Public query, search, graph and bulk-read requests share the node's HTTP admission pool described in command-admission.md. That pool reserves modeled working bytes and verified tenant/principal request counts before executing the read. Inside a search or graph read, ReadExecutionBudget additionally enforces one deadline, cancellation token and cumulative raw-read byte budget across the whole storage cut.
The default cumulative budget is 64 MiB (DatabaseLimits.MaxQueryReadBytes) and the execution deadline is 30 seconds (QueryDeadlineSeconds). Accounting includes returned raw keys/values from scans and point reads. Vector sidecar scans charge their referenced canonical documents too; graph adjacency scans charge edge and vertex dereferences. Missing, hidden, stale and filtered records still consume the work needed to examine them. Text and vector branches share the same budget and the same authorized read gate. HTTP request cancellation reaches search and graph execution; checks occur between reads, scores, projections and text-token batches. An in-progress synchronous storage lock or serialization is not preempted.
Graph MaxEdges bounds the total examined adjacency records across the traversal, including label-filtered and hidden destinations. It is not a fresh per-vertex allowance. Depth and vertex caps also apply. Labels use an ordinal set; a hidden intermediate vertex is never expanded. Search and graph responses must fit MaxBatchBytes after serializing their complete protocol result, including identity, revision, scores and edge/vertex metadata.
Exact BM25 reads the visible corpus while retaining document lengths and counts for query terms only. It does not retain an array of every corpus word or repeatedly count each query term across those arrays. NFKC normalization, invariant rune casing, visible-corpus document frequencies, repeated-term counts and the original BM25 constants remain unchanged. Query-term order controls floating-point score accumulation; score ties use canonical document ID. The default corpus-wide cap is 1,048,576 tokens (MaxSearchTextTokens), in addition to 65,536 tokens per document and a 4,096-character token bound. Missing text fields still participate in the visible corpus's document count and average-length policy. Only selected fused results receive full returned-document projection.
Text and exact-vector ranks use weighted RRF with one-based ranks. Its denominator is calculated in floating point so a large valid FusionConstant cannot wrap an integer into a negative score. Current row, field-use and returned-field policies continue to apply under the same read gate.
Regressions use the real store to prove point-dereference byte accounting, shared hybrid accounting, corpus-wide token limits, Unicode/repeated-term BM25 ranks, filtered and hidden graph work limits, complete result byte accounting and cancellation without canonical mutations. A monotonic test clock exercises deadline exhaustion without freezing the Orleans host clock.
These are raw-data, work and response bounds. Backend scans still have their own 64 MiB materialization cap before cumulative accounting, and object/JSON/native allocations can exceed the raw byte count. Native memory, process RSS, storage cache/memtable sizes, disk floors and sustained/endurance qualification remain separate work. Managed ANN and distributed ranking are separate search profiles.