@open-mercato/core 0.10.1-develop.7776.1.3032ea0741 → 0.10.1-develop.7781.1.079f42c863

package/src/modules/query_index/lib/engine.ts

@@ -1,8 +1,9 @@
+import { resolveQueryIndexSourceTableMetadata } from './subscriber-scope'
 import type { QueryEngine, QueryOptions, QueryResult, QueryResultMeta, EncryptedSortRowCapWarning, ListCountCapWarning, FilterOp, Filter, QueryCustomFieldSource, PartialIndexWarning, QueryExtensionsConfig, Sort } from '@open-mercato/shared/lib/query/types'
 import { SortDir } from '@open-mercato/shared/lib/query/types'
 import type { EntityId } from '@open-mercato/shared/modules/entities'
 import type { EntityManager } from '@mikro-orm/postgresql'
-import { BasicQueryEngine, resolveEntityTableName, resolveRegisteredEntityTableName } from '@open-mercato/shared/lib/query/engine'
+import { BasicQueryEngine, resolveEntityTableName as resolveFallbackEntityTableName, resolveRegisteredEntityTableName } from '@open-mercato/shared/lib/query/engine'
 import { isOrmBackedSystemEntityId } from '@open-mercato/shared/lib/data/engine'
 import {
   buildArrayColumnNoOverlapPredicate,
@@ -72,6 +73,10 @@ import { createLogger } from '@open-mercato/shared/lib/logger'
 import { parseNumberWithDefault } from '@open-mercato/shared/lib/number'
 import { createBoundedTtlMemo } from '@open-mercato/shared/lib/query/bounded-ttl-memo'
 
+function resolveEntityTableName(em: EntityManager, entity: string): string {
+  return resolveQueryIndexSourceTableMetadata(em, entity)?.table ?? resolveFallbackEntityTableName(em, entity)
+}
+
 const logger = createLogger('query_index').child({ component: 'engine' })
 
 function customDocumentValue(row: Record<string, unknown>, field: string): unknown {
@@ -488,14 +493,14 @@ export class HybridQueryEngine implements QueryEngine {
       const baseExists = await profiler.measure('base_table_exists', () => this.tableExists(baseTable))
       if (!baseExists) {
         if (debugEnabled) this.debug('query:fallback:missing-base', { entity, baseTable })
-        const fallbackResult = await this.fallback.query(entity, opts)
+        const fallbackResult = await this.queryFallback<T>(entity, opts)
         finishProfile({ result: 'fallback', reason: 'missing_base' })
         return await applyAfterExtensions(fallbackResult)
       }
 
       if (opts.omitAutomaticTenantOrgScope === true) {
         if (debugEnabled) this.debug('query:fallback:omit-automatic-scope', { entity })
-        const fallbackResult = await this.fallback.query(entity, opts)
+        const fallbackResult = await this.queryFallback<T>(entity, opts)
         finishProfile({ result: 'fallback', reason: 'omit_automatic_tenant_org_scope' })
         return await applyAfterExtensions(fallbackResult)
       }
@@ -539,7 +544,7 @@ export class HybridQueryEngine implements QueryEngine {
         )
         if (!hasIndexRows) {
           if (debugEnabled) this.debug('query:fallback:no-index', { entity })
-          const fallbackResult = await this.fallback.query(entity, opts)
+          const fallbackResult = await this.queryFallback<T>(entity, opts)
           finishProfile({ result: 'fallback', reason: 'no_index_rows' })
           return await applyAfterExtensions(fallbackResult)
         }
@@ -568,7 +573,7 @@ export class HybridQueryEngine implements QueryEngine {
                 logger.warn('Partial index coverage detected; falling back to basic engine', { entity })
                 if (debugEnabled) this.debug('query:fallback:partial-coverage', { entity })
               }
-              const fallbackResult = await this.fallback.query(entity, opts)
+              const fallbackResult = await this.queryFallback<T>(entity, opts)
               const resultWithWarning: QueryResult<T> = {
                 ...fallbackResult,
                 meta: {
@@ -654,6 +659,11 @@ export class HybridQueryEngine implements QueryEngine {
         }
       }
 
+      const tenantlessIndexSources = new Set<string>()
+      for (const source of preparedCfSources) {
+        if (!source.tenantField && !(await this.columnExists(source.table, 'tenant_id'))) tenantlessIndexSources.add(source.indexAlias)
+      }
+
       const searchSources: SearchTokenSource[] = indexSources
         .map((src) => ({ entity: String(src.entityId), recordIdColumn: src.recordIdColumn }))
         .filter((src) => src.recordIdColumn && src.entity)
@@ -963,6 +973,8 @@ export class HybridQueryEngine implements QueryEngine {
             jc = jc
               .onRef('ei.tenant_id', '=', qualify('tenant_id'))
               .on('ei.tenant_id', 'is not', null)
+          } else {
+            jc = jc.on('ei.tenant_id', 'is', null)
           }
           if (!opts.withDeleted) {
             jc = jc.on('ei.deleted_at', 'is', null)
@@ -995,7 +1007,9 @@ export class HybridQueryEngine implements QueryEngine {
             const tenantRef = source.tenantField
               ? `${source.alias}.${source.tenantField}`
               : (columns.has('tenant_id') ? qualify('tenant_id') : null)
-            if (tenantRef) {
+            if (tenantlessIndexSources.has(source.indexAlias)) {
+              jc = jc.on(`${source.indexAlias}.tenant_id`, 'is', null)
+            } else if (tenantRef) {
               jc = jc
                 .onRef(`${source.indexAlias}.tenant_id`, '=', tenantRef)
                 .on(`${source.indexAlias}.tenant_id`, 'is not', null)
@@ -2572,13 +2586,22 @@ export class HybridQueryEngine implements QueryEngine {
     return result
   }
 
+  private async queryFallback<T = unknown>(entity: EntityId, opts: QueryOptions): Promise<QueryResult<T>> {
+    const source = resolveQueryIndexSourceTableMetadata(this.em, entity)
+    if (source?.schema || source?.table.includes('.')) {
+      throw new Error('[internal] Query fallback cannot preserve a schema-qualified source identity')
+    }
+    return this.fallback.query<T>(entity, opts)
+  }
+
   private async tableExists(table: string): Promise<boolean> {
     if (baseTableExistsCache.get(table)) return true
     const db = this.getDb() as any
     const exists = await db
       .selectFrom('information_schema.tables')
       .select(sql<number>`1`.as('one'))
-      .where('table_name', '=', table)
+      .where(table.includes('.') ? sql<boolean>`table_schema = ${table.split('.')[0]}` : sql<boolean>`table_schema = current_schema()`)
+      .where('table_name', '=', table.split('.').pop())
       .executeTakeFirst()
     const present = !!exists
     if (present) baseTableExistsCache.set(table, true)
@@ -2949,7 +2972,8 @@ export class HybridQueryEngine implements QueryEngine {
     const exists = await db
       .selectFrom('information_schema.columns')
       .select(sql<number>`1`.as('one'))
-      .where('table_name', '=', table)
+      .where(table.includes('.') ? sql<boolean>`table_schema = ${table.split('.')[0]}` : sql<boolean>`table_schema = current_schema()`)
+      .where('table_name', '=', table.split('.').pop())
       .where('column_name', '=', column)
       .executeTakeFirst()
     const present = !!exists
@@ -2964,7 +2988,8 @@ export class HybridQueryEngine implements QueryEngine {
     const rows = await db
       .selectFrom('information_schema.columns')
       .select(['column_name', 'data_type'])
-      .where('table_name', '=', table)
+      .where(table.includes('.') ? sql<boolean>`table_schema = ${table.split('.')[0]}` : sql<boolean>`table_schema = current_schema()`)
+      .where('table_name', '=', table.split('.').pop())
       .execute() as Array<{ column_name: string; data_type: string }>
     const map = new Map<string, string>()
     for (const r of rows) map.set(r.column_name, r.data_type)

package/src/modules/query_index/lib/indexer.ts

@@ -1,5 +1,6 @@
+import { resolveQueryIndexSourceTableMetadata } from './subscriber-scope'
 import type { EntityManager } from '@mikro-orm/postgresql'
-import { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'
+import { resolveEntityTableName as resolveFallbackEntityTableName } from '@open-mercato/shared/lib/query/engine'
 import { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'
 import { decryptIndexDocForSearch, encryptIndexDocForStorage } from '@open-mercato/shared/lib/encryption/indexDoc'
 import {
@@ -15,6 +16,10 @@ import { replaceSearchTokensForRecord, deleteSearchTokensForRecord } from './sea
 import { attachAggregateSearchField, rebuildAggregateSearchField } from './document'
 import { applyIndexDocEnrichers } from './doc-enrichers'
 
+function resolveEntityTableName(em: EntityManager, entity: string): string {
+  return resolveQueryIndexSourceTableMetadata(em, entity)?.table ?? resolveFallbackEntityTableName(em, entity)
+}
+
 const logger = createLogger('query_index').child({ component: 'indexer' })
 
 type QueryIndexExecutor = Kysely<any> | Transaction<any>

package/src/modules/query_index/lib/reindexer.ts

@@ -1,6 +1,6 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { type Kysely, sql } from 'kysely'
-import { resolveRegisteredEntityTableName } from '@open-mercato/shared/lib/query/engine'
+import { resolveQueryIndexSourceTableMetadata } from './subscriber-scope'
 import { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'
 import { decryptIndexDocForSearch, encryptIndexDocForStorage } from '@open-mercato/shared/lib/encryption/indexDoc'
 import {
@@ -11,12 +11,19 @@ import {
   QueryIndexBatchWriteError,
   type AnyRow,
 } from './batch'
-import { refreshCoverageSnapshot, writeCoverageCounts, applyCoverageAdjustments } from './coverage'
+import {
+  refreshCoverageSnapshot,
+  writeCoverageCounts,
+  applyCoverageAdjustments,
+  deleteScopedCoverageForEntity,
+} from './coverage'
 import { prepareJob, updateJobProgress, finalizeJob, type JobScope } from './jobs'
-import { purgeOrphans } from './stale'
+import { purgeOrphans, retireScopedCatalogueRows } from './stale'
 import type { VectorIndexService } from '@open-mercato/search/vector'
 import { isSearchDebugEnabled } from './search-tokens'
+import { isTenantGlobalEntityType } from './tenant-global'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
 
 const logger = createLogger('query_index').child({ component: 'reindexer' })
 
@@ -37,11 +44,34 @@ export type ReindexJobOptions = {
   vectorService?: VectorIndexService | null
 }
 
+/**
+ * Why a sweep did no work, when it did none on purpose.
+ *
+ * A refused run is otherwise byte-identical to a successful sweep that found zero rows,
+ * and the surfaces an operator reads - `indexer_status_logs`, the indexer status page,
+ * the CLI's `0 / 0 (0.00%)` - report the second. The allowlist's safety argument is that
+ * a missing `registerTenantGlobalEntityTypes()` declaration "shows up in the log", so the
+ * log the product surfaces has to be able to say it.
+ */
+export type ReindexRefusalReason =
+  /** The source table has no `tenant_id` column and the type is not a declared catalogue. */
+  | 'no-tenant-column'
+  /** `information_schema` could not be read, so no column could be proven to exist. */
+  | 'column-probe-failed'
+  /**
+   * The type IS declared tenant-global, but its table carries `organization_id` while
+   * lacking `tenant_id`. A global projection means both scope columns absent - the same
+   * definition `loadQueryIndexRowScope()` uses - so the declaration cannot be honoured.
+   */
+  | 'declared-global-but-org-scoped'
+
 export type ReindexJobResult = {
   processed: number
   total: number
   tenantScopes: Array<string | null>
   scopes: Array<{ tenantId: string | null; organizationId: string | null }>
+  /** Absent on a sweep that ran. Present, with the reason, on one that deliberately did not. */
+  refused?: ReindexRefusalReason
 }
 
 export const DEFAULT_REINDEX_PARTITIONS = 5
@@ -110,17 +140,50 @@ function toNumber(value: unknown): number {
   return 0
 }
 
-async function getColumnSet(db: Kysely<any>, tableName: string): Promise<Set<string>> {
+/**
+ * Returns `null` - never an empty set - when the probe itself fails.
+ *
+ * An empty set is indistinguishable from "this table has no columns we care about", so a
+ * transient failure (an aborted transaction on the same connection, a statement timeout, a
+ * blip during a partition-parallel sweep) would make every entity type look tenant-less and
+ * refuse every tenant-scoped reindex, reported as a successful zero-row run. Failing closed
+ * is right; failing closed silently and globally is the hardest state to diagnose.
+ */
+async function getColumnSet(db: Kysely<any>, tableName: string, schema?: string): Promise<Set<string> | null> {
   try {
     const rows = await db
       .selectFrom('information_schema.columns' as any)
       .select(['column_name' as any])
-      .where(sql<boolean>`table_schema = current_schema()`)
+      .where(schema ? sql<boolean>`table_schema = ${schema}` : sql<boolean>`table_schema = current_schema()`)
       .where('table_name' as any, '=', tableName)
       .execute() as Array<{ column_name: string }>
     return new Set(rows.map((row) => String(row.column_name).toLowerCase()))
-  } catch {
-    return new Set<string>()
+  } catch (error) {
+    logger.warn('Failed to read information_schema.columns for a reindex target', {
+      table: tableName,
+      error: error instanceof Error ? error.message : String(error),
+    })
+    reportColumnProbeFailure(error, tableName)
+    return null
+  }
+}
+
+/**
+ * The probe's caller refuses the sweep whatever happens here, so a telemetry backend that
+ * throws must not turn that refusal into a failed job.
+ */
+function reportColumnProbeFailure(error: unknown, tableName: string): void {
+  try {
+    getTelemetryRuntime()?.reportError(error, {
+      module: 'query_index',
+      code: 'query_index.column_probe_failed',
+      attributes: { table: tableName },
+    })
+  } catch (telemetryError) {
+    logger.warn('Failed to report a column probe failure', {
+      table: tableName,
+      error: telemetryError instanceof Error ? telemetryError.message : String(telemetryError),
+    })
   }
 }
 
@@ -166,7 +229,8 @@ export async function reindexEntity(
   // here: doing so would let a principal with `query_index.reindex` point the
   // reindexer at arbitrary tables (e.g. `auth_users`, `users`) and read their
   // rows into the index, bypassing tenant scoping and entity-level encryption.
-  const table = resolveRegisteredEntityTableName(em, entityType)
+  const source = resolveQueryIndexSourceTableMetadata(em, entityType)
+  const table = source?.table
   if (!table || entityType === 'query_index:search_token' || table === 'search_tokens') {
     if (!table) {
       logger.warn('Refusing to reindex unregistered entity type', {
@@ -180,11 +244,103 @@ export async function reindexEntity(
       scopes: [],
     }
   }
-  const columns = await getColumnSet(db, table)
+  const columns = await getColumnSet(db, source?.tableName ?? table, source?.schema)
+  // A probe failure proves nothing about the table, so it cannot be read as "no tenant
+  // column". Refuse with its own reason rather than letting a database blip masquerade as
+  // a permanent classification - and refuse rather than proceed, because proceeding would
+  // drop the tenant predicate and stamp the caller's tenant, which is the defect this guard
+  // exists for.
+  if (columns === null) {
+    logger.warn("Refusing reindex: could not read the source table's columns", {
+      entityType,
+      table,
+      tenantId,
+    })
+    return { processed: 0, total: 0, tenantScopes: [], scopes: [], refused: 'column-probe-failed' }
+  }
   const hasOrgCol = columns.has('organization_id')
   const hasTenantCol = columns.has('tenant_id')
   const hasDeletedCol = columns.has('deleted_at')
 
+  // `applyBaseWhere()` below can only apply the tenant predicate when the source
+  // table HAS a `tenant_id` column; when it does not, it silently drops the
+  // predicate the caller asked for. `scopeOverrides.tenantId` further down then
+  // stamps every swept row with the caller's tenant anyway. A tenant-scoped
+  // reindex of a tenant-less table therefore does two wrong things at once: it
+  // reads every tenant's rows, and it files them under whichever tenant happened
+  // to run it. Nothing downstream corrects that, because both readers ask for an
+  // exact tenant match with no NULL branch, so the rows become searchable and
+  // readable as that tenant's own.
+  //
+  // The condition is derived, not enumerated: it is exactly the set of inputs
+  // where a predicate is dropped AND an override is stamped. A `tenantId` of
+  // `undefined` or `null` sets no override, so those rows land under
+  // `tenant_id = NULL` — invisible to both readers, but filed under nobody — and
+  // are deliberately left alone here.
+  //
+  // Indexing every tenant-less table under NULL was considered as the general fix
+  // and rejected: an unqualified NULL branch in the readers overloads a value that
+  // also means "written by an unscoped reindex", so every mis-scoped row would
+  // become globally visible — fail-open, in a fix whose whole value is failing
+  // closed. `isTenantGlobalEntityType` is the narrow allowlist for the catalogue
+  // case instead; see its comment in ./tenant-global. The readers widen for exactly
+  // that declared set and for nothing else, and the projection of a declared type is
+  // written under the null tenant just below.
+  // A declared platform-wide catalogue has one row per record for every tenant to
+  // share, so its projection belongs to no tenant and no organization in particular and
+  // is written under `tenant_id = NULL, organization_id = NULL`. That is already where
+  // the incremental path files these rows: `resolveQueryIndexRecordScope()` resolves a
+  // source table with NEITHER scope column to `kind: 'global'` and requires an explicitly
+  // null tenant AND organization. Before this, the sweep disagreed with it and stamped the
+  // caller's scope, and since `entity_indexes` is unique on
+  // (entity_type, entity_id, organization_id_coalesced) the last caller to reindex simply
+  // took the catalogue from the previous one. Both readers in `@open-mercato/search` now
+  // carry the matching NULL branch for declared types.
+  //
+  // The condition matches `loadQueryIndexRowScope()`'s definition of global exactly -
+  // NEITHER column, not just no tenant column. Keying on the tenant column alone would let
+  // a third-party declaration of a table that HAS `organization_id` take the global branch
+  // for a record the event path never classifies as global, so the two writers would
+  // disagree again on a different axis.
+  //
+  // Only the PROJECTION scope moves. `jobScope` keeps the caller's tenant and organization:
+  // it records who ran the sweep, so two tenants reindexing the catalogue remain two jobs
+  // rather than one that blocks the other behind the active-job guard.
+  const writesGlobalProjection =
+    columns.has('id') && !hasTenantCol && !hasOrgCol && !source?.tenantColumn && !source?.organizationColumn && isTenantGlobalEntityType(entityType)
+  const projectionTenantId = writesGlobalProjection ? null : tenantId
+  const projectionOrganizationId = writesGlobalProjection ? null : organizationId
+  // Vector work keeps the caller's scope even where the projection moves. Its consumers -
+  // the `query_index.vectorize_one` and `query_index.vectorize_purge` subscribers and
+  // `removeOrphans` - need a real tenant, and nothing defines a shared vector across
+  // dispatch, storage and reads, so a declared catalogue's vectors stay filed per tenant
+  // exactly as they were before its projection moved to the null scope.
+  const vectorTenantId = writesGlobalProjection ? tenantId : projectionTenantId
+  const vectorOrganizationId = writesGlobalProjection ? organizationId : projectionOrganizationId
+
+  // Refuse anything tenant-less that is not writing a global projection. That is the
+  // no-tenant-column case, and also a declaration this module cannot honour: a declared
+  // type whose table carries `organization_id` but no `tenant_id`. Letting the second
+  // through would silently drop the tenant predicate and stamp the caller's tenant - the
+  // exact defect the guard exists for - while the author believes the declaration took
+  // effect. Fail closed and name it, in the spirit of the allowlist itself.
+  if (!hasTenantCol && tenantId != null && !writesGlobalProjection) {
+    const declaredButOrgScoped = isTenantGlobalEntityType(entityType)
+    logger.warn(
+      declaredButOrgScoped
+        ? 'Refusing tenant-scoped reindex: entity type is declared tenant-global but its table has an organization_id column'
+        : 'Refusing tenant-scoped reindex of a table with no tenant_id column',
+      { entityType, table, tenantId },
+    )
+    return {
+      processed: 0,
+      total: 0,
+      tenantScopes: [],
+      scopes: [],
+      refused: declaredButOrgScoped ? 'declared-global-but-org-scoped' : 'no-tenant-column',
+    }
+  }
+
   const jobScope: JobScope = {
     entityType,
     organizationId: organizationId ?? null,
@@ -268,18 +424,18 @@ export async function reindexEntity(
     for (const row of rows) {
       const bucketTenant = groupByTenant
         ? ((row as any)?.tenant_id ?? null)
-        : (tenantId === undefined ? null : tenantId ?? null)
+        : (projectionTenantId === undefined ? null : projectionTenantId ?? null)
       const bucketOrg = groupByOrg
         ? ((row as any)?.organization_id ?? null)
-        : (organizationId === undefined ? null : organizationId ?? null)
+        : (projectionOrganizationId === undefined ? null : projectionOrganizationId ?? null)
       registerBaseCount(bucketTenant, bucketOrg, toNumber((row as any)?.count))
     }
   } else {
     const row = await applyBaseWhere(
       db.selectFrom(`${table} as b` as any).select(sql<number>`count(*)`.as('count')),
     ).executeTakeFirst() as { count: unknown } | undefined
-    const bucketTenant = tenantId === undefined ? null : tenantId ?? null
-    const bucketOrg = organizationId === undefined ? null : organizationId ?? null
+    const bucketTenant = projectionTenantId === undefined ? null : projectionTenantId ?? null
+    const bucketOrg = projectionOrganizationId === undefined ? null : projectionOrganizationId ?? null
     registerBaseCount(bucketTenant, bucketOrg, toNumber(row?.count))
   }
 
@@ -301,11 +457,11 @@ export async function reindexEntity(
     : undefined
 
   const scopeOverrides: { tenantId?: string; orgId?: string } = {}
-  if (tenantId !== undefined && tenantId !== null) {
-    scopeOverrides.tenantId = String(tenantId)
+  if (projectionTenantId !== undefined && projectionTenantId !== null) {
+    scopeOverrides.tenantId = String(projectionTenantId)
   }
-  if (organizationId !== undefined && organizationId !== null) {
-    scopeOverrides.orgId = String(organizationId)
+  if (projectionOrganizationId !== undefined && projectionOrganizationId !== null) {
+    scopeOverrides.orgId = String(projectionOrganizationId)
   }
 
   const scopeEntries = Array.from(baseCounts.values()).map((entry) => ({
@@ -334,11 +490,11 @@ export async function reindexEntity(
       let purgeQuery = db
         .deleteFrom('entity_indexes' as any)
         .where('entity_type' as any, '=', entityType)
-      if (tenantId !== undefined) {
-        purgeQuery = purgeQuery.where(sql<boolean>`tenant_id is not distinct from ${tenantId ?? null}`)
+      if (projectionTenantId !== undefined) {
+        purgeQuery = purgeQuery.where(sql<boolean>`tenant_id is not distinct from ${projectionTenantId ?? null}`)
       }
-      if (organizationId !== undefined) {
-        purgeQuery = purgeQuery.where(sql<boolean>`organization_id is not distinct from ${organizationId ?? null}`)
+      if (projectionOrganizationId !== undefined) {
+        purgeQuery = purgeQuery.where(sql<boolean>`organization_id is not distinct from ${projectionOrganizationId ?? null}`)
       }
       if (usingPartitions && partitionIndex !== null) {
         purgeQuery = purgeQuery.where(
@@ -363,12 +519,12 @@ export async function reindexEntity(
   // leaves it to the caller that owns the fan-out (`api/reindex.ts` queues it once, before
   // dispatching any partition).
   if (force && resetCoverage && !usingPartitions && emitVectorize && eventBus) {
-    if (tenantId !== undefined) {
+    if (vectorTenantId !== undefined) {
       const payload: Record<string, unknown> = {
         entityType,
-        tenantId: tenantId ?? null,
+        tenantId: vectorTenantId ?? null,
       }
-      if (organizationId !== undefined) payload.organizationId = organizationId ?? null
+      if (vectorOrganizationId !== undefined) payload.organizationId = vectorOrganizationId ?? null
       try {
         await eventBus.emitEvent('query_index.vectorize_purge', payload)
       } catch (err) {
@@ -473,11 +629,11 @@ export async function reindexEntity(
 
       const coverageDeltas = new Map<string, { tenantId: string | null; organizationId: string | null; delta: number }>()
       for (const row of writtenRows) {
-        const scopeTenant = tenantId !== undefined
-          ? tenantId ?? null
+        const scopeTenant = projectionTenantId !== undefined
+          ? projectionTenantId ?? null
           : (hasTenantCol ? ((row as AnyRow).tenant_id ?? null) : null)
-        const scopeOrg = organizationId !== undefined
-          ? organizationId ?? null
+        const scopeOrg = projectionOrganizationId !== undefined
+          ? projectionOrganizationId ?? null
           : (hasOrgCol ? ((row as AnyRow).organization_id ?? null) : (deriveOrg ? deriveOrg(row) ?? null : null))
         const key = scopeKey(scopeTenant ?? null, scopeOrg ?? null)
         const existingDelta = coverageDeltas.get(key)
@@ -505,13 +661,13 @@ export async function reindexEntity(
       if (emitVectorize && eventBus) {
         await Promise.all(
           writtenRows.map((row) => {
-            const scopeOrg = organizationId !== undefined
-              ? organizationId ?? null
+            const scopeOrg = vectorOrganizationId !== undefined
+              ? vectorOrganizationId ?? null
               : hasOrgCol
                 ? ((row as AnyRow).organization_id ?? null)
                 : (deriveOrg ? deriveOrg(row) ?? null : null)
-            const scopeTenant = tenantId !== undefined
-              ? tenantId ?? null
+            const scopeTenant = vectorTenantId !== undefined
+              ? vectorTenantId ?? null
               : (hasTenantCol ? ((row as AnyRow).tenant_id ?? null) : null)
             return eventBus
               .emitEvent('query_index.vectorize_one', {
@@ -543,21 +699,34 @@ export async function reindexEntity(
     } else {
       await purgeOrphans(db, {
         entityType,
-        tenantId,
-        organizationId,
+        tenantId: projectionTenantId,
+        organizationId: projectionOrganizationId,
         partitionIndex: usingPartitions ? partitionIndex : null,
         partitionCount: usingPartitions ? partitionCountRaw : null,
         startedAt: jobStartedAt,
         excludeRecordIds: purgeExclusions,
       })
+      // The purge above only sees the canonical null scope. Rows earlier sweeps stamped with
+      // a caller's tenant and organization are other keys of the same records, so a sweep of
+      // a declared catalogue also retires them - after the canonical rows are written, so the
+      // catalogue never goes unserved in between.
+      if (writesGlobalProjection) {
+        await retireScopedCatalogueRows(db, {
+          entityType,
+          partitionIndex: usingPartitions ? partitionIndex : null,
+          partitionCount: usingPartitions ? partitionCountRaw : null,
+          excludeRecordIds: purgeExclusions,
+        })
+        if (resetCoverage) await deleteScopedCoverageForEntity(db, entityType)
+      }
     }
 
     if (force && vectorService && (!usingPartitions || partitionIndex === null)) {
       try {
         await vectorService.removeOrphans({
           entityId: entityType,
-          tenantId,
-          organizationId,
+          tenantId: vectorTenantId,
+          organizationId: vectorOrganizationId,
           olderThan: jobStartedAt,
         })
       } catch (error) {