Part I — The retrieval contract
Finding useful information
A search system selects and orders useful information from a larger collection in response to a query. The underlying discipline is usually called information retrieval. Search may help someone reach a known page, investigate a subject, discover unfamiliar items, filter a catalog, supply recommendation candidates, or locate evidence. None of those purposes requires a generated answer. If a model later turns retrieved passages into an answer, that separate evidence-to-answer problem belongs to Retrieval-Augmented Generation.
| Condition | Private collection | Public web |
|---|---|---|
| Membership | Chosen by an organization, connector, or product boundary | Distributed across independently operated sites |
| Authority | Often available from source identities and access-control lists | Public reachability is not permission for every use |
| Discovery | Databases, exports, connectors, or change feeds | Links, sitemaps, submitted URLs, and recrawling |
| Change | Source-specific updates and revocations | Pages appear, move, duplicate, redirect, and disappear |
| Coverage | Bounded only if the source interface supports defensible enumeration | No central registry makes complete discovery impossible to assume |
Need, Query, Corpus, and Result
An information need is the task to be satisfied; a query is the submitted expression of that need. The corpus is the collection against which search runs, and the retrieval unit is what the system ranks—perhaps a document, passage, product, page, or database record. Relevance is therefore conditional: an item is useful for a particular need, corpus, unit, user context, and time. The same query can require one known destination in a navigational task but exhaustive coverage in an audit or counting task.
A top-k response contains the first items under a ranking rule. Ranking compares results with one another; even the highest-ranked result may not satisfy the information need. Nor does a shortlist establish completeness: returning five matching documents is not proof that only five matching entities exist. Raw search scores usually order items within one configured query. They need not be probabilities or remain comparable after the corpus, query, or scoring configuration changes.
| Field | What it establishes |
|---|---|
| sourceId and unitId | Stable source identity and the particular ranked representation |
| rank and scoreType | Ordering and the meaning of the score—not calibrated confidence unless separately established |
| sourceRevision and retrievedAt | Which source state the result refers to and when it was observed |
| eligibility constraints | Filters and authority applied to this request |
| coverage status | Whether execution completed, degraded, timed out, or omitted sources |
Part II — Building the searchable collection
Acquisition Guarantees
Search can query an external provider or build its own collection. A local index copies or derives records from databases, exports, connectors, or change feeds. Federated search sends live queries to independently operated collections and merges their responses. A search API returns a bounded provider-ranked list through provider-specific semantics. These modes expose different knowledge about enumeration, source versions, failures, and authorization.
| Mode | System can usually observe | Remaining uncertainty |
|---|---|---|
| Local collection | Record identities, processing state, index generation, and copied metadata | Whether source enumeration, permission synchronization, and deletion propagation are complete |
| Federated query | Which sources were contacted and which responses arrived | Cross-source score comparability, partial failure, and each source's internal coverage |
| Opaque search API | Submitted parameters and returned ranked results | Provider corpus coverage, ranking internals, hard caps, and unreturned matches |
Pagination completion means the documented page sequence ended; it is not automatically proof that the source exposed every eligible record. A successful batch envelope may hide per-item throttling failures. When a provider returns HTTP 429, retry behavior and durable progress determine whether synchronization is incomplete or merely delayed. Every accepted record should enter the collection with source identity, source time, acquisition time, provenance, and eligibility metadata. The broader rules are developed in Origins, times and permitted use and Establish permitted uses.
From Discovery to Searchable State
A crawler is an automated client that schedules locations to fetch. Its crawl frontier is the pending work. Starting from seed URLs, it discovers links or sitemap entries, obeys scope and politeness rules, resolves redirects, normalizes addresses, detects repeated content, and schedules revisits. Different URLs can return the same content, while generated addresses and session identifiers can create effectively unbounded crawler traps. The Robots Exclusion Protocol communicates requested crawling rules; it is not access authorization.
Fetching and publication remain separate. A conditional request can revalidate a representation without downloading its body, but it does not discover new URLs or update an index by itself. A fetch may redirect, remain unchanged, fail, parse incorrectly, violate acceptance rules, or produce a version awaiting index refresh. Private polling and change feeds replace link discovery with source-specific enumeration, yet retain the same distinction among acquisition, processing, publication, and deletion.
Retrieval Turning Points
Search developed along several complementary lines: representing documents, comparing systems, and deciding which results deserve attention. These turning points explain why modern search combines methods rather than replacing every earlier technique.
| Development | Contribution |
|---|---|
| Statistical text searching — 1957 | Hans Peter Luhn proposed computing searchable representations from document language to help organize growing technical literature. |
| Cranfield comparative evaluation — 1966 | Cleverdon and Keen compared indexing approaches by retrieval performance, testing whether richer representations actually helped. |
| Probabilistic relevance weighting — 1976 | Stephen Robertson and Karen Spärck Jones used collection statistics and relevance information to weight discriminating query terms. |
| Okapi BM25 — 1994 experiments | The Okapi team combined term-frequency and document-length weighting in experiments at the Text REtrieval Conference (TREC). |
| Google's link and anchor evidence — 1998 | Brin and Page supplemented page text with incoming-link importance and the words other pages used to link to a destination. |
| RankNet — 2005 | Learned ordering from query-document features and relevance judgments; later LambdaRank and LambdaMART addressed the importance of mistakes near the top. |
| Reciprocal Rank Fusion — 2009 | Cormack, Clarke, and Büttcher combined result positions from multiple rankings without training a fusion model. |
| BERT passage reranking — first submitted 2019 | Nogueira and Cho applied a pretrained language model to query-passage pairs on a BM25 shortlist, strengthening a later ranking stage. |
| Dense Passage Retrieval — 2020 | Separate learned question and passage encoders enabled candidate retrieval with reusable, precomputed passage vectors. |
Part III — Representing and retrieving candidates
Choosing Searchable Units
The retrieval unit controls what can match and what evaluation counts. Whole documents preserve context but may mix several subjects. Chunking divides a document into smaller, independently searchable units. Those units can follow fixed sizes, sentences, sections, or combinations. Smaller units allow finer matches, but a statement may lose its heading, table header, or qualifying exception. Repeating headings or table headers preserves their meaning locally; overlapping adjacent chunks repeats boundary text to preserve continuity. The useful boundary depends on the document's structure and the questions search must answer.
Each chunk needs a key distinguishing it from other chunks and a parent identifier linking it to its source document. Retain the source revision and inherited metadata as well. A selector locates the chunk within that revision—for example, a character range measured against the extracted text. Without the revision, later edits can make the same range point to different content. Generated chunk keys may change when a parent changes, so they cannot replace stable source identity. Parent-child links also let deletion processing find the derived units to remove. Precise source coordinates are developed in Locate supporting source material.
Counting must use the intended unit. Twenty retrieved passages may belong to three documents; grouping by source can display one source with several passages, but grouping is not semantic deduplication. A question about the number of entities requires an enumerative or structured operation with population coverage, not a count of returned passages.
Terms and Posting Lists
An inverted index reverses the document-to-words relationship: each searchable term points to a posting list identifying the documents that contain it. Before building the index, an analyzer applies text-processing rules such as splitting text into tokens and lowercasing them. Index construction assigns document identifiers, sorts term-document pairs, and groups each term's entries into postings. A query can then look up document identities without scanning all source text. Query analysis must produce terms compatible with the indexed representation. Using identical analyzers is common, but compatibility means producing the intended matches, not merely choosing the same analyzer name.
| Document | Analyzed tokens | Positions for “vector” and “search” | Phrase “vector search”? |
|---|---|---|---|
| D1 | hybrid vector search | vector:2, search:3 | Yes: positions are adjacent |
| D2 | search combines vector methods | search:1, vector:3 | No: order and distance differ |
| D3 | vector database search | vector:1, search:3 | No: another token intervenes |
Positions belong to the indexed token stream; offsets locate matches in retained source text for highlighting. Term presence only produces candidates. It does not establish relevance, freshness, permission, or support for a later claim.
From matches to a candidate set
Posting-list matches can still be too numerous for expensive ranking. The eligible set contains the indexed units allowed by the request's mandatory filters and current authority. First-stage candidate generation selects a manageable subset of those units using a cheaper scoring rule. Its candidate depth is the maximum number passed onward, not the number ultimately displayed. To maintain a top-k shortlist, the engine keeps the best k scored items seen so far. Once that shortlist is full, its lowest score becomes the threshold a new item must beat to displace an existing item, subject to the declared tie rule.
Finding that shortlist need not require fully scoring every match. WAND uses upper bounds on query-term score contributions to skip documents that cannot beat the current threshold. Block-Max WAND tightens those bounds for blocks of postings. If a block's maximum possible score is strictly below the threshold, skipping it cannot change the top-k results. This is safe pruning: it reduces work while preserving the exact result under the supported scoring rule. Invalid bounds or more aggressive approximate pruning can instead omit competitive documents.
A valid bound can rule out competitive documents
A full two-item shortlist scores 9 and 7. Its current competitive threshold is 7.
Illustrative valid bounds; bars encode maximum possible document scores, not measured scores. The dashed line marks 7 on a common 0–10 scale.
| Posting block | Upper bound | Decision |
|---|---|---|
| A | 6 | Safe to skip: 6 < 7 |
| B | 7 | Consider further: ties depend on the tie rule |
| C | 10 | Consider further: may beat 7 |
One bound comparison within Block-Max WAND, not the complete pivot-selection algorithm.
Exactness here concerns the first-stage score, not relevance under every later model. Exhaustive scoring and safe pruning can produce the same shortlist; approximate execution can miss even that shortlist's best-scoring items. Either way, a relevant unit outside the admitted candidate set is unavailable to fusion or reranking. Increasing candidate depth can expose more items to those stages at additional cost, but cannot guarantee that the missing relevant unit appears. The next sections explain the lexical and vector scoring rules used to construct these shortlists.
Lexical Evidence and BM25
Lexical ranking goes beyond Boolean matching by weighting the evidence supplied by query terms. BM25 combines inverse document frequency, saturating term frequency, and document-length normalization. A rare query term can discriminate more strongly than a common one. Repetition adds evidence, but with diminishing returns. A match in a short field can be more concentrated than the same match in a long field. Parameters control saturation and the strength of length normalization and should be tuned on development judgments, not the final test collection.
Repetition saturates; length changes concentration
One query term; fixed IDF = 1 and average document length = 100 tokens. Document lengths stay at 50, 100, and 200 tokens.
Contribution = tf × (k₁ + 1) / [tf + k₁ × (1 − b + b × length / 100)]. Zero occurrences contribute zero.
| Document length | Occurrences | Contribution |
|---|---|---|
| 50 tokens | 3 | 1.7600 |
| 100 tokens | 3 | 1.5714 |
| 200 tokens | 3 | 1.2941 |
For the same frequency, length normalization changes how concentrated the match is. Increasing repetition has diminishing returns.
Text relevance and eligibility are different operations. A Boolean filter excludes a document without contributing a score; a title boost, inventory signal, or popularity feature changes ordering among eligible results. An item cannot compensate for failing a required tenant, date, status, or authorization filter by scoring highly elsewhere.
Lexical retrieval remains especially useful for exact identifiers, product codes, names, quoted phrases, and vocabulary already shared by queries and documents. Analysis can also destroy useful signals: indiscriminate stop-word removal may erase a quotation or negation, and the wrong language analyzer applies inappropriate stemming and frequency statistics. Raw scores should remain ranking values rather than percentages.
Dense and Approximate Retrieval
Lexical search depends on matching indexed terms. Dense retrieval can bridge differences in wording by comparing learned representations instead. An embedding is a vector—an array of numbers—produced by an encoder for a query or corpus unit. Corpus embeddings are computed and indexed ahead of time; a request encodes its query and compares it with compatible stored vectors. Candidate retrieval, not complete search develops this representation. Query and document preprocessing must follow the encoder's conventions, and nearest still means best under the chosen representation, metric, collection, and selection policy—not necessarily useful for the task.
Exhaustive nearest-neighbor search compares the query with every eligible vector. Approximate nearest-neighbor (ANN) search avoids some comparisons but can miss vectors that exhaustive search would return. Keep two questions separate: how well the index recovers the exact nearest vectors, and how useful those vectors' source items are to a person. Exact search provides a baseline for the first question, not the second.
Hierarchical Navigable Small World (HNSW) organizes vectors in layers of proximity graphs. Search moves through sparse upper layers, then explores more candidates near the bottom. Increasing exploration spends more work on neighbor recovery. IVFFlat, an inverted-file index, instead groups vectors into lists and searches selected nearby lists; increasing the number of lists probed broadens the search at additional cost.
Compression addresses a related resource problem. Product quantization divides a vector into smaller subvectors and represents each with a short code. Search can estimate distances from those codes, reducing storage while potentially changing neighbor order. Index traversal and compression therefore introduce distinct ways to lose exact neighbors; benchmark their combined settings rather than comparing speed alone.
Filters interact with approximation too. In Azure AI Search's HNSW implementation, a prefilter constrains eligibility during traversal and may require additional exploration when few candidates qualify. A postfilter removes ineligible items from an unfiltered shortlist, so the response can be short or empty even when eligible neighbors exist outside it. Speed comparisons must disclose the distance function, index settings, filter placement, requested neighbors, and recovery against exact search.
A postfilter cannot recover truncated neighbors
Eight fixed vectors; query Q = (0, 0), Euclidean distance, requested k = 3. This example uses exact distances to isolate filtering loss.
Exact eligible top-3C, E, F
Unfiltered input windowA, B, C
Window → filter → top-3C
Circles: EU · squares: US. Gold rings mark window membership; faded points fail the filter. Ties would use document ID.
1/3 result slots filled. Exact eligible neighbors omitted by the window: E, F.
Inspect all coordinates and distances
| ID | (x, y) | Region | Distance | Eligible | In window |
|---|---|---|---|---|---|
| A | (1, 0) | US | 1.000 | no | yes |
| B | (0, 2) | US | 2.000 | no | yes |
| C | (2, 2) | EU | 2.828 | yes | yes |
| D | (3, 0) | US | 3.000 | no | no |
| E | (0, 4) | EU | 4.000 | yes | no |
| F | (3, 4) | EU | 5.000 | yes | no |
| G | (6, 0) | US | 6.000 | no | no |
| H | (0, 7) | EU | 7.000 | yes | no |
Web Signals Beyond Text
Open-web ranking adds evidence unavailable in an isolated document collection. In Google's 1998 system paper, PageRank weighted incoming links using properties of their source pages, while anchor text associated other pages' descriptions with the destination. A resource could therefore receive textual evidence even when its own page text was unavailable. These signals complemented lexical retrieval rather than replacing it.
Link-derived importance is a prominence signal, not proof of topical relevance, authority, trustworthiness, or freshness. Web search must also reconcile duplicates and revisions, choose canonical identities, account for language or location, resist adversarial manipulation, and avoid lists that repeat the same information. Link manipulation exploits ranking signals by creating bogus pages that point to a target. In TrustRank, Gyöngyi, Garcia-Molina, and Pedersen's 2004 countermeasure, experts identify reputable seed sites and a biased PageRank computation propagates dampened trust through outgoing links. That score can filter an index or supplement other ranking signals. It assumes reputable pages seldom link to spam, so it is not a guarantee of trustworthiness or a description of current search engines. Maximum Marginal Relevance addresses a different list-level problem: select items by balancing query relevance with similarity to items already selected. Diversification still cannot recover an absent candidate.
Part IV — Combining and refining rankings
Hybrid Retrieval
Lexical and dense retrievers fail differently. Exact product names or identifiers favor lexical evidence; paraphrases and behaviorally related files with different vocabulary may favor dense representations. Hybrid retrieval runs complementary candidate generators and combines their identities. The combined system needs its own evaluation because an extra branch may add useful candidates, duplicates, irrelevant neighbors, latency, or all four.
RRF combines positions rather than pretending BM25 and vector-score magnitudes share a calibrated scale. Input windows and final output size remain distinct: increasing the displayed result count cannot restore candidates truncated before fusion. Weighted score fusion is another option, but its normalization range and weights become part of the retrieval contract.
Two ranked windows become one identity-based union
Lexical window (depth 3)1 A → 2 B → 3 C
Dense window (depth 3)1 B → 2 D → 3 A
Fixed example rankings; c = 60. Each present rank contributes 1/(60 + rank). Missing ranks contribute zero.
| Fused rank / ID | Lexical contribution | Dense contribution | Sum | Output (size 2) |
|---|---|---|---|---|
| 1 / B | rank 2: 1/62 | rank 1: 1/61 | 0.032522 | returned |
| 2 / A | rank 1: 1/61 | rank 3: 1/63 | 0.032266 | returned |
| 3 / D | absent: 0 | rank 2: 1/62 | 0.016129 | outside final 2 |
| 4 / C | rank 3: 1/63 | absent: 0 | 0.015873 | outside final 2 |
Reranking a Fixed Set
A reranker spends more computation on a bounded candidate set. A dual encoder represents query and document separately, enabling corpus vectors to be reused. A cross-encoder processes a query-candidate pair jointly, exposing interactions that independent vector comparison cannot. Because joint scoring is expensive across a large corpus, the usual architecture retrieves broadly and reranks a smaller shortlist.
The candidate set is a hard ceiling. The 2019 BERT passage-reranking work improved ordering on a BM25 shortlist but also identified questions whose relevant passage never reached that shortlist. No second-stage model can score an item it never receives. Candidate depth therefore trades opportunity against reranking cost, while input truncation can hide the very passage detail the reranker needs.
A learned relevance score is still not necessarily a calibrated probability or a complete product objective. Feature-based rankers may combine text, structure, popularity, and application signals. Diversity, deduplication, freshness, fairness, and business constraints are list-level or policy decisions that should remain distinguishable from query-item relevance.
Part V — Relevance evidence
Judgments Define the Target
A relevance judgment records an assessor's decision for a specified query, corpus unit, task, time, and rubric. Binary labels distinguish relevant from nonrelevant; graded labels distinguish degrees of usefulness. Passage and document tasks may assign different meanings to the same numeric grade. The resulting query-relevance files, commonly called qrels, are recorded measurements rather than universal truth.
Large collections are rarely judged exhaustively. Pooling combines leading results from participating systems and sends that subset for assessment. This makes evaluation practical but leaves unjudged documents and can affect systems that retrieve candidates unlike those that formed the pool. A deeper sampled assessment in the TREC 2006 Terabyte Track ranked systems somewhat differently from a shallow pool.
Disagreement may expose ambiguous intent, insufficient context, or a defective rubric. Preserve topical relevance, utility, authority, freshness, and satisfaction as separate concepts when the product decision needs them. Label design and disagreement handling are developed in Specify the label and Disagreement is diagnostic.
Metrics and Denominators
Rank-sensitive measures also account for where useful results appear.
- Precision@k and Recall@k — Apply the set measures to the first k results. With k results returned, precision divides relevant hits by k; recall divides them by the size of the relevant set.
- Reciprocal rank and MRR — Reciprocal rank is 1/r, where r is the first relevant result's rank, or zero if none appears within the cutoff. Mean reciprocal rank (MRR) averages this value across queries. Later relevant hits do not change it.
- Average precision — Rewards relevant results appearing consistently early, rather than considering only the first hit. Unlike precision at one cutoff, it assesses precision at successive relevant hits.
- Normalized discounted cumulative gain (nDCG) — Assigns gain to each relevance grade, discounts gain at later ranks, sums it, and divides by the gain of an ideal ordering at the same cutoff. One common convention uses gain 2^g−1 for grade g and discount log2(i+1) at rank i. State the convention: linear gains and different ideal denominators measure something different.
For example, suppose a query has two relevant documents, found at ranks 2 and 4. At cutoff 3, precision is 1/3, recall is 1/2, and reciprocal rank is 1/2. At cutoff 4, precision rises to 2/4 and recall to 2/2, while reciprocal rank stays 1/2: the first relevant result has not moved. The measures disagree because they describe different properties of the same list.
The same judgments, different ranks and cutoffs
Four fixed documents. The known relevant set is always {B, D}; A and C are judged nonrelevant.
- 1. A · nonrelevant
- 2. B · relevant
- 3. C · nonrelevant
- 4. D · relevant · outside cutoff
Inspect discounted gains
| Rank / ID | Binary gain | Discount | Included gain |
|---|---|---|---|
| 1 / A | 0 | log₂(2) = 1.0000 | 0/1.0000 = 0.0000 |
| 2 / B | 1 | log₂(3) = 1.5850 | 1/1.5850 = 0.6309 |
| 3 / C | 0 | log₂(4) = 2.0000 | 0/2.0000 = 0.0000 |
| 4 / D | 1 | log₂(5) = 2.3219 | 0: outside cutoff |
Gain = 2ᵍ − 1 for binary grade g. Ideal gain places the two known relevant documents first, taking only the first k positions: 1 + 1/log₂(3) = 1.6309. Relevant documents outside the observed cutoff still belong in the ideal ordering.
Define how per-query results become an aggregate. Averaging query scores gives each included query equal weight; pooling retrieved and relevant counts can give larger result sets more influence. A zero denominator requires an explicit reporting convention. Reports must also name the retrieval unit, relevance scale, cutoff, corpus and judgment versions, tie handling, and treatment of unjudged items, timeouts, and unresolved runs. An unjudged item may count as nonrelevant in a scoring implementation without having been assessed as nonrelevant. General reporting discipline is developed in Keep denominators visible.
Keep operational measures separate from relevance measures. Execution coverage describes how much of the requested search completed. Exact-vector recall describes recovery of nearest vectors under a metric. Neither establishes how much useful information the user received.
Offline and Live Evaluation
An offline test collection binds a corpus snapshot, information needs, judgments, retrieval configurations, and per-query runs. Candidate recall and final ranking should be measured separately: a reranker should not be blamed for a passage absent from its input. Representative queries estimate behavior for the intended workload; challenge slices deliberately concentrate difficult or consequential conditions. Keep paired per-query changes visible rather than relying only on an aggregate.
Production feedback adds information but changes the observation process. Clicks depend on exposure and rank position; no click may mean dissatisfaction or successful completion directly from a result page. In Team-Draft interleaving, two rankers contribute to one displayed list and clicks are credited to contributors, supporting a relative comparison under shared exposure. It does not turn clicks into universal relevance labels.
Offline relevance, user satisfaction, and business outcomes can disagree. Pinterest, for example, reported human-assessed relevance separately from search fulfillment actions. A ranking gain should not automatically be translated into reduced user effort. Sampling and matched-comparison methods are covered in Sample the intended work and Compare changes on matched work; incomplete production feedback and live experiments belong to Account for incomplete feedback and Choose the live experiment.
Part VI — Serving trustworthy results
Authority on Every Path
Authentication establishes the requesting actor; authorization decides which operations that actor may perform on resources. Search must apply current authority to candidate generation or safely compensate for filtering losses, then preserve it across reranking, snippets, facets, counts, caches, logs, and alternate lookups. Indexed principal identifiers are data used by an enforcement mechanism, not authentication or authorization by themselves.
An access-control list (ACL) records which users or groups may perform operations on a resource. Copying that information into an index allows retrieval to filter results, but the copy can become stale. Every independently searchable chunk needs the applicable permissions. Synchronization must handle changes inherited from parent resources as well as changes on the document itself; connector support for those paths varies. Content and permission updates must also stay consistent: checking new content against an older ACL can disclose it to a user whose access was revoked.
Visible hits are not the only disclosure surface. Global relevance statistics, terms, field names, aggregates, counts, timing, and shared caches can reveal information about inaccessible documents. Every query path should fail closed under missing identity or permission state. The general rule is Enforce current authority; model instructions are not an enforcement point.
Freshness, Deletion, and Cutover
Search freshness spans several clocks: source event, discovery, acquisition, parsing, index write, refresh, replica visibility, cache invalidation, and query time. A successful indexing request need not make a change immediately searchable. Waiting for refresh can establish visibility at that boundary; forcing refresh trades visibility latency against indexing and merge costs.
Out-of-order events can overwrite newer content or recreate a deleted result. External versions can reject stale writes. A tombstone retains a newer deletion state so delayed older work cannot treat absence as permission to recreate the item. Parent-to-child identities are required to remove derived chunks, and deletion markers must remain observable long enough for failed or delayed consumers.
Remember the deletion version before delayed work arrives
Source emission order
- Publish document v41
- Delete document v42
Consumer arrival order
- Delete document v42
- Delayed publish v41
| Consumer step | Retained state | Consequence |
|---|---|---|
| Accept delete v42 | v42 tombstone | Retain deletion version; initiate parent and derived-child removal. |
| Compare delayed write v41 | v42 tombstone | 41 < 42: reject the stale write before it can recreate the record. |
| Verify serving state | Version remains known | Check child removal, search visibility, replicas, and caches separately. |
Event positions express ordering, not elapsed time. Without retained version state, absence alone cannot distinguish a new item from this stale write.
A stable alias can switch queries from an old index generation to a rebuilt one, but a multi-action update can partially succeed unless failure semantics are configured appropriately. The cutover also does not coordinate query encoders, rerankers, or application caches automatically. Verify source state, active index generation, derived-record removal, replica visibility, cache behavior, and restoration paths independently. Maintenance and deletion obligations are developed in Maintain fitness through change and Propagate correction and deletion.
Latency and Degraded Coverage
A distributed search can send one request to several sources or shards, partitions of an index served separately. This fan-out lets branches retrieve candidates in parallel before their results are merged. The full request also includes query parsing or rewriting, permission checks, reranking, metadata or snippet retrieval, and response serialization. Elapsed time follows the critical path, the chain of operations that must finish before the response can complete. Parallel durations overlap, so adding them overstates elapsed time; merging waits for the branches the request requires.
Tail latency describes the slower end of the request-time distribution: p95, for example, is the time at or below which 95% of requests finish. Fan-out makes occasional component delays consequential because a request may wait for its slowest required branch. Propagate the remaining deadline downstream, and stop spawned work when cancellation arrives rather than merely ending the client's wait. Capacity tests must combine candidate depth, ANN exploration, restrictive filters, rerank depth, memory use, update traffic, and concurrent queries. A setting that is fast on an idle, read-only index may behave differently under the application's actual load.
A system may intentionally return partial results near a deadline, but the response must expose coverage and the reason for degradation. Execution coverage distinguishes timeouts, missing nodes, and configured matching limits; it is not relevance recall. A ranked list without execution status cannot safely be interpreted as a completed search.
Parallel retrieval and the request critical path
Example timingsA single slow required branch extends elapsed request time, while overlapping branch durations cannot be summed.
Read the diagram as text
- Search request. Parent operation from receipt through response. 0 to 190 ms; duration 190 ms.
- Plan identity, filters, deadline. Establish authenticated identity, current authority context, source filters, and the shared deadline. 0 to 15 ms; duration 15 ms. Parent: Search request.
- Source A · required. Required branch; enforce applicable authority during source retrieval. 15 to 65 ms; duration 50 ms. Parent: Search request.
- Source B · required. Longest required branch; enforce applicable authority during source retrieval. 15 to 115 ms; duration 100 ms. Parent: Search request.
- Source C · optional. Optional branch; enforce applicable authority. Completes in this depicted run. 15 to 80 ms; duration 65 ms. Parent: Search request.
- Merge candidates. Begins after required retrieval branches complete. 115 to 130 ms; duration 15 ms. Parent: Search request.
- Final authority recheck. Recheck current authority after merge; source branches have already enforced applicable authority. 130 to 142 ms; duration 12 ms. Parent: Search request.
- Rerank shortlist. More expensive scoring on bounded eligible candidates. 142 to 180 ms; duration 38 ms. Parent: Search request.
- Serialize complete response. All three requested source branches finished in this example; report complete execution coverage. 180 to 190 ms; duration 10 ms. Parent: Search request.
Part VII — Diagnosing the complete path
One Trace, Separate Claims
A retrieval trace should preserve the source and corpus snapshot, index generation, analyzer or encoder contract, query and filters, authenticated authority, first-stage candidates, fusion inputs, reranker version, stage timings, coverage status, and delivered identities. A distributed trace connects these operations through spans and events, but an error-free span establishes only that the instrumented operation completed—not that the requested search outcome was correct.
| Boundary | Claim it can support | Typical counterevidence |
|---|---|---|
| Acquisition | The source record was observed under a stated snapshot | Source absent, throttled, or only partially enumerated |
| Index publication | The intended representation became searchable | Stale generation, parse rejection, or refresh pending |
| Eligibility | Current authority admitted the record | Stale ACL, wrong tenant, or unsafe postfilter |
| Candidate generation | The relevant unit reached the shortlist | Window truncation, ANN miss, or filter starvation |
| Ranking | Available candidates were ordered for the stated relevance target | Wrong feature, rubric, fusion, or reranker |
| Delivery | The client received a complete or explicitly degraded result | Timeout, truncation, cache error, or serialization failure |
Repair the first invalid boundary. A fluent downstream answer cannot establish upstream corpus coverage, current authority, candidate recall, or freshness. Conversely, a bad answer does not prove retrieval failed. Record retrieval's meaning-changing boundaries as described in Record meaning-changing boundaries, then evaluate any later evidence-to-answer synthesis separately.
Open questions
How can permission-aware approximate retrieval preserve both strict authorization and high candidate recall when highly selective filters fragment an ANN index? Progress would include explicit freshness semantics for authority, adversarial side-channel tests, and workload-matched recall and latency results.
How should a search service communicate corpus coverage when it combines local indexes, federated sources, and opaque web APIs? A useful solution would distinguish complete enumeration, sampled coverage, provider-bounded rankings, source failures, and unknown coverage without reducing them to one percentage.
How can relevance judgments remain reusable as corpora, source revisions, and user intents change? Progress would require versioned judgment units, explicit temporal validity, principled handling of unjudged new material, and affordable reassessment strategies.
Which hybrid and reranking policies adapt candidate depth to query difficulty without hiding latency or coverage degradation? Progress would show paired improvements across exact identifiers, paraphrases, restrictive filters, and out-of-domain queries under a fixed resource budget.
How should deletion completion be proven across source connectors, derived chunks, replicas, caches, logs, and restoration paths? A credible answer needs stable identity, durable deletion state, stale-event rejection, and serving-boundary verification.








































