /** Best p95 of {@link #TS2_ATTEMPTS} sets of {@link #TS2_SAMPLES} timings of one family at one dimension, in ms. */
     private double ts2P95(String family, String coll) {
         double best = Double.MAX_VALUE;
@@ -702,7 +728,8 @@ class ReadPathLeafPruningIntegrationTest {
 
     /**
      * TS2, as the RDR writes it: every search family planned 200 times per set at 2 tenants and at 300, p95 at 300 at most
-     * twice the 2-tenant p95 and at most 25 ms. A family is timed as EXPLAIN of its call (parse and plan, no
+     * twice the 2-tenant p95 (counted only when the two differ by more than {@link #TS2_RATIO_MIN_DIFF_MS} ms) and
+     * at most 25 ms. A family is timed as EXPLAIN of its call (parse and plan, no
      * execution) when it is inlined into the caller's statement, and as the call itself when it is not (a
      * plpgsql function plans its own statements at call time: the probe, assign_from_chashes, cross_preview;
      * their inputs are four rows, so the call is dominated by planning). The numbers are printed for the record.
@@ -767,14 +794,15 @@ class ReadPathLeafPruningIntegrationTest {
                 double p2 = at2.get(key);
                 double p300 = ts2P95(family, coll);
                 table.append(String.format("  %-34s  2 tenants %7.3f   300 tenants %7.3f%n", key, p2, p300));
-                if (p300 > 2 * p2 || p300 > 25.0) failures.add(String.format("%s: p95 %.3f ms at 300 vs %.3f ms at 2", key, p300, p2));
+                if (ts2Violates(p2, p300)) failures.add(String.format("%s: p95 %.3f ms at 300 vs %.3f ms at 2", key, p300, p2));
             }
         }
         long end = System.nanoTime();
         table.append(String.format("  wall: warm pass %.1f s, 2-tenant pass %.1f s, 298 tenants created %.1f s, 300-tenant pass %.1f s%n",
             (warmDone - started) / 1e9, (at2Done - warmDone) / 1e9, (tenantsDone - at2Done) / 1e9, (end - tenantsDone) / 1e9));
         System.out.println(table);
-        assertThat(failures).as("TS2 (p95 at 300 tenants <= 2x the 2-tenant p95 and <= 25 ms):%n%s", table).isEmpty();
+        assertThat(failures).as("TS2 (p95 at 300 tenants <= 2x the 2-tenant p95, or within "
+            + TS2_RATIO_MIN_DIFF_MS + " ms of it, and <= 25 ms):%n%s", table).isEmpty();
     }
 
     /**