conexus 7.86.2__tar.gz → 7.87.0__tar.gz

{conexus-7.86.2 → conexus-7.87.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: conexus
-Version: 7.86.2
+Version: 7.87.0
 Summary: Self-hosted semantic search and knowledge management for LLM-driven development
 Project-URL: Homepage, https://hellblazer.github.io/nexus/
 Project-URL: Repository, https://github.com/Hellblazer/nexus

{conexus-7.86.2 → conexus-7.87.0}/conexus/README.md

@@ -331,9 +331,6 @@ names each handler by its program and verb.
 | `UserPromptSubmit` | `hooks/scripts/mailbox_drain.py` | Claim, ack and render this session's RDR-205 mailbox rows; the unconditional delivery floor beneath the channel |
 | `PreToolUse` (`Bash`) | `hooks/scripts/routing/subagent_git_write_requires_orchestrator.py` | Deny index-writing / working-tree-destroying git verbs from subagents in the shared tree (RDR-184 Gap-4); a single ssh command to the chas test host is exempt, since its git runs there (nexus-yc7fs) |
 | `PreToolUse` (`Bash`) | `hooks/scripts/routing/credential_print_guard.py` | Deny commands that would reveal a Claude credential: a keychain read, a `.credentials.json` read, naming a protected token variable, or reading another process's environment (RDR-219 Gap 2, no escape) |
-| `PreToolUse` (`Bash`) | `hooks/scripts/routing/subagent_git_integrity_check.py` | Subagent calls: snapshot the project repository's shared state (config, config.worktree, hooks and any `core.hooksPath` target, info/attributes, info/exclude, HEAD, the checked-out branch's ref) before the call; never denies. Main-conversation calls: return the findings subagents queued, once, at this next Bash call (nexus-i93tz, phase 1) |
-| `PostToolUse` (`Bash`) | `hooks/scripts/routing/subagent_git_integrity_check.py` | Diff that snapshot after the call. A risky change blocks-with-report to the subagent and shows a user banner; routine upstream-tracking and HEAD movement are logged and queued only. Findings are queued for the orchestrator; reports, never restores. A missing snapshot is reported UNVERIFIED |
-| `PostToolUseFailure` (`Bash`) | `hooks/scripts/routing/subagent_git_integrity_check.py` | The same check for a Bash call that exits non-zero, which `PostToolUse` does not see |
 | `SubagentStart` | `hook_subagent_start` | Inject inherited context (active bead, session, MCP priority) into spawned subagents |
 | `PreToolUse` (`mcp__plugin_conexus_.*`) | `hooks/scripts/nx_hook_shim.py auto-approve` | Auto-approve nexus and nexus-catalog MCP tool calls; paired with the PermissionRequest entry below because the two events fire in different permission modes |
 | `PermissionRequest` (`mcp__plugin_conexus_.*`) | `hooks/scripts/nx_hook_shim.py auto-approve` | Auto-approve nexus and nexus-catalog MCP tool calls |

{conexus-7.86.2 → conexus-7.87.0}/conexus/hooks/scripts/routing/README.md

@@ -41,18 +41,22 @@ them sequentially. Current count (the review-coverage push gate,
 `git_add_all_redirects_to_explicit_paths`, was deleted 2026-08-22 —
 Sam's decision, see the file's former history; the bd-close review
 gate and the phase-review close gate were deleted at cleanup steps A2
-and A3, nexus-0r1uz):
+and A3, nexus-0r1uz; the subagent git-state integrity check, nexus-i93tz,
+was added and removed again, by Sam's decision of 2026-10-25):
 
 | Plugin | Routing rules | Other PreToolUse:Bash | Subtotal |
 |--------|----|----|----|
-| nx | 3 (`subagent_git_write`, `credential_print_guard`, `subagent_git_integrity_check`) | 0 | 3 |
+| nx | 2 (`subagent_git_write`, `credential_print_guard`) | 0 | 2 |
 | sn | 0 | 0 | 0 |
-| **Aggregate** | | | **3** |
-
-`subagent_git_integrity_check` (nexus-i93tz) is registered for three events on
-the Bash matcher (PreToolUse, PostToolUse, PostToolUseFailure). A Bash call
-fires PostToolUse or PostToolUseFailure, never both, so the per-call count the
-registration-surface lint holds to the cap is 2 + 1 + 1 = 4: at the cap.
+| **Aggregate** | | | **2** |
+
+**The subagent git-write guard is frozen** (Sam, 2026-10-25, nexus-i93tz). The
+integrity check that used to back it is gone, so the guard is the only line,
+and it changes only for a real incident. Routes it does not cover are known
+and accepted, and are not to be patched with more spellings: raw writes into
+`.git/config` and `.git/hooks`; index, ref and HEAD writers reached through
+plumbing; verbs held in `$VAR`; decode-then-exec; and writing a script and
+then running it. The guard's own KNOWN LIMITS docstring carries the same list.
 
 The cap is 4. Adding a fifth routing rule in any plugin requires either
 consolidation or a budget revision in a successor RDR. The

{conexus-7.86.2 → conexus-7.87.0}/docs/agents/README.md

@@ -12,7 +12,7 @@ Moved from AGENTS.md on 2026-10-14 (nexus-2ziaz). AGENTS.md is loaded into every
 | CI Cost Discipline | [ci-cost-discipline.md](ci-cost-discipline.md) | [`.claude/rules/ci-and-runners.md`](../../.claude/rules/ci-and-runners.md) |
 | Self-hosted runners and fork PRs | [self-hosted-runners.md](self-hosted-runners.md) | [`.claude/rules/ci-and-runners.md`](../../.claude/rules/ci-and-runners.md) |
 | Workflows § Release cadence policy | [release-cadence.md](release-cadence.md) | [`.claude/rules/releases-and-engine.md`](../../.claude/rules/releases-and-engine.md) |
-| Workflows § Independent plugin release channel | [plugin-release-channel.md](plugin-release-channel.md) | [`.claude/rules/releases-and-engine.md`](../../.claude/rules/releases-and-engine.md) |
+| Workflows § Plugin-only releases | [plugin-release-channel.md](plugin-release-channel.md) | [`.claude/rules/releases-and-engine.md`](../../.claude/rules/releases-and-engine.md) |
 | Workflows § Engine-service release (authority) | [engine-service-release.md](engine-service-release.md) | [`.claude/rules/releases-and-engine.md`](../../.claude/rules/releases-and-engine.md) |
 | Workflows § Cutting a release | [cutting-a-release.md](cutting-a-release.md) | [`.claude/rules/releases-and-engine.md`](../../.claude/rules/releases-and-engine.md) |
 | Worktrees: one session, one worktree | [worktrees.md](worktrees.md) | `AGENTS.md` |

{conexus-7.86.2 → conexus-7.87.0}/docs/rdr/README.md

@@ -215,7 +215,7 @@ An RDR (Research-Design-Review) is a short document that records a technical dec
 | [RDR-194](rdr-194-fk-census-structural-schema-warts.md) | Post-RDR-187 FK Census and Structural Wart Retirement: One chash Encoding, One doc_id Meaning, Tenant-Keyed Uniqueness Everywhere, One TTL Semantics, and Every Enforceable Relationship Enforced | Architecture | Closed | 2026-08-15 |
 | [RDR-195](rdr-195-voyage-batch-token-limit.md) | Token-Aware Voyage Batch Splitting: Make the 120K-Tokens-Per-Request Ceiling a Planned Bound Instead of an Opaque 500 | Bug Fix | Closed | 2026-08-19 |
 | [RDR-196](rdr-196-cost-aware-nx-answer.md) | Cost-Aware nx_answer: Per-Step Cost/Quality Telemetry, Per-Operator Model Routing, and Cost-Ranked Plan Choice — Closing the NOMA §5.1–5.3 Gap | Architecture | Closed | 2026-08-19 |
-| [RDR-197](rdr-197-plugin-only-release-channel.md) | Independent Plugin Release Channel (plugin-vX.Y.Z-n) | Architecture | Closed | 2026-08-22 |
+| [RDR-197](rdr-197-plugin-only-release-channel.md) | Independent Plugin Release Channel (plugin-vX.Y.Z-n) | Architecture | Superseded by T2 nexus/design-plugin-only-fast-lane.md, the plugin-only fast lane on the client release (nexus-rbmja; Sam, 2026-10-26) | 2026-08-22 |
 | [RDR-198](rdr-198-collapse-duplicated-client-transport.md) | Collapse the Duplicated Client Transport: One Pooled Connection to One Engine | Architecture | Closed | 2026-08-23 |
 | [RDR-199](rdr-199-indexing-lifecycle-ref-identity.md) | Indexing Lifecycle: Give the Corpus a Nameable Source Revision — Index the Mainline Ref from the Git Object Store, Diff-Driven and Opt-In | Architecture | Draft | 2026-08-23 |
 | [RDR-200](rdr-200-nx-answer-continuation-mode.md) | nx_answer Continuation Mode and the Composed-Retrieval Bridge Route | Architecture | Closed | 2026-09-01 |
@@ -228,7 +228,7 @@ An RDR (Research-Design-Review) is a short document that records a technical dec
 | [RDR-207](rdr-207-summarization-at-the-t2-expiry-boundary.md) | Summarization at the T2 Expiry Boundary — the Manage Phase RDR-057 Cut | Feature | Closed | 2026-09-12 |
 | [RDR-208](rdr-208-session-id-mail-addressing.md) | Session-Id Mail Addressing: One Mailbox per Session, Names Resolved at Send Time | Architecture | Closed | 2026-09-14 |
 | [RDR-209](rdr-209-heat-based-graduation-between-memory-tiers.md) | Heat-Based Graduation Between Memory Tiers | Feature | Draft | 2026-09-14 |
-| [RDR-210](rdr-210-dual-mode-local-engine.md) | One Local Engine Serves Both Embedders: bge-768 and Voyage Collections Side by Side | Architecture | Accepted | 2026-09-15 |
+| [RDR-210](rdr-210-dual-mode-local-engine.md) | One Local Engine Serves Both Embedders: bge-768 and Voyage Collections Side by Side | Architecture | Closed | 2026-09-15 |
 | [RDR-211](rdr-211-board-queue-and-lock-tuple-templates.md) | Broadcast Board, Work Queue, and Lock as Tuple-Space Templates | Feature | Closed | 2026-09-15 |
 | [RDR-212](rdr-212-orb-cockpit-surfaces-over-the-tuple-space.md) | ORB Cockpit Surfaces over the Tuple Space | Architecture | Draft | 2026-09-16 |
 | [RDR-213](rdr-213-channel-delivery-without-a-proof-gate.md) | Channel Delivery Without a Proof Gate: Notify a Reference, Let the Session Claim | Architecture | Closed | 2026-09-17 |
@@ -249,7 +249,8 @@ An RDR (Research-Design-Review) is a short document that records a technical dec
 | [RDR-229](rdr-229-collection-name-becomes-a-label.md) | The Collection Name Becomes a Label: Retiring What RDR-204 Left Reading the Name | Architecture | Draft | 2026-10-17 |
 | [RDR-230](rdr-230-event-keyed-reindex-and-recall-canary.md) | Event-Keyed REINDEX and a Recall Canary for Per-Collection HNSW Indexes | Architecture | Draft | 2026-10-18 |
 | [RDR-231](rdr-231-note-source-uri-scheme.md) | Note source_uri scheme: replace chroma:// with nx-note:// | Technical Debt | Draft | 2026-10-23 |
-| [RDR-232](rdr-232-nx-answer-shape-eligibility-and-evidence-sufficiency.md) | nx_answer Answer-Shape Eligibility and Evidence Sufficiency | Architecture | Draft | 2026-10-23 |
+| [RDR-232](rdr-232-nx-answer-shape-eligibility-and-evidence-sufficiency.md) | nx_answer Answer-Shape Eligibility and Evidence Sufficiency | Architecture | Accepted | 2026-10-23 |
+| [RDR-235](rdr-235-aspect-queue-onto-tuple-queue-template.md) | Aspect Extraction Queue onto the Tuple-Space Queue Template, and Why the PDF Pipeline Row Stays | Architecture | Draft | 2026-10-26 |
 
 > RDR-216 is unused on `develop`: drafted, gated BLOCKED, then abandoned 2026-09-19 without landing. Its measurements survive in T2 as `nexus_rdr/216-research-1` through `-19` and in `nexus/manticore-auto-chunking-analysis-2026-09-19`; the record itself never merged.
 

{conexus-7.86.2 → conexus-7.87.0}/mcpb/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "conexus-mcpb"
-version = "7.86.2"
+version = "7.87.0"
 description = "Conexus packaged as Claude Desktop .mcpb (Desktop Extension)"
 requires-python = ">=3.12,<3.14"
 dependencies = [
@@ -12,7 +12,7 @@ dependencies = [
     # the extension's plan cache picked a different embedder than the plugin's
     # and downloaded its own bge copy. Pinned by
     # tests/test_plugin_structure.py::test_mcpb_pins_bare_conexus.
-    "conexus>=7.86.2",
+    "conexus>=7.87.0",
 ]
 
 [tool.uv]

{conexus-7.86.2 → conexus-7.87.0}/pyproject.toml

@@ -12,7 +12,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "conexus"
-version = "7.86.2"
+version = "7.87.0"
 description = "Self-hosted semantic search and knowledge management for LLM-driven development"
 readme = { file = "README.md", content-type = "text/markdown" }
 requires-python = ">=3.12,<3.14"

{conexus-7.86.2 → conexus-7.87.0}/service/src/main/java/dev/nexus/service/db/CatalogRepository.java

@@ -5229,7 +5229,8 @@ public final class CatalogRepository {
          *  conflict is possible in practice. */
         PLAIN,
         /** Mirrors {@link #appendManifestChunks}' pre-existing minimal upsert: only
-         *  {@code chash}/{@code collection} are updated on conflict (chunk_index/line/char
+         *  {@code chash}/{@code collection} (and, nexus-tko2w, the section labels that describe the
+         *  chunk at the position, with their {@code labels_written} marker) are updated on conflict (chunk_index/line/char
          *  positions are NOT touched — this method's long-standing contract, unchanged). */
         UPSERT_APPEND,
         /** Mirrors the two RDR-176 ETL import paths' full-column upsert. */
@@ -5298,7 +5299,9 @@ public final class CatalogRepository {
         var insert = ctx.insertInto(CATALOG_DOCUMENT_CHUNKS,
                 CATALOG_DOCUMENT_CHUNKS.TENANT_ID, CATALOG_DOCUMENT_CHUNKS.DOC_ID, CATALOG_DOCUMENT_CHUNKS.POSITION, CHK_CHASH_HEX, CATALOG_DOCUMENT_CHUNKS.CHUNK_INDEX,
                 CATALOG_DOCUMENT_CHUNKS.LINE_START, CATALOG_DOCUMENT_CHUNKS.LINE_END, CATALOG_DOCUMENT_CHUNKS.CHAR_START, CATALOG_DOCUMENT_CHUNKS.CHAR_END,
-                CATALOG_DOCUMENT_CHUNKS.COLLECTION, CATALOG_DOCUMENT_CHUNKS.EMBEDDING_MODEL);
+                CATALOG_DOCUMENT_CHUNKS.COLLECTION, CATALOG_DOCUMENT_CHUNKS.EMBEDDING_MODEL,
+                CATALOG_DOCUMENT_CHUNKS.SECTION_TITLE, CATALOG_DOCUMENT_CHUNKS.SECTION_TYPE, CATALOG_DOCUMENT_CHUNKS.PAGE_NUMBER,
+                CATALOG_DOCUMENT_CHUNKS.LABELS_WRITTEN);
         for (var row : rows) {
             // hygiene-001 (nexus-tk070.p6a follow-on): catalog_document_chunks.chunk_index
             // is NOT NULL now — a client that omits it (the wire field predates this
@@ -5308,7 +5311,14 @@ public final class CatalogRepository {
             insert = insert.values(tenant, docId, i(row,"position"), s(row,"chash"),
                     ni(i(row,"chunk_index"), i(row,"position")),
                     i(row,"line_start"), i(row,"line_end"), i(row,"char_start"), i(row,"char_end"), coll,
-                    embeddingModel);
+                    embeddingModel,
+                    // nexus-tko2w (RDR-108): the per-position section labels and whether they are this
+                    // document's own answer (labels_written). A client that predates them sends no label
+                    // key: the columns stay NULL and labels_written false ("legacy", exactly the state of
+                    // every row written before catalog-046), and a reader then falls back to the chunk
+                    // row's own label for the row.
+                    s(row,"section_title"), s(row,"section_type"), i(row,"page_number"),
+                    labelsWritten(row));
         }
         switch (mode) {
             case PLAIN -> insert.execute();
@@ -5326,6 +5336,11 @@ public final class CatalogRepository {
                 // (tenant, collection, chash, model)); a conflict that re-points the row at another
                 // collection re-points its model with it.
                 .set(CATALOG_DOCUMENT_CHUNKS.EMBEDDING_MODEL, DSL.excluded(CATALOG_DOCUMENT_CHUNKS.EMBEDDING_MODEL))
+                // nexus-tko2w: the labels describe the chunk AT this position, so they follow its chash.
+                .set(CATALOG_DOCUMENT_CHUNKS.SECTION_TITLE, DSL.excluded(CATALOG_DOCUMENT_CHUNKS.SECTION_TITLE))
+                .set(CATALOG_DOCUMENT_CHUNKS.SECTION_TYPE, DSL.excluded(CATALOG_DOCUMENT_CHUNKS.SECTION_TYPE))
+                .set(CATALOG_DOCUMENT_CHUNKS.PAGE_NUMBER, DSL.excluded(CATALOG_DOCUMENT_CHUNKS.PAGE_NUMBER))
+                .set(CATALOG_DOCUMENT_CHUNKS.LABELS_WRITTEN, DSL.excluded(CATALOG_DOCUMENT_CHUNKS.LABELS_WRITTEN))
                 .execute();
             case UPSERT_IMPORT -> insert
                 .onConflict(CATALOG_DOCUMENT_CHUNKS.TENANT_ID, CATALOG_DOCUMENT_CHUNKS.DOC_ID, CATALOG_DOCUMENT_CHUNKS.POSITION)
@@ -5339,10 +5354,29 @@ public final class CatalogRepository {
                 // RDR-191: same reasoning as the UPSERT_APPEND arm above.
                 .set(CATALOG_DOCUMENT_CHUNKS.COLLECTION, EX_CHK_COLL)
                 .set(CATALOG_DOCUMENT_CHUNKS.EMBEDDING_MODEL, DSL.excluded(CATALOG_DOCUMENT_CHUNKS.EMBEDDING_MODEL))
+                .set(CATALOG_DOCUMENT_CHUNKS.SECTION_TITLE, DSL.excluded(CATALOG_DOCUMENT_CHUNKS.SECTION_TITLE))
+                .set(CATALOG_DOCUMENT_CHUNKS.SECTION_TYPE, DSL.excluded(CATALOG_DOCUMENT_CHUNKS.SECTION_TYPE))
+                .set(CATALOG_DOCUMENT_CHUNKS.PAGE_NUMBER, DSL.excluded(CATALOG_DOCUMENT_CHUNKS.PAGE_NUMBER))
+                .set(CATALOG_DOCUMENT_CHUNKS.LABELS_WRITTEN, DSL.excluded(CATALOG_DOCUMENT_CHUNKS.LABELS_WRITTEN))
                 .execute();
         }
     }
 
+    /**
+     * nexus-tko2w: whether an incoming manifest row's section labels are the document's own answer. An
+     * explicit boolean {@code labels_written} wins (a row read back from this engine and written again, as the
+     * re-embed move and a client's manifest rewrite do, says what it was: a legacy row stays legacy even
+     * though the read always carries the three label keys); otherwise the row is written iff it carries any
+     * of the three label keys (a client sends them all, "" for a chunk with no heading; a client that
+     * predates catalog-046 sends none, and so does a backfill, which must not mint authoritative labels).
+     */
+    private static boolean labelsWritten(Map<String, Object> row) {
+        if (row.get("labels_written") instanceof Boolean explicit) {
+            return explicit;
+        }
+        return row.containsKey("section_title") || row.containsKey("section_type") || row.containsKey("page_number");
+    }
+
     private static String writeManifestRows(DSLContext ctx, String tenant, String docId,
                                           String collection, List<Map<String, Object>> rows) {
         return writeManifestRows(ctx, tenant, docId, collection, rows, null, null, null, null, null);
@@ -7253,6 +7287,21 @@ public final class CatalogRepository {
                       .and(CATALOG_DOCUMENTS.DELETED_AT.isNull())));
     }
 
+    /**
+     * nexus-tko2w: the per-position section labels of one manifest row, as the wire carries them: the keys
+     * are always present. {@code labels_written} says whether the three are this document's own answer
+     * (true: an empty title or type means "none here", and the chunk row's label never overrides it) or the
+     * row predates catalog-046 / was written by a client that sends no labels (false: the labels are NULL
+     * because nothing was ever recorded, and a reader may fall back to the chunk row's label).
+     */
+    private static void putSectionLabels(Map<String, Object> m, String title, String type, Integer page,
+                                         boolean labelsWritten) {
+        m.put("section_title", title);
+        m.put("section_type",  type);
+        m.put("page_number",   page);
+        m.put("labels_written", labelsWritten);
+    }
+
     /**
      * Get manifest rows for docId, ordered by position. Tombstoned docs read empty (nexus-mqd6t).
      *
@@ -7267,7 +7316,9 @@ public final class CatalogRepository {
         return tenantScope.withTenant(tenant, ctx ->
             ctx.select(CATALOG_DOCUMENT_CHUNKS.DOC_ID, CATALOG_DOCUMENT_CHUNKS.POSITION, CHK_CHASH_HEX, CATALOG_DOCUMENT_CHUNKS.CHUNK_INDEX,
                        CATALOG_DOCUMENT_CHUNKS.LINE_START, CATALOG_DOCUMENT_CHUNKS.LINE_END, CATALOG_DOCUMENT_CHUNKS.CHAR_START, CATALOG_DOCUMENT_CHUNKS.CHAR_END,
-                       CATALOG_DOCUMENT_CHUNKS.COLLECTION)
+                       CATALOG_DOCUMENT_CHUNKS.COLLECTION,
+                       CATALOG_DOCUMENT_CHUNKS.SECTION_TITLE, CATALOG_DOCUMENT_CHUNKS.SECTION_TYPE, CATALOG_DOCUMENT_CHUNKS.PAGE_NUMBER,
+                       CATALOG_DOCUMENT_CHUNKS.LABELS_WRITTEN)
                .from(CATALOG_DOCUMENT_CHUNKS)
                .where(CATALOG_DOCUMENT_CHUNKS.DOC_ID.eq(docId).and(liveParentDoc(ctx, tenant)))
                .orderBy(CATALOG_DOCUMENT_CHUNKS.POSITION)
@@ -7282,6 +7333,7 @@ public final class CatalogRepository {
                    m.put("char_start",  r.value7());
                    m.put("char_end",    r.value8());
                    m.put("collection",  r.value9());
+                   putSectionLabels(m, r.value10(), r.value11(), r.value12(), Boolean.TRUE.equals(r.value13()));
                    return m;
                })
         );
@@ -7929,7 +7981,10 @@ public final class CatalogRepository {
                 ctx.selectCount().from(all)
                    .where(all.DOC_ID.eq(CATALOG_DOCUMENT_CHUNKS.DOC_ID).and(liveParentDoc(ctx, tenant))));
             var rows = ctx.select(CHK_CHASH_HEX, CATALOG_DOCUMENT_CHUNKS.DOC_ID,
-                                  CATALOG_DOCUMENT_CHUNKS.POSITION, chunkCount)
+                                  CATALOG_DOCUMENT_CHUNKS.POSITION, chunkCount,
+                                  CATALOG_DOCUMENT_CHUNKS.COLLECTION,
+                                  CATALOG_DOCUMENT_CHUNKS.SECTION_TITLE, CATALOG_DOCUMENT_CHUNKS.SECTION_TYPE,
+                                  CATALOG_DOCUMENT_CHUNKS.PAGE_NUMBER, CATALOG_DOCUMENT_CHUNKS.LABELS_WRITTEN)
                           .from(CATALOG_DOCUMENT_CHUNKS)
                           .where(CHK_CHASH_HEX.in(chashes).and(liveParentDoc(ctx, tenant)))
                           .orderBy(CATALOG_DOCUMENT_CHUNKS.DOC_ID, CATALOG_DOCUMENT_CHUNKS.POSITION)
@@ -7941,6 +7996,13 @@ public final class CatalogRepository {
                 m.put("doc_id",      r.value2());
                 m.put("position",    r.value3());
                 m.put("chunk_count", r.value4());
+                // nexus-tko2w (additive): the row's own collection and per-position section labels, so a
+                // caller holding a chash resolves the label of THIS owner, not the shared chunk row's.
+                m.put("collection",  r.value5());
+                m.put("section_title", r.value6());
+                m.put("section_type",  r.value7());
+                m.put("page_number",   r.value8());
+                m.put("labels_written", Boolean.TRUE.equals(r.value9()));
                 out.add(m);
             }
             return out;
@@ -7962,7 +8024,9 @@ public final class CatalogRepository {
         return tenantScope.withTenant(tenant, ctx -> {
             var rows = ctx.select(CATALOG_DOCUMENT_CHUNKS.DOC_ID, CATALOG_DOCUMENT_CHUNKS.POSITION, CHK_CHASH_HEX, CATALOG_DOCUMENT_CHUNKS.CHUNK_INDEX,
                                   CATALOG_DOCUMENT_CHUNKS.LINE_START, CATALOG_DOCUMENT_CHUNKS.LINE_END, CATALOG_DOCUMENT_CHUNKS.CHAR_START, CATALOG_DOCUMENT_CHUNKS.CHAR_END,
-                                  CATALOG_DOCUMENT_CHUNKS.COLLECTION)
+                                  CATALOG_DOCUMENT_CHUNKS.COLLECTION,
+                                  CATALOG_DOCUMENT_CHUNKS.SECTION_TITLE, CATALOG_DOCUMENT_CHUNKS.SECTION_TYPE, CATALOG_DOCUMENT_CHUNKS.PAGE_NUMBER,
+                                  CATALOG_DOCUMENT_CHUNKS.LABELS_WRITTEN)
                           .from(CATALOG_DOCUMENT_CHUNKS)
                           // nexus-mqd6t: batch twin of getManifest's tombstone filter.
                           // Load-bearing beyond parity — HttpCatalogClient.docs_for_chashes
@@ -7984,6 +8048,7 @@ public final class CatalogRepository {
                 m.put("char_end",    r.value8());
                 // nexus-kzso5: row's own collection, same additive field as getManifest.
                 m.put("collection",  r.value9());
+                putSectionLabels(m, r.value10(), r.value11(), r.value12(), Boolean.TRUE.equals(r.value13()));
                 result.computeIfAbsent(docId, k -> new ArrayList<>()).add(m);
             }
             return result;

{conexus-7.86.2 → conexus-7.87.0}/service/src/main/java/dev/nexus/service/db/TaxonomyRepository.java

@@ -584,15 +584,50 @@ public final class TaxonomyRepository {
      * - projection rows: MAX(existing.similarity, incoming.similarity)
      * - non-projection rows: INSERT OR IGNORE (idempotent)
      */
-    public void assignTopic(String tenant, String docId, long topicId,
-                             String assignedBy, Double similarity,
-                             String sourceCollection, String assignedAt) {
-        tenantScope.withTenant(tenant, ctx -> {
+    public boolean assignTopic(String tenant, String docId, long topicId,
+                               String assignedBy, Double similarity,
+                               String sourceCollection, String assignedAt) {
+        return tenantScope.withTenant(tenant, ctx -> {
+            // nexus-2k8wi: a projection row onto a SUPERSEDED collection's topic is skipped (see
+            // supersededTopicIds); every other kind of write is unchanged.
+            if ("projection".equals(assignedBy) && !supersededTopicIds(ctx, tenant, List.of(topicId)).isEmpty()) {
+                return false;
+            }
             assignOne(ctx, tenant, docId, topicId, assignedBy, similarity, sourceCollection, assignedAt);
-            return null;
+            return true;
         });
     }
 
+    /**
+     * nexus-2k8wi: which of {@code topicIds} belong to a SUPERSEDED collection (a registry row whose
+     * {@code superseded_by} is non-empty). One statement for the whole batch, no per-row round trip.
+     *
+     * <p>A supersede tombstone keeps its topics and centroids, and a projection write names its target
+     * topic_id on the wire: {@code nx taxonomy project --persist} and {@code --backfill --persist} read
+     * each target collection's centroids by name and post the nearest one. Without this check a live
+     * collection's chunks attach to the retired collection's topics and raise their {@code doc_count},
+     * the defect the engine's own cross pass ({@code vectors-038-1}) no longer produces. Projection is by
+     * definition a nearest-foreign pick, so no flow writes it onto a retired target on purpose;
+     * centroid, manual and import writes are not checked (the {@code /import/*} verbs carry
+     * tombstoned collections as they were).
+     */
+    private static java.util.Set<Long> supersededTopicIds(DSLContext ctx, String tenant,
+                                                          java.util.Collection<Long> topicIds) {
+        if (topicIds.isEmpty()) return java.util.Set.of();
+        return new java.util.HashSet<>(ctx.select(TOPICS.ID)
+            .from(TOPICS)
+            .join(CATALOG_COLLECTIONS)
+            .on(CATALOG_COLLECTIONS.TENANT_ID.eq(TOPICS.TENANT_ID))
+            .and(CATALOG_COLLECTIONS.NAME.eq(TOPICS.COLLECTION))
+            .where(TOPICS.TENANT_ID.eq(tenant))
+            .and(TOPICS.ID.in(topicIds))
+            .and(coalesce(CATALOG_COLLECTIONS.SUPERSEDED_BY, "").ne(""))
+            .fetch(TOPICS.ID));
+    }
+
+    /** {@link #assignMany} outcome: rows written, and projection rows skipped for a superseded target. */
+    public record AssignManyResult(int persisted, int skippedSuperseded) {}
+
     /**
      * Batch upsert of topic assignments (bead nexus-71988). Loops the SAME two
      * insert shapes as {@link #assignTopic} inside ONE
@@ -604,10 +639,23 @@ public final class TaxonomyRepository {
      *
      * @param rows each carries doc_id/topic_id/assigned_by (required) and
      *             optional similarity/source_collection/assigned_at.
-     * @return number of rows submitted.
+     * @return number of rows written: the rows submitted less the projection rows skipped because
+     *         their topic belongs to a superseded collection (nexus-2k8wi).
      */
     public int assignMany(String tenant, List<Map<String, Object>> rows) {
-        if (rows == null || rows.isEmpty()) return 0;
+        return assignManyCounted(tenant, rows).persisted();
+    }
+
+    /**
+     * {@link #assignMany} with the skip count. nexus-2k8wi: a projection row whose topic belongs to a
+     * superseded collection is SKIPPED, not refused. The batch is mixed by construction (one persist
+     * call spans every target collection of a project run), so a refusal would roll back the live
+     * targets' rows with the retired one's, and an older client that still names the tombstone would
+     * fail whole batches instead of losing only those rows. The count is returned so the route can
+     * report it.
+     */
+    public AssignManyResult assignManyCounted(String tenant, List<Map<String, Object>> rows) {
+        if (rows == null || rows.isEmpty()) return new AssignManyResult(0, 0);
         // nexus-ps9wb: assignMany accumulates one row lock per assignOne across the
         // whole transaction, in arrival order. Two concurrent assignMany calls (the
         // flush-grain assign_many hook under multi-worker indexing) that touch
@@ -635,13 +683,23 @@ public final class TaxonomyRepository {
                 .filter(c -> c != null && !c.isBlank())
                 .distinct()
                 .forEach(c -> ensureCollectionRegistered(ctx, tenant, c));
+            java.util.Set<Long> retired = supersededTopicIds(ctx, tenant, ordered.stream()
+                .filter(r -> "projection".equals(reqS(r, "assigned_by")))
+                .map(r -> reqL(r, "topic_id"))
+                .distinct()
+                .toList());
+            int skipped = 0;
             for (Map<String, Object> r : ordered) {
+                if ("projection".equals(reqS(r, "assigned_by")) && retired.contains(reqL(r, "topic_id"))) {
+                    skipped++;
+                    continue;
+                }
                 assignOne(ctx, tenant, reqS(r, "doc_id"), reqL(r, "topic_id"),
                           reqS(r, "assigned_by"), optD(r, "similarity"),
                           optS(r, "source_collection"), optS(r, "assigned_at"),
                           false);
             }
-            return ordered.size();
+            return new AssignManyResult(ordered.size() - skipped, skipped);
         }));
     }
 
@@ -2438,18 +2496,17 @@ public final class TaxonomyRepository {
      *   <li>{@code never_discovered_count} — contributing collections with a NULL
      *       last_discover_at PLUS those with no taxonomy_meta row at all. Both are
      *       "never discovered" from the command's point of view.</li>
-     *   <li>{@code is_stale} — the hub has assignments newer than the latest discover,
-     *       or any contributing collection was never discovered.</li>
+     *   <li>{@code is_stale} — a contributing collection was discovered after the hub's
+     *       latest assignment (discover ran, projection did not), or any contributing
+     *       collection was never discovered. RDR-077 Phase 5 sense, Sam's ruling
+     *       2026-10-26 (nexus-9kp10); it read the reverse until then.</li>
      * </ul>
      *
-     * <p>{@code is_stale} IS COMPUTED HERE rather than client-side, deliberately, even
-     * though ICF and score are computed client-side. The oracle compared ISO-8601
-     * strings lexicographically, which was sound on SQLite's TEXT timestamps. Over HTTP
-     * the values cross as {@code OffsetDateTime.toString()}, which ELIDES ZERO SECONDS
-     * ("2026-04-09T00:00Z", not "...T00:00:00Z") — so the same lexicographic comparison
-     * would silently misorder timestamps that differ only in whether seconds were zero.
-     * Comparing real TIMESTAMPTZ values server-side avoids reintroducing that trap; the
-     * client passes the verdict through.
+     * <p>{@code is_stale} is compared on real TIMESTAMPTZ values here. Clients from
+     * nexus-9kp10 on re-derive it from {@code last_assigned_at},
+     * {@code max_last_discover_at} and {@code never_discovered_count} (parsed, not
+     * compared as strings), because engines before this change send the reverse
+     * sense; this verdict serves older clients, which pass it through.
      *
      * <p>One extra query, not N+1: taxonomy_meta is fetched once for every collection
      * referenced by any hub, then folded per topic in memory.
@@ -2538,7 +2595,7 @@ public final class TaxonomyRepository {
                 boolean isStale = neverCount > 0;
                 if (!isStale && maxDiscover != null
                         && lastAt instanceof OffsetDateTime assignedAt) {
-                    isStale = assignedAt.isAfter(maxDiscover);
+                    isStale = maxDiscover.isAfter(assignedAt);
                 }
                 m.put("max_last_discover_at", utcIso(maxDiscover));
                 m.put("never_discovered_count", neverCount);

{conexus-7.86.2 → conexus-7.87.0}/service/src/main/java/dev/nexus/service/http/ReembedHandler.java

@@ -549,6 +549,9 @@ public final class ReembedHandler implements HttpHandler {
                     + "; the source is not re-entered",
                 "job_id", earlier.jobId().toString(), "state", earlier.state())));
         }
+        // A re-entry moves documents into the target again: the engine must be able to embed for its model, as a
+        // start requires (nexus-6zchp; this path never ran through resolve).
+        requireServed(String.valueOf(targetRow.get("embedding_model")));
         final Event event;
         final State next;
         if (reader.anyCandidate(tenant, source)) {
@@ -741,6 +744,14 @@ public final class ReembedHandler implements HttpHandler {
                                 "job_id", job.jobId().toString(), "state", job.state())));
                         }
                     }
+                    if (event == Event.RESUME) {
+                        // Refuse up front a resume into a family the engine cannot embed for (nexus-6zchp). A target
+                        // that is gone needs no check here: the runner fails the job loud for it.
+                        Map<String, Object> targetRow = catalog.getCollection(tenant, job.targetCollection());
+                        if (targetRow != null) {
+                            requireServed(String.valueOf(targetRow.get("embedding_model")));
+                        }
+                    }
                     Optional<Job> updated = jobs.applyTransition(tenant, jobId, from.wire(), job.cutoverStep(),
                         a.next().wire(), new Transition(null, null, null, tokenCap));
                     if (updated.isPresent()) {

{conexus-7.86.2 → conexus-7.87.0}/service/src/main/java/dev/nexus/service/http/TaxonomyHandler.java

@@ -533,8 +533,9 @@ public final class TaxonomyHandler implements HttpHandler {
         String sourceCollection = optStringOrNull(body, "source_collection");
         String assignedAt      = optStringOrNull(body, "assigned_at");
         // VISITED (RDR-194 P3c, site 1/9): docId is hex; repo.assignTopic absorbs bytes.
-        repo.assignTopic(tenant, docId, topicId, assignedBy, similarity, sourceCollection, assignedAt);
-        HttpUtil.send(ex, 200, "{\"ok\":true}");
+        boolean written = repo.assignTopic(tenant, docId, topicId, assignedBy, similarity, sourceCollection, assignedAt);
+        // nexus-2k8wi: a projection onto a superseded collection's topic is skipped; the field is additive.
+        HttpUtil.send(ex, 200, written ? "{\"ok\":true}" : "{\"ok\":true,\"skipped_superseded\":true}");
     }
 
     /**
@@ -545,7 +546,9 @@ public final class TaxonomyHandler implements HttpHandler {
      * lands under ONE tenant transaction via
      * {@link dev.nexus.service.db.TaxonomyRepository#assignMany}, mirroring the
      * single-row {@link #handleAssign} semantics exactly. Cap
-     * {@value #MAX_ASSIGN_MANY} rows. Response 200 {@code {"persisted": N}}.
+     * {@value #MAX_ASSIGN_MANY} rows. Response 200
+     * {@code {"persisted": N, "skipped_superseded": M}}: nexus-2k8wi, a {@code projection} row whose topic
+     * belongs to a superseded collection is skipped and counted in M, not written and not refused.
      */
     @SuppressWarnings("unchecked")
     private void handleAssignMany(HttpExchange ex, String tenant, String method) throws IOException {
@@ -573,8 +576,9 @@ public final class TaxonomyHandler implements HttpHandler {
             requireString(row, "assigned_by");
             rows.add(row);
         }
-        int persisted = repo.assignMany(tenant, rows);
-        HttpUtil.send(ex, 200, json(Map.of("persisted", persisted)));
+        var result = repo.assignManyCounted(tenant, rows);
+        HttpUtil.send(ex, 200, json(Map.of("persisted", result.persisted(),
+                                           "skipped_superseded", result.skippedSuperseded())));
     }
 
     /**
@@ -1351,9 +1355,13 @@ public final class TaxonomyHandler implements HttpHandler {
 
     /**
      * GET /v1/taxonomy/centroids/foreign?collection= (required)
-     * All centroids in collections OTHER than the given one (cross-collection projection
-     * source set). Serves the oracle's compute_cross_links ($ne) directly and
-     * project_against ($in) via client-side filtering. Same row shape as by_collection.
+     * All centroids in collections OTHER than the given one, leaving out the centroids of any
+     * SUPERSEDED collection (nexus-2k8wi; the engine's cross pass skips them too). Serves
+     * {@code nx doctor}'s exact nearest-foreign recompute, {@code compute_cross_links} (discover's
+     * topic_links pass: a retired collection's topics get no new cross-links) and
+     * {@code compute_assignments(cross_collection=True)}. {@code project_against} does NOT use it: it
+     * reads each named target through {@code /centroids/by_collection}, which is unfiltered, and its
+     * persist is guarded in {@code assignMany}. Same row shape as by_collection.
      */
     private void handleCentroidForeign(HttpExchange ex, String tenant, String method) throws IOException {
         requireMethod(ex, method, "GET");

{conexus-7.86.2 → conexus-7.87.0}/service/src/main/java/dev/nexus/service/http/VectorHandler.java

@@ -620,6 +620,17 @@ public final class VectorHandler implements HttpHandler {
      *
      * <p>Response 200: [{"id","content","distance","collection","retention", ...metadata}]
      *
+     * <p><b>Section labels (nexus-tko2w, additive).</b> A {@code where} naming {@code section_title},
+     * {@code section_type} or {@code page_number} is answered per (document, position) from the catalog
+     * manifest, not from the shared chunk row (whose copy is the last writer's). A chunk held by several
+     * documents comes back once for each document whose label passes the filter, and those rows carry
+     * {@code doc_id}, {@code position} and that document's own labels; the limit applies after that
+     * expansion; with {@code include_source_uri} each of those rows carries its own document's URI, on {@code
+     * /hybrid-search} as on the other two routes. A manifest row whose {@code labels_written} is true is
+     * authoritative (an empty label is "none here"); only a legacy row falls back to the chunk row's label.
+     * A request without those keys is unchanged. Same behavior on {@code /search-per-collection} and {@code
+     * /hybrid-search}. See {@code ManifestLabelStage}.
+     *
      * <p>{@code retention} ({@code "full"} or {@code "reference-only"}, RDR-169 Phase B
      * fix round 1, Gap 2) and a nullable {@code content} are additive — existing consumers
      * that ignore the two new fields see the same shape they always have. A