TRICKYwalkthrough
The Trending Overlay: Two-Layer Freshness
At 19:03 a stadium announces a surprise concert; by 19:04 thousands of people are typing "taylor" and the right first suggestion has changed. The batch index, rebuilt hourly at best, cannot know: its scores encode stable popularity, not the last five minutes.
The trending overlay is a small, fast, decaying structure fed directly from the live query stream: sliding-window counts (last 5-15 minutes) for queries whose current velocity wildly exceeds their baseline rate: not popular queries, accelerating ones. It lives in Redis or in-process: tens of thousands of entries, megabytes not gigabytes: because at any moment only a tiny set of queries is genuinely spiking.
“Rebuilding the whole 80 GB index every minute is absurd: so freshness gets its own layer.”
At serve time the flow is: fetch the precomputed top-10 (batch truth), fetch overlay hits for the same prefix (fresh truth), and merge: a trending query with sufficient velocity earns a slot (typically capped at 2-3 of the 10) with a small "trending" affordance in the UI. The merge is deliberately conservative: the overlay can add, it cannot reorder the batch list wholesale: which bounds the blast radius of manipulation.
And manipulation is the overlay's defining risk: a botnet pumping one query for ten minutes is indistinguishable, naively, from breaking news. Defenses stack: per-source rate caps in the counting (one IP/session contributes bounded weight), velocity baselines per locale, a sanity delay (a query must sustain velocity for N minutes before surfacing), and the blocklist applying to the overlay path with zero exceptions.
Decay handles the aftermath: counts halve every few minutes, so yesterday's spike is gone by construction rather than by cleanup job. What if the interviewer asks: why not just shorten the batch cycle to 5 minutes?
Cost and safety: a full rebuild-and-ship every 5 minutes burns compute for the 99.99% of the index that did not change, and removes the human-scale window in which a poisoned build can be caught before promotion.
Related concepts