Viewer relationships

Prerequisites and scoped previews

Frame the decision and non-ML baseline

Define user action, prediction unit, target horizon, product outcome and guardrails.

Labels, delayed outcomes and human annotation

Define label windows, maturity, censoring, annotation policy and disagreement.

Leakage, splits and evaluation contamination

Prevent future information, entity overlap, preprocessing leakage and test-set reuse.

Sampling, imbalance and observation bias

Explain selection/exposure bias, negatives, weighting and what sampling changes.

Embeddings and representation contracts

Define embedding training objective, normalization, dimension and model/index compatibility.

Candidate retrieval and ANN indexes

Separate eligible-corpus recall from latency/memory and filtering effects.

Ranking, reranking and multi-stage systems

Bound candidate sets, score/rerank and apply policy without confusing retrieval with ranking.

Retrieval and ranking evaluation

Define recall/precision at K, MRR, DCG/NDCG, relevance labels and query/user weighting.

Online experiments and causal limits

Specify randomization unit, exposure, guardrails, SRM, delayed outcomes and interference.

Scoped prerequisite preview. The complete chapter is planned; this preview does not count as authored coverage.

Training-serving consistency

Version feature/transform/model contracts and compare training versus serving behavior.

Registry, validation, rollout and rollback

Promote compatible artifact bundles through checks, shadow/canary and rollback gates.

Scoped prerequisite preview. The complete chapter is planned; this preview does not count as authored coverage.

Cold start, exposure and recommender feedback

Handle new users/items and interactions shaped by previous decisions.

Scoped prerequisite preview. The complete chapter is planned; this preview does not count as authored coverage.

What, when, why and how

Decision, objective and policy

what: The decision returns up to K ordered, eligible videos for one viewer/placement at a known time. Product satisfaction, learning loss, ranking metric and slate guardrails are separate contracts.
when: Use this before data/model choice and when a product changes the placement, allowed content or user action.
why: Clicks and raw watch duration can reward clickbait or long videos without improving satisfaction. Safety, privacy and creator constraints cannot be recovered from an unconstrained relevance score alone.
how: Clarify the placement, eligible audience, response deadline and outcome. Start with followed/popular recent eligible items; measure qualified-watch and satisfaction proxies with duration/creator/safety guardrails. Version the policy and state what evidence would reject a model upgrade.

Exposure and delayed outcome labels

what: A response decision, a rendered impression and later interaction are distinct records. A label refers to one attributable eligible exposure under a policy/window.
when: Use this when building ranking examples, measuring position effects and diagnosing feedback loops.
why: An unshown item has no observed user response. No event yet can mean an immature window or telemetry outage rather than disinterest. Replaying future watch events as features leaks the outcome.
how: Join interactions to an impression ID and deduplicate producer event identity. For this exercise, qualified watch requires at least min(30 seconds, half the video duration) within 24 hours of exposure. Add one hour ingestion allowance; require completeness or label unknown. Keep raw watch and satisfaction/report evidence separate.

Retrieval followed by bounded ranking

what: Retrieval combines cheap candidate sources; a ranker scores a bounded unique subset; a slate policy enforces final constraints.
when: Use this when the catalog is too large for a rich user-item model to score every item synchronously.
why: A strong ranker cannot recover a video omitted by retrieval. Global ANN top K followed by eligibility filtering can underfill. A model with better offline score can still exceed serving or review budgets.
how: Retrieve from followed/recent/popular and compatible vector sources, deduplicate and recheck eligibility, cap expensive scoring, then apply creator/safety rules. Trace stage exclusions and evaluate candidate recall independently of final NDCG and product outcomes.

Embeddings, loss and model choice

what: An item encoder supports offline vectors, a user/context encoder supports request-time retrieval, and a ranker may use richer pair features. All have explicit input/output and objective contracts.
when: Use a dual-encoder hypothesis when precomputed candidate vectors improve retrieval coverage within the serving budget.
why: Same vector dimension does not establish a shared space. A random unexposed negative can be a genuinely desirable video. More model complexity does not automatically improve available evidence or quality.
how: Define user/item vectors in R^d and dot similarity, loss/normalization and negative sampling. Compare the complete popularity baseline, a simple learned ranker and optional richer retrieval/sequence extensions. Validate source contributions and ablations on mature time-split data; reject incompatible or non-finite vectors.

Immutable lineage and compatible rollout

what: A serving bundle binds query/item representation contract, index snapshot, ranker, transforms and policy to one immutable release identity.
when: Use it for promotion, canary observation, incident rollback, backfills and explaining a past recommendation.
why: Rolling back ranker weights alone can leave a mismatched index or transform. A green process health check does not establish data or product quality.
how: Pin dataset/split/run identities, validate candidate and serving contracts, prewarm a compatible bundle, shadow for compatibility/cost and expose a bounded canary under guardrails. Roll back the whole reference; recheck live eligibility independently of snapshot age.

Cold start, exploration and feedback

what: New users/items lack behavioral evidence; repeated recommendations influence which future labels exist. Exploration is a policy change with user impact and statistical assumptions.
when: Use these when high average quality masks catalog narrowing, new-creator exclusion or rapidly changing interests.
why: Popularity feedback can crowd out new content. Logging an unshown candidate score does not reveal its user outcome. Inductive encoders still fail when metadata is absent or out of distribution.
how: Use eligible metadata/content and cohort popularity fallback, track new-user/item slices, and separate observation from intervention. If controlled exploration is justified, define support/assignment/exposure and guardrails; evaluate its costs and uncertainty rather than claiming propensity weighting removes every bias.

Deadline, caching and failure policy

what: A request deadline bounds feature reads, retrieval and ranker work; fallback is an explicit policy. Cached candidates and current eligibility have different freshness needs.
when: Use these to contain overload and dependency failures while preserving the product’s hard invariants.
why: Unlimited queueing worsens tail latency. Cached personalized output can leak context or serve revoked content. Retrying after the client deadline wastes resources and can duplicate telemetry.
how: Use per-stage work caps and remaining-deadline checks; cache only under user/placement/bundle/policy keys or use nonpersonalized eligible candidates. Recheck eligibility at display, return a shorter slate if needed and tag degraded decisions without fabricating model scores.

Understanding the product and clarifying the problem

We design a signed-in home-page surface that returns up to ten videos. Search results, autoplay chaining, ad auctions, creator upload/transcoding and moderation-model training are separate systems. We consume their authorized catalog/policy outputs and explain their failure boundaries. Anonymous users receive an eligible nonpersonalized baseline.

The following are assumed interviewer answers, not an employer’s interview script or current production requirements.

Clarifying question	Assumed answer	Design consequence
What is the placement and requested slate size?	Home page, at most ten items.	Optimize a slate; define per-request identity and positions.
What is the response target?	Synthetic p99 target 200 ms at 2,000 peak requests/s.	Bound stage deadlines, candidates and queueing.
What catalog is eligible?	Published, permitted language/region/age policy; no revoked videos.	Eligibility authority is separate from learned relevance.
Which data exists?	Permitted exposures, watch events and sparse satisfaction/report outcomes.	Labels have provenance, delay and selection limits.
How much user history may be used?	Consented pre-request history, maximum 30-day lookback.	Feature availability and deletion must propagate.
Can the system return fewer than ten?	Yes, when eligibility or safety constraints prevent a full slate.	Do not weaken invariants to fill slots.

Change two answers and revise the architecture

If history use is disabled, remove personalized history features and user-vector lookup. Serve permitted context/region popularity and explicitly report the changed population; do not silently reuse cached personalized results. An item/content model can still be considered under permitted inputs.

If the deadline drops from 200 to 50 ms, the proposed budget no longer fits. Consider precomputed eligible candidate pools and a small local scorer, reduce source fan-out and candidate work, and measure quality loss and revocation freshness. Do not claim the same sequence ranker will simply run four times faster.

Hard invariants: no ineligible output; unique video IDs per slate; bounded work; every served learned decision names a compatible bundle; an interaction is not treated as an unexposed negative; historical features were available at decision time. Logical schemas below specify identity, but cross-record timing and compatibility need application/transaction validation.

Separate product outcome, proxy, model loss and guardrail

The product outcome is useful, satisfying discovery over repeated sessions. We do not observe that perfectly. This exercise uses qualified-watch rate as an early proxy, with sparse explicit satisfaction/report evidence and longer-horizon return behavior as separate signals. Longer watch is not unconditionally better: duration, accidental play and regret matter.

A retrieval contrastive loss optimizes paired representation separation; a ranker may optimize binary log loss for an observed qualified-watch label. Neither is the entire product objective. Offline Recall@K and NDCG measure declared judgments; online treatment evidence asks whether actual exposure improves outcomes under guardrails.

Layer	Definition / denominator	Failure to watch for
Product	Useful discovery and satisfaction in eligible viewer sessions	Cannot equate raw time with satisfaction.
Early proxy	Mature qualified-watch labels / eligible rendered impressions	Position, missing telemetry and selected exposure bias.
Offline retrieval	Retrieved relevant eligible IDs / judged relevant eligible IDs	Missing items and filter mismatch.
Offline ranking	Exponential-gain NDCG under fixed eligible judgments	Unknown labels or changed gain/ideal convention.
System	p99 ≤ 200 ms at stated synthetic peak; stage caps	Toy fixtures do not establish this SLO.
Guardrails	Revoked/safety output, creator concentration, error/fallback, cost	Aggregate engagement can hide a harmful slice.

Build a complete non-ML service first

Use followed creators where permitted, then recent popular items in the viewer’s eligible region/language. Deduplicate, exclude already-consumed items under an explicit product rule, apply current eligibility and a creator cap, and return at most K. Store the rule/policy release identity with the decision.

This baseline already has useful output and a defined degraded mode. A simple learned ranker over the same candidates is the first controlled upgrade. Compare candidate-source coverage and operating costs before adding learned retrieval. A complete simple service is preferable to a neural diagram with no trustworthy labels or fallback.

Do not treat a “popular” count as timeless: use a declared rolling window of available, deduplicated events and document bot/filter effects. A popularity aggregate computed tomorrow is not valid for replaying yesterday’s request unless it reconstructs yesterday’s available state.

Prioritize signal groups and reject leakage

Initial groups are item content/metadata, pre-request user history and active request context. Include missing/default and freshness behavior, not a list of every conceivable feature. Sensitive or inferred attributes are not required by this teaching design.

Reject the current exposure’s eventual watch duration, like, report or corrected moderation decision as pre-exposure inputs. A prior signal can be valid only if its availability precedes this request and its permitted purpose remains valid.

Signal group / hypothesis	Representation / freshness	Cost and verification
Item topic/language/duration: preference and feasibility	Versioned categorical/numeric features; optional content vector	Cache with catalog/bundle identity; test changed metadata and new items.
Prior history: taste and recent interests	Bounded sequence or aggregates from consented 30-day history	Bounded read/default; late-event and revoked-consent tests.
Request context: placement and active session	Available placement/device/session fields; unknown category	Small request payload; missing and unsupported values tested.
Rejected signal: current watch outcome	Future outcome belongs to label construction	Deliberately leaked historical join must fail eligibility.

Create exposure labels and temporal splits

A Decision may return ten candidates, but only rendered/visible items generate Impressions under the product’s declared visibility rule. An Interaction references that impression. A retry uses a stable producer event ID so repeated delivery does not double-count watch or likes. Duration aggregation must avoid counting replayed progress deltas twice.

Synthetic example: I1 is rendered October 1 10:00 UTC for a 60-second video; a 40-second qualified watch is observed 10:05 and available 10:06. The 24-hour observation horizon plus one-hour ingestion allowance closes October 2 11:00. Before that boundary, label maturity is pending. After it, the outcome is positive if the telemetry source is complete. I2 with no interaction is not negative while pending or during an outage.

Use min(30 seconds, duration/2) as the exercise’s qualified-watch threshold. This is a synthetic target definition, not an industry standard; validate alternatives by duration and satisfaction slices. Define negative only for a mature eligible impression with complete observation and no qualifying outcome. Unshown videos remain unobserved.

Train on earlier mature impressions, tune on later validation and reserve a final future test period. Freeze source/duplicate and user-cohort rules matching the deployment question. Purge/embargo overlap where a training label window extends into the evaluation boundary; preprocess only on training. Existing-user future quality and unseen-user quality need separately declared assessments.

Snapshot examples pin exact feature and label revisions plus their known-at cutoff. A later appeal, deletion or corrected watch event creates a new revision/snapshot under a stated retention policy; it must not silently rewrite a published benchmark. Event time alone cannot justify a feature that arrived after the decision.

Choose a model with explicit shapes, losses and negatives

Baseline B0 has no learned model. Candidate B1 uses a simple linear/logistic or tree ranker with item, history and context features for the bounded retrieved set. For binary y, log loss is -[y log(p)+(1-y) log(1-p)], evaluated with an explicit numerically stable implementation if trained. Toy rank scores below are hand-authored and do not train B1.

Candidate B2 adds a dual-encoder retrieval hypothesis: user/context vector q in R^d, item vector v in R^d, similarity q·v under a declared normalization. Candidate vectors can be precomputed; a richer pair ranker consumes cross-features for the smaller candidate set. Contrastive or margin loss uses explicit positive/negative sampling; in-batch duplicates and alternate positives need handling.

For similarity hinge, positive 3, negative 1 and margin 1 gives zero; swapping them gives 3. For cosine, normalize nonzero vectors and use an equivalent query/index contract. Same dimension with a different representation identity is invalid. A sequence ranker is an optional design-only extension requiring learning curves, resource measurements and evidence beyond these fixtures.

Clicks, skips and watch labels depend on previous exposure and position. Random corpus negatives are modeling samples, not confirmed dislike. Define sample probabilities and any weighting assumptions; audit hard-negative quality and contamination. Do not claim a negative sampler or propensity weight alone eliminates feedback bias.

Required experiment plan: compare B0/B1 on the same eligible mature data, then ablate history/context and candidate sources. Add B2 only if it recovers useful missing candidates under resource and guardrail limits. Tune on validation; a fair final assessment uses a frozen held-out contract and reports slices/uncertainty.

Make training and promotion reproducible

The offline path consumes deduplicated available events, label-policy revisions and a permitted catalog snapshot. DatasetSnapshot records eligibility, time cutoffs, split rules, transform identity and label maturity/completeness. Each example pins feature/label revisions. TrainingRun pins code/config/environment, seed where meaningful, dataset and objective.

A completed run does not imply an approved model. Validate finite/shape outputs, stage coverage, metric oracles, new-user/item slices and compatibility before publishing ModelVersion and IndexSnapshot. A build retry uses run/artifact identity to avoid publishing two conflicting snapshots; invalid partial artifacts remain unpublished.

Only a release bundle with declared query/item representation, index, ranker, transform and policy versions can receive traffic. Maintain old compatible artifacts within the retention/access policy. The reference fixtures exercise these contracts without orchestrating a training job, checkpoint recovery or a distributed registry. A seed is not a guarantee of bitwise training determinism.

Trace training and serving paths separately

Offline: permitted events → validated snapshot/examples → simple training/validation → immutable models and index → compatible release bundle. Serving: request/consent/context → eligible candidate sources and query encoding → bounded ranking → final live policy → decision response and actual exposure telemetry. The two paths meet through explicit artifact and feature contracts.

For the synthetic workload, retrieve at most 200 unique candidates and send at most 100 to the expensive ranker. Batch feature reads within the stage budget. A relevant item lost at cheap selection is a measured stage loss; it cannot be recovered by a later model. Final live policy can remove an item that was valid in the index snapshot.

Use request/decision identity for retries and a deterministic per-response tie rule. A repeated transport attempt must not create duplicate exposure facts; the client uses a stable actual-render event ID. Decision logging acknowledgement is distinct from user exposure and later durable analytics ingestion.

Specify the request, result and event contracts

Logical interface: recommend(request_id, viewer_id_or_anonymous, placement, region, consent_context, requested_k, deadline). The server enforces K limits, authorized context and its own deadline; a client cannot grant access merely by setting region or consent flags.

Response: decision_id, ordered video IDs with positions, bundle_id, policy_version, fallback_reason and optional cursor scoped to the query/bundle/eligibility policy. Do not expose internal sensitive features or unvalidated reason text. A stale cursor or revoked consent must revalidate rather than replay an unsafe cached slate.

Exposure event: producer_event_id, decision_id, video_id, position, rendered_at, received/available timestamps and visibility-rule version. Interaction: stable event identity, impression_id, type, event/available times and bounded duration measurement. Reject impossible joins, wrong viewer/decision references and incompatible schema versions; quarantine with an owned error counter.

Logical acknowledgement semantics: a successful recommend response means selection completed, not that every item was viewed. A telemetry acknowledgement means accepted under the ingestion durability contract; analytics consumers deduplicate retries. These are proposed contracts, not deployed APIs.

Boundary	Normal case	Failure behavior
Request	Valid context and K within limit	Reject invalid/unauthorized input; do not broaden permissions.
Feature fetch	Available permitted snapshot/defaults	Bound timeout; use explicit missing/default indicators.
Candidate/ranker	Compatible versions; bounded unique work	Reject mixed bundle; eligible baseline on timeout.
Final response	Current eligibility and creator cap hold	Return fewer when no safe fill exists.
Telemetry	Stable producer identity and valid attribution	Deduplicate identical retry; quarantine conflicting payload.

Work retrieval, ranking and slate evaluation by hand

Use q=(1,0), candidate vectors X=(1,0), A=(.9,0), B=(.8,0), C=(.7,0), D=(.6,0), E=(.5,0). X is ineligible. Exact eligible top-3 by dot is A/B/C. A simulated approximate A/C/D overlaps that oracle in 2/3 IDs. With independent binary relevant eligible set A/B/E, its relevance Recall@3 is 1/3. This fixture simulates a search miss; no ANN algorithm was executed.

For a separate graded-ranking query, eligible relevance grades A=3, B=2, C=1, D=0 and returned order B/A/D give DCG=3+7/log2(3)≈7.416508. Ideal A/B/C gives IDCG≈9.392789, so NDCG@3≈.789596. Binary recall and precision are both 2/3. Keep this relevance set distinct from the previous retrieval fixture.

For the slate-policy trace, rank scores A=.9 and B=.8 share creator C1; C=.7 is C2; D=.6 is C3; E=.5 is ineligible. Top-3 with one-per-creator cap is A/C/D. B’s exclusion is a policy decision, not a model failure. Evaluate the displayed slate under a declared constrained or unconstrained ideal; do not change the ideal silently to make policy look perfect.

Duplicates A/A/B count A/B once. Under precision denominator K=3 the shortfall remains visible. A query with all relevance grades zero has undefined NDCG; a mean reports defined and undefined counts. Stable item-ID score ties, zero/invalid vectors, K bounds and revoked items are exercised in the reference suite.

Separate offline evidence, shadow checks and causal lift

Offline evaluation measures historical ranking under selected, imperfect labels. Use user/cohort/region/new-item slices, source coverage, duration strata, exposure policy and completeness counts. Include uncertainty appropriate to the sampling process and correlated observations; these tiny fixtures do not estimate confidence intervals.

Shadow deployment computes candidate output without displaying it and can measure compatibility, latency and request/policy failure. It cannot observe the user’s response to unshown alternatives. A controlled exposure experiment needs a stable assignment unit (for example viewer), actual exposure logs, predefined outcome/guardrail windows and mature analysis.

Define sample-ratio-mismatch checks, interference/novelty risks, repeated-peeking/multiple-comparison discipline and a minimum detectable effect/variance/traffic assumption before estimating duration. No universal number of days or users is asserted. Long-horizon return behavior cannot be inferred from one immediate click metric.

If exploration is used, declare which eligible items have nonzero exposure probability, what propensities are logged and where support is absent. User/candidate logging alone is not counterfactual outcome data. Controlled audit labels and independent judgments can complement behavior logs without claiming perfect debiasing.

Estimate capacity, latency and cost with units

Synthetic assumptions: 10 million active catalog videos, dimension d=128, float32 vectors, 2,000 peak requests/s, at most 200 retrieved and 100 expensive-rank candidates, up to ten outputs. Raw candidate vector storage is 10,000,000*128*4=5,120,000,000 bytes, approximately 4.77 GiB, excluding index, metadata, replicas, user vectors and rebuild overlap.

If old/new vector snapshots coexist during migration, raw candidate vectors alone use 10.24 GB decimal; index overhead and regional replicas add more. At peak, the configured caps imply up to 400,000 retrieved candidate IDs/s and 200,000 expensive pair scores/s. These are work bounds, not measured service capacity or hardware sizing.

An authored deadline budget of 15 ms request/context, 35 ms feature access, 40 ms retrieval, 65 ms scoring, 15 ms policy/logging and 30 ms reserve totals 200 ms. This is an allocation, not a proof that component p99 values add to end-to-end p99; benchmark correlated tail behavior and overload under representative traffic.

Cost worksheet: requests per window times bounded candidate work; raw vectors plus index/metadata/replicas/rebuild storage; training resource-hours; feature read and telemetry bytes. Price is a dated input to fill, not a live cloud estimate. Compare a simple ranker and precomputed baseline at equal eligible quality and constraints before reserving GPUs.

Quantity	Synthetic calculation	Practical limit
Raw item vectors	10M * 128 * 4 = 5.12 GB decimal	No index/metadata/replicas included.
Expensive pair work	2,000 req/s * 100 = 200,000 pairs/s	Not an observed throughput benchmark.
Response items	2,000 req/s * 10 = 20,000 IDs/s maximum	Actual impressions may be fewer.
Latency allocation	15+35+40+65+15+30 = 200 ms	Measure end-to-end tails; bound queues.

Trace normal, boundary and failure requests

Normal: permitted viewer U1 requests K=3 under bundle B1. Retrieval produces unique eligible A/B/C/D, scores are finite, the creator cap selects A/C/D and a decision is returned. Only actually rendered items create deduplicated impressions. Mature interactions later produce versioned labels.

Boundary: a new viewer with no history uses a declared missing-history representation or eligible baseline; a new item uses compatible content metadata or waits for indexing/fallback. If fewer than K eligible creators exist, return fewer. A no-positive evaluation query is undefined, not a serving failure.

Failure: query representation E2 arrives with index E1. Compatibility validation rejects the pair before scoring. Use B1 or the eligible rule baseline, tag the fallback and alert the release owner. Never serve mixed vectors because their dimensions happen to match. A revocation arriving after retrieval removes the item during final policy; remaining safe items can underfill.

Failure: the feature service is slow and ranker queue is saturated. Enforce remaining deadline and work caps, stop optional sources and use bounded eligible fallback. Cancel/abandon expired scoring work. Track degraded rate and quality; fallback is not evidence that the learned model succeeded.

Recovery: quarantine a bad bundle, restore the last compatible reference, verify sample decisions and event lineage, then compare live system signals immediately and mature quality later. Do not erase failed decisions or silently retrain into production.

Release, monitor and retrain under explicit gates

Stage a release through schema/vector/compatibility and metric-oracle validation, representative offline/slice review, shadow compatibility/cost checks, then bounded controlled exposure under predefined guardrails. Owner approval and rollback criteria are domain decisions; this educational reference does not auto-promote a trained model.

Monitor system tails/errors/queue saturation, data freshness/defaults/conflicts, candidate coverage/shortfalls, score/slate/creator distribution, policy violations, cost per request and delayed mature outcome quality. Immediate distribution shifts are diagnostic signals, not automatic proof of quality loss.

Retraining requires a documented cause/hypothesis, valid new data/labels, an immutable run and the same promotion gates. A telemetry outage, label-policy change or incompatible index may need data repair or rollback rather than a larger model. Scheduled retraining is a proposal, not an automation created by this course.

Signal	Owner / immediate action	What remains unknown
Mixed representation or invalid vector	Release/serving owner: reject and restore compatible bundle	New bundle’s product quality cannot be inferred.
Eligibility violation	Catalog/policy owner: contain and audit affected decisions	Late label evidence may still be incomplete.
High default/feature lag	Feature owner: bounded fallback, check producer/materialization	Is quality affected in each mature cohort?
Candidate shortfall/new-item exclusion	Retrieval owner: inspect filters/coverage and source fallback	Does recovered coverage improve outcomes?
Delayed outcome regression	Product/model/data owners: validate maturity, policy and assignment	Do not attribute causality without appropriate evidence.

Own privacy, deletion and multi-team evolution

Use only permitted history and synthetic/appropriately licensed examples. Do not log raw sensitive viewer histories or free-form reports in routine traces. Apply purpose, access and retention controls to raw events, feature snapshots, indexes, datasets and model artifacts.

Revoking history consent invalidates personalized lookup/cache entries under an explicit SLA and prevents new examples from using that history. Catalog removal propagates to candidate sources and indexes; authoritative final checks contain stale snapshots. Deleting online rows alone does not prove removal of all derived influence or model unlearning.

Product owns objectives and exposure policy; catalog/policy owns eligibility; data owns event/label semantics; retrieval/ranking own quality/contracts; platform/SRE own serving budgets and rollback. Use reviewed version changes, support windows and accountable incident handoffs rather than letting one score encode every team’s policy.

Staff deep dives: negotiate satisfaction versus creator exposure, migrate representation/index bundles across regions, and correct feedback-biased benchmarks without hiding a score drop. Each needs a rollout, owner, measurement period and explicit trade-off. Research-paper patterns are dated inputs, not claims about a named employer’s current system.

Data model, schema and relationships

Proposed logical schema for the synthetic recommendation product. IDs are globally unique; a multi-tenant adaptation must add tenant-qualified identity and authorization. FK relationships protect identity, not temporal eligibility or representation compatibility.

Implementation boundary: Logical contracts and deterministic synthetic references only; no SQL migrations, data ingestion service, ANN cluster or trained model is deployed.

These are proposed logical schemas with field contracts, not executable database migrations. PK identifies a row, FK references an existing parent, UK is a uniqueness rule. A composite PK identifies the combination. Nullable references are marked with ?. A foreign key protects identity; cross-row limits, timing and state transitions also require the transaction rules below.

Viewer: relationship map