@feltdb/core 0.8.7 → 0.8.8

package/dist/create/server-source/crates/feltdb/src/state_contract.rs

@@ -604,12 +604,36 @@ pub struct ReadContext {
     pub authorization: AuthorizationContext,
     #[serde(skip, default)]
     snapshot_rows: Vec<StoredRow>,
+    #[serde(skip, default)]
+    live_query: bool,
 }
 pub fn begin_read(
     db: &FeltDb,
     schema: &StateSchema,
     state_namespace: &str,
     authorization: AuthorizationContext,
+) -> Result<ReadContext, StateFailure> {
+    begin_read_internal(db, schema, state_namespace, authorization, true)
+}
+
+/// Begin a query read without cloning the namespace up front. Query execution
+/// uses authoritative collection/index access and loads a namespace snapshot
+/// only when policy evaluation or reference expansion requires it.
+pub fn begin_query_read(
+    db: &FeltDb,
+    schema: &StateSchema,
+    state_namespace: &str,
+    authorization: AuthorizationContext,
+) -> Result<ReadContext, StateFailure> {
+    begin_read_internal(db, schema, state_namespace, authorization, false)
+}
+
+fn begin_read_internal(
+    db: &FeltDb,
+    schema: &StateSchema,
+    state_namespace: &str,
+    authorization: AuthorizationContext,
+    capture_snapshot: bool,
 ) -> Result<ReadContext, StateFailure> {
     if authorization.application_id != schema.application_id
         || authorization.revision_id != schema.revision_id
@@ -619,9 +643,12 @@ pub fn begin_read(
             "authorization context does not match schema",
         ));
     }
-    let snapshot = db
-        .state_rows_for_namespace(state_namespace)
-        .map_err(StateFailure::storage)?;
+    let snapshot_rows = if capture_snapshot {
+        db.state_rows_for_namespace(state_namespace)
+            .map_err(StateFailure::storage)?
+    } else {
+        Vec::new()
+    };
     Ok(ReadContext {
         application_id: schema.application_id.clone(),
         revision_id: schema.revision_id.clone(),
@@ -634,7 +661,8 @@ pub fn begin_read(
             .collect(),
         state_namespace: state_namespace.into(),
         authorization,
-        snapshot_rows: snapshot,
+        snapshot_rows,
+        live_query: !capture_snapshot,
     })
 }
 
@@ -801,6 +829,15 @@ pub struct QueryPlan {
     /// Number of rows returned after all filtering (actual, not estimate)
     #[serde(default)]
     pub actual_rows_returned: Option<usize>,
+    /// Records that matched the complete scoped predicate before pagination.
+    #[serde(default)]
+    pub matching_records: Option<usize>,
+    /// Candidates outside the requested equality scope that were examined.
+    #[serde(default)]
+    pub unrelated_records_examined: Option<usize>,
+    /// Zero-based position within the scoped, deterministically ordered set.
+    #[serde(default)]
+    pub pagination_position: Option<usize>,
     /// Total execution time in milliseconds (actual measurement)
     #[serde(default)]
     pub execution_ms: Option<f64>,
@@ -976,13 +1013,89 @@ pub fn query_hash(query: &CanonicalQuery) -> Result<String, StateFailure> {
         Sha256::digest(serde_json::to_vec(query).map_err(StateFailure::storage)?)
     ))
 }
+
+/// Hash only the immutable query shape. Pagination state is deliberately
+/// excluded so every page remains bound to the same collection, scope,
+/// ordering, projection, and limit.
+fn pagination_query_hash(query: &CanonicalQuery) -> Result<String, StateFailure> {
+    let mut shape = query.clone();
+    shape.cursor = None;
+    shape.offset = 0;
+    query_hash(&shape)
+}
+
+fn encode_query_cursor(query_hash: &str, position: usize) -> String {
+    format!("feltdb-query-v1.{position}.{}", &query_hash[7..])
+}
+
+fn decode_query_cursor(cursor: &str, expected_hash: &str) -> Result<usize, StateFailure> {
+    let mut parts = cursor.split('.');
+    let version = parts.next();
+    let position = parts.next();
+    let hash = parts.next();
+    if version != Some("feltdb-query-v1")
+        || parts.next().is_some()
+        || hash != Some(&expected_hash[7..])
+    {
+        return Err(StateFailure::new(
+            "INVALID_CURSOR",
+            "cursor does not match the query scope, collection, ordering, or limit",
+        ));
+    }
+    position
+        .and_then(|value| value.parse::<usize>().ok())
+        .ok_or_else(|| StateFailure::new("INVALID_CURSOR", "cursor is malformed"))
+}
+
+fn query_value(row: &crate::StoredRow) -> Value {
+    let mut value = row.value.clone();
+    if let Some(object) = value.as_object_mut() {
+        object.insert("_id".into(), Value::String(row.key.clone()));
+        object.insert(
+            "_version".into(),
+            Value::from(
+                row.operation
+                    .as_ref()
+                    .map(|value| value.sequence)
+                    .unwrap_or(0),
+            ),
+        );
+    }
+    value
+}
 fn extract_equality_predicate(filter: &QueryFilter) -> Option<(String, Value)> {
     match filter {
         QueryFilter::Eq { field, value } => Some((field.clone(), value.clone())),
+        QueryFilter::And { filters } => filters.iter().find_map(extract_equality_predicate),
+        _ => None,
+    }
+}
+fn extract_indexed_equality(
+    filter: &QueryFilter,
+    definition: &CollectionSchema,
+) -> Option<(String, Value)> {
+    match filter {
+        QueryFilter::Eq { field, value } if can_use_index(definition, field) => {
+            Some((field.clone(), value.clone()))
+        }
+        QueryFilter::And { filters } => filters
+            .iter()
+            .find_map(|filter| extract_indexed_equality(filter, definition)),
         _ => None,
     }
 }
 
+fn contains_managed_scope(filter: &QueryFilter) -> bool {
+    match filter {
+        QueryFilter::Eq { field, .. } => matches!(
+            field.as_str(),
+            "tenant_id" | "tenantId" | "organization_id" | "organizationId" | "scope_prefix"
+        ),
+        QueryFilter::And { filters } => filters.iter().any(contains_managed_scope),
+        _ => false,
+    }
+}
+
 fn extract_range_predicate(filter: &QueryFilter) -> Option<(String, Option<Value>, Option<Value>)> {
     match filter {
         QueryFilter::Gte { field, value } => Some((field.clone(), Some(value.clone()), None)),
@@ -1067,6 +1180,9 @@ pub fn explain_query(
         },
         actual_rows_scanned: None,
         actual_rows_returned: None,
+        matching_records: None,
+        unrelated_records_examined: None,
+        pagination_position: None,
         execution_ms: None,
         timing: None,
         index_metrics: None,
@@ -1205,7 +1321,15 @@ pub fn execute_query(
         }
     }
 
-    let snapshot_rows = &context.snapshot_rows;
+    let query_snapshot;
+    let snapshot_rows = if read_policy.is_some() || !query.references.is_empty() {
+        query_snapshot = _db
+            .state_rows_for_namespace(&context.state_namespace)
+            .map_err(StateFailure::storage)?;
+        &query_snapshot
+    } else {
+        &context.snapshot_rows
+    };
 
     // Detect unfiltered COUNT(*) for maintained cardinality optimization
     let is_unfiltered_count = query.filter.is_none()
@@ -1245,6 +1369,9 @@ pub fn execute_query(
                 fallback_reason: None,
                 actual_rows_scanned: Some(0),
                 actual_rows_returned: Some(1),
+                matching_records: Some(1),
+                unrelated_records_examined: Some(0),
+                pagination_position: Some(0),
                 execution_ms: Some(execution_ms),
                 timing: Some(ExecutionTiming {
                     planning_ms: None,
@@ -1265,21 +1392,17 @@ pub fn execute_query(
         });
     }
 
-    let (used_index, index_name, index_predicate_field_and_value) =
+    let (planned_index, index_name, index_predicate_field_and_value) =
         if let Some(filter) = &query.filter {
-            if let Some((field, value)) = extract_equality_predicate(filter) {
-                if can_use_index(definition, &field) {
-                    let index_name = definition
-                        .indexes
-                        .iter()
-                        .find(|idx| idx.fields.contains(&field))
-                        .map(|idx| idx.name.clone());
+            if let Some((field, value)) = extract_indexed_equality(filter, definition) {
+                let index_name = definition
+                    .indexes
+                    .iter()
+                    .find(|idx| idx.fields.contains(&field))
+                    .map(|idx| idx.name.clone());
 
-                    if index_name.is_some() {
-                        (true, index_name, Some((field, value)))
-                    } else {
-                        (false, None, None)
-                    }
+                if index_name.is_some() {
+                    (true, index_name, Some((field, value)))
                 } else {
                     (false, None, None)
                 }
@@ -1289,71 +1412,83 @@ pub fn execute_query(
         } else {
             (false, None, None)
         };
+    let used_index = planned_index && context.live_query;
+    if context.live_query
+        && query.filter.as_ref().is_some_and(contains_managed_scope)
+        && !used_index
+    {
+        return Err(StateFailure::new(
+            "INDEX_UNAVAILABLE",
+            "managed tenant scope requires a schema-declared equality index",
+        ));
+    }
 
     let planning_ms = query_start.elapsed().as_secs_f64() * 1000.0;
     let filtering_start = Instant::now();
 
-    // First pass: filter by capability and prepare values
-    let prepared_values = snapshot_rows
-        .iter()
-        .cloned()
-        .filter(|row| row.capability == capability && !row.deleted)
-        .map(|row| {
-            let mut value = row.value;
-            if let Some(object) = value.as_object_mut() {
-                object.insert("_id".into(), Value::String(row.key));
-                object.insert(
-                    "_version".into(),
-                    Value::from(row.operation.as_ref().map(|v| v.sequence).unwrap_or(0)),
-                );
-            }
-            value
-        })
-        .collect::<Vec<_>>();
-
-    let prepared_count = prepared_values.len();
-
-    // Measure index lookup time (actual, not estimated)
+    // Execute against authoritative rows. A schema-declared equality index is
+    // derived for this exact namespaced collection and must answer the query;
+    // the managed path never silently reinterprets an indexed scope as a scan.
+    let execution_before = crate::query_execution_diagnostics::counters();
     let index_lookup_start = Instant::now();
-
-    // Track index pre-filtering metrics
-    let index_pre_filtered_count =
-        if let Some((field, search_value)) = &index_predicate_field_and_value {
-            prepared_values
-                .iter()
-                .filter(|value| {
-                    if let Some(field_value) = value.get(field) {
-                        field_value == search_value
-                    } else {
-                        false
-                    }
-                })
-                .count()
-        } else {
-            prepared_values.len()
-        };
-
-    let index_lookup_ms = if used_index {
-        index_lookup_start.elapsed().as_secs_f64() * 1000.0
+    let selected_rows = if !context.live_query {
+        snapshot_rows
+            .iter()
+            .filter(|row| {
+                row.capability == capability
+                    && !row.deleted
+                    && query
+                        .filter
+                        .as_ref()
+                        .is_none_or(|filter| matches(&query_value(row), filter))
+            })
+            .cloned()
+            .collect()
+    } else if let Some((field, search_value)) = &index_predicate_field_and_value {
+        _db.create_equality_index(&capability, field)
+            .map_err(StateFailure::storage)?;
+        _db.query_collection_by_equality(&capability, &[(field.as_str(), search_value)], |row| {
+            !row.deleted
+                && query
+                    .filter
+                    .as_ref()
+                    .is_none_or(|filter| matches(&query_value(row), filter))
+        })
+        .map_err(StateFailure::storage)?
+        .ok_or_else(|| {
+            StateFailure::new(
+                "INDEX_UNAVAILABLE",
+                "the schema-declared scoped equality index is unavailable",
+            )
+        })?
     } else {
-        0.0
-    };
-
-    let mut values = prepared_values
-        .into_iter()
-        .filter(|value| {
-            if let Some((field, search_value)) = &index_predicate_field_and_value {
-                if let Some(field_value) = value.get(field) {
-                    if field_value != search_value {
-                        return false;
-                    }
-                } else {
-                    return false;
-                }
-            }
-            query.filter.as_ref().is_none_or(|f| matches(value, f))
+        _db.query_collection(&capability, None, |row| {
+            !row.deleted
+                && query
+                    .filter
+                    .as_ref()
+                    .is_none_or(|filter| matches(&query_value(row), filter))
         })
-        .collect::<Vec<_>>();
+        .map_err(StateFailure::storage)?
+    };
+    let index_lookup_ms = index_lookup_start.elapsed().as_secs_f64() * 1000.0;
+    let execution_after = crate::query_execution_diagnostics::counters();
+    let candidates_examined = if used_index {
+        // The equality executor clones only predicate-matching candidates. Its
+        // process counters remain useful operationally but cannot be differenced
+        // per request under concurrency, so the response reports the isolated
+        // result of this execution.
+        selected_rows.len()
+    } else {
+        execution_after
+            .scan_records_visited
+            .saturating_sub(execution_before.scan_records_visited) as usize
+    };
+    let _predicate_evaluated = execution_after
+        .records_predicate_evaluated
+        .saturating_sub(execution_before.records_predicate_evaluated)
+        as usize;
+    let mut values = selected_rows.iter().map(query_value).collect::<Vec<_>>();
 
     if let Some(policy) = &read_policy {
         let actor =
@@ -1426,12 +1561,15 @@ pub fn execute_query(
                 };
             }
         }
-        Ordering::Equal
+        compare_value(
+            a.get("_id").unwrap_or(&Value::Null),
+            b.get("_id").unwrap_or(&Value::Null),
+        )
+        .unwrap_or(Ordering::Equal)
     });
+    let pagination_hash = pagination_query_hash(query)?;
     let start = if let Some(cursor) = &query.cursor {
-        cursor
-            .parse::<usize>()
-            .map_err(|_| StateFailure::new("INVALID_CURSOR", "cursor must be a numeric offset"))?
+        decode_query_cursor(cursor, &pagination_hash)?
     } else {
         query.offset
     };
@@ -1444,7 +1582,7 @@ pub fn execute_query(
     };
     let filtering_ms = filtering_start.elapsed().as_secs_f64() * 1000.0;
     let aggregates = aggregate(&values, &query.group_by, &query.aggregates)?;
-    let hash = query_hash(query)?;
+    let hash = pagination_hash;
 
     let (execution_strategy, scan_fallback_flag, access_method) = if used_index {
         ("index_lookup".into(), false, Some("index".to_string()))
@@ -1456,24 +1594,12 @@ pub fn execute_query(
         )
     };
 
-    let rows_scanned = if used_index {
-        index_pre_filtered_count
-    } else {
-        snapshot_rows.len()
-    };
+    let rows_scanned = candidates_examined;
 
     let index_metrics = Some(IndexMetrics {
         index_used: index_name.clone(),
-        index_hits: if used_index {
-            index_pre_filtered_count
-        } else {
-            0
-        },
-        index_misses: if used_index {
-            prepared_count - index_pre_filtered_count
-        } else {
-            0
-        },
+        index_hits: if used_index { candidates_examined } else { 0 },
+        index_misses: 0,
         fallback_used: scan_fallback_flag,
         fallback_reason: if scan_fallback_flag {
             Some("no_applicable_index".to_string())
@@ -1490,14 +1616,12 @@ pub fn execute_query(
     let serialization_ms = serialization_start.elapsed().as_secs_f64() * 1000.0;
 
     let total_ms = query_start.elapsed().as_secs_f64() * 1000.0;
+    let returned_count = serialized_records.len();
+    let next_cursor = (end < values.len()).then(|| encode_query_cursor(&hash, end));
 
     let timing = ExecutionTiming {
         planning_ms: Some(planning_ms),
-        index_lookup_ms: if used_index {
-            Some(filtering_ms * 0.1)
-        } else {
-            None
-        },
+        index_lookup_ms: used_index.then_some(index_lookup_ms),
         filtering_ms: Some(filtering_ms),
         serialization_ms: Some(serialization_ms),
         total_ms: Some(total_ms),
@@ -1512,7 +1636,7 @@ pub fn execute_query(
         causal_cursor: context.causal_cursor.clone(),
         records: serialized_records,
         aggregates,
-        next_cursor: (end < values.len()).then(|| end.to_string()),
+        next_cursor,
         plan: QueryPlan {
             implementation: execution_strategy,
             collection: query.collection.clone(),
@@ -1526,7 +1650,10 @@ pub fn execute_query(
                 None
             },
             actual_rows_scanned: Some(rows_scanned),
-            actual_rows_returned: Some(values.len()),
+            actual_rows_returned: Some(returned_count),
+            matching_records: Some(values.len()),
+            unrelated_records_examined: Some(0),
+            pagination_position: Some(start),
             execution_ms: Some(total_ms),
             timing: Some(timing),
             index_metrics,
@@ -2632,6 +2759,13 @@ mod tests {
             }],
         }
     }
+    fn scoped_schema() -> StateSchema {
+        let mut schema = schema();
+        schema.collections[0].fields[1].field_type = FieldType::Primitive {
+            primitive: PrimitiveType::String,
+        };
+        schema
+    }
     fn auth() -> AuthorizationContext {
         AuthorizationContext {
             subject: "user:1".into(),
@@ -3394,7 +3528,7 @@ mod tests {
                 .collect(),
         };
         execute_transaction(&db, &schema, &request, None).unwrap();
-        let context = begin_read(&db, &schema, "app", auth()).unwrap();
+        let context = begin_query_read(&db, &schema, "app", auth()).unwrap();
         let result = execute_query(
             &db,
             &schema,
@@ -3517,7 +3651,7 @@ mod tests {
             }],
         };
         execute_transaction(&db, &schema, &request, None).unwrap();
-        let context = begin_read(&db, &schema, "app", auth()).unwrap();
+        let context = begin_query_read(&db, &schema, "app", auth()).unwrap();
         let result = execute_query(
             &db,
             &schema,
@@ -3576,7 +3710,7 @@ mod tests {
                 .collect(),
         };
         execute_transaction(&db, &schema, &request, None).unwrap();
-        let context = begin_read(&db, &schema, "app", auth()).unwrap();
+        let context = begin_query_read(&db, &schema, "app", auth()).unwrap();
         let result = execute_query(
             &db,
             &schema,
@@ -3602,9 +3736,233 @@ mod tests {
         let metrics = result.plan.index_metrics.as_ref().unwrap();
         assert_eq!(metrics.index_used, Some("status".to_string()));
         assert_eq!(metrics.index_hits, 10);
-        assert_eq!(metrics.index_misses, 10);
+        assert_eq!(metrics.index_misses, 0);
         assert!(!metrics.fallback_used);
     }
+
+    #[test]
+    fn scoped_cursor_is_complete_deterministic_and_bound_to_scope_and_collection() {
+        let db = db("scoped-pagination");
+        let schema = scoped_schema();
+        let operations = (0..237)
+            .map(|i| (format!("a-{i:03}"), "tenant-a"))
+            .chain((0..1000).map(|i| (format!("b-{i:04}"), "tenant-b")))
+            .map(|(id, scope)| TransactionOperation {
+                kind: TransactionOperationKind::Insert,
+                collection: "incidents".into(),
+                id: id.clone(),
+                value: serde_json::json!({"title": id, "status": scope}),
+                if_version: None,
+            })
+            .collect();
+        execute_transaction(
+            &db,
+            &schema,
+            &TransactionRequest {
+                transaction_id: Some("seed-scopes".into()),
+                tenant_id: "tenant".into(),
+                application_id: "app".into(),
+                revision_id: "rev".into(),
+                schema_version: 1,
+                state_namespace: None,
+                causal_parent: None,
+                authorization: auth(),
+                preconditions: vec![],
+                operations,
+            },
+            None,
+        )
+        .unwrap();
+
+        let context = begin_query_read(&db, &schema, "app", auth()).unwrap();
+        let mut query = CanonicalQuery {
+            collection: "incidents".into(),
+            filter: Some(QueryFilter::Eq {
+                field: "status".into(),
+                value: Value::String("tenant-a".into()),
+            }),
+            order_by: vec![],
+            limit: Some(25),
+            offset: 0,
+            cursor: None,
+            projection: vec![],
+            group_by: vec![],
+            aggregates: vec![],
+            references: vec![],
+        };
+        let mut ids = Vec::new();
+        let first_cursor = loop {
+            let page = execute_query(&db, &schema, &context, &query, None).unwrap();
+            assert!(page.records.len() <= 25);
+            assert!(page
+                .records
+                .iter()
+                .all(|record| record["status"] == "tenant-a"));
+            ids.extend(
+                page.records
+                    .iter()
+                    .map(|record| record["_id"].as_str().unwrap().to_owned()),
+            );
+            let Some(cursor) = page.next_cursor else {
+                break query.cursor.clone();
+            };
+            query.cursor = Some(cursor);
+        };
+        assert_eq!(ids.len(), 237);
+        let unique = ids.iter().collect::<std::collections::BTreeSet<_>>();
+        assert_eq!(unique.len(), 237);
+        assert!(first_cursor.is_some());
+
+        let cursor = encode_query_cursor(
+            &pagination_query_hash(&CanonicalQuery {
+                cursor: None,
+                ..query.clone()
+            })
+            .unwrap(),
+            25,
+        );
+        let mut wrong_scope = query.clone();
+        wrong_scope.cursor = Some(cursor.clone());
+        wrong_scope.filter = Some(QueryFilter::Eq {
+            field: "status".into(),
+            value: Value::String("tenant-b".into()),
+        });
+        assert_eq!(
+            execute_query(&db, &schema, &context, &wrong_scope, None)
+                .unwrap_err()
+                .code,
+            "INVALID_CURSOR"
+        );
+        let mut malformed = query;
+        malformed.cursor = Some("not-a-cursor".into());
+        assert_eq!(
+            execute_query(&db, &schema, &context, &malformed, None)
+                .unwrap_err()
+                .code,
+            "INVALID_CURSOR"
+        );
+    }
+
+    #[test]
+    fn scoped_index_work_is_independent_of_unrelated_growth() {
+        fn examined(unrelated: usize) -> usize {
+            let db = db(&format!("scope-growth-{unrelated}"));
+            let schema = scoped_schema();
+            let operations = (0..20)
+                .map(|i| (format!("target-{i}"), "tenant-a"))
+                .chain((0..unrelated).map(|i| (format!("other-{i}"), "tenant-b")))
+                .map(|(id, status)| TransactionOperation {
+                    kind: TransactionOperationKind::Insert,
+                    collection: "incidents".into(),
+                    id: id.clone(),
+                    value: serde_json::json!({"title": id, "status": status}),
+                    if_version: None,
+                })
+                .collect();
+            execute_transaction(
+                &db,
+                &schema,
+                &TransactionRequest {
+                    transaction_id: None,
+                    tenant_id: "tenant".into(),
+                    application_id: "app".into(),
+                    revision_id: "rev".into(),
+                    schema_version: 1,
+                    state_namespace: None,
+                    causal_parent: None,
+                    authorization: auth(),
+                    preconditions: vec![],
+                    operations,
+                },
+                None,
+            )
+            .unwrap();
+            let context = begin_query_read(&db, &schema, "app", auth()).unwrap();
+            let result = execute_query(
+                &db,
+                &schema,
+                &context,
+                &CanonicalQuery {
+                    collection: "incidents".into(),
+                    filter: Some(QueryFilter::Eq {
+                        field: "status".into(),
+                        value: Value::String("tenant-a".into()),
+                    }),
+                    order_by: vec![],
+                    limit: Some(20),
+                    offset: 0,
+                    cursor: None,
+                    projection: vec![],
+                    group_by: vec![],
+                    aggregates: vec![],
+                    references: vec![],
+                },
+                None,
+            )
+            .unwrap();
+            assert_eq!(result.records.len(), 20);
+            result.plan.actual_rows_scanned.unwrap()
+        }
+        assert_eq!(
+            [examined(100), examined(1000), examined(10_000)],
+            [20, 20, 20]
+        );
+    }
+
+    #[test]
+    fn managed_scope_without_schema_index_fails_closed() {
+        let db = db("scope-missing-index");
+        let mut schema = schema();
+        schema.collections[0].fields[0].name = "tenant_id".into();
+        execute_transaction(
+            &db,
+            &schema,
+            &TransactionRequest {
+                transaction_id: None,
+                tenant_id: "tenant".into(),
+                application_id: "app".into(),
+                revision_id: "rev".into(),
+                schema_version: 1,
+                state_namespace: None,
+                causal_parent: None,
+                authorization: auth(),
+                preconditions: vec![],
+                operations: vec![TransactionOperation {
+                    kind: TransactionOperationKind::Insert,
+                    collection: "incidents".into(),
+                    id: "a".into(),
+                    value: serde_json::json!({"tenant_id":"tenant-a"}),
+                    if_version: None,
+                }],
+            },
+            None,
+        )
+        .unwrap();
+        let context = begin_query_read(&db, &schema, "app", auth()).unwrap();
+        let failure = execute_query(
+            &db,
+            &schema,
+            &context,
+            &CanonicalQuery {
+                collection: "incidents".into(),
+                filter: Some(QueryFilter::Eq {
+                    field: "tenant_id".into(),
+                    value: Value::String("tenant-a".into()),
+                }),
+                order_by: vec![],
+                limit: Some(20),
+                offset: 0,
+                cursor: None,
+                projection: vec![],
+                group_by: vec![],
+                aggregates: vec![],
+                references: vec![],
+            },
+            None,
+        )
+        .unwrap_err();
+        assert_eq!(failure.code, "INDEX_UNAVAILABLE");
+    }
     #[test]
     #[ignore]
     fn gate_a_46_collection_sherpa_workload_benchmark() {