@@ -17,6 +17,7 @@ permissions:
 
 jobs:
   lint:
+    timeout-minutes: 30
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -29,6 +30,7 @@ jobs:
         run: ruff check backend ingestion tests
 
   typecheck:
+    timeout-minutes: 30
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -41,7 +43,14 @@ jobs:
         run: mypy backend ingestion router db
 
   test:
+    timeout-minutes: 30
     runs-on: ubuntu-latest
+    env:
+      DATABASE_URL: "postgresql+asyncpg://test:test@localhost:5432/test"
+      QDRANT_URL: "http://localhost:6333"
+      JWT_SECRET: "test-secret-for-ci"
+      API_KEY_SALT: "test-salt-for-ci"
+      CORS_ALLOWED_ORIGINS: '["http://localhost"]'
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
@@ -53,6 +62,7 @@ jobs:
         run: pytest -q --cov=backend --cov=ingestion --cov=router --cov=db --cov-fail-under=80
 
   security:
+    timeout-minutes: 30
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -111,6 +121,7 @@ jobs:
           PY
 
   frontend-security:
+    timeout-minutes: 30
     runs-on: ubuntu-latest
     defaults:
       run:
 
@@ -11,16 +11,16 @@
 (``RouterDecision`` / ``IngestOutcome`` / ``DocumentRecord`` etc.). Observable
 endpoint behavior is unchanged; the only difference is that the live
 dependency providers now construct these instead of raising a 503.
+
+Imports are intentionally lazy (issue #221): the heavy sub-modules pull in
+SQLAlchemy engines, the Qdrant client, and the Anthropic SDK. Importing them
+at module level would slow every worker startup even when only one adapter is
+needed. Consumers should import directly from the sub-module or rely on the
+dependency providers in ``backend.app.api.dependencies``.
 """
 
 from __future__ import annotations
 
-from backend.app.adapters.document_store import SqlAlchemyDocumentStore
-from backend.app.adapters.generation import ClaudeGenerationLLM
-from backend.app.adapters.ingestor import PipelineIngestor
-from backend.app.adapters.router import RouterModuleAdapter
-from backend.app.adapters.stores import QdrantVectorStore, SqlAlchemySectionStore
-
 __all__ = [
     "RouterModuleAdapter",
     "PipelineIngestor",
@@ -29,3 +29,31 @@
     "QdrantVectorStore",
     "ClaudeGenerationLLM",
 ]
+
+
+def __getattr__(name: str) -> object:
+    """Lazily import adapter classes on first attribute access.
+
+    Args:
+        name: The adapter class name being accessed.
+
+    Returns:
+        The requested adapter class.
+
+    Raises:
+        AttributeError: When ``name`` is not a known adapter.
+    """
+    _lazy_map = {
+        "SqlAlchemyDocumentStore": ("backend.app.adapters.document_store", "SqlAlchemyDocumentStore"),
+        "ClaudeGenerationLLM": ("backend.app.adapters.generation", "ClaudeGenerationLLM"),
+        "PipelineIngestor": ("backend.app.adapters.ingestor", "PipelineIngestor"),
+        "RouterModuleAdapter": ("backend.app.adapters.router", "RouterModuleAdapter"),
+        "QdrantVectorStore": ("backend.app.adapters.stores", "QdrantVectorStore"),
+        "SqlAlchemySectionStore": ("backend.app.adapters.stores", "SqlAlchemySectionStore"),
+    }
+    if name in _lazy_map:
+        import importlib
+        module_path, attr = _lazy_map[name]
+        module = importlib.import_module(module_path)
+        return getattr(module, attr)
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
@@ -19,7 +19,7 @@
 import datetime as _dt
 import logging
 
-from db.models import Document, ErasureOutbox, Section
+from db.models import ERASURE_STORE_VALUES, Document, ErasureOutbox, Section
 from sqlalchemy import func, select
 from sqlalchemy.exc import SQLAlchemyError
 from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
@@ -32,9 +32,6 @@
 
 _logger = logging.getLogger(__name__)
 
-_ERASURE_STORES: tuple[str, ...] = ("qdrant", "object_store", "postgres")
-"""Downstream stores a tombstone targets in the OAQ-2 outbox."""
-
 
 def _to_document_record(row: Document) -> DocumentRecord:
     """Project a ``db.models.Document`` row onto the backend DocumentRecord.
@@ -107,7 +104,15 @@ def from_database_url(cls, database_url: str) -> SqlAlchemyDocumentStore:
         Returns:
             A store bound to a freshly created async engine/session factory.
         """
-        engine = create_async_engine(database_url, pool_pre_ping=True)
+        engine_kwargs: dict[str, object] = {"pool_pre_ping": True}
+        if not database_url.startswith("sqlite"):
+            engine_kwargs.update(
+                pool_size=3,
+                max_overflow=7,
+                pool_timeout=30,
+                pool_recycle=3600,
+            )
+        engine = create_async_engine(database_url, **engine_kwargs)
         factory = async_sessionmaker(engine, expire_on_commit=False)
         return cls(factory)
 
@@ -259,7 +264,7 @@ async def tombstone_document(self, tenant_id: str, doc_id: str) -> bool:
                     if row is None:
                         return False
                     row.tombstoned_at = _dt.datetime.now(_dt.UTC)
-                    for store in _ERASURE_STORES:
+                    for store in ERASURE_STORE_VALUES:
                         session.add(
                             ErasureOutbox(
                                 doc_id=doc_id,
 
@@ -22,19 +22,48 @@
 from collections.abc import AsyncIterator
 
 from backend.app.api.interfaces import DependencyUnavailable, RoutedSection
+from backend.app.settings import get_settings
 
 DEFAULT_GENERATION_MODEL = os.environ.get("GENERATION_MODEL", "claude-opus-4-8")
 """Answer-synthesis model id (overridable via the GENERATION_MODEL env var)."""
 
-DEFAULT_MAX_TOKENS = int(os.environ.get("GENERATION_MAX_TOKENS", "16000"))
-"""Output token ceiling for a synthesized answer (must exceed DEFAULT_THINKING_BUDGET_TOKENS)."""
-
-DEFAULT_THINKING_BUDGET_TOKENS = 5000
-"""Default extended-thinking budget in tokens."""
-
 DEFAULT_STREAM_TIMEOUT = 300.0
 """Total timeout in seconds for a streaming answer generation call."""
 
+_THINKING_CAPABLE_MODELS = (
+    "claude-3-7",
+    "claude-opus-4",
+    "claude-sonnet-4",
+    "claude-haiku-4",
+    "claude-fable",
+)
+"""Model id prefixes that support extended thinking (budget_tokens parameter)."""
+
+
+def _default_max_tokens() -> int:
+    """Return the configured max-tokens ceiling, falling back to 16 000.
+
+    Returns:
+        The generation_max_tokens value from settings, or 16 000 on error.
+    """
+    try:
+        return get_settings().generation_max_tokens
+    except Exception:
+        return 16000
+
+
+def _default_thinking_budget() -> int:
+    """Return the configured thinking-budget token count, falling back to 5 000.
+
+    Returns:
+        The generation_thinking_budget_tokens value from settings, or 5 000 on error.
+    """
+    try:
+        return get_settings().generation_thinking_budget_tokens
+    except Exception:
+        return 5000
+
+
 _SYSTEM_PROMPT = (
     "You are a retrieval-augmented answer assistant. Answer the user's question "
     "using only the routed document sections provided as context. Cite section "
@@ -72,24 +101,32 @@ class ClaudeGenerationLLM:
     def __init__(
         self,
         model: str = DEFAULT_GENERATION_MODEL,
-        max_tokens: int = DEFAULT_MAX_TOKENS,
-        thinking_budget_tokens: int = DEFAULT_THINKING_BUDGET_TOKENS,
+        max_tokens: int | None = None,
+        thinking_budget_tokens: int | None = None,
         client: object | None = None,
     ) -> None:
         """Initialize the adapter.
 
         Args:
             model: Generation model id (defaults to Claude Opus 4.8).
-            max_tokens: Output token ceiling for the synthesized answer.
+            max_tokens: Output token ceiling for the synthesized answer. When
+                omitted, the value is read from settings (GENERATION_MAX_TOKENS).
             thinking_budget_tokens: Extended-thinking budget in tokens passed to
-                the Anthropic ``thinking`` parameter.
+                the Anthropic ``thinking`` parameter. When omitted, read from
+                settings (GENERATION_THINKING_BUDGET_TOKENS).
             client: Optional pre-built ``anthropic.AsyncAnthropic`` instance. When
                 omitted, one is constructed lazily on first use so importing this
                 module never requires credentials.
         """
         self._model = model
-        self._max_tokens = max_tokens
-        self._thinking_budget_tokens = thinking_budget_tokens
+        self._max_tokens = max_tokens if max_tokens is not None else _default_max_tokens()
+        self._thinking_budget_tokens = (
+            thinking_budget_tokens
+            if thinking_budget_tokens is not None
+            else _default_thinking_budget()
+        )
+        if self._thinking_budget_tokens >= self._max_tokens:
+            self._thinking_budget_tokens = max(1000, self._max_tokens - 1000)
         self._client = client
         self._client_lock = asyncio.Lock()
 
@@ -155,17 +192,26 @@ async def stream_answer(
             "</routed_sections>\n\n"
             "Answer the question using only the information in the routed sections above."
         )
+        stream_kwargs: dict[str, object] = {
+            "model": self._model,
+            "max_tokens": self._max_tokens,
+            "system": _SYSTEM_PROMPT,
+            "messages": [{"role": "user", "content": user_message}],
+            "timeout": DEFAULT_STREAM_TIMEOUT,
+        }
+        if any(self._model.startswith(prefix) for prefix in _THINKING_CAPABLE_MODELS):
+            stream_kwargs["thinking"] = {
+                "type": "enabled",
+                "budget_tokens": self._thinking_budget_tokens,
+            }
         try:
             async with client.messages.stream(  # type: ignore[attr-defined]
-                model=self._model,
-                max_tokens=self._max_tokens,
-                thinking={"type": "enabled", "budget_tokens": self._thinking_budget_tokens},
-                system=_SYSTEM_PROMPT,
-                messages=[{"role": "user", "content": user_message}],
-                timeout=DEFAULT_STREAM_TIMEOUT,
+                **stream_kwargs
             ) as stream:
                 async for text in stream.text_stream:
                     yield text
+        except asyncio.CancelledError:
+            raise
         except DependencyUnavailable:
             raise
         except Exception as exc:
@@ -177,6 +223,7 @@ async def stream_answer(
                         _anthropic.RateLimitError,
                         _anthropic.AuthenticationError,
                         _anthropic.APIConnectionError,
+                        _anthropic.APIStatusError,
                     ),
                 ):
                     raise DependencyUnavailable(
 
@@ -192,12 +192,16 @@ async def ingest_document(
         Returns:
             An :class:`IngestOutcome` mirroring the openapi IngestResponse.
         """
+        # Pass residency_region into IngestInput so the pipeline persists it
+        # atomically inside the Postgres transaction that runs before Qdrant
+        # upsert, eliminating the DPDP split-brain window (issue #205).
         doc = IngestInput(
             data=content,
             tenant_id=tenant_id,
             title=title,
             domain=domain,
             no_retention=no_retention,
+            residency_region=residency_region,
         )
         try:
             result, deduplicated = await anyio.to_thread.run_sync(self._run_pipeline, doc)
@@ -240,28 +244,6 @@ async def ingest_document(
                 exc_info=True,
             )
 
-        if not no_retention and residency_region != "GLOBAL":
-            try:
-                await anyio.to_thread.run_sync(
-                    lambda: self._section_store.update_residency_region(
-                        doc_id_str, tenant_id, residency_region
-                    )
-                )
-            except OSError as exc:
-                _logger.error(
-                    "Failed to update residency_region after ingest",
-                    extra={
-                        "doc_id": doc_id_str,
-                        "tenant_id": tenant_id,
-                        "residency_region": residency_region,
-                    },
-                    exc_info=True,
-                )
-                raise DependencyUnavailable(
-                    f"Residency region update failed for doc {doc_id_str};"
-                    " DPDP FR-028 compliance at risk."
-                ) from exc
-
         toc = list(result.get("toc") or [])
         fallback_only = bool(result.get("fallback_only", False))
         extracted_title = result.get("title") or title
 
@@ -96,9 +96,12 @@ def _merge_fairly(
             if section.document_id is None
             else section.document_id
         )
-        grouped = by_doc.setdefault(group_key, [])
-        emission_index[id(section)] = len(grouped)
-        grouped.append(section)
+        by_doc.setdefault(group_key, []).append(section)
+
+    for grouped in by_doc.values():
+        grouped.sort(key=lambda s: -s.confidence)
+        for rank, section in enumerate(grouped):
+            emission_index[id(section)] = rank
 
     def _cross_doc_key(section: RoutedSection) -> tuple[float, str, int]:
         """Order tied cross-document sections independent of the request order."""
@@ -109,10 +112,6 @@ def _cross_doc_key(section: RoutedSection) -> tuple[float, str, int]:
         )
         return (-section.confidence, doc_sort_key, emission_index[id(section)])
 
-    for grouped in by_doc.values():
-        grouped.sort(
-            key=lambda s: (-s.confidence, emission_index[id(s)])
-        )
     representatives = [grouped[0] for grouped in by_doc.values()]
     remainder = [section for grouped in by_doc.values() for section in grouped[1:]]
     representatives.sort(key=_cross_doc_key)
@@ -177,6 +176,11 @@ def _routed_sections_from_output(
     for index, section_id in enumerate(relevant):
         record = toc_by_id.get(str(section_id))
         if record is None:
+            _logger.warning(
+                "Router returned section_id=%r not found in TOC for doc %r; dropping",
+                section_id,
+                doc_id,
+            )
             continue
         if index >= len(confidences):
             continue