The module works with its built-in database index and no external search service. PostgreSQL uses native full-text search; SQLite provides a bounded development fallback. Other modules may:

register a live search provider in their module manifest
write authorized documents through the search.index_writer capability
announce context-sensitive WebUI search scopes through search.contexts

An optional OpenSearch adapter is a later provider, not a hard dependency. Source modules remain responsible for defining visibility and authorization.

Index lifecycle

Source modules register a versioned search_sources provider. A provider declares its resource types and index version, returns bounded resumable backfill pages, and batch-rechecks current authorization for sensitive resources. Incremental writes use SearchIndexChange and search.index_writer.enqueue_change() so change IDs are durable and idempotent in the same database transaction as the caller.

The built-in backend exposes opaque cursor pagination and does not return pre-authorization totals. PostgreSQL uses full-text search and will add trigram indexes when pg_trgm is already installed; SQLite remains a bounded development fallback.

Tenant search administrators can inspect /api/v1/search/admin/diagnostics, reconcile disabled modules, process queued changes, and start or continue resumable provider rebuilds. Rows requiring a source authorization recheck are omitted when their provider is unavailable, stale, or fails to return an explicit allow decision.