314 Timestamped Runs, Thirty Actual Sessions: What moment_group Recovers That a Count Cannot
Mixpeek writes every retriever execution into mxp_retriever_executions in your own namespace, so a retriever can read your own telemetry. Grouped by query_class with a sixty-second tolerance, 314 executions resolve into 30 moments: ten of them a single run, and the largest 24 runs inside 165 seconds.

A log tells you when things happened. It cannot tell you which of them were the same sitting. moment_group takes documents that share a parent field, sorts them in time, and merges any two whose gap falls inside merge_tolerance_ms, so a burst of work becomes one row and an isolated run stays one row.
This is that stage run over 314 real executions from mxp_retriever_executions, grouped by query_class. The shape of the result is the point: ten of the 30 moments hold exactly one run, and the largest holds 24 runs inside 165 seconds. A count of executions cannot tell those two apart. A count of moments can, and the difference is someone working against someone querying once.
Tolerance is the argument the stage asks you to make, and it has no correct default, because the right value is a claim about how your users work. Widen it and bursts swallow the quiet gaps between them; narrow it and one sitting splits into several. On this corpus the curve happens to be nearly flat, because these executions sit minutes apart: tolerances of 0, 1,000 and 10,000 ms all produce 30 moments and 60,000 produces 29. A corpus with genuine sub-second bursts would show a steep curve. The flat result here is a property of this data rather than a verdict on the parameter.
One detail on the image is worth reading closely, because it was a real bug. merge_tolerance_ms is compared against the time field's own values, and the scale used to be keyed off the field NAME: *_ms passed through, *_time and *_s and *_seconds scaled by 1000, and anything unrecognised was assumed to be milliseconds already. occurred_at_ts matched neither list, so epoch seconds were read as milliseconds, a tolerance of 60,000 meant 16.7 hours, and these same 314 runs collapsed into 9 moments. Output fields named start_ms and duration_ms carried seconds. Nothing warned. That is fixed: _ts now scales, and a magnitude check logs a warning when a value's size contradicts its name, in both directions and log-only so a false warning can never change a merge. Every number here is from the fixed build.
Getting to this collection needed a second stage first. mxp_retriever_executions carries vector_indexes: [] and no vectors, so feature_search cannot source from it; attribute_filter can, because as a first stage it fetches directly rather than requiring a prior vector search. Sourcing returned zero documents on three of four attempts, and those runs were discarded as unmeasured rather than counted, so the figures come only from the run that delivered.
Every number traces to one execution against col_60783f4a99 in ns_cbb394f1a5 with skip_cache true: 314 documents in, 3 parents, 30 moments, 3.74 ms of stage time.
Where this diagram appears
Run this on your own data
Mixpeek turns video, images, audio, and documents in your object storage into searchable, timestamped results through one API.
Search your own data

