One recall_search call: pin, certify, retrieve, verdict Diagram

Pin and certify

The whole search runs against one generation, read once from the tenant state
The threshold comes from that generation's published calibration
A different embedder than the one that built the generation voids the threshold

Refuse, abstain, answer

Refuse: under strict trust, an uncertified or mismatched generation is never searched
Abstain: retrieval ran but no hit earned verdict ok, so the reason is returned
Answer: ok hits first, then superseded or expired ones, each with provenance

Retrieve

The query is embedded once, as a query rather than a passage
Dense cosine and Postgres full text each return candidates from the pinned generation
Reciprocal rank fusion merges the two lists; a reranker is opt in