Your RAG confidently quotes the policy you cancelled last March

Someone asks your assistant what the refund window is. It answers thirty days, quotes a paragraph, and cites the document the paragraph came from. The paragraph is real. The citation resolves. The document is the refund policy you cancelled in March, and the current window is fourteen days.

Nobody hallucinated anything. That is the part worth sitting with, because it means the entire apparatus you have built to catch wrong answers is silent.

Every control you own passes

Groundedness checks pass, because the answer is grounded. The model did not invent thirty days. It was handed thirty days by your retrieval layer, from a document that genuinely says it, and reported it faithfully. Citation verification passes, because the citation is real and the quote matches the source byte for byte. A span-level attribution check passes for the same reason.

A human reviewer passes it too, and this is the part teams underestimate. Showing the evidence is not the same as the evidence being read. A browser game about approving AI agent commands logged 409,000 decisions across 40,000 plays at 66.3 percent mean accuracy, and its single most-missed command was approved 64.7 percent of the time with the malicious payload displayed directly above the prompt (https://scalex.dev/blog/ai-agent-permissions-stats/, 5 August 2026). The author's own caveat travels with it: short game, an artificial base rate of roughly 34 percent threats, time pressure, vendor-published. Take it as directional. Evidence rendered on screen does not reliably become evidence consulted.

So the wrong answer ships with a citation attached, which makes it more persuasive than an uncited wrong answer would have been. You have not merely failed to catch the error. You have decorated it.

The dead document is not competing on equal terms

The reflex is to assume the old policy got retrieved by bad luck, and that a better embedding model or a reranker would have surfaced the current one instead. That reflex has the mechanism backwards, and the clearest statement of why came from a practitioner comment on r/AI_Agents in August.

The argument, in his framing, is that "a superseded document is worse than a missing one" (u/nejcar20, https://old.reddit.com/r/AI_Agents/comments/1vfa9iq/i_dont_think_rag_is_the_default_answer_for/, 4 August 2026). Retrieval ranks on similarity. A cancelled refund policy is maximally similar to a question about the refund policy, because it is a document written specifically to answer that question. It usually carries the questioner's exact vocabulary too, since the replacement was rewritten with new headings and new terminology while everyone learned to phrase their questions from the old one. The dead document does not merely get retrieved alongside the live one. It outranks it.

That last part is not our inference. It was measured and published in the ACL main track a year before the comment. HoH built a QA benchmark from Wikipedia snapshots that keeps both the current and the historical version of every article, then ran search over it. With no temporal signal applied, the outdated document is retrieved more often than the relevant one at every cut-off, hit rate at 5 of 0.8837 against 0.8707, and the paper states it plainly: outdated information "actually shows slightly higher retrieval rates than relevant information" (Ouyang et al., ACL 2025, Volume 1 Long Papers, https://aclanthology.org/2025.acl-long.301/, Table 2).

Worth noting, because it says something about how this discourse is going: that diagnosis sat at 2 points in a thread scoring about 92 with 46 comments when we read it on 14 August 2026. The sharpest thing in the thread was the least upvoted thing in the thread.

Five fixes that do not fix it

There is a mechanism underneath it. A June 2026 preprint reports that on a 98-pair calibration set with one open-weights embedder, cosine similarity separates a contradicted fact from a duplicated one at AUROC 0.59, near chance, because contradictions sit closer to the original than rephrasings do (https://arxiv.org/abs/2606.26511). Small sample, one model, unrefereed. Take it as the mechanism rather than the magnitude, and the standard remedies are all aimed at the wrong layer.

A better embedding model. You would be improving the accuracy of a similarity judgment that is already accurate. On this account the dead policy really is the most similar document, so making the ranker better at its job makes this worse, not better.

A reranker. Same layer, same problem. Cross-encoders score relevance to the query. The retired document is relevant to the query. It was written to be. HoH ran that experiment: adding a reranker moved the outdated hit rate at 5 from 0.5289 to 0.5563. It went up.

Hybrid or keyword search. This one actively backfires. Exact lexical match rewards the document carrying the question's vocabulary, which is the old one by construction.

A bigger context window. Now both documents are in context and the model has to adjudicate between them. It has no signal on which to do so. Two internal documents, both plausible, one of them dead, and nothing in either text says which. If your assistant guesses right here it is guessing.

A recency filter, the near miss that catches most teams. It is the one remedy that does move the number: with a Gaussian time decay applied, HoH's outdated hit rate at 5 falls from 0.8837 to 0.4950. It also drags the relevant one down from 0.8707 to 0.7023, and still leaves what the paper calls "a nearly 50% probability of retrieving outdated information in the top 5 results". You are buying a partial fix with real recall, because freshness is not validity. A 2019 returns policy that nobody has needed to change is still correct, and a document published last week can be wrong on the day it ships. Modification date is a proxy, and on this evidence a middling one.

The failure is at the filing layer, not the retrieval layer

None of these work because none of them are the right layer. The commenter above called the working fix "a filing rule, not a retrieval feature", and reported that three months of deleting superseded documents fixed what better chunking would never have touched.

He is right, and the reason he is right is that there was no way to say the thing that needed saying. Deleting is what you do when your corpus has no vocabulary for "this used to be true." A document store holds text and a modification date. It cannot hold an interval. So the only way to express that a policy died in March is to make the policy stop existing, which is a heavy operation with consequences we take up separately. His own closing question to the thread was whether the housekeeping stayed done, and his observation was that this arrangement rots about six months after the project finishes, because the library still has no owner.

A filing discipline that depends on a person remembering is not an architecture. It is a chore with a half-life.

What a corpus that carries time looks like

The alternative is to make the corpus able to say it, and none of that mechanism is new. It is a settled position that document retrieval has not adopted. In SQL:2011, a DELETE against a system-versioned table "does not actually delete the qualifying rows"; it closes the row's system-time period, and the row stays readable in the past (Kulkarni and Michels, SIGMOD Record 41(3), 2012, https://sigmodrecord.org/publications/sigmodRecord/1209/pdfs/07.industry.kulkarni.pdf). The taxonomy underneath it was published at SIGMOD in 1985. Retiring rather than deleting is forty-one years old and has been in an ISO standard for fifteen.

What is new is narrower, and it is the whole difficulty: a SQL query has a WHERE clause to hang the validity predicate on, and a vector index does not. Similarity search is not a query language, so there is nowhere to put the restriction.

In SAGARIS the unit of memory is not a document, it is a claim, and a claim stores when the fact was true separately from when the system came to believe it. The schema makes both timestamps mandatory, the time the fact was true and the time we came to believe it, and a later change adds an end-of-validity timestamp. A claim therefore carries a half-open interval: the window in which the fact held, with an open end meaning it still holds.

That gives you the sentence a document store cannot form: this was true from January until June, and we learned it in February. A contradiction then supersedes rather than overwrites. The supersede path is an UPDATE that appends to an append-only history chain and closes the interval with a single coalescing write, so the interval end is written once and a later correction cannot rewrite the past.

Retrieval over that corpus can ask for what was valid on a date, rather than asking for what is most similar and hoping the corpus was tidied recently.

What is actually running

The store is shipped and the schema above is committed. The extraction that would fill it from your email and call transcripts is not generally available yet. Claim reads into the dossier, the chat and next-best-action are behind their own flags, all unset.

And one thing we describe carefully for the same reason: every claim stores a hash of the quote it came from, but the function that fetches the stored bytes and re-verifies that hash against the span has no callers outside tests. The data supports click-through verification. The product does not do it today.

That is a narrower claim than the one this article could have made. It is the one the code supports.