Search generation ledgers do not isolate provider visibility

Context

Typing lookup uses a dedicated search provider whose documents are maintained asynchronously from CRM changes.

Decision

Quick Search keeps provider documents as a derived copy, uses version claims for writes and a generation ledger for rebuild coordination, and gives browsers short-lived credentials limited to the workspace and permitted record types.

Alternatives Considered

Run each typed lookup against the database: The query engine does not implement the provider’s tiered lookup and ranking interface.

Revoke each issued credential after an access change: Credentials are derived provider keys; their fifteen-minute lifetime limits stale access.

Consequences

Permission withdrawal may take up to fifteen minutes to affect an issued key. Scheduled repair addresses drift in asynchronously maintained documents. Generation activation changes the ledger; provider replacements can already be visible during a failed or incomplete rebuild.