@@ -52,13 +52,22 @@ trap cleanup EXIT
 java -cp "$JAR" net.ladenthin.llama.RpcServer --port "$RPC_PORT" --threads 2 --device CPU > rpc-server.log 2>&1 &
 PIDS+=($!)
 SERVER_PID=$!
-for _ in $(seq 1 60); do
+# Up to 300 s, like the NativeServer smoke: an all-backends jar extracts every GPU backend's
+# library (CUDA, ROCm and SYCL are hundreds of MB) and fails to load each before it reaches one
+# this GPU-less runner can load. 60 s was too short for that on the first CI run.
+for _ in $(seq 1 100); do
     kill -0 "$SERVER_PID" 2> /dev/null || fail "RpcServer exited before listening"
     grep -q "RpcServer listening on 127.0.0.1:$RPC_PORT" rpc-server.log && break
-    sleep 1
+    sleep 3
 done
 grep -q "RpcServer listening on 127.0.0.1:$RPC_PORT" rpc-server.log || fail "RpcServer never reported listening"
 grep -q "serving \[CPU\]" rpc-server.log || fail "RpcServer --device CPU did not serve exactly the CPU"
+# The backend is chosen once. RpcServer is the one entry point that reaches the loader before
+# LlamaModel, and JNI_OnLoad initializes LlamaModel, whose static block re-entered the loader and
+# ran a second complete load over the library being loaded (LlamaLoader.runOnceOnThisThread).
+# A manifest-less jar prints the line zero times.
+[ "$(grep -c '\[jllama\] using native backend' rpc-server.log)" -le 1 ] \
+    || fail "the native library was loaded more than once: $(grep -c '\[jllama\] using native backend' rpc-server.log) backend selections"
 echo "RPC server up: $(grep 'RpcServer listening' rpc-server.log)"
 
 # --- JVM B: the model, offloaded over RPC --------------------------------------------------------
 
@@ -54,6 +54,10 @@ from version 5.0.0 onward. Pre-fork releases (`1.x`–`4.2.0`) were authored by
   The served devices can be chosen by name (`RpcServer.startLocal(…, List<String> devices)`,
   `--device CPU`), because a served device that cannot run an operation terminates the server
   (llama.cpp's RPC client reports every operation as supported).
+- **`LlamaLoader` no longer loads the native library twice** when the first class to load it is not
+  `LlamaModel` (e.g. `TextToSpeech`, `LlamaQuantizer`, `RpcServer`): `JNI_OnLoad` initializes
+  `LlamaModel`, whose static block re-entered the loader and ran a second full load — with an
+  all-backends fat jar that meant re-extracting every GPU backend over the library being loaded.
 - **`.github/verify-native-deps.py`** holds every shipped native library to its known runtime
   dependencies (ELF, PE incl. Windows arm64, Mach-O). It found that the macOS dylib has always
   linked Homebrew's `openssl@3` (see `TODO.md`).
 
@@ -975,6 +975,15 @@ every `supports_op` with `true` (upstream TODO), so a served device that cannot
 **aborts the process** — the macOS CI runners' paravirtual Metal GPU has no `MUL_MAT` and took the
 first CI run down that way. **Every test that computes over RPC serves `CPU`** (C++ `loopback_server`,
 `RpcIntegrationTest`); do not switch one back to the default choice.
+**`RpcServer` is the first entry point that loads the library before `LlamaModel`, which exposed a
+loader defect** (fixed in `LlamaLoader.runOnceOnThisThread`): `JNI_OnLoad`'s `GetFieldID` on
+`LlamaModel` initializes that class, whose static block re-entered `LlamaLoader.initialize()` on the
+loading thread — the lock is reentrant, so a second complete load ran while the first was inside
+`System.load`, clearing the temp files and, with an all-backends jar, probing and extracting every
+backend again over the library being loaded. The fat-jar RPC smoke timed out on it (the doubled
+extraction of the CUDA/ROCm/SYCL libraries); it now waits 300 s like the other smoke and fails if the
+backend is selected more than once. Only the *nested* call is skipped — later calls still run the body,
+which `BackendManifestLoadTest` relies on.
 **Single instance per process** (ggml keeps the server state in globals). `startLocal` binds
 loopback only; `startOnNetwork` is the explicit, warned opt-in, and binding needs an IPv4 literal
 (the server uses `inet_addr`). Endpoints on the client side are `value.RpcEndpoint`
 
@@ -63,6 +63,10 @@ public class LlamaLoader {
     private static final Object INITIALIZE_LOCK = new Object();
 
     private static boolean extracted = false;
+
+    /** Whether {@link #initialize()} is running; only read and written under the lock. */
+    private static boolean initializing = false;
+
     private static final LlamaSystemProperties systemProperties = new LlamaSystemProperties();
     private static final NativeLibraryPermissionSetter permissionSetter = new NativeLibraryPermissionSetter(System.err);
 
@@ -123,23 +127,53 @@ private LlamaLoader() {}
      * Loads the llama and jllama shared libraries
      */
     public static void initialize() {
+        runOnceOnThisThread(LlamaLoader::load);
+    }
+
+    /**
+     * Runs {@code body} under the initialization lock, unless this thread is already inside it.
+     *
+     * <p>Loading the library re-enters {@link #initialize()} on the same thread: the library's
+     * {@code JNI_OnLoad} calls {@code GetFieldID} on {@code LlamaModel}, which initializes that class,
+     * whose static block calls {@code initialize()}. The lock is reentrant, so without this guard the
+     * nested call ran a second, complete load while the first was still inside {@code System.load}:
+     * it deleted the extracted files and, with a multi-backend jar, probed every backend again and
+     * extracted over the library being loaded. Any class but {@code LlamaModel} as the first entry
+     * point reached it -- {@code RpcServer} hung its fat-jar start that way. Calls from other threads,
+     * and later calls from this one, still run the body; only the nested one returns at once.
+     *
+     * @param body what to run
+     */
+    static void runOnceOnThisThread(Runnable body) {
         synchronized (INITIALIZE_LOCK) {
-            // only cleanup before the first extract
-            if (!extracted) {
-                cleanup();
+            if (initializing) {
+                return;
             }
-            if ("Mac".equals(OSInfo.getOSName())) {
-                String nativeDirName = getNativeResourcePath();
-                String tempFolder = getTempDir().getAbsolutePath();
-                System.out.println(nativeDirName);
-                Path metalFilePath = extractFile(nativeDirName, "ggml-metal.metal", tempFolder);
-                if (metalFilePath == null) {
-                    System.err.println("'ggml-metal.metal' not found");
-                }
+            initializing = true;
+            try {
+                body.run();
+            } finally {
+                initializing = false;
+            }
+        }
+    }
+
+    private static void load() {
+        // only cleanup before the first extract
+        if (!extracted) {
+            cleanup();
+        }
+        if ("Mac".equals(OSInfo.getOSName())) {
+            String nativeDirName = getNativeResourcePath();
+            String tempFolder = getTempDir().getAbsolutePath();
+            System.out.println(nativeDirName);
+            Path metalFilePath = extractFile(nativeDirName, "ggml-metal.metal", tempFolder);
+            if (metalFilePath == null) {
+                System.err.println("'ggml-metal.metal' not found");
             }
-            loadNativeLibrary("jllama");
-            extracted = true;
         }
+        loadNativeLibrary("jllama");
+        extracted = true;
     }
 
     /**
 
@@ -476,4 +476,37 @@ public void extractFileReplacesACopyWhoseContentDiffers() throws IOException {
         assertEquals(target, extracted);
         assertArrayEquals(testResourceBytes(), Files.readAllBytes(target));
     }
+
+    // The nested call is what JNI_OnLoad makes: GetFieldID on LlamaModel initializes it, and its
+    // static block calls initialize() again on the loading thread. It must not run a second load
+    // (with a multi-backend jar that deleted and re-extracted the library still being loaded).
+    @Test
+    public void aNestedInitializeOnTheLoadingThreadDoesNotRunTheBodyAgain() {
+        java.util.concurrent.atomic.AtomicInteger runs = new java.util.concurrent.atomic.AtomicInteger();
+        LlamaLoader.runOnceOnThisThread(() -> {
+            runs.incrementAndGet();
+            LlamaLoader.runOnceOnThisThread(runs::incrementAndGet);
+        });
+        assertEquals(1, runs.get());
+    }
+
+    @Test
+    public void aLaterInitializeStillRunsTheBody() {
+        java.util.concurrent.atomic.AtomicInteger runs = new java.util.concurrent.atomic.AtomicInteger();
+        LlamaLoader.runOnceOnThisThread(runs::incrementAndGet);
+        LlamaLoader.runOnceOnThisThread(runs::incrementAndGet);
+        assertEquals(2, runs.get(), "only a nested call is skipped; tests and later classes re-run it");
+    }
+
+    @Test
+    public void aFailingBodyDoesNotLeaveTheGuardSet() {
+        assertThrows(
+                IllegalStateException.class,
+                () -> LlamaLoader.runOnceOnThisThread(() -> {
+                    throw new IllegalStateException("load failed");
+                }));
+        java.util.concurrent.atomic.AtomicInteger runs = new java.util.concurrent.atomic.AtomicInteger();
+        LlamaLoader.runOnceOnThisThread(runs::incrementAndGet);
+        assertEquals(1, runs.get(), "a failed load must be retryable");
+    }
 }