Recorded evidence.

Verification boundary

The current evidence supports a narrower conclusion than production readiness. I ran pnpm test:export against the local fixture database, and the export now includes the previously missing tax column. The generated file at tmp/invoice-preview.csv also opened successfully in the local preview tool.

Those checks establish the behavior of the fixture-backed path; they do not establish that the production credentials, storage permissions, or larger customer datasets will behave the same way. No staging or production request was made, and no remote configuration was changed.

Before calling this ready, we still need a staging export using the deployed service identity and a representative large dataset. That is a proposed verification step, not a completed test. I have also not checked whether older spreadsheet templates accept the additional column, so compatibility with those templates remains unresolved.

The evidence supports the local fixture-backed path, not production readiness. I ran pnpm test:export against the local fixture database; the export now includes the missing tax column, and tmp/invoice-preview.csv opened successfully in the local preview tool.

I did not test staging or production or change remote configuration, so production credentials, storage permissions, and larger customer datasets remain unverified.

Before this is ready, a staging export should be tested with the deployed service identity and a representative large dataset. That verification has not been completed. I also have not checked whether older spreadsheet templates accept the added column, so their compatibility remains unresolved.

Verification boundary

The current evidence supports a narrower conclusion than production readiness. I ran pnpm test:export against the local fixture database, and the export now includes the previously missing tax column. The generated file at tmp/invoice-preview.csv also opened successfully in the local preview tool.

Those checks establish the behavior of the fixture-backed path; they do not establish that the production credentials, storage permissions, or larger customer datasets will behave the same way. No staging or production request was made, and no remote configuration was changed.

Before calling this ready, we still need a staging export using the deployed service identity and a representative large dataset. That is a proposed verification step, not a completed test. I have also not checked whether older spreadsheet templates accept the additional column, so compatibility with those templates remains unresolved.

Verification boundary

The evidence supports a narrower conclusion than production readiness. I ran pnpm test:export against the local fixture database; the export now includes the previously missing tax column. The generated file at tmp/invoice-preview.csv also opened successfully in the local preview tool.

These checks establish fixture-backed behavior, not whether production credentials, storage permissions, or larger customer datasets will behave the same way. No staging or production request was made, and no remote configuration changed.

Before calling this ready, we still need a staging export using the deployed service identity and a representative large dataset. This is proposed verification, not a completed test. I have not checked whether older spreadsheet templates accept the additional column, so compatibility remains unresolved.

Verification boundary

The current evidence supports a narrower conclusion than production readiness. I ran pnpm test:export against the local fixture database, and the export now includes the previously missing tax column. The generated file at tmp/invoice-preview.csv also opened successfully in the local preview tool.

Those checks establish the behavior of the fixture-backed path; they do not establish that the production credentials, storage permissions, or larger customer datasets will behave the same way. No staging or production request was made, and no remote configuration was changed.

Before calling this ready, we still need a staging export using the deployed service identity and a representative large dataset. That is a proposed verification step, not a completed test. I have also not checked whether older spreadsheet templates accept the additional column, so compatibility with those templates remains unresolved.

Next verification step

Before calling this ready, we still need a staging export using the deployed service identity and a representative large dataset. This is a proposed verification step, not a completed test.

Verified locally

• I ran pnpm test:export against the local fixture database, and the export now includes the previously missing tax column.

• The generated file at tmp/invoice-preview.csv opened successfully in the local preview tool.

These checks establish the behavior of the fixture-backed path. They do not establish that production credentials, storage permissions, or larger customer datasets will behave the same way.

Still unresolved

• No staging or production request was made.

• No remote configuration was changed.

• I have not checked whether older spreadsheet templates accept the additional column, so compatibility with those templates remains unresolved.

Verification boundary

The current evidence supports a narrower conclusion than production readiness. I ran pnpm test:export against the local fixture database, and the export now includes the previously missing tax column. The generated file at tmp/invoice-preview.csv also opened successfully in the local preview tool.

Those checks establish the behavior of the fixture-backed path; they do not establish that the production credentials, storage permissions, or larger customer datasets will behave the same way. No staging or production request was made, and no remote configuration was changed.

Before calling this ready, we still need a staging export using the deployed service identity and a representative large dataset. That is a proposed verification step, not a completed test. I have also not checked whether older spreadsheet templates accept the additional column, so compatibility with those templates remains unresolved.

Verification boundary

The current evidence does not establish production readiness.

1. I ran pnpm test:export against the local fixture database, and the export now includes the previously missing tax column.

2. The generated file at tmp/invoice-preview.csv opened successfully in the local preview tool.

3. These checks establish behavior for the fixture-backed path, but not whether production credentials, storage permissions, or larger customer datasets will behave the same way.

4. No staging or production request was made, and no remote configuration was changed.

5. Before calling this ready, we still need a staging export using the deployed service identity and a representative large dataset. This is a proposed verification step, not a completed test.

Compatibility with older spreadsheet templates remains unresolved because I have not checked whether they accept the additional column.

Verification boundary

The current evidence supports a narrower conclusion than production readiness. I ran pnpm test:export against the local fixture database, and the export now includes the previously missing tax column. The generated file at tmp/invoice-preview.csv also opened successfully in the local preview tool.

Those checks establish the behavior of the fixture-backed path; they do not establish that the production credentials, storage permissions, or larger customer datasets will behave the same way. No staging or production request was made, and no remote configuration was changed.

Before calling this ready, we still need a staging export using the deployed service identity and a representative large dataset. That is a proposed verification step, not a completed test. I have also not checked whether older spreadsheet templates accept the additional column, so compatibility with those templates remains unresolved.

Verification boundary

The current evidence supports a narrower conclusion than production readiness.

I ran pnpm test:export against the local fixture database. The export now includes the previously missing tax column. The generated file at tmp/invoice-preview.csv also opened successfully in the local preview tool.

These checks establish behavior for the fixture-backed path. They do not establish equivalent behavior for production credentials, storage permissions, or larger customer datasets.

No staging or production request was made. No remote configuration was changed.

Before calling this ready, we still need a staging export with the deployed service identity and a representative large dataset. This is a proposed verification step, not a completed test.

I have not checked whether older spreadsheet templates accept the additional column. Compatibility with those templates remains unresolved.

Verification boundary

The current evidence supports a narrower conclusion than production readiness. I ran pnpm test:export against the local fixture database, and the export now includes the previously missing tax column. The generated file at tmp/invoice-preview.csv also opened successfully in the local preview tool.

Those checks establish the behavior of the fixture-backed path; they do not establish that the production credentials, storage permissions, or larger customer datasets will behave the same way. No staging or production request was made, and no remote configuration was changed.

Before calling this ready, we still need a staging export using the deployed service identity and a representative large dataset. That is a proposed verification step, not a completed test. I have also not checked whether older spreadsheet templates accept the additional column, so compatibility with those templates remains unresolved.

Verification boundary

The current evidence supports a narrower conclusion than production readiness. I ran pnpm test:export against the local fixture database, and the export now includes the previously missing tax column. The generated file at tmp/invoice-preview.csv also opened successfully in the local preview tool.

These checks confirm the fixture-backed path works. They do not confirm that the production credentials, storage permissions, or larger customer datasets will behave the same way. No staging or production request was made, and no remote configuration was changed.

Before calling this ready, we still need a staging export using the deployed service identity and a representative large dataset. That is a proposed verification step, not a completed test. I have also not checked whether older spreadsheet templates accept the additional column, so compatibility with those templates remains unresolved.

There are two different questions wrapped up in the suggestion to cache the reports page, and it is useful to separate them before choosing an implementation. One is whether previously calculated report data can be reused without violating the freshness expectation. The other is whether introducing a separate distributed service is necessary to get that reuse. Accepting data that is up to 15 minutes old makes reuse a possibility, but it does not, by itself, establish that a distributed cache is the appropriate first change. We have not measured which part of the current request consumes the most time. The delay could come from the report query, from preparing the response, or from work in the browser, and those possibilities would not all benefit from the same intervention.

There is also a boundary between the freshness of the report and the freshness of the decision about who may read it. The accepted delay applies to report data, not to access permissions. Even if the data comes from a cache, the request must use the current access decision before returning it. Separating cached entries by organization would reduce the chance of mixing organizations' data, but that separation would not replace authorization. A person whose access was removed must not continue to receive the report simply because a cached result still exists. None of this establishes that the current implementation has such a bug; it describes a requirement any proposed cache would have to satisfy.

My recommendation is therefore to measure a representative request before adding the distributed service. If the report query dominates, and equivalent requests recur often enough to make reuse useful, a cache becomes a reasonable candidate. If response preparation or browser work dominates instead, reusing query results may leave the main delay untouched. A distributed cache would also introduce expiration behavior, cache-miss handling, and another service to operate. Those are tradeoffs to evaluate, not proof that caching would be a mistake.

The measurement has not been run, and neither a cache nor an authorization change has been implemented. I would reconsider the recommendation once we know where the delay occurs and whether repeated requests actually share reusable results. Until then, the freshness allowance supports investigating caching; it is not evidence that caching will improve this page.

Caching the reports page raises two separate questions: whether old report data can be reused within the allowed freshness delay, and whether a distributed service is needed. Allowing report data to be 15 minutes old makes reuse possible, but we have not measured whether the main delay comes from the report query, response preparation, or browser work.

The freshness allowance applies to report data, not access permissions. Requests must use the current authorization decision before returning cached data. Separating cache entries by organization would reduce the risk of mixing organizations' data, but it would not replace authorization. Someone whose access was removed must not receive the report from an existing cache entry. This is a requirement for a proposed cache, not evidence that the current implementation has this bug.

I recommend measuring a representative request before adding a distributed service. If the query is the main delay and equivalent requests recur often enough, caching may help. If response preparation or browser work is the main delay, reusing query results may not. A distributed cache would also add expiration rules, cache-miss handling, and another service to operate.

The measurement has not been run, and no cache or authorization change has been implemented. I would reconsider the recommendation after we know where the delay occurs and whether repeated requests share reusable results. For now, the freshness allowance justifies investigating caching; it does not show that caching will improve the page.

There are two different questions wrapped up in the suggestion to cache the reports page, and it is useful to separate them before choosing an implementation. One is whether previously calculated report data can be reused without violating the freshness expectation. The other is whether introducing a separate distributed service is necessary to get that reuse. Accepting data that is up to 15 minutes old makes reuse a possibility, but it does not, by itself, establish that a distributed cache is the appropriate first change. We have not measured which part of the current request consumes the most time. The delay could come from the report query, from preparing the response, or from work in the browser, and those possibilities would not all benefit from the same intervention.

There is also a boundary between the freshness of the report and the freshness of the decision about who may read it. The accepted delay applies to report data, not to access permissions. Even if the data comes from a cache, the request must use the current access decision before returning it. Separating cached entries by organization would reduce the chance of mixing organizations' data, but that separation would not replace authorization. A person whose access was removed must not continue to receive the report simply because a cached result still exists. None of this establishes that the current implementation has such a bug; it describes a requirement any proposed cache would have to satisfy.

My recommendation is therefore to measure a representative request before adding the distributed service. If the report query dominates, and equivalent requests recur often enough to make reuse useful, a cache becomes a reasonable candidate. If response preparation or browser work dominates instead, reusing query results may leave the main delay untouched. A distributed cache would also introduce expiration behavior, cache-miss handling, and another service to operate. Those are tradeoffs to evaluate, not proof that caching would be a mistake.

The measurement has not been run, and neither a cache nor an authorization change has been implemented. I would reconsider the recommendation once we know where the delay occurs and whether repeated requests actually share reusable results. Until then, the freshness allowance supports investigating caching; it is not evidence that caching will improve this page.

The suggestion to cache the reports page combines two questions:

1. Can previously calculated report data be reused without violating freshness?

2. Is a separate distributed service necessary for that reuse?

Allowing data up to 15 minutes old makes reuse possible, but does not establish that a distributed cache is the right first change. We have not measured whether the delay comes from the report query, response preparation, or browser work; those would not necessarily benefit from the same intervention.

Report freshness is separate from authorization freshness. The accepted delay applies to report data, not access decisions. Even cached data must be returned only after the current access decision is checked. Separating entries by organization could reduce cross-organization mixing, but would not replace authorization. A person whose access was removed must not receive the report because a cached result remains. This describes a requirement for any proposed cache, not evidence that the current implementation has this bug.

I recommend measuring a representative request before adding the distributed service. If the report query dominates and equivalent requests recur often enough, caching becomes a reasonable candidate. If response preparation or browser work dominates, reusing query results may not address the main delay. A distributed cache would also add expiration behavior, cache-miss handling, and another service to operate. These are tradeoffs, not proof that caching would be a mistake.

The measurement has not been run, and neither a cache nor an authorization change has been implemented. I would reconsider the recommendation after we know where the delay occurs and whether repeated requests share reusable results. Until then, the freshness allowance supports investigating caching; it does not show that caching will improve the page.

There are two different questions wrapped up in the suggestion to cache the reports page, and it is useful to separate them before choosing an implementation. One is whether previously calculated report data can be reused without violating the freshness expectation. The other is whether introducing a separate distributed service is necessary to get that reuse. Accepting data that is up to 15 minutes old makes reuse a possibility, but it does not, by itself, establish that a distributed cache is the appropriate first change. We have not measured which part of the current request consumes the most time. The delay could come from the report query, from preparing the response, or from work in the browser, and those possibilities would not all benefit from the same intervention.

There is also a boundary between the freshness of the report and the freshness of the decision about who may read it. The accepted delay applies to report data, not to access permissions. Even if the data comes from a cache, the request must use the current access decision before returning it. Separating cached entries by organization would reduce the chance of mixing organizations' data, but that separation would not replace authorization. A person whose access was removed must not continue to receive the report simply because a cached result still exists. None of this establishes that the current implementation has such a bug; it describes a requirement any proposed cache would have to satisfy.

My recommendation is therefore to measure a representative request before adding the distributed service. If the report query dominates, and equivalent requests recur often enough to make reuse useful, a cache becomes a reasonable candidate. If response preparation or browser work dominates instead, reusing query results may leave the main delay untouched. A distributed cache would also introduce expiration behavior, cache-miss handling, and another service to operate. Those are tradeoffs to evaluate, not proof that caching would be a mistake.

The measurement has not been run, and neither a cache nor an authorization change has been implemented. I would reconsider the recommendation once we know where the delay occurs and whether repeated requests actually share reusable results. Until then, the freshness allowance supports investigating caching; it is not evidence that caching will improve this page.

Measure a representative request before adding the distributed service.

1. Determine which part of the current request consumes the most time:

   • The report query

   • Response preparation

   • Browser work

   The measurement has not been run. These possibilities would not all benefit from the same intervention.

2. If the report query dominates and equivalent requests recur often enough to make reuse useful, a cache becomes a reasonable candidate.

3. If response preparation or browser work dominates, reusing query results may leave the main delay untouched.

The accepted delay of up to 15 minutes applies to report data, not access permissions. Cached responses must still use the current access decision before being returned. Separating cached entries by organization would reduce the chance of mixing organizations' data, but would not replace authorization. A person whose access was removed must not continue receiving the report because a cached result exists. This describes a requirement for any proposed cache; it does not establish that the current implementation has such a bug.

A distributed cache would introduce expiration behavior, cache-miss handling, and another service to operate. These are tradeoffs to evaluate, not proof that caching would be a mistake.

Neither a cache nor an authorization change has been implemented. I would reconsider the recommendation after determining where the delay occurs and whether repeated requests actually share reusable results. Until then, the freshness allowance supports investigating caching; it is not evidence that caching will improve this page.

There are two different questions wrapped up in the suggestion to cache the reports page, and it is useful to separate them before choosing an implementation. One is whether previously calculated report data can be reused without violating the freshness expectation. The other is whether introducing a separate distributed service is necessary to get that reuse. Accepting data that is up to 15 minutes old makes reuse a possibility, but it does not, by itself, establish that a distributed cache is the appropriate first change. We have not measured which part of the current request consumes the most time. The delay could come from the report query, from preparing the response, or from work in the browser, and those possibilities would not all benefit from the same intervention.

There is also a boundary between the freshness of the report and the freshness of the decision about who may read it. The accepted delay applies to report data, not to access permissions. Even if the data comes from a cache, the request must use the current access decision before returning it. Separating cached entries by organization would reduce the chance of mixing organizations' data, but that separation would not replace authorization. A person whose access was removed must not continue to receive the report simply because a cached result still exists. None of this establishes that the current implementation has such a bug; it describes a requirement any proposed cache would have to satisfy.

My recommendation is therefore to measure a representative request before adding the distributed service. If the report query dominates, and equivalent requests recur often enough to make reuse useful, a cache becomes a reasonable candidate. If response preparation or browser work dominates instead, reusing query results may leave the main delay untouched. A distributed cache would also introduce expiration behavior, cache-miss handling, and another service to operate. Those are tradeoffs to evaluate, not proof that caching would be a mistake.

The measurement has not been run, and neither a cache nor an authorization change has been implemented. I would reconsider the recommendation once we know where the delay occurs and whether repeated requests actually share reusable results. Until then, the freshness allowance supports investigating caching; it is not evidence that caching will improve this page.

Recommendation

Measure a representative request before adding the distributed service. The freshness allowance makes caching worth investigating, but does not establish that a distributed cache is the appropriate first change.

1. Separate the two questions:

   • Can previously calculated report data be reused without violating freshness?

   • Is a separate distributed service necessary for that reuse?

2. Data up to 15 minutes old may be reusable, but this alone does not justify a distributed cache.

3. The current bottleneck has not been measured. It could be:

   • The report query

   • Response preparation

   • Browser work

4. If the report query dominates and equivalent requests recur often enough, caching becomes a reasonable candidate.

5. If response preparation or browser work dominates, reusing query results may leave the main delay untouched.

Authorization and freshness

1. The accepted delay applies to report data, not to the decision about who may read it.

2. A cached response must still use the current access decision before it is returned.

3. Separating cached entries by organization would reduce the chance of mixing organizations’ data, but would not replace authorization.

4. Someone whose access was removed must not continue receiving the report because a cached result still exists.

5. This does not establish that the current implementation has such a bug; it states a requirement any proposed cache must satisfy.

Tradeoffs and status

A distributed cache would introduce expiration behavior, cache-miss handling, and another service to operate. These are tradeoffs to evaluate, not proof that caching would be a mistake.

The measurement has not been run, and neither a cache nor an authorization change has been implemented. I would reconsider the recommendation once we know where the delay occurs and whether repeated requests actually share reusable results.

Until then, the freshness allowance supports investigating caching; it is not evidence that caching will improve this page.

There are two different questions wrapped up in the suggestion to cache the reports page, and it is useful to separate them before choosing an implementation. One is whether previously calculated report data can be reused without violating the freshness expectation. The other is whether introducing a separate distributed service is necessary to get that reuse. Accepting data that is up to 15 minutes old makes reuse a possibility, but it does not, by itself, establish that a distributed cache is the appropriate first change. We have not measured which part of the current request consumes the most time. The delay could come from the report query, from preparing the response, or from work in the browser, and those possibilities would not all benefit from the same intervention.

There is also a boundary between the freshness of the report and the freshness of the decision about who may read it. The accepted delay applies to report data, not to access permissions. Even if the data comes from a cache, the request must use the current access decision before returning it. Separating cached entries by organization would reduce the chance of mixing organizations' data, but that separation would not replace authorization. A person whose access was removed must not continue to receive the report simply because a cached result still exists. None of this establishes that the current implementation has such a bug; it describes a requirement any proposed cache would have to satisfy.

My recommendation is therefore to measure a representative request before adding the distributed service. If the report query dominates, and equivalent requests recur often enough to make reuse useful, a cache becomes a reasonable candidate. If response preparation or browser work dominates instead, reusing query results may leave the main delay untouched. A distributed cache would also introduce expiration behavior, cache-miss handling, and another service to operate. Those are tradeoffs to evaluate, not proof that caching would be a mistake.

The measurement has not been run, and neither a cache nor an authorization change has been implemented. I would reconsider the recommendation once we know where the delay occurs and whether repeated requests actually share reusable results. Until then, the freshness allowance supports investigating caching; it is not evidence that caching will improve this page.

The suggestion to cache the reports page contains two separate questions:

1. Can previously calculated report data be reused without violating the freshness requirement?

2. Is a separate distributed service necessary for that reuse?

Allowing data to be 15 minutes old makes reuse possible. It does not establish that a distributed cache is the appropriate first change.

We have not measured which part of the request consumes the most time. The delay could come from the report query, response preparation, or browser work. Each possibility may require a different intervention.

Report freshness and access-decision freshness have different boundaries. The accepted delay applies to report data, not access permissions. The request must use the current access decision before it returns cached data.

Separating cached entries by organization would reduce the chance of mixing organizations' data. It would not replace authorization. A person whose access was removed must not receive the report because a cached result still exists. This does not establish that the current implementation has this bug. It states a requirement for any proposed cache.

My recommendation is to measure a representative request before adding the distributed service.

• If the report query dominates and equivalent requests recur often enough, a cache becomes a reasonable candidate.

• If response preparation or browser work dominates, reusing query results may leave the main delay unchanged.

A distributed cache would also introduce expiration behavior, cache-miss handling, and another service to operate. These are tradeoffs to evaluate, not proof that caching would be a mistake.

The measurement has not been run. Neither a cache nor an authorization change has been implemented. I would reconsider the recommendation after we know where the delay occurs and whether repeated requests share reusable results.

Until then, the freshness allowance supports investigating caching. It is not evidence that caching will improve this page.

There are two different questions wrapped up in the suggestion to cache the reports page, and it is useful to separate them before choosing an implementation. One is whether previously calculated report data can be reused without violating the freshness expectation. The other is whether introducing a separate distributed service is necessary to get that reuse. Accepting data that is up to 15 minutes old makes reuse a possibility, but it does not, by itself, establish that a distributed cache is the appropriate first change. We have not measured which part of the current request consumes the most time. The delay could come from the report query, from preparing the response, or from work in the browser, and those possibilities would not all benefit from the same intervention.

There is also a boundary between the freshness of the report and the freshness of the decision about who may read it. The accepted delay applies to report data, not to access permissions. Even if the data comes from a cache, the request must use the current access decision before returning it. Separating cached entries by organization would reduce the chance of mixing organizations' data, but that separation would not replace authorization. A person whose access was removed must not continue to receive the report simply because a cached result still exists. None of this establishes that the current implementation has such a bug; it describes a requirement any proposed cache would have to satisfy.

My recommendation is therefore to measure a representative request before adding the distributed service. If the report query dominates, and equivalent requests recur often enough to make reuse useful, a cache becomes a reasonable candidate. If response preparation or browser work dominates instead, reusing query results may leave the main delay untouched. A distributed cache would also introduce expiration behavior, cache-miss handling, and another service to operate. Those are tradeoffs to evaluate, not proof that caching would be a mistake.

The measurement has not been run, and neither a cache nor an authorization change has been implemented. I would reconsider the recommendation once we know where the delay occurs and whether repeated requests actually share reusable results. Until then, the freshness allowance supports investigating caching; it is not evidence that caching will improve this page.

The suggestion to cache the reports page contains two separate questions. We should separate them before choosing an implementation. First, can we reuse report data that was calculated earlier without breaking the freshness requirement? Second, do we need a separate distributed service to reuse that data? Accepting data that is up to 15 minutes old makes reuse possible. It does not, by itself, show that a distributed cache is the right first change. We have not measured which part of the current request takes the most time. The delay could come from the report query, preparing the response, or browser work. The same change would not help all of these equally.

The report's freshness is separate from the freshness of the decision about who may read it. The allowed delay applies to report data, not access permissions. Even if the data comes from a cache, the request must check current access before returning it. Separating cached entries by organization would reduce the chance of mixing organizations' data, but it would not replace authorization. Someone whose access was removed must not keep receiving the report just because a cached result still exists. This does not show that the current implementation has this bug. It states a requirement for any proposed cache.

I recommend measuring a representative request before adding the distributed service. If the report query takes most of the time, and equivalent requests happen often enough for reuse to help, a cache becomes a reasonable option. If preparing the response or browser work takes most of the time, reusing query results may not reduce the main delay. A distributed cache would also add expiration behavior, cache-miss handling, and another service to operate. These are tradeoffs to assess, not proof that caching would be a mistake.

The measurement has not been run, and we have not implemented a cache or an authorization change. I would reconsider the recommendation after we know where the delay occurs and whether repeated requests actually share reusable results. Until then, the freshness allowance supports investigating caching. It does not show that caching will improve this page.

Local recovery procedure

Use this sequence for the local indexer only. Keep incoming work paused until verification is complete; successful process startup is not sufficient evidence of recovery.

1. Run indexctl pause --local and confirm that the status reports paused. If it does not, stop here rather than continuing with a moving queue.

2. Save the recovery inputs:

   • Copy var/index/checkpoint.json to var/index/checkpoint.backup.json.

   • Record the pending item count shown by indexctl status --local. If the checkpoint cannot be copied, stop and investigate before restarting.

3. Run indexctl restart --local. Do not delete the queue directory as part of this step.

4. While intake remains paused, verify the recovered queue:

   • Check that the pending item count matches the recorded count.

   • If it differs, leave intake paused and compare the saved checkpoint with the current one; do not resume automatically.

5. Only after the counts match, run indexctl resume --local.

Retain the backup until the resumed indexer has processed the pending work. These are instructions, not a report that recovery has already been performed.

Local recovery procedure

Use this sequence for the local indexer only. Keep incoming work paused until verification is complete; a successful process startup does not confirm recovery.

1. Run indexctl pause --local and confirm that the status reports paused. If it does not, stop rather than continuing with a moving queue.

2. Save the recovery inputs:

   • Copy var/index/checkpoint.json to var/index/checkpoint.backup.json.

   • Record the pending item count shown by indexctl status --local. If the checkpoint cannot be copied, stop and investigate before restarting.

3. Run indexctl restart --local. Do not delete the queue directory during this step.

4. While intake remains paused, verify the recovered queue:

   • Confirm that the pending item count matches the recorded count.

   • If it differs, keep intake paused and compare the saved checkpoint with the current one. Do not resume automatically.

5. After the counts match, run indexctl resume --local.

Keep the backup until the resumed indexer has processed the pending work. These are instructions, not a report that recovery has already been performed.

Local recovery procedure

Use this sequence for the local indexer only. Keep incoming work paused until verification is complete; successful process startup is not sufficient evidence of recovery.

1. Run indexctl pause --local and confirm that the status reports paused. If it does not, stop here rather than continuing with a moving queue.

2. Save the recovery inputs:

   • Copy var/index/checkpoint.json to var/index/checkpoint.backup.json.

   • Record the pending item count shown by indexctl status --local. If the checkpoint cannot be copied, stop and investigate before restarting.

3. Run indexctl restart --local. Do not delete the queue directory as part of this step.

4. While intake remains paused, verify the recovered queue:

   • Check that the pending item count matches the recorded count.

   • If it differs, leave intake paused and compare the saved checkpoint with the current one; do not resume automatically.

5. Only after the counts match, run indexctl resume --local.

Retain the backup until the resumed indexer has processed the pending work. These are instructions, not a report that recovery has already been performed.

Local recovery procedure

Use this sequence for the local indexer only. Keep incoming work paused until verification is complete; successful process startup alone does not confirm recovery.

1. Run indexctl pause --local and confirm the status reports paused. If it does not, stop rather than continuing with a moving queue.

2. Save the recovery inputs:

   • Copy var/index/checkpoint.json to var/index/checkpoint.backup.json.

   • Record the pending item count shown by indexctl status --local. If the checkpoint cannot be copied, stop and investigate before restarting.

3. Run indexctl restart --local. Do not delete the queue directory as part of this step.

4. While intake remains paused, verify the recovered queue:

   • Confirm that the pending item count matches the recorded count.

   • If it differs, leave intake paused, compare the saved checkpoint with the current one, and do not resume automatically.

5. Only after the counts match, run indexctl resume --local.

Retain the backup until the resumed indexer has processed the pending work. These are instructions, not a report that recovery has already been performed.

Local recovery procedure

Use this sequence for the local indexer only. Keep incoming work paused until verification is complete; successful process startup is not sufficient evidence of recovery.

1. Run indexctl pause --local and confirm that the status reports paused. If it does not, stop here rather than continuing with a moving queue.

2. Save the recovery inputs:

   • Copy var/index/checkpoint.json to var/index/checkpoint.backup.json.

   • Record the pending item count shown by indexctl status --local. If the checkpoint cannot be copied, stop and investigate before restarting.

3. Run indexctl restart --local. Do not delete the queue directory as part of this step.

4. While intake remains paused, verify the recovered queue:

   • Check that the pending item count matches the recorded count.

   • If it differs, leave intake paused and compare the saved checkpoint with the current one; do not resume automatically.

5. Only after the counts match, run indexctl resume --local.

Retain the backup until the resumed indexer has processed the pending work. These are instructions, not a report that recovery has already been performed.

Local recovery procedure

Keep incoming work paused until verification is complete. Successful process startup is not sufficient evidence of recovery.

1. Run indexctl pause --local and confirm that the status reports paused. If it does not, stop rather than continuing with a moving queue.

2. Save the recovery inputs:

   • Copy var/index/checkpoint.json to var/index/checkpoint.backup.json.

   • Record the pending item count shown by indexctl status --local.

   • If the checkpoint cannot be copied, stop and investigate before restarting.

3. Run indexctl restart --local. Do not delete the queue directory as part of this step.

4. While intake remains paused, verify the recovered queue:

   • Confirm that the pending item count matches the recorded count.

   • If it differs, leave intake paused and compare the saved checkpoint with the current one; do not resume automatically.

5. Only after the counts match, run indexctl resume --local.

Retain the backup until the resumed indexer has processed the pending work. These are instructions, not a report that recovery has already been performed.

Local recovery procedure

Use this sequence for the local indexer only. Keep incoming work paused until verification is complete; successful process startup is not sufficient evidence of recovery.

1. Run indexctl pause --local and confirm that the status reports paused. If it does not, stop here rather than continuing with a moving queue.

2. Save the recovery inputs:

   • Copy var/index/checkpoint.json to var/index/checkpoint.backup.json.

   • Record the pending item count shown by indexctl status --local. If the checkpoint cannot be copied, stop and investigate before restarting.

3. Run indexctl restart --local. Do not delete the queue directory as part of this step.

4. While intake remains paused, verify the recovered queue:

   • Check that the pending item count matches the recorded count.

   • If it differs, leave intake paused and compare the saved checkpoint with the current one; do not resume automatically.

5. Only after the counts match, run indexctl resume --local.

Retain the backup until the resumed indexer has processed the pending work. These are instructions, not a report that recovery has already been performed.

Local recovery procedure

Use this sequence for the local indexer only. Keep incoming work paused until verification is complete; successful process startup is not sufficient evidence of recovery.

1. Run indexctl pause --local and confirm that the status reports paused. If it does not, stop here rather than continuing with a moving queue.

2. Save the recovery inputs:

   • Copy var/index/checkpoint.json to var/index/checkpoint.backup.json.

   • Record the pending item count shown by indexctl status --local. If the checkpoint cannot be copied, stop and investigate before restarting.

3. Run indexctl restart --local. Do not delete the queue directory as part of this step.

4. While intake remains paused, verify the recovered queue:

   • Confirm that the pending item count matches the recorded count.

   • If it differs, leave intake paused and compare the saved checkpoint with the current one; do not resume automatically.

5. Only after the counts match, run indexctl resume --local.

Retain the backup until the resumed indexer has processed the pending work. These are instructions, not a report that recovery has already been performed.

Local recovery procedure

Use this sequence for the local indexer only. Keep incoming work paused until verification is complete; successful process startup is not sufficient evidence of recovery.

1. Run indexctl pause --local and confirm that the status reports paused. If it does not, stop here rather than continuing with a moving queue.

2. Save the recovery inputs:

   • Copy var/index/checkpoint.json to var/index/checkpoint.backup.json.

   • Record the pending item count shown by indexctl status --local. If the checkpoint cannot be copied, stop and investigate before restarting.

3. Run indexctl restart --local. Do not delete the queue directory as part of this step.

4. While intake remains paused, verify the recovered queue:

   • Check that the pending item count matches the recorded count.

   • If it differs, leave intake paused and compare the saved checkpoint with the current one; do not resume automatically.

5. Only after the counts match, run indexctl resume --local.

Retain the backup until the resumed indexer has processed the pending work. These are instructions, not a report that recovery has already been performed.

Local recovery procedure

Use this sequence for the local indexer only. Keep incoming work paused until verification is complete. Successful process startup does not prove recovery.

1. Run indexctl pause --local. Confirm that the status reports paused. If it does not, stop and do not continue with a moving queue.

2. Save the recovery inputs:

   • Copy var/index/checkpoint.json to var/index/checkpoint.backup.json.

   • Record the pending item count from indexctl status --local. If you cannot copy the checkpoint, stop and investigate before restarting.

3. Run indexctl restart --local. Do not delete the queue directory during this step.

4. Keep intake paused and verify the recovered queue:

   • Confirm that the pending item count matches the recorded count.

   • If the count differs, keep intake paused and compare the saved checkpoint with the current checkpoint. Do not resume automatically.

5. Run indexctl resume --local only after the counts match.

Retain the backup until the resumed indexer has processed the pending work. These are instructions, not a report that recovery has already occurred.

Local recovery procedure

Use this sequence for the local indexer only. Keep incoming work paused until verification is complete; successful process startup is not sufficient evidence of recovery.

1. Run indexctl pause --local and confirm that the status reports paused. If it does not, stop here rather than continuing with a moving queue.

2. Save the recovery inputs:

   • Copy var/index/checkpoint.json to var/index/checkpoint.backup.json.

   • Record the pending item count shown by indexctl status --local. If the checkpoint cannot be copied, stop and investigate before restarting.

3. Run indexctl restart --local. Do not delete the queue directory as part of this step.

4. While intake remains paused, verify the recovered queue:

   • Check that the pending item count matches the recorded count.

   • If it differs, leave intake paused and compare the saved checkpoint with the current one; do not resume automatically.

5. Only after the counts match, run indexctl resume --local.

Retain the backup until the resumed indexer has processed the pending work. These are instructions, not a report that recovery has already been performed.

Local recovery procedure

Use this sequence for the local indexer only. Keep incoming work paused until verification is complete. A successful process startup does not confirm recovery.

1. Run indexctl pause --local and confirm that the status says paused. If it does not, stop instead of continuing with a moving queue.

2. Save the recovery inputs:

   • Copy var/index/checkpoint.json to var/index/checkpoint.backup.json.

   • Record the pending item count shown by indexctl status --local. If the checkpoint cannot be copied, stop and investigate before restarting.

3. Run indexctl restart --local. Do not delete the queue directory during this step.

4. While intake is paused, verify the recovered queue:

   • Confirm that the pending item count matches the recorded count.

   • If it differs, keep intake paused and compare the saved checkpoint with the current one. Do not resume automatically.

5. Run indexctl resume --local only after the counts match.

Keep the backup until the resumed indexer has processed the pending work. These are instructions, not a report that recovery has already been performed.

Processing options

The following comparison describes behavior, not measured throughput. Neither option has been benchmarked with the current image set.

Concern	Inline processing	Queued processing
Response meaning	Thumbnail is ready when the request succeeds	Job is accepted; thumbnail may still be pending
Failure visibility	Processing failure is returned in the request	Processing failure must be exposed through job status
Service ownership	No separate worker to operate	Worker and queue require operation
Traffic bursts	Requests occupy processing capacity immediately	Pending jobs can wait, increasing completion delay

I recommend inline processing for the initial version if its measured request duration fits the caller's timeout. This avoids introducing a worker before we know one is needed. Choose queued processing if that duration cannot fit and callers can handle a pending result. A queue changes where waiting occurs; it does not by itself make image processing faster. The next useful step is a representative duration measurement, not a throughput claim based on the architecture alone.

The comparison describes behavior, not measured throughput. Neither option has been benchmarked with the current image set.

Concern	Inline processing	Queued processing
Response meaning	The thumbnail is ready when the request succeeds	The job is accepted, but the thumbnail may still be pending
Failure visibility	Processing failures are returned in the request	Processing failures must be exposed through job status
Service ownership	No separate worker is required	The worker and queue must be operated
Traffic bursts	Requests use processing capacity immediately	Pending jobs can wait, increasing completion delay

Use inline processing for the initial version if its measured request duration fits the caller’s timeout. This avoids adding a worker before it is needed. Use queued processing if the duration does not fit and callers can handle a pending result. A queue changes where waiting occurs; it does not automatically make image processing faster.

The next useful step is to measure duration with a representative image set, not to infer throughput from the architecture.

Processing options

The following comparison describes behavior, not measured throughput. Neither option has been benchmarked with the current image set.

Concern	Inline processing	Queued processing
Response meaning	Thumbnail is ready when the request succeeds	Job is accepted; thumbnail may still be pending
Failure visibility	Processing failure is returned in the request	Processing failure must be exposed through job status
Service ownership	No separate worker to operate	Worker and queue require operation
Traffic bursts	Requests occupy processing capacity immediately	Pending jobs can wait, increasing completion delay

I recommend inline processing for the initial version if its measured request duration fits the caller's timeout. This avoids introducing a worker before we know one is needed. Choose queued processing if that duration cannot fit and callers can handle a pending result. A queue changes where waiting occurs; it does not by itself make image processing faster. The next useful step is a representative duration measurement, not a throughput claim based on the architecture alone.

Processing options

The following comparison describes behavior, not measured throughput. Neither option has been benchmarked with the current image set.

Concern	Inline processing	Queued processing
Response meaning	Thumbnail is ready when the request succeeds	Job is accepted; thumbnail may still be pending
Failure visibility	Processing failure is returned in the request	Processing failure must be exposed through job status
Service ownership	No separate worker to operate	Worker and queue require operation
Traffic bursts	Requests occupy processing capacity immediately	Pending jobs can wait, increasing completion delay

I recommend inline processing initially if its measured request duration fits the caller’s timeout. This avoids introducing a worker before we know one is needed. Choose queued processing if that duration cannot fit and callers can handle a pending result. A queue changes where waiting occurs; it does not by itself make image processing faster. The next useful step is measuring representative duration, not claiming throughput from the architecture alone.

Processing options

The following comparison describes behavior, not measured throughput. Neither option has been benchmarked with the current image set.

Concern	Inline processing	Queued processing
Response meaning	Thumbnail is ready when the request succeeds	Job is accepted; thumbnail may still be pending
Failure visibility	Processing failure is returned in the request	Processing failure must be exposed through job status
Service ownership	No separate worker to operate	Worker and queue require operation
Traffic bursts	Requests occupy processing capacity immediately	Pending jobs can wait, increasing completion delay

I recommend inline processing for the initial version if its measured request duration fits the caller's timeout. This avoids introducing a worker before we know one is needed. Choose queued processing if that duration cannot fit and callers can handle a pending result. A queue changes where waiting occurs; it does not by itself make image processing faster. The next useful step is a representative duration measurement, not a throughput claim based on the architecture alone.

Next step

Measure representative request duration. This is not a throughput benchmark, and neither option has been benchmarked with the current image set.

Processing options

Concern	Inline processing	Queued processing
Response meaning	Thumbnail is ready when the request succeeds	Job is accepted; thumbnail may still be pending
Failure visibility	Processing failure is returned in the request	Processing failure must be exposed through job status
Service ownership	No separate worker to operate	Worker and queue require operation
Traffic bursts	Requests occupy processing capacity immediately	Pending jobs can wait, increasing completion delay

• Use inline processing for the initial version if its measured request duration fits the caller's timeout. This avoids introducing a worker before we know one is needed.

• Use queued processing if that duration cannot fit and callers can handle a pending result.

• A queue changes where waiting occurs; it does not by itself make image processing faster.

Processing options

The following comparison describes behavior, not measured throughput. Neither option has been benchmarked with the current image set.

Concern	Inline processing	Queued processing
Response meaning	Thumbnail is ready when the request succeeds	Job is accepted; thumbnail may still be pending
Failure visibility	Processing failure is returned in the request	Processing failure must be exposed through job status
Service ownership	No separate worker to operate	Worker and queue require operation
Traffic bursts	Requests occupy processing capacity immediately	Pending jobs can wait, increasing completion delay

I recommend inline processing for the initial version if its measured request duration fits the caller's timeout. This avoids introducing a worker before we know one is needed. Choose queued processing if that duration cannot fit and callers can handle a pending result. A queue changes where waiting occurs; it does not by itself make image processing faster. The next useful step is a representative duration measurement, not a throughput claim based on the architecture alone.

Processing options

This comparison describes behavior, not measured throughput. Neither option has been benchmarked with the current image set.

Concern	Inline processing	Queued processing
Response meaning	Thumbnail is ready when the request succeeds	Job is accepted; thumbnail may still be pending
Failure visibility	Processing failure is returned in the request	Processing failure must be exposed through job status
Service ownership	No separate worker to operate	Worker and queue require operation
Traffic bursts	Requests occupy processing capacity immediately	Pending jobs can wait, increasing completion delay

I recommend inline processing for the initial version if its measured request duration fits the caller's timeout. This avoids introducing a worker before we know one is needed.

Choose queued processing if that duration cannot fit and callers can handle a pending result. A queue changes where waiting occurs; it does not by itself make image processing faster.

The next useful step is a representative duration measurement, not a throughput claim based on the architecture alone.

Processing options

The following comparison describes behavior, not measured throughput. Neither option has been benchmarked with the current image set.

Concern	Inline processing	Queued processing
Response meaning	Thumbnail is ready when the request succeeds	Job is accepted; thumbnail may still be pending
Failure visibility	Processing failure is returned in the request	Processing failure must be exposed through job status
Service ownership	No separate worker to operate	Worker and queue require operation
Traffic bursts	Requests occupy processing capacity immediately	Pending jobs can wait, increasing completion delay

I recommend inline processing for the initial version if its measured request duration fits the caller's timeout. This avoids introducing a worker before we know one is needed. Choose queued processing if that duration cannot fit and callers can handle a pending result. A queue changes where waiting occurs; it does not by itself make image processing faster. The next useful step is a representative duration measurement, not a throughput claim based on the architecture alone.

Processing options

The comparison below describes behavior, not measured throughput. Neither option has been benchmarked with the current image set.

Concern	Inline processing	Queued processing
Response meaning	The thumbnail is ready when the request succeeds.	The job is accepted. The thumbnail may still be pending.
Failure visibility	The request returns processing failure.	Job status must expose processing failure.
Service ownership	No separate worker requires operation.	The worker and queue require operation.
Traffic bursts	Requests immediately occupy processing capacity.	Pending jobs can wait, which increases completion delay.

I recommend inline processing for the initial version if its measured request duration fits the caller's timeout. This avoids introducing a worker before we know that one is needed.

Choose queued processing if the measured duration cannot fit the timeout and callers can handle a pending result. A queue changes where waiting occurs. It does not make image processing faster by itself.

The next useful step is to measure a representative duration. Do not make a throughput claim based on the architecture alone.

Processing options

The following comparison describes behavior, not measured throughput. Neither option has been benchmarked with the current image set.

Concern	Inline processing	Queued processing
Response meaning	Thumbnail is ready when the request succeeds	Job is accepted; thumbnail may still be pending
Failure visibility	Processing failure is returned in the request	Processing failure must be exposed through job status
Service ownership	No separate worker to operate	Worker and queue require operation
Traffic bursts	Requests occupy processing capacity immediately	Pending jobs can wait, increasing completion delay

I recommend inline processing for the initial version if its measured request duration fits the caller's timeout. This avoids introducing a worker before we know one is needed. Choose queued processing if that duration cannot fit and callers can handle a pending result. A queue changes where waiting occurs; it does not by itself make image processing faster. The next useful step is a representative duration measurement, not a throughput claim based on the architecture alone.

Processing options

This comparison describes behavior, not measured throughput. Neither option has been benchmarked with the current image set.

Concern	Inline processing	Queued processing
Response meaning	The thumbnail is ready when the request succeeds	The job is accepted; the thumbnail may still be pending
Failure visibility	The request returns processing failure	Job status must show processing failure
Service ownership	No separate worker to operate	The worker and queue require operation
Traffic bursts	Requests use processing capacity immediately	Pending jobs can wait, increasing completion delay

I recommend inline processing for the initial version if its measured request duration fits the caller's timeout. This avoids adding a worker before we know one is needed. Choose queued processing if that duration does not fit and callers can handle a pending result. A queue changes where waiting occurs; it does not make image processing faster by itself. The next useful step is to measure duration with representative data, not to claim throughput from the architecture alone.