@open-mercato/core 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/src/modules/query_index/lib/engine.ts

@@ -58,6 +58,10 @@ function resolveBooleanEnv(names: readonly string[], defaultValue: boolean): boo
   return defaultValue
 }
 
+export function coerceSortDirection(dir: unknown): SortDir {
+  return String(dir ?? SortDir.Asc).toLowerCase() === SortDir.Desc ? SortDir.Desc : SortDir.Asc
+}
+
 function resolveDebugVerbosity(): boolean {
   const queryIndexDebug = process.env.OM_QUERY_INDEX_DEBUG
   if (queryIndexDebug !== undefined) {
@@ -87,6 +91,8 @@ type SearchRuntime = {
   organizationScope?: { ids: string[]; includeNull: boolean } | null
   tenantId?: string | null
   searchSources?: SearchTokenSource[]
+  /** Per-`query()` alias minter for `search_tokens` subqueries (see #2738). */
+  mintAlias: () => string
 }
 
 type EncryptionResolver = () => {
@@ -97,6 +103,18 @@ type EncryptionResolver = () => {
 
 type SearchTokenSource = { entity: string; recordIdColumn: string }
 
+/**
+ * Mints `search_tokens` subquery aliases (`st_0`, `st_1`, …). Aliases only need
+ * to be unique within a single SQL statement, so every `query()` invocation owns
+ * a fresh minter. Keeping the counter call-local (rather than on the shared
+ * engine instance) means concurrent queries can never reset or collide on each
+ * other's sequence (#2738).
+ */
+function createSearchAliasMinter(): () => string {
+  let seq = 0
+  return () => `st_${seq++}`
+}
+
 function createQueryProfiler(entity: string): Profiler {
   const enabled = shouldEnableProfiler(entity)
   return createProfiler({
@@ -113,13 +131,13 @@ export class HybridQueryEngine implements QueryEngine {
   private customFieldKeysCache = new Map<string, { expiresAt: number; value: string[] }>()
   private customFieldKeysTtlMs: number
   private columnCache = new Map<string, boolean>()
+  private customEntityCache = new Map<string, boolean>()
   private debugVerbosity: boolean | null = null
   private sqlDebugEnabled: boolean | null = null
   private forcePartialIndexEnabled: boolean | null = null
   private autoReindexEnabled: boolean | null = null
   private coverageOptimizationEnabled: boolean | null = null
   private pendingCoverageRefreshKeys = new Set<string>()
-  private searchAliasSeq = 0
 
   constructor(
     private em: EntityManager,
@@ -200,7 +218,6 @@ export class HybridQueryEngine implements QueryEngine {
     try {
       const debugEnabled = this.isDebugVerbosity()
       if (debugEnabled) this.debug('query:start', { entity })
-      this.searchAliasSeq = 0
 
       const isCustom = await this.isCustomEntity(entity)
       if (isCustom) {
@@ -374,6 +391,7 @@ export class HybridQueryEngine implements QueryEngine {
         config: searchConfig,
         organizationScope: orgScope,
         tenantId: opts.tenantId ?? null,
+        mintAlias: createSearchAliasMinter(),
       }
 
       // Prepare index sources for JSONB custom-field access.
@@ -724,6 +742,7 @@ export class HybridQueryEngine implements QueryEngine {
           recordIdColumn: `${join.alias}.id`,
           tenantId: opts.tenantId ?? null,
           organizationScope: orgScope,
+          mintAlias: searchRuntime.mintAlias,
         })
       }
 
@@ -800,7 +819,7 @@ export class HybridQueryEngine implements QueryEngine {
           if (fieldName.startsWith('cf:')) {
             const textExpr = this.buildCfTextExprSql(fieldName, indexSources)
             if (textExpr) {
-              const direction = sql.raw(String(s.dir ?? SortDir.Asc))
+              const direction = sql.raw(coerceSortDirection(s.dir))
               next = next.orderBy(sql`${textExpr} ${direction}`)
             }
           } else {
@@ -973,6 +992,9 @@ export class HybridQueryEngine implements QueryEngine {
   }
 
   private async isCustomEntity(entity: string): Promise<boolean> {
+    const cached = this.customEntityCache.get(entity)
+    if (cached !== undefined) return cached
+    let result = false
     try {
       const db = this.getDb() as any
       const row = await db
@@ -981,6 +1003,36 @@ export class HybridQueryEngine implements QueryEngine {
         .where('entity_id', '=', entity)
         .where('is_active', '=', true)
         .executeTakeFirst()
+      if (row) {
+        result = true
+      } else {
+        // Read/write symmetry. Records written through the entities data engine
+        // (`de.createCustomEntityRecord`) always land in `custom_entities_storage`,
+        // even for module-declared custom entities whose id is also a frozen system
+        // id — those are NEVER registered in `custom_entities` (install treats a
+        // system id as non-registrable). Without this fallback the query routes to
+        // the empty ORM/index path and those records are write-only (created with
+        // 200 but unreadable on the edit form). A real ORM entity never writes rows
+        // to `custom_entities_storage`, so this can only ever re-classify genuine
+        // doc-storage entities — it cannot misroute table-backed entities.
+        result = await this.hasCustomEntityStorageRows(entity)
+      }
+    } catch {
+      result = false
+    }
+    this.customEntityCache.set(entity, result)
+    return result
+  }
+
+  private async hasCustomEntityStorageRows(entity: string): Promise<boolean> {
+    try {
+      const db = this.getDb() as any
+      const row = await db
+        .selectFrom('custom_entities_storage')
+        .select(sql<number>`1`.as('one'))
+        .where('entity_type', '=', entity)
+        .limit(1)
+        .executeTakeFirst()
       return !!row
     } catch {
       return false
@@ -1006,6 +1058,7 @@ export class HybridQueryEngine implements QueryEngine {
       tenantId?: string | null
       organizationScope?: { ids: string[]; includeNull: boolean } | null
       combineWith?: 'and' | 'or'
+      mintAlias: () => string
     }
   ): boolean {
     if (!opts.hashes.length) {
@@ -1015,7 +1068,7 @@ export class HybridQueryEngine implements QueryEngine {
       })
       return false
     }
-    const alias = `st_${this.searchAliasSeq++}`
+    const alias = opts.mintAlias()
     this.logSearchDebug('search:apply-search-tokens', {
       entity: opts.entity, field: opts.field, alias,
       tokenCount: opts.hashes.length,
@@ -1187,6 +1240,7 @@ export class HybridQueryEngine implements QueryEngine {
           recordIdColumn: `${source.alias}.entity_id`,
           tenantId: search.tenantId ?? null,
           organizationScope: search.organizationScope ?? null,
+          mintAlias: search.mintAlias,
         }))
       )
     ))
@@ -1203,9 +1257,10 @@ export class HybridQueryEngine implements QueryEngine {
       recordIdColumn: string
       tenantId?: string | null
       organizationScope?: { ids: string[]; includeNull: boolean } | null
+      mintAlias: () => string
     }
   ): any {
-    const alias = `st_${this.searchAliasSeq++}`
+    const alias = opts.mintAlias()
     let sub = eb
       .selectFrom(`search_tokens as ${alias}`)
       .select(sql<number>`1`.as('one'))
@@ -1246,6 +1301,7 @@ export class HybridQueryEngine implements QueryEngine {
           recordIdColumn: `${alias}.entity_id`,
           tenantId: search.tenantId ?? null,
           organizationScope: search.organizationScope ?? null,
+          mintAlias: search.mintAlias,
         })))
         this.logSearchDebug('search:cf-filter', {
           entity: entityType, field: key, tokens: tokens.tokens, hashes, applied: true,
@@ -1317,6 +1373,7 @@ export class HybridQueryEngine implements QueryEngine {
           entity: entityType, field: key, hashes, recordIdColumn,
           tenantId: search.tenantId ?? null,
           organizationScope: search.organizationScope ?? null,
+          mintAlias: search.mintAlias,
         })))
         this.logSearchDebug('search:index-doc-filter', {
           entity: entityType, field: key, tokens: tokens.tokens, hashes, applied: true,
@@ -1402,6 +1459,7 @@ export class HybridQueryEngine implements QueryEngine {
                 recordIdColumn: src.recordIdColumn,
                 tenantId: searchRuntime.tenantId ?? null,
                 organizationScope: searchRuntime.organizationScope ?? null,
+                mintAlias: searchRuntime.mintAlias,
               })),
             ),
           )
@@ -1492,6 +1550,7 @@ export class HybridQueryEngine implements QueryEngine {
       config: searchConfig,
       organizationScope: orgScope,
       tenantId: opts.tenantId ?? null,
+      mintAlias: createSearchAliasMinter(),
     }
 
     const normalizedFilters = normalizeFilters(opts.filters)
@@ -1593,7 +1652,7 @@ export class HybridQueryEngine implements QueryEngine {
         } else if (s.field === 'created_at' || s.field === 'updated_at' || s.field === 'deleted_at') {
           next = next.orderBy(`${alias}.${s.field}`, s.dir ?? SortDir.Asc)
         } else {
-          const direction = sql.raw(String(s.dir ?? SortDir.Asc))
+          const direction = sql.raw(coerceSortDirection(s.dir))
           next = next.orderBy(sql`(${sql.ref(alias + '.doc')} ->> ${s.field}) ${direction}`)
         }
       }
@@ -2072,6 +2131,7 @@ export class HybridQueryEngine implements QueryEngine {
                 recordIdColumn: src.recordIdColumn,
                 tenantId: search.tenantId ?? null,
                 organizationScope: search.organizationScope ?? null,
+                mintAlias: search.mintAlias,
               })))
           ))
           this.logSearchDebug('search:filter', {

package/src/modules/query_index/lib/indexer.ts

@@ -158,7 +158,7 @@ function scopeEntityIndexes<QB extends { where: (...args: any[]) => QB }>(
 
 export async function upsertIndexRow(
   em: EntityManager,
-  args: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null; searchTokenDoc?: Record<string, unknown> | null }
+  args: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null; searchTokenDoc?: Record<string, unknown> | null; deferSearchTokens?: boolean }
 ): Promise<UpsertIndexResult> {
   const db = (em as any).getKysely()
 
@@ -172,14 +172,19 @@ export async function upsertIndexRow(
 
   const doc = await buildIndexDoc(em, args)
   if (!doc) {
-    try {
-      await deleteSearchTokensForRecord(db, {
-        entityType: args.entityType,
-        recordId: args.recordId,
-        organizationId: args.organizationId ?? null,
-        tenantId: args.tenantId ?? null,
-      })
-    } catch {}
+    // When the caller defers token work it owns the matching token cleanup; the
+    // projection-row removal below stays synchronous so list reads converge immediately.
+    if (!args.deferSearchTokens) {
+      try {
+        await reindexSearchTokensForRecord(em, {
+          entityType: args.entityType,
+          recordId: args.recordId,
+          organizationId: args.organizationId ?? null,
+          tenantId: args.tenantId ?? null,
+          doc: null,
+        })
+      } catch {}
+    }
     if (existed) {
       await scopeEntityIndexes(
         db.deleteFrom('entity_indexes' as any) as any,
@@ -233,27 +238,69 @@ export async function upsertIndexRow(
 
   const created = !existed
   const revived = existed && wasDeleted
-  try {
-    const tokenDoc = args.searchTokenDoc ?? (() => {
-      const encryption = resolveTenantEncryptionService(em as any)
-      const dekKeyCache = new Map<string | null, string | null>()
-      return decryptIndexDocForSearch(
-        args.entityType,
+  // The search-token rebuild (DELETE + chunked INSERT) is the heavy tail of indexing.
+  // Callers that defer it (the upsert subscriber) run `reindexSearchTokensForRecord`
+  // asynchronously after this projection update so write latency stays bounded.
+  if (!args.deferSearchTokens) {
+    try {
+      await reindexSearchTokensForRecord(em, {
+        entityType: args.entityType,
+        recordId: args.recordId,
+        organizationId: args.organizationId ?? null,
+        tenantId: args.tenantId ?? null,
         doc,
-        { tenantId: args.tenantId ?? null, organizationId: args.organizationId ?? null },
-        encryption,
-        dekKeyCache,
-      )
-    })()
-    await replaceSearchTokensForRecord(db, {
+        searchTokenDoc: args.searchTokenDoc ?? null,
+      })
+    } catch {}
+  }
+  return { doc, existed, wasDeleted, created, revived }
+}
+
+/**
+ * Rebuilds (or clears, when `doc` is null) the search-token rows for a single record.
+ * This is the asynchronous-friendly tail of `upsertIndexRow`: it does not touch the
+ * `entity_indexes` projection that list endpoints read, so it can run out-of-band
+ * without making query-index reads inconsistent.
+ */
+export async function reindexSearchTokensForRecord(
+  em: EntityManager,
+  args: {
+    entityType: string
+    recordId: string
+    organizationId?: string | null
+    tenantId?: string | null
+    doc: Record<string, any> | null
+    searchTokenDoc?: Record<string, unknown> | null
+  },
+): Promise<void> {
+  const db = (em as any).getKysely()
+  if (!args.doc) {
+    await deleteSearchTokensForRecord(db, {
       entityType: args.entityType,
       recordId: args.recordId,
       organizationId: args.organizationId ?? null,
       tenantId: args.tenantId ?? null,
-      doc: await tokenDoc,
     })
-  } catch {}
-  return { doc, existed, wasDeleted, created, revived }
+    return
+  }
+  const tokenDoc = args.searchTokenDoc ?? (() => {
+    const encryption = resolveTenantEncryptionService(em as any)
+    const dekKeyCache = new Map<string | null, string | null>()
+    return decryptIndexDocForSearch(
+      args.entityType,
+      args.doc,
+      { tenantId: args.tenantId ?? null, organizationId: args.organizationId ?? null },
+      encryption,
+      dekKeyCache,
+    )
+  })()
+  await replaceSearchTokensForRecord(db, {
+    entityType: args.entityType,
+    recordId: args.recordId,
+    organizationId: args.organizationId ?? null,
+    tenantId: args.tenantId ?? null,
+    doc: await tokenDoc,
+  })
 }
 
 export async function markDeleted(

package/src/modules/query_index/lib/jobs.ts

@@ -20,6 +20,17 @@ function applyScopeWhere<QB extends { where: (...args: any[]) => QB }>(
   return q
 }
 
+// True when ON CONFLICT could not infer an arbiter index (Postgres SQLSTATE
+// 42P10) — i.e. entity_index_jobs_scope_unique is not present yet. Used to scope
+// prepareJob's fallback to the missing-index case only.
+function isMissingConflictArbiterError(err: unknown): boolean {
+  const code = (err as { code?: unknown } | null | undefined)?.code
+  if (code === '42P10') return true
+  const message = (err as { message?: unknown } | null | undefined)?.message
+  return typeof message === 'string'
+    && /no unique or exclusion constraint matching the on conflict/i.test(message)
+}
+
 export async function prepareJob(
   db: Kysely<any>,
   scope: JobScope,
@@ -39,6 +50,52 @@ export async function prepareJob(
     total_count: options.totalCount ?? null,
   }
 
+  // Single atomic upsert keyed by the coalesced scope tuple. This closes the
+  // read-then-write race where two concurrent schedulers each see "no row" and
+  // both INSERT a duplicate for the same scope, after which updateJobProgress /
+  // finalizeJob corrupt each other's progress and finish state (#2739). The
+  // ON CONFLICT target must match entity_index_jobs_scope_unique exactly.
+  try {
+    const upserted = await db
+      .insertInto('entity_index_jobs' as any)
+      .values({ entity_type: scope.entityType, ...base } as any)
+      .onConflict((oc: any) => oc
+        .expression(sql`
+          "entity_type",
+          coalesce("organization_id", '00000000-0000-0000-0000-000000000000'::uuid),
+          coalesce("tenant_id", '00000000-0000-0000-0000-000000000000'::uuid),
+          coalesce("partition_index", -1),
+          coalesce("partition_count", -1)
+        `)
+        .doUpdateSet({
+          status,
+          started_at: sql`now()`,
+          finished_at: null,
+          heartbeat_at: sql`now()`,
+          processed_count: 0,
+          total_count: options.totalCount ?? null,
+        } as any))
+      .returning(['id' as any])
+      .execute() as Array<{ id: string }>
+    return upserted?.[0]?.id ?? null
+  } catch (err) {
+    // Only degrade to the legacy path when the scope unique index is absent
+    // (e.g. a rolling deploy running this code against the pre-migration schema):
+    // Postgres raises 42P10. Any other failure is real and must surface rather
+    // than silently fall back to the racy read-then-write path and re-open #2739.
+    if (!isMissingConflictArbiterError(err)) throw err
+    return prepareJobLegacy(db, scope, base)
+  }
+}
+
+// Pre-#2739 read-then-write path. Retained only as a fallback when the
+// entity_index_jobs scope unique index is unavailable; it carries the original
+// (racy) semantics and must never be reached once the migration has applied.
+async function prepareJobLegacy(
+  db: Kysely<any>,
+  scope: JobScope,
+  base: Record<string, unknown>,
+): Promise<string | null> {
   const existing = await applyScopeWhere(
     db.selectFrom('entity_index_jobs' as any).select(['id' as any]),
     scope,

package/src/modules/query_index/lib/reindexer.ts

@@ -1,6 +1,6 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { type Kysely, sql } from 'kysely'
-import { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'
+import { resolveRegisteredEntityTableName } from '@open-mercato/shared/lib/query/engine'
 import { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'
 import { decryptIndexDocForSearch, encryptIndexDocForStorage } from '@open-mercato/shared/lib/encryption/indexDoc'
 import { upsertIndexBatch, type AnyRow } from './batch'
@@ -40,6 +40,33 @@ const deriveOrgFromId = new Set<string>(['directory:organization'])
 const COVERAGE_REFRESH_THROTTLE_MS = 5 * 60 * 1000
 const lastCoverageReset = new Map<string, number>()
 
+const REINDEX_DECRYPT_DEBUG_KEYS = ['display_name', 'first_name', 'last_name', 'brand_name', 'legal_name', 'primary_email', 'primary_phone'] as const
+
+export type ReindexDecryptDebugPayload = {
+  entityType: string
+  tenantId: string | null
+  organizationId: string | null
+  keys: string[]
+}
+
+export function buildReindexDecryptDebugPayload(
+  entityType: string,
+  doc: Record<string, unknown>,
+  scope: { organizationId: string | null; tenantId: string | null },
+): ReindexDecryptDebugPayload {
+  const presentKeys: string[] = []
+  for (const key of REINDEX_DECRYPT_DEBUG_KEYS) {
+    const value = doc[key]
+    if (key in doc && value != null && value !== '') presentKeys.push(key)
+  }
+  return {
+    entityType,
+    tenantId: scope.tenantId ?? null,
+    organizationId: scope.organizationId ?? null,
+    keys: presentKeys,
+  }
+}
+
 async function cleanupLegacyJobScopes(
   db: Kysely<any>,
   options: {
@@ -118,8 +145,18 @@ export async function reindexEntity(
   const resetCoverage = options?.resetCoverage ?? (!usingPartitions || partitionIndex === 0)
 
   const db = (em as any).getKysely() as Kysely<any>
-  const table = resolveEntityTableName(em, entityType)
-  if (entityType === 'query_index:search_token' || table === 'search_tokens') {
+  // Resolve the source table strictly via registered MikroORM metadata. We must
+  // never fall back to a pluralized guess derived from the caller-supplied id
+  // here: doing so would let a principal with `query_index.reindex` point the
+  // reindexer at arbitrary tables (e.g. `auth_users`, `users`) and read their
+  // rows into the index, bypassing tenant scoping and entity-level encryption.
+  const table = resolveRegisteredEntityTableName(em, entityType)
+  if (!table || entityType === 'query_index:search_token' || table === 'search_tokens') {
+    if (!table) {
+      console.warn('[HybridQueryEngine] Refusing to reindex unregistered entity type', {
+        entityType,
+      })
+    }
     return {
       processed: 0,
       total: 0,
@@ -377,18 +414,7 @@ export async function reindexEntity(
           dekKeyCache,
         )
         if (isSearchDebugEnabled()) {
-          const keysOfInterest = ['display_name', 'first_name', 'last_name', 'brand_name', 'legal_name', 'primary_email', 'primary_phone']
-          const snapshot: Record<string, unknown> = {}
-          for (const key of keysOfInterest) {
-            if (key in result) snapshot[key] = (result as Record<string, unknown>)[key]
-          }
-          console.info('[reindex:decrypt]', {
-            entityType: targetEntity,
-            tenantId: scope.tenantId ?? null,
-            organizationId: scope.organizationId ?? null,
-            keys: Object.keys(snapshot),
-            sample: snapshot,
-          })
+          console.info('[reindex:decrypt]', buildReindexDecryptDebugPayload(targetEntity, result as Record<string, unknown>, scope))
         }
         return result
       }

package/src/modules/query_index/lib/search-tokens.ts

@@ -78,7 +78,7 @@ export function buildSearchTokenRows(params: BuildTokenOptions): SearchTokenRow[
   if (!params.doc) return []
   const tokens: SearchTokenRow[] = []
   const capturePairs = isSearchDebugEnabled() && params.entityType === 'customers:customer_deal'
-  const debugPairs: Array<{ field: string; token: string; hash: string }> = []
+  const debugPairs: Array<{ field: string; hash: string }> = []
   const scope = {
     organizationId: params.organizationId ?? DEFAULT_SCOPE.organizationId,
     tenantId: params.tenantId ?? DEFAULT_SCOPE.tenantId,
@@ -96,7 +96,7 @@ export function buildSearchTokenRows(params: BuildTokenOptions): SearchTokenRow[
         const dedupeKey = `${field}|${hash}`
         if (seen.has(dedupeKey)) continue
         seen.add(dedupeKey)
-        debug('token.generated', { entityType: params.entityType, recordId: params.recordId, field, token, hash })
+        debug('token.generated', { entityType: params.entityType, recordId: params.recordId, field, hash })
         tokens.push({
           entity_type: params.entityType,
           entity_id: String(params.recordId),
@@ -107,7 +107,7 @@ export function buildSearchTokenRows(params: BuildTokenOptions): SearchTokenRow[
           token: config.storeRawTokens ? token : null,
         })
         if (capturePairs) {
-          debugPairs.push({ field, token, hash })
+          debugPairs.push({ field, hash })
         }
       }
     }
@@ -116,7 +116,7 @@ export function buildSearchTokenRows(params: BuildTokenOptions): SearchTokenRow[
     debug('deal.tokens', {
       entityType: params.entityType,
       recordId: params.recordId,
-      title: params.doc?.title ?? null,
+      tokenCount: debugPairs.length,
       tokens: debugPairs,
     })
   }

package/src/modules/query_index/migrations/.snapshot-open-mercato.json

@@ -409,6 +409,15 @@
           "keyName": "entity_index_jobs_type_idx",
           "primary": false,
           "unique": false
+        },
+        {
+          "columnNames": [],
+          "composite": false,
+          "constraint": true,
+          "keyName": "entity_index_jobs_scope_unique",
+          "primary": false,
+          "unique": true,
+          "expression": "create unique index \"entity_index_jobs_scope_unique\" on \"entity_index_jobs\" (\"entity_type\", coalesce(\"organization_id\", '00000000-0000-0000-0000-000000000000'::uuid), coalesce(\"tenant_id\", '00000000-0000-0000-0000-000000000000'::uuid), coalesce(\"partition_index\", -1), coalesce(\"partition_count\", -1))"
         }
       ],
       "checks": [],

package/src/modules/query_index/migrations/Migration20260606205453_query_index.ts

@@ -0,0 +1,39 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260606205453_query_index extends Migration {
+
+  override up(): void | Promise<void> {
+    // De-duplicate scope rows that the pre-#2739 read-then-write prepareJob could
+    // create when two schedulers raced. Keep the most relevant per coalesced scope
+    // (still-running first, then most recently started). Required before the unique
+    // index can be created.
+    this.addSql(`
+      delete from "entity_index_jobs" loser
+      using (
+        select "id"
+        from (
+          select
+            "id",
+            row_number() over (
+              partition by
+                "entity_type",
+                coalesce("organization_id", '00000000-0000-0000-0000-000000000000'::uuid),
+                coalesce("tenant_id", '00000000-0000-0000-0000-000000000000'::uuid),
+                coalesce("partition_index", -1),
+                coalesce("partition_count", -1)
+              order by ("finished_at" is null) desc, "started_at" desc, "id" desc
+            ) as row_number
+          from "entity_index_jobs"
+        ) ranked
+        where ranked.row_number > 1
+      ) duplicates
+      where loser."id" = duplicates."id";
+    `);
+    this.addSql(`create unique index if not exists "entity_index_jobs_scope_unique" on "entity_index_jobs" ("entity_type", coalesce("organization_id", '00000000-0000-0000-0000-000000000000'::uuid), coalesce("tenant_id", '00000000-0000-0000-0000-000000000000'::uuid), coalesce("partition_index", -1), coalesce("partition_count", -1));`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`drop index if exists "entity_index_jobs_scope_unique";`);
+  }
+
+}

package/src/modules/query_index/subscribers/delete_one.ts

@@ -8,7 +8,11 @@ import { loadQueryIndexRowScope, resolveQueryIndexRecordScope } from '../lib/sub
 export const metadata = { event: 'query_index.delete_one', persistent: false }
 
 export default async function handle(payload: any, ctx: { resolve: <T=any>(name: string) => T }) {
-  const em = ctx.resolve<any>('em')
+  // Forked EntityManager — this awaited subscriber runs synchronously on the request
+  // `em`; isolating it prevents our queries/writes from resetting the originating CRUD
+  // write's UnitOfWork and dropping its pending changes. See upsert_one.ts for detail.
+  const baseEm = ctx.resolve<any>('em')
+  const em = typeof baseEm?.fork === 'function' ? baseEm.fork() : baseEm
   const entityType = String(payload?.entityType || '')
   const recordId = String(payload?.recordId || '')
   if (!entityType || !recordId) return
@@ -73,24 +77,40 @@ export default async function handle(payload: any, ctx: { resolve: <T=any>(name:
       }
     }
 
+    // The projection row + token removal above are synchronous (the data engine
+    // awaits this subscriber) so list reads are consistent immediately. The coverage
+    // recompute (a COUNT, run inline when delayMs is 0) and the fulltext delete are
+    // secondary, so defer them fire-and-forget to keep write/bulk-delete latency bounded.
     const shouldRefreshCoverage = coverageDelayMs === undefined || coverageDelayMs >= 0
-    if (shouldRefreshCoverage) {
-      const delay = coverageDelayMs ?? 0
+    const coverageRefreshDelay = coverageDelayMs ?? 0
+    void (async () => {
       try {
         const bus = ctx.resolve<any>('eventBus')
-        await bus.emitEvent('query_index.coverage.refresh', {
-          entityType,
-          tenantId: tenantId ?? null,
-          organizationId: organizationId ?? null,
-          delayMs: delay,
-        })
-      } catch {}
-    }
-    // Emit search delete event
-    try {
-      const bus = ctx.resolve<any>('eventBus')
-      await bus.emitEvent('search.delete_record', { entityId: entityType, recordId, organizationId, tenantId })
-    } catch {}
+        if (shouldRefreshCoverage) {
+          await bus.emitEvent('query_index.coverage.refresh', {
+            entityType,
+            tenantId: tenantId ?? null,
+            organizationId: organizationId ?? null,
+            delayMs: coverageRefreshDelay,
+          })
+        }
+        await bus.emitEvent('search.delete_record', { entityId: entityType, recordId, organizationId, tenantId })
+      } catch (error) {
+        await recordIndexerError(
+          { em },
+          {
+            source: 'query_index',
+            handler: 'event:query_index.delete_one:coverage_search',
+            error,
+            entityType,
+            recordId,
+            tenantId: tenantId ?? null,
+            organizationId: organizationId ?? null,
+            payload,
+          },
+        ).catch(() => {})
+      }
+    })()
   } catch (error) {
     await recordIndexerError(
       { em },