---
id: ADR-PFM-QRY-010
title: Search generation ledgers do not isolate provider visibility
product_area: platform
module: queries
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Quick Search keeps provider documents as a derived copy, uses version claims for writes and a
  generation ledger for rebuild coordination, and gives browsers short-lived credentials limited to
  the workspace and permitted record types.
constrains:
  - DOM-PFM-QRY-005
  - STATE-PFM-QRY-013
  - WF-PFM-QRY-014
  - WF-PFM-QRY-015
  - WF-PFM-QRY-016
  - WF-PFM-QRY-017
  - SVC-PFM-QRY-quick-search
origin: docs/proposals/quick-search.md (approved by Andrew 2026-10-09)
alternatives:
  - option: Run each typed lookup against the database
    why_not: The query engine does not implement the provider’s tiered lookup and ranking interface.
  - option: Revoke each issued credential after an access change
    why_not: Credentials are derived provider keys; their fifteen-minute lifetime limits stale access.
consequences:
  - Permission withdrawal may take up to fifteen minutes to affect an issued key.
  - Scheduled repair addresses drift in asynchronously maintained documents.
  - >-
    Generation activation changes the ledger; provider replacements can already be visible during a
    failed or incomplete rebuild.
supersedes: []
evidence:
  - 'services-platform at ad3f6a6: modules/quick-search/**; docs/quick-search.md'
---

# Search generation ledgers do not isolate provider visibility

## Context

Typing lookup uses a dedicated search provider whose documents are maintained asynchronously from CRM changes.

## Decision

Quick Search keeps provider documents as a derived copy, uses version claims for writes and a generation ledger for rebuild coordination, and gives browsers short-lived credentials limited to the workspace and permitted record types.

## Alternatives Considered

Run each typed lookup against the database: The query engine does not implement the provider’s tiered lookup and ranking interface.

Revoke each issued credential after an access change: Credentials are derived provider keys; their fifteen-minute lifetime limits stale access.

## Consequences

Permission withdrawal may take up to fifteen minutes to affect an issued key. Scheduled repair addresses drift in asynchronously maintained documents. Generation activation changes the ledger; provider replacements can already be visible during a failed or incomplete rebuild.