ADR-0033: explicit typed native search with observed index provenance

Status: accepted within the contract below. All 688 provider units pass, including fourteen search protocol cases; five new search facts plus seven native regressions pass in .artifacts/search/accepted-live.log, zero failures/skips. Builds have zero warnings/errors and the exact owned fixture was removed.

FS-15 calls for explicit vector/full-text APIs, typed scored results, metadata/provenance, server capability checks, stable parameters, bounded execution and parity with native queries. Provide both node and relationship variants on DatabaseFacade, projecting driver entities into caller-owned untracked values. This extends the native DTO lane without inventing EF entity tracking or LINQ semantics for ranked results.

Use explicit CYPHER 25 ... SEARCH for vectors and the supported db.index.fulltext.queryNodes/queryRelationships procedures for full-text on the pinned Neo4j 2026.09 server. The observed capability gate admits known 2026 vector releases and 2026.09+ full-text releases with advertised Cypher 25, while treating other profiles as unsupported by this typed API. Direct QueryCypherAsync remains available. This does not claim live verification of every admitted version/edition. Prefer current vector syntax rather than introducing the deprecated vector procedures as a new dependency. The initial full-text SEARCH implementation passed ordinary-index tests but the pinned server rejected a visible ONLINE eventual index as nonexistent. Select the documented full-text procedures consistently for both consistency modes, with a parameterized index name and procedure/result row limits; this is a planned execution choice, not fallback or retry. The failing configuration evidence remains in .artifacts/search/configuration-live.log.

Preflight reads bounded server-component and index observations in the same guarded transaction as search. The selected index must exist, be ONLINE and match the requested kind and node/relationship target. Verify configured dimensions and known similarity functions; preserve full-text analyzer and eventual-consistency observations. Index metadata can change concurrently: this is not a schema lock. Permission/server/parser errors propagate and are not converted into empty results. No index creation, fallback scan or automatic retry is performed.

Only the vector query interpolates a validated ASCII index identifier, and it must match the observed index before search executes. All query values and row limits are parameters. Copy vector coordinates before any I/O. Validate finite float32-range coordinates, 1–4096 dimensions, nonzero cosine vectors, 1–10000 result limits and nonblank full-text input up to 16384 characters. Full-text input retains Lucene syntax; parameterization does not turn it into literal substring matching. Malformed Lucene expressions remain explicit server errors.

Results retain raw native scores and diagnostic element IDs; element IDs are not durable application identities. Vector scores are approximate similarity values in [0,1]; full-text scores retain their native relevance scale. Do not compare scores across queries/indexes or merge full-text/vector scores as if they had common units. Return observed provenance even for zero matches. The client row cap and SEARCH/procedure limit bound result count, not server traversal/index work or property-byte size; normal transaction configuration and cancellation remain relevant.

Reuse the native executor's ownership, cancellation, concurrency, reentrancy and cleanup behavior via an internal preflight callback. Both metadata cursors and result cursors emit existing value-free diagnostics under a search operation span. Projector/error/cancellation behavior must preserve borrowed transactions and clean up owned transactions. Vector index changes within the current transaction are not visible to search; full-text freshness depends on observed index consistency. Embedding generation and model provenance cannot be inferred from vector dimensions.

Acceptance requires actual node and relationship vector/full-text parity with independently issued native queries, score/order/limit semantics, empty results, dimension/index/capability/error cases, projector failure, cancellation, borrowed transaction behavior and regression of the native executor. Fourteen mocked protocol cases prove client behavior only; they do not prove SEARCH syntax or database outcomes.

Sources inspected 2026-10-11: SEARCH syntax and release boundaries, vector index behavior, full-text score and analyzer semantics. Local fixture pins remain the acceptance authority.