@learncard/network-brain-service 4.0.2 → 4.0.4

package/src/accesslayer/boost/relationships/read.ts

@@ -324,6 +324,59 @@ export const getBoostByUriWithDefaultClaimPermissions = async (
     };
 };
 
+/** Every send of the boost bound as `$boostId`: binds `source`, `credential`, `sent`, `sender`. */
+const MATCH_BOOST_SENDS = `MATCH (source:Boost {id: $boostId})<-[:INSTANCE_OF]-(credential:Credential)<-[sent:CREDENTIAL_SENT]-(sender:Profile)`;
+
+/**
+ * Same rows as MATCH_BOOST_SENDS, but the boost's credentials are collected first and the sends
+ * are then matched from each credential.
+ *
+ * The aim is to keep the cost tied to this boost's own sends. With a range or IN predicate on
+ * `sent.date` / `sent.to`, the planner can otherwise start from credential_sent_date_idx or
+ * credential_sent_to_idx across every boost and filter down to this one afterwards, which for a
+ * small boost reads far more sends than the boost has.
+ *
+ * This nudges the planner toward expanding from each credential; it doesn't guarantee that plan.
+ * With unsampled or stale index statistics, Neo4j has still been seen to run a global
+ * credential_sent_date_idx scan once per credential. If a change here matters, check the real plan
+ * with PROFILE, and refresh index statistics if it shows that scan. `carry` lists variables from
+ * earlier clauses that later clauses still need.
+ */
+const matchBoostSendsFromBoost = (carry: string[] = []): string =>
+    `MATCH (source:Boost {id: $boostId})<-[:INSTANCE_OF]-(boostCredential:Credential)
+    WITH ${[...carry, 'collect(boostCredential) AS boostCredentials'].join(', ')}
+    UNWIND boostCredentials AS credential
+    MATCH (credential)<-[sent:CREDENTIAL_SENT]-(sender:Profile)`;
+
+/**
+ * When a recipient profile query pins `profileId` to a value (or an `$in` list), the join
+ * `recipient.profileId = sent.to` means the same condition holds for `sent.to`. Applying it to
+ * the send first lets the query skip the Profile lookup for every other send.
+ *
+ * Mirrors buildWhereClause: a document-level `$or` ignores every other key, so no prefilter then.
+ */
+const getSentToPrefilter = (
+    convertedQuery: Record<string, unknown>
+): { clause: string; params: Record<string, unknown> } | undefined => {
+    if (!convertedQuery || '$or' in convertedQuery) return undefined;
+
+    const value = convertedQuery.profileId;
+
+    if (typeof value === 'string') {
+        return { clause: 'sent.to = $sentToPrefilter', params: { sentToPrefilter: value } };
+    }
+
+    if (value && typeof value === 'object' && Object.keys(value).length === 1) {
+        const inList = (value as { $in?: unknown }).$in;
+
+        if (Array.isArray(inList)) {
+            return { clause: 'sent.to IN $sentToPrefilter', params: { sentToPrefilter: inList } };
+        }
+    }
+
+    return undefined;
+};
+
 /**
  * Query to get the recipients of a boost. Cipher Code is:
  * MATCH (source:`Boost` { id: $id })<-[instanceOf:INSTANCE_OF]-(credential:`Credential`)-[received:CREDENTIAL_RECEIVED]->(recipient:`Profile`)
@@ -352,26 +405,35 @@ export const getBoostRecipients = async (
         convertedQuery as any
     );
 
-    const _query = new QueryBuilder(new BindParam({ cursor, from, ...queryParams }))
-        .match({
-            related: [
-                { identifier: 'source', model: Boost, where: { id: boost.id } },
-                {
-                    ...Credential.getRelationshipByAlias('instanceOf'),
-                    identifier: 'instanceOf',
-                    direction: 'in',
-                },
-                { identifier: 'credential', model: Credential },
-                {
-                    ...Profile.getRelationshipByAlias('credentialSent'),
-                    identifier: 'sent',
-                    direction: 'in',
-                },
-                { identifier: 'sender', model: Profile },
-            ],
+    const sentToPrefilter = getSentToPrefilter(convertedQuery);
+
+    // Filter and sort the sends before touching recipient Profiles. The Profile lookup and the
+    // CREDENTIAL_RECEIVED expand then only run until LIMIT is satisfied, instead of once per send.
+    const sendFilters = [
+        ...(from ? ['sender.profileId = $from'] : []),
+        ...(cursor ? ['sent.date > $cursor'] : []),
+        ...(sentToPrefilter ? [sentToPrefilter.clause] : []),
+    ];
+
+    const query = new QueryBuilder(
+        new BindParam({
+            boostId: boost.id,
+            cursor,
+            from,
+            ...queryParams,
+            ...sentToPrefilter?.params,
         })
+    )
+        .raw(
+            // An equality on sent.to or the sender's profileId is selective enough to start from;
+            // otherwise try to read the sends from the boost (see matchBoostSendsFromBoost)
+            sentToPrefilter || from ? MATCH_BOOST_SENDS : matchBoostSendsFromBoost()
+        )
+        .raw(sendFilters.length > 0 ? `WHERE ${sendFilters.join(' AND ')}` : '')
+        .with('sender, sent, credential')
+        .orderBy('sent.date')
         .match({ model: Profile, identifier: 'recipient' })
-        .where(`recipient.profileId = sent.to${from ? ' AND sender.profileId = $from' : ''}`)
+        .where('recipient.profileId = sent.to')
         .match({
             optional: includeUnacceptedBoosts,
             related: [
@@ -391,8 +453,6 @@ export const getBoostRecipients = async (
             }`
         );
 
-    const query = cursor ? _query.raw('AND sent.date > $cursor') : _query;
-
     const results = convertQueryResultToPropertiesObjectArray<{
         sender: FlatProfileType;
         sent: ProfileRelationships['credentialSent']['RelationshipProperties'];
@@ -414,10 +474,7 @@ export const getBoostRecipients = async (
         received: received?.date,
         ...(credential && { uri: getCredentialUri(credential.id, domain) }),
         status: coalesceStatus(sent.status, received?.status) as
-            | 'active'
-            | 'revoked'
-            | 'suspended'
-            | undefined,
+            'active' | 'revoked' | 'suspended' | undefined,
     }));
 
     const recipients = await getProfilesByProfileIds(resultsWithIds.map(result => result.to));
@@ -512,10 +569,7 @@ export const getBoostRecipientsSkipLimit = async (
         received: received?.date,
         ...(credential && { uri: getCredentialUri(credential.id, domain) }),
         status: coalesceStatus(sent.status, received?.status) as
-            | 'active'
-            | 'revoked'
-            | 'suspended'
-            | undefined,
+            'active' | 'revoked' | 'suspended' | undefined,
     }));
 
     const recipients = await getProfilesByProfileIds(resultsWithIds.map(result => result.to));
@@ -990,7 +1044,7 @@ export const getConnectedBoostRecipients = async (
         convertedQuery as any
     );
 
-    const _query = new QueryBuilder(new BindParam({ cursor, ...queryParams }))
+    const query = new QueryBuilder(new BindParam({ boostId: boost.id, cursor, ...queryParams }))
         // Build connection list
         .match({
             model: Profile,
@@ -1141,23 +1195,11 @@ export const getConnectedBoostRecipients = async (
         .unwind('allConnectedProfiles AS conn')
         .with('COLLECT(DISTINCT conn.profileId) AS connectionIds')
         // --- Boost recipient matching ---
-        .match({
-            related: [
-                { identifier: 'source', model: Boost, where: { id: boost.id } },
-                {
-                    ...Credential.getRelationshipByAlias('instanceOf'),
-                    identifier: 'instanceOf',
-                    direction: 'in',
-                },
-                { identifier: 'credential', model: Credential },
-                {
-                    ...Profile.getRelationshipByAlias('credentialSent'),
-                    identifier: 'sent',
-                    direction: 'in',
-                },
-                { identifier: 'sender', model: Profile },
-            ],
-        })
+        .raw(matchBoostSendsFromBoost(['connectionIds']))
+        // Narrow and sort the sends first so the Profile lookup only runs until LIMIT is met
+        .raw(`WHERE sent.to IN connectionIds${cursor ? ' AND sent.date > $cursor' : ''}`)
+        .with('sender, sent, credential')
+        .orderBy('sent.date')
         .match({ model: Profile, identifier: 'recipient' })
         .where('recipient.profileId = sent.to')
         .match({
@@ -1171,10 +1213,8 @@ export const getConnectedBoostRecipients = async (
                 { identifier: 'recipient' },
             ],
         })
-        .with('sender, sent, received, recipient, credential, connectionIds')
-        .where(`sent.to IN connectionIds AND ${recipientWhereClause}`);
-
-    const query = cursor ? _query.raw('AND sent.date > $cursor') : _query;
+        .with('sender, sent, received, recipient, credential')
+        .where(recipientWhereClause);
 
     const results = convertQueryResultToPropertiesObjectArray<{
         sender: FlatProfileType;
@@ -1208,6 +1248,44 @@ export const getConnectedBoostRecipients = async (
         .filter(result => Boolean(result.to)) as Array<BoostRecipientInfo & { sent: string }>;
 };
 
+/**
+ * Tail of a recipient count, continuing from a MATCH that bound `credential` and `sent`.
+ * Produces one `to` row per distinct recipient profileId, ready for `RETURN COUNT(to)`.
+ *
+ * Same answer as joining `(recipient:Profile {profileId: sent.to})` (plus the CREDENTIAL_RECEIVED
+ * edge into it when unaccepted sends are excluded) on every send and counting distinct ids, but it
+ * looks each profile up once per distinct id and stops at the first match.
+ */
+const buildDistinctRecipientCount = ({
+    includeUnacceptedBoosts,
+    recipientWhereClause,
+    profileKnownToExist,
+}: {
+    includeUnacceptedBoosts: boolean;
+    recipientWhereClause: string;
+    profileKnownToExist: boolean;
+}): string => {
+    const hasProfileFilter = Boolean(recipientWhereClause) && recipientWhereClause !== 'true';
+    const profileFilter = hasProfileFilter ? ` AND ${recipientWhereClause}` : '';
+
+    if (!includeUnacceptedBoosts) {
+        return `WITH DISTINCT credential, sent.to AS to
+            WHERE EXISTS {
+                MATCH (credential)-[:CREDENTIAL_RECEIVED]->(recipient:Profile)
+                WHERE recipient.profileId = to${profileFilter}
+            }
+            WITH DISTINCT to`;
+    }
+
+    if (profileKnownToExist && !hasProfileFilter) return 'WITH DISTINCT sent.to AS to';
+
+    return `WITH DISTINCT sent.to AS to
+        WHERE EXISTS {
+            MATCH (recipient:Profile)
+            WHERE recipient.profileId = to${profileFilter}
+        }`;
+};
+
 /**
  * Count boost recipients that are connected with the requesting profile
  */
@@ -1223,7 +1301,7 @@ export const countConnectedBoostRecipients = async (
     const { whereClause: countRecipientWhereClause, params: countQueryParams } =
         buildWhereForQueryBuilder('recipient', convertedQuery as any);
 
-    const countQuery = new QueryBuilder(new BindParam({ ...countQueryParams }))
+    const countQuery = new QueryBuilder(new BindParam({ boostId: boost.id, ...countQueryParams }))
         // Build connection list
         .match({
             model: Profile,
@@ -1374,40 +1452,18 @@ export const countConnectedBoostRecipients = async (
         .unwind('allConnectedProfiles AS conn')
         .with('COLLECT(DISTINCT conn.profileId) AS connectionIds')
         // --- Boost recipient matching ---
-        .match({
-            related: [
-                { identifier: 'source', model: Boost, where: { id: boost.id } },
-                {
-                    ...Credential.getRelationshipByAlias('instanceOf'),
-                    identifier: 'instanceOf',
-                    direction: 'in',
-                },
-                { identifier: 'credential', model: Credential },
-                {
-                    ...Profile.getRelationshipByAlias('credentialSent'),
-                    identifier: 'sent',
-                    direction: 'in',
-                },
-                { identifier: 'sender', model: Profile },
-            ],
-        })
-        .match({ model: Profile, identifier: 'recipient' })
-        .where('recipient.profileId = sent.to')
-        .match({
-            optional: includeUnacceptedBoosts,
-            related: [
-                { identifier: 'credential', model: Credential },
-                {
-                    ...Credential.getRelationshipByAlias('credentialReceived'),
-                    identifier: 'received',
-                },
-                { identifier: 'recipient' },
-            ],
-        })
-        .with('sender, sent, received, recipient, credential, connectionIds')
-        .where(`sent.to IN connectionIds AND ${countRecipientWhereClause}`);
+        .raw(matchBoostSendsFromBoost(['connectionIds']))
+        .raw('WHERE sent.to IN connectionIds')
+        .raw(
+            buildDistinctRecipientCount({
+                includeUnacceptedBoosts,
+                recipientWhereClause: countRecipientWhereClause,
+                // Every id in connectionIds was read off a Profile node, so the Profile always exists
+                profileKnownToExist: true,
+            })
+        );
 
-    const result = await countQuery.return('COUNT(DISTINCT sent.to) AS count').run();
+    const result = await countQuery.return('COUNT(to) AS count').run();
 
     return Number(result.records[0]?.get('count') ?? 0);
 };
@@ -1493,31 +1549,26 @@ export const getBoostRecipientsWithChildren = async (
                 { identifier: 'sender', model: Profile },
             ],
         })
-        .match({ model: Profile, identifier: 'recipient' })
-        .where('recipient.profileId = sent.to')
-        // Optional match for received credentials
-        .match({
-            optional: includeUnacceptedBoosts,
-            related: [
-                { identifier: 'credential', model: Credential },
-                {
-                    ...Credential.getRelationshipByAlias('credentialReceived'),
-                    identifier: 'received',
-                },
-                { identifier: 'recipient' },
-            ],
-        })
-        // Group by recipient and collect boost data first
+        // Read the received edge off the credential (one hop) rather than looking up a Profile
+        // for every send. The recipient Profile is only looked up per page row further down.
+        .raw(
+            `${includeUnacceptedBoosts ? 'OPTIONAL ' : ''}MATCH (credential)-[received:CREDENTIAL_RECEIVED]->(receivedBy:Profile)
+            WHERE receivedBy.profileId = sent.to`
+        )
+        // Group by recipient profileId and collect boost data first
         .with(
-            `recipient, 
+            `sent.to AS to,
                COLLECT(DISTINCT {relevantBoost: relevantBoost, sender: sender, sent: sent, received: received, credential: credential}) AS boostData`
         )
+        .raw(cursor ? 'WHERE NOT to <= $cursor' : '')
+        .orderBy('to ASC')
+        .match({ model: Profile, identifier: 'recipient' })
+        .where('recipient.profileId = to')
+        .with('to, recipient, boostData')
         // Apply profile query filtering after grouping
         .where(profileWhereClause)
-        // Add cursor filtering if provided
-        .raw(cursor ? 'AND recipient.profileId > $cursor' : '')
         // Order by profileId and limit profiles (not individual boost relationships)
-        .orderBy('recipient.profileId ASC')
+        .orderBy('to ASC')
         .limit(limit)
         .unwind('boostData AS data')
         .return(
@@ -1547,10 +1598,7 @@ export const getBoostRecipientsWithChildren = async (
                 boostUri: getBoostUri(boostId, domain),
                 ...(credential && { uri: getCredentialUri(credential.id, domain) }),
                 status: coalesceStatus(sent.status, received?.status) as
-                    | 'active'
-                    | 'revoked'
-                    | 'suspended'
-                    | undefined,
+                    'active' | 'revoked' | 'suspended' | undefined,
             };
         });
 
@@ -1663,26 +1711,15 @@ export const countBoostRecipientsWithChildren = async (
                 { identifier: 'sender', model: Profile },
             ],
         })
-        .match({ model: Profile, identifier: 'recipient' })
-        .where('recipient.profileId = sent.to')
-        // Optional match for received credentials
-        .match({
-            optional: includeUnacceptedBoosts,
-            related: [
-                { identifier: 'credential', model: Credential },
-                {
-                    ...Credential.getRelationshipByAlias('credentialReceived'),
-                    identifier: 'received',
-                },
-                { identifier: 'recipient' },
-            ],
-        })
-        // Reduce to recipient before applying filter to ensure it doesn't attach to OPTIONAL MATCH
-        .with('recipient')
-        // Apply profile query filtering after WITH so it filters rows, not optional pattern
-        .where(countProfileWhereClause);
+        .raw(
+            buildDistinctRecipientCount({
+                includeUnacceptedBoosts,
+                recipientWhereClause: countProfileWhereClause,
+                profileKnownToExist: false,
+            })
+        );
 
-    const result = await _query.return('COUNT(DISTINCT recipient.profileId) AS count').run();
+    const result = await _query.return('COUNT(to) AS count').run();
 
     return Number(result.records[0]?.get('count') ?? 0);
 };

package/src/accesslayer/consentflowcontract/relationships/create.ts

@@ -21,7 +21,7 @@ import { BoostType } from 'types/boost';
 import { flattenObject, inflateObject } from '@helpers/objects.helpers';
 import { convertQueryResultToPropertiesObjectArray } from '@helpers/neo4j.helpers';
 import { reconsentTerms } from './update';
-import { getBoostUri, sendBoost } from '@helpers/boost.helpers';
+import { getBoostUri, sendBoost, stampIssuanceDate } from '@helpers/boost.helpers';
 import { setCredentialSubjectIds } from '@helpers/credentialSubject.helpers';
 import { getDidWeb } from '@helpers/did.helpers';
 import { getSigningAuthorityForUserByName } from '@accesslayer/signing-authority/relationships/read';
@@ -296,6 +296,8 @@ export const consentToContract = async (
 
                     boostCredential.issuer = { id: contractOwnerSigningAuthority.relationship.did };
 
+                    stampIssuanceDate(boostCredential);
+
                     if (boostCredential.type.includes('BoostCredential')) {
                         boostCredential.boostId = getBoostUri(boost.target.id, domain);
                     }

package/src/accesslayer/consentflowcontract/relationships/update.ts

@@ -15,7 +15,7 @@ import { ConsentFlowTerms, ConsentFlowTransaction, ConsentFlowContract } from '@
 import { neogma } from '@instance';
 import { flattenObject } from '@helpers/objects.helpers';
 import { DbContractType, DbTermsType } from 'types/consentflowcontract';
-import { getBoostUri, sendBoost } from '@helpers/boost.helpers';
+import { getBoostUri, sendBoost, stampIssuanceDate } from '@helpers/boost.helpers';
 import { setCredentialSubjectIds } from '@helpers/credentialSubject.helpers';
 import { getDidWeb } from '@helpers/did.helpers';
 import { getSigningAuthorityForUserByName } from '@accesslayer/signing-authority/relationships/read';
@@ -201,6 +201,8 @@ export const reconsentTerms = async (
                     // Set the issuer and subject
                     boostCredential.issuer = { id: contractOwnerSigningAuthority.relationship.did };
 
+                    stampIssuanceDate(boostCredential);
+
                     if (boostCredential.type.includes('BoostCredential')) {
                         boostCredential.boostId = getBoostUri(boost.dataValues.id, domain);
                     }
@@ -439,6 +441,8 @@ export const updateTerms = async (
                     // Set the issuer and subject
                     boostCredential.issuer = { id: contractOwnerSigningAuthority.relationship.did };
 
+                    stampIssuanceDate(boostCredential);
+
                     if (boostCredential.type.includes('BoostCredential')) {
                         boostCredential.boostId = getBoostUri(boost.target.id, domain);
                     }

package/src/accesslayer/inbox-batch/schema.test.ts

@@ -0,0 +1,91 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type { Driver, ManagedTransaction } from 'neo4j-driver';
+
+vi.mock('@instance', () => ({ neogma: { driver: { session: vi.fn() } } }));
+import { createInboxBatchSchemaInitializer } from './schema';
+
+const harness = () => {
+    const run = vi.fn().mockResolvedValue({});
+    const close = vi.fn().mockResolvedValue(undefined);
+    const executeWrite = vi.fn(async (callback: (tx: ManagedTransaction) => unknown) =>
+        callback({ run } as unknown as ManagedTransaction)
+    );
+    const driver = { session: vi.fn(() => ({ run: vi.fn(), executeWrite, close })) };
+    const ensure = createInboxBatchSchemaInitializer(driver as unknown as Driver);
+    return { run, close, executeWrite, driver, ensure };
+};
+
+beforeEach(() => vi.clearAllMocks());
+
+describe('inbox batch schema readiness', () => {
+    it('shares in-flight readiness and runs every constraint AND index in its own managed write', async () => {
+        const { ensure, driver, executeWrite, run, close } = harness();
+        const first = ensure();
+        expect(ensure()).toBe(first);
+        await first;
+        await ensure();
+        expect(driver.session).toHaveBeenCalledTimes(1);
+        expect(executeWrite).toHaveBeenCalledTimes(10);
+        expect(run).toHaveBeenCalledTimes(10);
+        expect(
+            run.mock.calls.filter(([query]) => query.startsWith('CREATE CONSTRAINT'))
+        ).toHaveLength(4);
+        expect(run.mock.calls.filter(([query]) => query.startsWith('CREATE INDEX'))).toHaveLength(
+            6
+        );
+        expect(close).toHaveBeenCalledTimes(1);
+    });
+
+    it('lets independent API/worker initializers complete through a transient managed-transaction retry', async () => {
+        const api = harness();
+        const worker = harness();
+        // Model the driver re-entering the transaction callback after a DDL deadlock.
+        // The real-driver concurrent cold-start regression lives in inbox-batch.spec.ts.
+        const deadlock = { code: 'Neo.TransientError.Transaction.DeadlockDetected' };
+        api.run.mockRejectedValueOnce(deadlock);
+        api.executeWrite.mockImplementationOnce(async callback => {
+            await expect(callback({ run: api.run } as unknown as ManagedTransaction)).rejects.toBe(
+                deadlock
+            );
+            return callback({ run: api.run } as unknown as ManagedTransaction);
+        });
+        await expect(Promise.all([api.ensure(), worker.ensure()])).resolves.toEqual([
+            undefined,
+            undefined,
+        ]);
+        const firstQuery =
+            'CREATE CONSTRAINT inboxbatch_id IF NOT EXISTS FOR (n:InboxBatch) REQUIRE n.id IS UNIQUE';
+        expect(api.run.mock.calls.slice(0, 2)).toEqual([[firstQuery], [firstQuery]]);
+        expect(api.run).toHaveBeenCalledTimes(11);
+        expect(worker.run).toHaveBeenCalledTimes(10);
+    });
+
+    it.each([0, 4])('accepts equivalent-schema races for statement %i', async position => {
+        const { ensure, run } = harness();
+        for (let index = 0; index < position; index++) run.mockResolvedValueOnce({});
+        run.mockRejectedValueOnce({
+            code: 'Neo.ClientError.Schema.EquivalentSchemaRuleAlreadyExists',
+        });
+        await expect(ensure()).resolves.toBeUndefined();
+        expect(run).toHaveBeenCalledTimes(10);
+    });
+
+    it.each([
+        'Neo.ClientError.Security.Forbidden',
+        'Neo.TransientError.Transaction.DeadlockDetected',
+    ])(
+        'propagates %s after the managed write fails and allows a later readiness attempt',
+        async code => {
+            const { ensure, executeWrite, run, close, driver } = harness();
+            const failure = { code };
+            executeWrite.mockRejectedValueOnce(failure);
+            await expect(ensure()).rejects.toBe(failure);
+            expect(run).not.toHaveBeenCalled();
+            expect(close).toHaveBeenCalledTimes(1);
+            await expect(ensure()).resolves.toBeUndefined();
+            expect(driver.session).toHaveBeenCalledTimes(2);
+            expect(run).toHaveBeenCalledTimes(10);
+            expect(close).toHaveBeenCalledTimes(2);
+        }
+    );
+});

package/src/accesslayer/inbox-batch/schema.ts

@@ -0,0 +1,54 @@
+import type { Driver } from 'neo4j-driver';
+import { neogma } from '@instance';
+
+const SCHEMA_QUERIES = [
+    ...['InboxBatch', 'InboxBatchItem', 'InboxBatchIssuer', 'InboxBatchReplay'].map(
+        label =>
+            `CREATE CONSTRAINT ${label.toLowerCase()}_id IF NOT EXISTS FOR (n:${label}) REQUIRE n.id IS UNIQUE`
+    ),
+    'CREATE INDEX inbox_batch_request IF NOT EXISTS FOR (b:InboxBatch) ON (b.issuer, b.requestId)',
+    'CREATE INDEX inbox_batch_dispatch IF NOT EXISTS FOR (i:InboxBatchItem) ON (i.state, i.dispatchAt)',
+    'CREATE INDEX inbox_batch_recovery IF NOT EXISTS FOR (i:InboxBatchItem) ON (i.state, i.leaseUntil)',
+    'CREATE INDEX inbox_batch_replay_owner IF NOT EXISTS FOR (r:InboxBatchReplay) ON (r.itemId)',
+    'CREATE INDEX inbox_batch_completed IF NOT EXISTS FOR (b:InboxBatch) ON (b.completedAt)',
+    'CREATE INDEX inbox_batch_replay_expiry IF NOT EXISTS FOR (r:InboxBatchReplay) ON (r.expiresAt)',
+];
+
+/** Each API/worker process shares readiness locally; the driver retries cross-process DDL deadlocks. */
+export const createInboxBatchSchemaInitializer = (
+    driver: Pick<Driver, 'session'>
+): (() => Promise<void>) => {
+    let readiness: Promise<void> | undefined;
+    return (): Promise<void> => {
+        if (!readiness) {
+            const pending = (async (): Promise<void> => {
+                const session = driver.session();
+                try {
+                    for (const query of SCHEMA_QUERIES) {
+                        try {
+                            // One schema statement per managed transaction. IF NOT EXISTS is
+                            // idempotent, but competing cold processes can still deadlock while
+                            // acquiring label locks. Auto-commit queryRunner.run does not retry.
+                            await session.executeWrite(tx => tx.run(query));
+                        } catch (error) {
+                            if (
+                                (error as { code?: string } | null)?.code !==
+                                'Neo.ClientError.Schema.EquivalentSchemaRuleAlreadyExists'
+                            )
+                                throw error;
+                        }
+                    }
+                } finally {
+                    await session.close();
+                }
+            })();
+            readiness = pending;
+            void pending.catch(() => {
+                if (readiness === pending) readiness = undefined;
+            });
+        }
+        return readiness;
+    };
+};
+
+export const ensureInboxBatchConstraints = createInboxBatchSchemaInitializer(neogma.driver);

package/src/accesslayer/inbox-batch/store.ts

@@ -6,49 +6,13 @@ import { neogma } from '@instance';
 import { encryptInboxCredential, decryptInboxCredential } from '@helpers/inbox-encryption.helpers';
 import type { BatchItem, BatchJob, BatchReplayStore, InboxDispatchLease } from 'types/inbox-batch';
 import { getInboxBatchState } from '@helpers/inbox-batch-status.helpers';
+import { ensureInboxBatchConstraints } from './schema';
 
 export const DAY = 86_400_000;
 export const LEASE_MS = 360_000;
 const CLEANUP_MARGIN_MS = 5_000;
 
-let readiness: Promise<void> | undefined;
-export const ensureInboxBatchConstraints = (): Promise<void> => {
-    if (!readiness) {
-        readiness = (async () => {
-            for (const label of [
-                'InboxBatch',
-                'InboxBatchItem',
-                'InboxBatchIssuer',
-                'InboxBatchReplay',
-            ]) {
-                try {
-                    await neogma.queryRunner.run(
-                        `CREATE CONSTRAINT ${label.toLowerCase()}_id IF NOT EXISTS FOR (n:${label}) REQUIRE n.id IS UNIQUE`
-                    );
-                } catch (error) {
-                    if (
-                        (error as { code?: string }).code !==
-                        'Neo.ClientError.Schema.EquivalentSchemaRuleAlreadyExists'
-                    )
-                        throw error;
-                }
-            }
-            for (const query of [
-                'CREATE INDEX inbox_batch_request IF NOT EXISTS FOR (b:InboxBatch) ON (b.issuer, b.requestId)',
-                'CREATE INDEX inbox_batch_dispatch IF NOT EXISTS FOR (i:InboxBatchItem) ON (i.state, i.dispatchAt)',
-                'CREATE INDEX inbox_batch_recovery IF NOT EXISTS FOR (i:InboxBatchItem) ON (i.state, i.leaseUntil)',
-                'CREATE INDEX inbox_batch_replay_owner IF NOT EXISTS FOR (r:InboxBatchReplay) ON (r.itemId)',
-                'CREATE INDEX inbox_batch_completed IF NOT EXISTS FOR (b:InboxBatch) ON (b.completedAt)',
-                'CREATE INDEX inbox_batch_replay_expiry IF NOT EXISTS FOR (r:InboxBatchReplay) ON (r.expiresAt)',
-            ])
-                await neogma.queryRunner.run(query);
-        })();
-        void readiness.catch(() => {
-            readiness = undefined;
-        });
-    }
-    return readiness;
-};
+export { ensureInboxBatchConstraints } from './schema';
 
 const transaction = async <T>(fn: (tx: ManagedTransaction) => Promise<T>): Promise<T> => {
     await ensureInboxBatchConstraints();

package/src/accesslayer/profile/create.ts

@@ -5,6 +5,7 @@ import { LCNProfile } from '@learncard/types';
 import { Profile } from '@models';
 import { BindParam, QueryBuilder } from 'neogma';
 import { ProfileType } from 'types/profile';
+import { syncProfileDisplayNameLower } from './search-fields';
 
 export const createProfile = async (input: LCNProfile): Promise<ProfileType> => {
     const result = await new QueryBuilder(
@@ -13,7 +14,7 @@ export const createProfile = async (input: LCNProfile): Promise<ProfileType> =>
         })
     )
         .create({ model: Profile, identifier: 'profile' })
-        .set('profile += $params')
+        .set(`profile += $params, ${syncProfileDisplayNameLower('profile')}`)
         .return('profile')
         .limit(1)
         .run();