Docs / Specification

A-read — Reading and memory decisions

Status: accepted

read-surface-admits — The read surface admits one read-only statement over registered relations

Cited byread.register.describe-zoneread.register.describe-zonecontext.describe reports the session zone as session_zone, and per table, listed or described, zone_admitted: whether the table's effective allow-set admits that zone.read.register.file-preview-targetread.register.file-preview-targetcontext.file resolves a path to its (table, run_id) and reads it through that table's registered relation. A snapshot part, a traversal, an absolute path or a ledger file raises FilePreviewNotATable.read.register.scoped-ledgerread.register.scoped-ledgerThe child relation registers on the owner read alone: a credential carrying no tenant scope, over a table carrying no row policy. Naming a closed ledger raises LedgerNotTenantScoped, stating what closed the relation.read.guard.single-read-only-statementread.guard.single-read-only-statementAdmitted text parses to exactly one read-only SELECT. Attach, copy, install, load, pragma, set, any schema change, any data modification and a piggybacked second statement raise StatementNotReadOnly.read.guard.relation-allowlistread.guard.relation-allowlistEvery base relation names a view registered for this caller or a common table expression the statement declares. A bare file path is a base relation and falls under this rule.read.guard.unregistered-relationread.guard.unregistered-relationThe guard rejects an unregistered base relation under ungranted-table. The error echoes the requested name and no relation belonging to another caller.read.guard.table-functionread.guard.table-functionA table function anywhere in the tree, and a schema-qualified reach into a system catalog, raise TableFunctionRefused.read.guard.statement-provenanceread.guard.statement-provenanceLocal operator statements, template bodies and engine-composed reads execute without caller-SQL validation. The guard validates capability-token callers' SQL. No network interface exposes raw operator execution.read.guard.template-relation-shaperead.guard.template-relation-shapeManifest validation and server startup raise TemplateNamesForeignRelation for template SQL naming anything except store tables as plain identifiers. Template identifiers starting with context., corpus. or memory. also raise that error.read.guard.template-bindingread.guard.template-bindingA missing, unknown or type-mismatched argument raises TemplateArgumentRejected ahead of execution, with no coercion. Placeholders are $1…$n or ? in declaration order, or exactly the declared names.read.respond.paths-stay-insideread.respond.paths-stay-insideAn ordinary read's result carries no store path. Provenance arrives as columns naming table, run, connector version, ingestion instant and authoring subject.read.reference.admissionread.reference.admissionResolution applies unregistered-relation, the caller's registered row and column restrictions, and duration-ceiling, byte-ceiling and read-entry before publishing its verdict.read.reference.index-visibilityread.reference.index-visibilityA tenant-scoped, row-policy-restricted, zone-excluded or column-masked caller receives an unreadable verdict before erasure-index access; only the owner metadata eligibility of scoped-ledger admits an erased verdict.surface.package.stdio-credentialsurface.package.stdio-credentialThe process transport requires a verified capability token; --owner selects its signed owner claim. An absent token raises StdioCredentialMissing before protocol framing and never resolves to owner context.

The guard walks the syntax tree the executor itself serializes, so what it admits is what runs. A relation allowlist, not a verb blocklist, decides admission.

pooled-engine-reuses — A pooled engine reuses a resolved session only while its whole key holds

Cited byread.register.tool-setread.register.tool-setThe face exposes context.describe, context.query, context.reference, context.lineage, context.execute_query for templates, context.files, context.file, context.subscribe, corpus.retrieve, memory.recall, memory.traverse and memory.explain as its closed tool set.read.register.concurrent-statementsread.register.concurrent-statementsRequests on any number of connections run concurrently. Each statement uses its own engine connection under pool-connections and delays no other request.

Each uncached call walks tables/, reads every granted schema and manifest, and builds one view per relation. The pool sits behind the guard, masks and zone gate. A contextful-context benchmark admits it: setup above 25% of warm p95 at 50 unfolded runs.

Criteria: no reuse crosses a snapshot, schema, table set or revocation; then warm latency.

result-reused-under — A result is reused only under the read frontier it was computed at

Cited byread.reference.callread.reference.callcontext.reference accepts one table, run identifier and row sequence. contextful context reference uses the same resolver under Read admission, returning one-projection without selecting a filesystem path.read.reference.erased-verdictread.reference.erased-verdictAn admitted reference in the independently verified cumulative erasure index returns available: false and reason: erased. An absent reference outside that index returns reason: missing without source payload.read.reference.frontierread.reference.frontierBefore resolution and response publication, the resolver validates the same signed store frontier. The frontier's erasure index binds store identity and cumulative reference versions through store-binding.read.cache.result-keyread.cache.result-keyResult keys include token id, revocation epoch, grants, subject, session zone and incognito state. Keys also include touched relations and files, bounds, statement, parameter values and applied row ceiling.read.cache.cache-is-opt-inread.cache.cache-is-opt-inResults enter the cache only if every touched table declares result_cache with a time to live and none declares private = true. Entries expire at the shortest declared time to live.read.cache.budgetread.cache.budgetThe result cache stays within its process's declared byte budget and evicts the least recently used entry first. Without a declared budget, the server caches nothing.read.cache.session-poolread.cache.session-poolFace reuses sessions and connections while the key matches: admitted authority, token id, revocation epoch, request zone, bounds, pin map and table set. Each granted table contributes schema digest, pointer, run set and ledger files.read.cache.change-missesread.cache.change-missesCommitted runs, snapshots, schema edits, new tables, request-ledger files and tokens with different ids or epochs cause pool misses. The next statement reads the changed state through a new connection.

A dashboard issues one statement per panel over one frontier, and each repeat re-executes. The cache sits behind the guard, masks and zone gate, and keys on the read frontier of each touched relation.

restricted-sidecar-probe — A probe blind to restriction doubles for a bounded number of rounds and reports under-fill

Cited byread.retrieve.filter-budget-refusalread.retrieve.filter-budget-refusalBefore building per-table queries, retrieval checks the entire filter's budget. An oversized or malformed condition raises FilterBudgetExceeded for the whole read.read.retrieve.excluded-armread.retrieve.excluded-armAn arm whose table the session's zone excludes contributes no candidate, and the ranked response names that table in restriction-block.read.retrieve.adaptive-over-fetchread.retrieve.adaptive-over-fetchA full-text probe, and a vector probe carrying neither filter nor restriction context, runs at most 4 rounds in total, doubling its size while readable rows fall below the requested limit. The retrieval block reports any remaining shortfall.

Rows a reader cannot see can rank above its own, so one oversampled probe under-fills the limit. A full-text probe’s postings carry no row predicate, and an unfiltered vector probe can name rows its relation no longer yields. Bounded work comes first, then recall, then an honest count.

Revisit: under-fill reported on more than a small share of restricted reads.

filtered-vector-traversal — A filtered vector probe walks the graph admitting matching rows, and ranks a narrow match exactly

Cited byread.retrieve.filtered-traversalread.retrieve.filtered-traversalUnder a caller filter or restriction context, a vector probe admits only identifiers the reader's relation yields under the filter; traversal expands refused nodes' neighbours and returns the probe size in admitted rows where that many exist.read.retrieve.filtered-exact-thresholdread.retrieve.filtered-exact-thresholdA pre-scan of the arm's relation under the filter counts the matching identifiers; under 4096 rows, the filtered probe ranks them by exact distance instead of traversal.

A filter or restriction can hide most of a graph near the query. A pre-scan of the reader’s relation under the filter yields the identifiers the probe may return, so enforcement stays in the relation. The walk skips refused nodes as results and still expands their neighbours. An exact probe reads every node’s identifier once, while the walk lengthens as the match narrows, so the crossover follows the matching count.

Revisit: a pre-scan exceeding the probe’s own cost on a large relation.

reciprocal-rank-calibrates — Reciprocal rank calibrates the lexical leg, admitted by the native evaluation

Cited byread.rank.calibration-gateread.rank.calibration-gateA lexical-leg calibration replaces the one fusion names only when the native evaluation scores it at or above that one on every tracked measure.

Min-max over the window let one outlier compress every other BM25 score. Reciprocal rank, 61 / (60 + r), met the gate against min-max and raised the hybrid leg’s nDCG and R-precision.

Revisit: a corpus where reciprocal rank loses a tracked measure to another calibration.

reranker-reorders-masked — A reranker reorders a masked post-authority window

A cross-encoder orders the leading rows better than fused order, at one model call per candidate. read.rankread.rankCandidate ordering by vector and lexical scores, timeframe and reported confidence. reranks only on a call naming rerank_with, over the first 50 masked rows after authority, pointwise. A reranker enters the declared set through the native-evaluation gate; a remote one is egress through connector.infer.model-endpointconnector.infer.model-endpointEvery model call resolves to one operator-configured OpenAI-compatible HTTP endpoint declared as a capability. The host owns the credential, rate limit and span; the component owns the prompt template and response schema..

Revisit: the native evaluation measuring no gain for a declared reranker over fused order.

zone-withheld-relation — A zone-withheld relation is named, with one whole-relation count

Cited byread.respond.restriction-blockread.respond.restriction-blockThe restriction block includes session zone, incognito flag and an entry per touched relation excluded or column-masked by zone: table, excluded, rows_dropped, columns_masked. Reads withholding no touched relation omit the block.authority.place.excluded-disclosedauthority.place.excluded-disclosedrows_dropped counts the rows the zone step removes from the whole relation, every earlier step applied; the caller's statement, filter and requested size never enter it, and no removed value crosses.

The count is a property of the relation, so no ranked position, filter or requested size moves it.

networked-read-transport — The networked read transport is MCP Streamable HTTP, admitted per request

Cited byread.register.network-transportread.register.network-transportcontextful serve --http <addr> --audience <aud> --max-in-flight <n> serves MCP Streamable HTTP at POST /mcp. The stdio tool server answers each request's single JSON-RPC message as application/json.read.register.past-ceilingread.register.past-ceilingA request arriving while the ceiling's count of requests is in flight answers 503 with a Retry-After of 1 s and admits nothing.read.register.per-request-admissionread.register.per-request-admissionEach request carries Authorization: Bearer <credential>, or DPoP <credential> with a DPoP proof header. The listener admits each credential under possession-binding and network-bearer and restricts reads to that credential's grants.read.register.credential-missingread.register.credential-missingA request carrying no Authorization credential raises HttpCredentialMissing with 401 and reads no row.read.register.admission-refusedread.register.admission-refusedA request its admission refuses answers 401 carrying the refusal's identifier, except a full nonce cache, which answers 503 under nonce-cache.read.register.per-request-revocationread.register.per-request-revocationThe server re-reads --denylist for each request and rejects a revoked credential on the next request without restarting. An unreadable denylist returns 503 and admits nothing.read.register.stateless-sessionread.register.stateless-sessionA notification answers 202 with no body. The face holds no protocol session and opens no server stream: a GET or DELETE on /mcp answers 405, any other path 404.run.project.unauthenticated-upgraderun.project.unauthenticated-upgradeThe run-stream socket, GET /runs/:run_id/stream, authenticates on the HTTP request before the upgrade; a missing or invalid credential raises RunStreamUnauthorized with 401, and an unseen run answers 404.

The stdio tool server answers only its spawning process, under one startup credential. MCP-client compatibility decided the shape; revocation latency decided per-request admission.

Consequences: an MCP client that signs nothing reads with a short-lived audience-bound bearer and re-exchanges it before expiry. Revisit: a caller needs server-initiated messages or resumable streams.

served-claim-write — A served claim write stays outside read MCP

Cited byread.revise.served-writeread.revise.served-writeA writable HTTP server accepts POST /memory/claims under per-request network credentials and stores declared claims through the direct-write operation. The read MCP tool set remains closed.read.revise.served-scoperead.revise.served-scopeA claim write raises MemoryClaimScopeRefused if actor differs from admitted on_behalf_of, session differs from admitted task, or session contains a colon. Accepted claims take scope from credential members rather than payload values.read.revise.browser-requestread.revise.browser-requestAn Origin header on the served claim-write route raises MemoryClaimBrowserRefused before credential admission and commits nothing.read.revise.malformed-requestread.revise.malformed-requestMalformed JSON, unknown fields, a client-selected claim scope, or an empty dedup key on the served claim-write route raises MemoryClaimMalformed and commits nothing.read.revise.served-dedupread.revise.served-dedupA served claim write passes its dedup_key to dedup-key, returns landed: false on restatement, and returns the bound scope on both outcomes.read.revise.served-faultread.revise.served-faultA served claim write whose store effect refuses raises MemoryClaimWriteRefused and lands nothing.

A hosted console distils claims after a read turn and owns no local store root. The route keeps the read tool set closed and reuses memory’s commit and evidence gates. The browser holds no writer credential.

memory-writes-validate — Memory writes validate or dead-letter, and outcomes settle under their source

Cited byread.synthesize.dead-letterread.synthesize.dead-letterA batch exhausting extract-attempts writes the response, template hash and drop reason to the dead-letter table, raises MemoryExtractExhausted, and leaves the cursor unadvanced.read.resolve-entity.ambiguous-mentionread.resolve-entity.ambiguous-mentionIf a mention matches two canonical identities with no deterministic distinguishing key, resolution records an ambiguous skip, raises MemoryEntityAmbiguous and dead-letters the candidate claim.read.resolve-entity.edge-endpointread.resolve-entity.edge-endpointIf a candidate edge's source or target resolves to no identity, resolution dead-letters the edge and raises MemoryEdgeEndpointUnresolved.read.settle.registrationread.settle.registrationA registration requires one form (relative horizon, absolute deadline, open watch) and one source (metric, adjudicator, manual). Only metric requires and permits a comparator. Invalid registrations raise OutcomeRegistrationInvalid.read.settle.source-mismatchread.settle.source-mismatchAn observation raises OutcomeSourceMismatch if its metric series differs from registration, or its verdict's resolution source or registered series is missing or differs. The error names each source by wire name.read.settle.settling-citationread.settle.settling-citationAn adjudicator or manual verdict without an http or https settling citation raises OutcomeCitationMissing. The label view includes the citation.read.settle.calibration-reportread.settle.calibration-reportCalibration reports group settled predictions by shape and predicate. Each group reports sample count, Brier score, expected calibration error over 10 equal-width bins, and confidence-calibration's held-out score over every fifth prediction.

A rejected candidate waits in the dead-letter table for a human rather than becoming an untraceable row. Metric comparators evaluate outside the engine.

gleaning-declared-single — Gleaning is a declared, single extra pass

Cited byread.synthesize.cadenceread.synthesize.cadenceBy default, contextful memory synthesize starts synthesis. A scheduled [[job]] of kind synthesize targeting the claims table replaces that default. Each execution advances only through pass-cursor.

A second prompt asking what the first pass missed recovers some supported claims. read.declareread.declareMemory table schemas, required columns, trust tiers, scopes and relation types. admits gleanings of 0 or 1, off by default; a gleaned claim carries _pass = 'glean' and commits with the batch. Bounded model spend comes first, then recall.

Consequences: a failed gleaning discards only gleaned claims and never holds the cursor. Revisit: gleaned claims superseded or contradicted at a rate above first-pass claims.

extraction-cache-keys — An extraction cache keys responses on marked bytes, template and model

Cited bydisclosure.erase.reader-frontierdisclosure.erase.reader-frontierQuery, file, retrieval and cache responses resolve one erasure frontier and revalidate it before releasing bytes; an obsolete frontier releases no rows or files.

Re-running synthesis over unchanged rows repeats model calls whose answer is known. Keying on fenced bytes keeps two credentials with different masks apart. The cache holds model responses, never evidence verdicts.

claim-standing-derived — Claim standing is one derived tier, and revision is scoped to a validity line

Cited byread.revise.tierread.revise.tierThe writer assigns tier, a Tier, from write method and grounding, excluding payload values: synthesis uses derived, direct writes use curated, fetched results use researched. Mixed grounding takes the lowest tier.read.revise.supersederead.revise.supersedeAn equal-or-higher-tier claim replaces a live prior matching subject, predicate and scope when both are open-ended or share valid-from, except unscoped-collision. The prior ends at the successor's start and names the successor.read.revise.unscoped-collisionread.revise.unscoped-collisionUnscoped direct writes sharing subject, predicate and valid-from but different objects record both claim ids in the dead-letter table. Neither claim replaces the other until an explicit revision resolves the conflict.read.recall.confidence-labelread.recall.confidence-labelEach keyed claim's confidence_label is calibrated or uncalibrated under confidence-calibration. Fitting uses the declared labels table, joining prediction_id to claim_id through the caller's session.read.recall.stale-revisionread.recall.stale-revisionA stale citation remains subject to keyed-gate; only a newly committed source row advancing pass-cursor starts synthesis against its live key version.

Recall orders by tier, then score. A lower-standing contradiction gets a bounded validity end instead of retiring the prior. Promotion is a human act. Only researched claims expire.

agent-third-party — Agent and third-party writes stand derived

Cited byread.revise.direct-writeread.revise.direct-writeThe direct write accepts claims alone. Naming memory_episodes, memory_entities, memory_edges or memory_preferences raises MemoryDirectWriteShapeRefused; an entity row enters through entity-upsert.

Recall puts curated claims first, so a curated agent write lets injected text become a top-ranked belief. read.reviseread.reviseClaim replacement within a validity interval, confidence decay, direct writes, timestamps, expiry, retention and promotion. stamps a direct write derived when its credential carries an agent member or a cited row reads ingested:third-party.

Consequences: the agent member is asserted, never verified, so a principal-only credential an agent presents still stamps curated. Revisit: a verified binding between the agent member and the writer.

memory-access-follows — Memory access follows evidence grants, and forgetting is a separate privilege

Cited byread.recall.evidence-unresolvedread.recall.evidence-unresolvedAn unreadable or masked source row, an unknown table, a reference into another memory row, or malformed lineage suppresses the claim and raises MemoryEvidenceUnresolved.read.recall.evidence-referencesread.recall.evidence-referencesFor claims citing more than 256 entries of evidence, recall returns the first 256 in cited table, run and sequence order. evidence_omitted reports the remaining count.read.recall.evidence-gate-boundread.recall.evidence-gate-boundRecall suppresses a claim with more than 4096 entries of evidence as unresolved and raises MemoryEvidenceOverflow.disclosure.erase.privilegedisclosure.erase.privilegeErasure sits outside the default grant set, and a caller without the forget grant raises ErasureUngranted.

Every evidence entry resolves at recall, so revocation takes effect on the next recall with no invalidation sweep.

Revisit: recall latency dominated by the evidence join at 4096 entries; evidence lists clustering at the 256 cap.

citation-keyed-table — A citation into a keyed table resolves through a pepper-keyed digest of its key

Cited byread.recall.evidence-keyread.recall.evidence-keyClaim writes stamp each citation to a keyed table with a pepper-keyed digest of the cited row's key. If that row is unreadable, recall resolves the digest's live version.read.recall.evidence-no-valueread.recall.evidence-no-valueA citation stored in a memory row carries the cited table, run, sequence and key digest, and no cell value of the cited row.read.recall.evidence-staleread.recall.evidence-staleRecall counts a served claim under stale in contextful.recall if the key digest resolves while the cited run and sequence are unreadable. The block names no claim.

A fold drops superseded versions, so a citation by run and sequence alone withdraws its claim at the next compaction. No caller holds the secret to test a guessed key.

Revisit: stale counts dominating a recall; a reader needing the claim’s cited version rather than its key’s live one.

store-holds-nothing — The store holds nothing a user could not see

Cited byauthority.resist.credential-shaped-valueauthority.resist.credential-shaped-valueA claim write, direct or synthesized, raises EnforceCredentialShapedValue on a field matching a credential shape, before it reaches storage.

Query-time enforcement bounds a read, not the stored bytes, so the ceiling sits at the write path.

nearness-parent-closure — Nearness is a parent closure over declared edges, and the engine holds no geospatial type

read.resolve-entityread.resolve-entityEntity matching, aliases, identity cards, location relationships, edges and ownership queries. answers nearness as the transitive closure over declared parent edges: near a place means at it or under it. The closure left-joins as an ordinary dimension, so an unmapped place tags null.

Revisit: a deployment declares artificial parent levels to approximate a radius; closure materialization dominates the dimension’s build.

statement-owns-deadline — Each statement owns its deadline and serialized response budget

Cited byread.respond.duration-ceilingread.respond.duration-ceilingUnder duration-ceiling, the engine interrupts the statement's connection at its deadline. ReadDurationExceeded names the ceiling, source and elapsed milliseconds. The response contains no rows; other statements continue running.read.respond.byte-ceilingread.respond.byte-ceilingUnder byte-ceiling, the serialized response includes only whole rows within the selected ceiling. An envelope or first row exceeding that ceiling raises ReadResponseTooLarge and returns no rows.authority.grant.duration-ceilingauthority.grant.duration-ceilingA statement's max_duration_ms is the least of its grant, touched-table and request limits; an undeclared component imposes none, and no component declares a default.authority.grant.byte-ceilingauthority.grant.byte-ceilingA response's max_response_bytes is the least of its grant, touched-table and request limits; an undeclared component imposes none, and no component declares a default.

Interrupting one connection leaves every other statement running. A first row that cannot fit refuses rather than looking empty.

memory-vocabulary-schedules — Memory vocabulary and schedules are explicit

Cited byread.declare.undeclared-relationread.declare.undeclared-relationFor a rel_type outside the allowed union, synthesis writes the candidate edge to the dead-letter table and raises MemoryUndeclaredRelation. No row uses the unknown type.read.declare.reserved-relationsread.declare.reserved-relationsReserved relation types are supports, contradicts, supersedes, about and derived_from. Deployments add types through [relation].declared. contextful memory relations rename rewrites stored edges before removing an old name.

The five reserved relations assign no deployment-specific meaning. A schedule never alters the pass cursor.

memory-confidence-retention — Memory confidence and retention separate history from ranking

Cited byread.synthesize.confidence-calibrationread.synthesize.confidence-calibrationModel-emitted confidence carries uncalibrated until a shape-and-predicate isotonic map trained on settled outcomes lowers held-out Brier score. A validated map supplies the reported calibrated confidence.read.revise.retention-defaultread.revise.retention-defaultClaims retain recorded validity until explicit expiry or erasure. With decay_half_life, ranked scores decrease by half per half-life since valid_from. Score decay neither deletes claims nor changes validity.

Decay changes ranking only; validity is history and ends only by expiry or erasure.

memory-reads-expose — Memory reads expose use and resolve ownership from enforced rows

Cited byread.recall.usage-ledgerread.recall.usage-ledgermemory.recall, memory.explain responses carrying claims, and corpus.retrieve responses containing memory_facts record returned claim ids as contextful.memory.claims. The read entry includes caller credential, subject and read instant.read.resolve-entity.graph-indexread.resolve-entity.graph-indexExternal graph engines index admitted memory edges as derived data. Entity and ownership answers resolve through access-controlled store rows at the read frontier.read.resolve-entity.ownership-answerread.resolve-entity.ownership-answerOwnership queries return targets of every caller-visible owned_by edge from the artifact. Results sort by newest _ingested_at, then principal id for equal timestamps.

A graph engine is a derived index; enforced store rows answer.

traversal-walks-enforced — A traversal walks enforced edges under fixed bounds

Cited byread.traverse.walkableread.traverse.walkableA rel_types entry whose declared relation is not walkable raises MemoryTraverseRelationUnwalkable.read.traverse.hop-boundread.traverse.hop-boundA walk follows at most 3 hops; a larger hops raises MemoryTraverseHopsExceeded.read.traverse.fan-outread.traverse.fan-outA node expands at most 64 memory-edges, ordered by valid_from newest first then edge id; the rest count in edges_omitted.read.traverse.frontier-capread.traverse.frontier-capA walk stops at 512 memory-edges and counts unexpanded edges in edges_omitted; a non-zero edges_omitted marks the walk incomplete, and truncated stays with truncation-cause.

An unreadable edge is never crossed, because the node beyond it discloses the edge. Only walkable relations are followed, so a dense relation such as about never fans a walk across the store.

Revisit: a graph arm seeded from the query’s entities earns a place in fusion; truncation dominates native multi-hop cases.

join-matches-availability — The as-of join matches on availability time, not valid time

Cited bystore.available-time.vintage-rowsstore.available-time.vintage-rowsA keyed table declaring available_time is a vintage table, keeping every vintage per primary key, valid-time from and availability instant; a read returns the latest at or before any available_as_of, or under vintage = "first" the earliest.read.as-of-join.per-row-boundread.as-of-join.per-row-boundPer equality key, ASOF JOIN selects the right row with latest declared availability at or before the driving instant named by the inequality. If given, max_age bounds that row's valid-time from.

A restated figure keeps its original valid time, so a valid-time match hands a backtest a value published after its decision. The join runs inside one statement, so restriction, masks and bounds compose as for any read.

sidecar-serves-past — A sidecar serves a past horizon by filtered traversal

Cited bystore.index.filter-copiesstore.index.filter-copiesA sidecar copies only id_column, the indexed column, and the tenant column, zone label and availability instant filtered traversal needs; every other filter applies at candidate-ids.read.horizon.rank-statisticsread.horizon.rank-statisticsUnder a horizon, sidecar probes return only entries available at or before that horizon. Full-text scoring derives document count, average length and document frequency solely from those entries.

A sweep over many past decision dates reads one sidecar rather than refusing or scanning the table once per date. The postings’ availability timeline yields horizon statistics in one binary search.