# Algolia Index Sync

## Objective

Keep the search index matching the database, including who is allowed to see what.

A sync pipeline that mirrors records into a search index with tenant-scoped filters and scheduled reconciliation.

## Before You Begin

This feature is being added to an application that already exists and already
works. Do not scaffold a new project, and do not assume a blank slate.

Inspect the codebase first and establish:

- The existing application structure and where code of this kind already lives.
- The framework and version in use.
- The existing design system — colours, spacing, typography, and component conventions.
- Existing UI components you can reuse instead of writing new ones.
- The existing database structure, if this feature needs to persist anything.
- The existing authentication and authorization system, if this feature is user-scoped.
- Dependencies already installed, so you don't add a library that duplicates one.
- The existing test setup and conventions.

Only start writing code once you understand the above. If the application
already implements part of this feature, extend it rather than replacing it.

## Implementation Instructions

1. Identify every record type that should be searchable and define one index document per record, keyed by an identifier that never changes for the life of that record.
2. Push changes through the app's existing background-job system on create, update, and delete, and make every write idempotent so a replayed job produces the same document rather than a duplicate.
3. Put tenant, workspace, and visibility values on each document as filter attributes, and have the server issue short-lived scoped search credentials that pin those filters. The browser must never choose its own filter.
4. Run backfills in batches sized to the provider's limits and throttled so a reindex does not starve live updates, and make a full rebuild something an operator can run without taking search offline.
5. Schedule a reconciliation that compares the index against the source of truth and repairs the difference. Search indexes drift, and a system with no reconciliation will be quietly wrong within a month.

## UI and UX Requirements

Match the application's existing design system exactly. Reuse its components,
spacing, and typography. This feature should look like it was always there.

## Responsive Requirements

Works on mobile, tablet, and desktop. Touch targets are large enough to hit on a
phone, and nothing overflows horizontally at 320px.

## Accessibility Requirements

- Fully keyboard navigable.
- Correct semantic elements and ARIA roles.
- Visible focus states.
- Meets WCAG AA contrast.
- Dynamic changes are announced to screen readers.
- Respects prefers-reduced-motion.

## Edge Cases

- An identifier derived from mutable data such as a slug or a title creates a duplicate document on every rename. Key documents by the record's permanent identifier.
- A deleted record, or one whose access was revoked, must leave search immediately. A stale document that still matches is a data leak, not a cosmetic bug.
- Filters enforced only in client code can be edited by the user. The filter has to be signed into the search credential the server issues, and that credential has to expire.
- Bulk operations exceed the provider's request size and rate limits. Chunk the payload, respect the retry interval it returns, and back off rather than dropping records on the floor.
- Indexing jobs fail, notifications are missed, and deploys interrupt queues. Reconciliation must find both missing and orphaned documents and repair each without a manual export.
- Index writes are eventually consistent. A user who saves a record and searches for it a second later may not find it, so drive the immediate view from the database rather than from search.
- Indexed content can include fields the searching user may not see. Decide per field what is indexed and returned, and keep private fields out of the document entirely rather than hiding them at render time.
- When the provider is unavailable the app must fall back to whatever database-backed search or listing it already has, with a notice, rather than showing an empty result page.

## Testing

Exercise the feature end to end in the running application. Cover every edge case
above, then run the existing test suite and confirm nothing regressed.

## Acceptance Criteria

- [ ] Every searchable record type has a document keyed by a permanent identifier.
- [ ] Create, update, and delete propagate through background jobs and are idempotent on replay.
- [ ] Deletion and access revocation remove the record from search results.
- [ ] Search credentials are issued server-side, scoped to the caller's tenant and visibility, and expire.
- [ ] Backfills batch within provider limits and do not block live updates.
- [ ] A scheduled reconciliation finds and repairs missing and orphaned documents.
- [ ] A provider outage falls back to the app's own search with a visible notice.
- [ ] The feature matches the existing design system.
- [ ] No existing functionality is broken.

## Adaptation Rules

- Match the existing design system. Do not introduce a new colour palette,
  spacing scale, or component library.
- Reuse existing components and utilities wherever they fit.
- Follow the naming, file layout, and code style already present.
- Do not upgrade, replace, or remove existing dependencies to make this
  feature fit. Adapt the feature to the app, not the app to the feature.
- Do not break existing functionality. If a change is genuinely required in
  existing code, make the smallest one that works and say so.
- If something in these instructions conflicts with how the application is
  built, follow the application and explain the deviation.

## Final Verification

Before you report the work as done:

1. Re-read the acceptance criteria above and check each one against what you
   actually built.
2. Run the application and exercise the feature end to end.
3. Run the existing test suite and confirm you have broken nothing.
4. Check the feature on mobile, tablet, and desktop widths.
5. Check keyboard navigation and focus handling.
6. Summarize what changed: files added, files modified, and anything you
   deliberately did differently because of how this application is built.

If any acceptance criterion is unmet, fix it before reporting completion.