@open-mercato/core 0.6.6-develop.6257.1.6d0af84d26 → 0.6.6-develop.6290.1.4bb5a8ba3f

package/src/modules/planner/commands/availability-weekly.ts

@@ -2,17 +2,27 @@ import type { CommandHandler } from '@open-mercato/shared/lib/commands'
 import { registerCommand } from '@open-mercato/shared/lib/commands'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { parseAvailabilityRuleWindow } from '@open-mercato/core/modules/planner/lib/availabilitySchedule'
-import { PlannerAvailabilityRule } from '../data/entities'
+import { PlannerAvailabilityRule, PlannerAvailabilityRuleSet } from '../data/entities'
 import {
   plannerAvailabilityWeeklyReplaceSchema,
   type PlannerAvailabilityWeeklyReplaceInput,
 } from '../data/validators'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { PlannerAvailabilityKind, PlannerAvailabilitySubjectType } from '../data/entities'
+import {
+  enforceCommandOptimisticLock,
+  enforceRecordGoneIsConflict,
+} from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { ensureOrganizationScope, ensureTenantScope, extractUndoPayload } from './shared'
 
 const AVAILABILITY_RULE_RESOURCE_KIND = 'planner.availability.rule'
 
+// Canonical resource kind for the parent rule set, matching the tag the CRUD
+// factory derives for `planner.availability-rule-sets.*` commands. Weekly
+// replace mutates the rule set's child `availability_rules`, so the parent is
+// the optimistic-lock consistency boundary (document-aggregate pattern).
+const AVAILABILITY_RULE_SET_RESOURCE_KIND = 'planner.availability.rule.set'
+
 const DAY_CODES = ['SU', 'MO', 'TU', 'WE', 'TH', 'FR', 'SA']
 
 type AvailabilityRuleSnapshot = {
@@ -164,6 +174,38 @@ const replaceWeeklyAvailabilityCommand: CommandHandler<PlannerAvailabilityWeekly
     const now = new Date()
 
     await em.transactional(async (trx) => {
+      // The weekly rules of a rule set are a sub-resource of that rule set: the
+      // parent is the optimistic-lock consistency boundary. Guard the parent's
+      // version (so a stale weekly save loses to a concurrent rule-set
+      // change/delete) and bump its `updated_at` after the replace (so a
+      // concurrent rule-set delete/update with a stale token conflicts). See #2927.
+      let ruleSet: PlannerAvailabilityRuleSet | null = null
+      if (parsed.subjectType === 'ruleset') {
+        ruleSet = await trx.findOne(PlannerAvailabilityRuleSet, {
+          id: parsed.subjectId,
+          tenantId: parsed.tenantId,
+          organizationId: parsed.organizationId,
+          deletedAt: null,
+        })
+        if (ruleSet) {
+          enforceCommandOptimisticLock({
+            resourceKind: AVAILABILITY_RULE_SET_RESOURCE_KIND,
+            resourceId: ruleSet.id,
+            current: ruleSet.updatedAt,
+            request: ctx.request ?? null,
+          })
+        } else {
+          // The rule set was deleted concurrently. When the client opted into
+          // optimistic locking, surface the unified conflict instead of
+          // silently writing orphan rules; otherwise preserve legacy behavior.
+          enforceRecordGoneIsConflict({
+            resourceKind: AVAILABILITY_RULE_SET_RESOURCE_KIND,
+            resourceId: parsed.subjectId,
+            request: ctx.request ?? null,
+          })
+        }
+      }
+
       const existing = await trx.find(PlannerAvailabilityRule, {
         tenantId: parsed.tenantId,
         organizationId: parsed.organizationId,
@@ -207,6 +249,11 @@ const replaceWeeklyAvailabilityCommand: CommandHandler<PlannerAvailabilityWeekly
         trx.persist(record)
       })
 
+      if (ruleSet) {
+        ruleSet.updatedAt = now
+        trx.persist(ruleSet)
+      }
+
       await trx.flush()
     })
 

package/src/modules/planner/components/AvailabilityRulesEditor.tsx

@@ -857,21 +857,31 @@ export function AvailabilityRulesEditor({
     if (!subjectIdForRules) return
     if (weeklyHasErrors) return
 
+    // Weekly rules of a rule set are a sub-resource of that rule set. Send the
+    // parent's expected version so a concurrent rule-set change/delete is
+    // detected, and refresh it afterwards because the server bumps the rule
+    // set's `updated_at` on a successful replace (#2927).
+    const parentRuleSet = subjectForRules === 'ruleset'
+      ? (ruleSets.find((entry) => entry.id === subjectIdForRules) ?? null)
+      : null
+
     const shouldSkipRefresh = Boolean(options?.skipRefresh)
     setIsWeeklyAutoSaving(options?.silentSuccess === true)
     try {
       const windows = buildWeeklyPayload(normalizeWeeklyWindows(weeklyWindowsRef.current))
       await runMutation({
-        operation: () => apiCallOrThrow('/api/planner/availability-weekly', {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({
-            subjectType: subjectForRules,
-            subjectId: subjectIdForRules,
-            timezone,
-            windows,
-          }),
-        }, { errorMessage: listLabels.saveWeeklyError }),
+        operation: () => withOptimisticLockForRuleSet(parentRuleSet, () => (
+          apiCallOrThrow('/api/planner/availability-weekly', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              subjectType: subjectForRules,
+              subjectId: subjectIdForRules,
+              timezone,
+              windows,
+            }),
+          }, { errorMessage: listLabels.saveWeeklyError })
+        )),
         context: mutationContext,
         mutationPayload: { action: 'save-weekly', subjectType: subjectForRules, subjectId: subjectIdForRules },
       })
@@ -884,7 +894,13 @@ export function AvailabilityRulesEditor({
         await refreshAvailability()
         await refreshRuleSetRules()
       }
+      if (parentRuleSet) {
+        await refreshRuleSets()
+      }
     } catch (error) {
+      if (surfaceRecordConflict(error, t)) {
+        return
+      }
       const message = error instanceof Error ? error.message : listLabels.saveWeeklyError
       flash(message, 'error')
     } finally {
@@ -895,9 +911,12 @@ export function AvailabilityRulesEditor({
     listLabels.saveWeeklySuccess,
     refreshAvailability,
     refreshRuleSetRules,
+    refreshRuleSets,
+    ruleSets,
     effectiveRulesetId,
     subjectId,
     subjectType,
+    t,
     timezone,
     usingRuleSet,
     weeklyHasErrors,
@@ -1161,6 +1180,7 @@ export function AvailabilityRulesEditor({
       refreshRuleSets,
       onSuccess: () => flash(listLabels.ruleSetDeleteSuccess, 'success'),
       onError: (error) => {
+        if (surfaceRecordConflict(error, t)) return
         console.error('planner.availability-rule-sets.delete', error)
         const normalized = normalizeCrudServerError(error)
         flash(normalized.message ?? listLabels.ruleSetDeleteError, 'error')
@@ -1178,6 +1198,7 @@ export function AvailabilityRulesEditor({
     refreshRuleSets,
     ruleSets,
     rulesetId,
+    t,
     mutationContext,
     runMutation,
   ])

package/src/modules/portal/frontend/[orgSlug]/portal/dashboard/hiddenWidgetsStorage.ts

@@ -0,0 +1,36 @@
+import {
+  readVersionedPreference,
+  writeVersionedPreference,
+  clearVersionedPreference,
+} from '@open-mercato/shared/lib/browser/versionedPreference'
+
+const LEGACY_HIDDEN_WIDGETS_KEY = 'om:portal:dashboard:hidden'
+const HIDDEN_WIDGETS_KEY_PREFIX = 'om:portal:dashboard:hidden:v1:'
+const HIDDEN_WIDGETS_VERSION = 1
+
+function buildHiddenWidgetsKey(orgSlug: string, userId: string): string {
+  return `${HIDDEN_WIDGETS_KEY_PREFIX}${orgSlug}:${userId}`
+}
+
+function isStringArray(value: unknown): value is string[] {
+  return Array.isArray(value) && value.every((id) => typeof id === 'string')
+}
+
+export function loadHiddenWidgets(orgSlug: string, userId: string): Set<string> {
+  const hidden = readVersionedPreference<string[]>(
+    buildHiddenWidgetsKey(orgSlug, userId),
+    HIDDEN_WIDGETS_VERSION,
+    isStringArray,
+    [],
+  )
+  return new Set(hidden)
+}
+
+export function saveHiddenWidgets(orgSlug: string, userId: string, hidden: Set<string>): void {
+  writeVersionedPreference(buildHiddenWidgetsKey(orgSlug, userId), HIDDEN_WIDGETS_VERSION, Array.from(hidden))
+}
+
+/** Drops the pre-scoping global key so stale preferences stop leaking across org/user contexts. */
+export function clearLegacyHiddenWidgetsKey(): void {
+  clearVersionedPreference(LEGACY_HIDDEN_WIDGETS_KEY)
+}

package/src/modules/portal/frontend/[orgSlug]/portal/dashboard/page.tsx

@@ -11,29 +11,14 @@ import { PortalEmptyState } from '@open-mercato/ui/portal/components/PortalEmpty
 import { usePortalDashboardWidgets } from '@open-mercato/ui/portal/hooks/usePortalDashboardWidgets'
 import { InjectionSpot } from '@open-mercato/ui/backend/injection/InjectionSpot'
 import { PortalInjectionSpots } from '@open-mercato/ui/backend/injection/spotIds'
+import {
+  loadHiddenWidgets,
+  saveHiddenWidgets,
+  clearLegacyHiddenWidgetsKey,
+} from './hiddenWidgetsStorage'
 
 type Props = { params: { orgSlug: string } }
 
-const HIDDEN_WIDGETS_KEY = 'om:portal:dashboard:hidden'
-
-function loadHiddenWidgets(): Set<string> {
-  try {
-    const raw = localStorage.getItem(HIDDEN_WIDGETS_KEY)
-    if (!raw) return new Set()
-    return new Set(JSON.parse(raw))
-  } catch {
-    return new Set()
-  }
-}
-
-function saveHiddenWidgets(hidden: Set<string>) {
-  try {
-    localStorage.setItem(HIDDEN_WIDGETS_KEY, JSON.stringify(Array.from(hidden)))
-  } catch {
-    // best effort
-  }
-}
-
 function WidgetIcon({ className }: { className?: string }) {
   return (
     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="1.5" strokeLinecap="round" strokeLinejoin="round" className={className}>
@@ -49,17 +34,31 @@ export default function PortalDashboardPage({ params }: Props) {
   const { user, loading } = auth
 
   const [editing, setEditing] = useState(false)
-  const [hiddenWidgets, setHiddenWidgets] = useState<Set<string>>(() => loadHiddenWidgets())
+  const [hiddenWidgetsScopeKey, setHiddenWidgetsScopeKey] = useState<string | null>(null)
+  const [hiddenWidgets, setHiddenWidgets] = useState<Set<string>>(() => new Set())
 
   const { widgets: dashboardWidgets, isLoading: widgetsLoading } = usePortalDashboardWidgets('portal:dashboard:sections' as any)
 
+  // Recompute synchronously during render (not in an effect) so a freshly
+  // resolved `user` never paints a frame with the previous scope's hidden set.
+  const activeHiddenWidgetsScopeKey = user ? `${params.orgSlug}:${user.id}` : null
+  if (activeHiddenWidgetsScopeKey !== hiddenWidgetsScopeKey) {
+    setHiddenWidgetsScopeKey(activeHiddenWidgetsScopeKey)
+    setHiddenWidgets(user ? loadHiddenWidgets(params.orgSlug, user.id) : new Set())
+  }
+
   useEffect(() => {
     if (!loading && !user) {
       router.replace(`/${params.orgSlug}/portal/login`)
     }
   }, [loading, user, router, params.orgSlug])
 
+  useEffect(() => {
+    clearLegacyHiddenWidgetsKey()
+  }, [])
+
   const toggleWidget = useCallback((widgetId: string) => {
+    if (!user) return
     setHiddenWidgets((prev) => {
       const next = new Set(prev)
       if (next.has(widgetId)) {
@@ -67,10 +66,10 @@ export default function PortalDashboardPage({ params }: Props) {
       } else {
         next.add(widgetId)
       }
-      saveHiddenWidgets(next)
+      saveHiddenWidgets(params.orgSlug, user.id, next)
       return next
     })
-  }, [])
+  }, [params.orgSlug, user?.id])
 
   const visibleWidgets = useMemo(
     () => dashboardWidgets.filter((w) => !hiddenWidgets.has(w.metadata.id)),

package/src/modules/progress/api/active/route.ts

@@ -20,7 +20,7 @@ export async function GET(req: Request) {
 
   const ctx = { tenantId: auth.tenantId, organizationId: auth.orgId }
 
-  await progressService.markStaleJobsFailed(auth.tenantId)
+  await progressService.markStaleJobsFailed(auth.tenantId, undefined, auth.orgId)
 
   const [jobs, recentlyCompleted] = await Promise.all([
     progressService.getActiveJobs(ctx),

package/src/modules/progress/lib/progressService.ts

@@ -16,11 +16,11 @@ export interface ProgressService {
   failJob(jobId: string, input: FailJobInput, ctx: ProgressServiceContext): Promise<ProgressJob>
   cancelJob(jobId: string, ctx: ProgressServiceContext): Promise<ProgressJob>
   markCancelled(jobId: string, ctx: ProgressServiceContext): Promise<ProgressJob>
-  isCancellationRequested(jobId: string, tenantId: string): Promise<boolean>
+  isCancellationRequested(jobId: string, tenantId: string, organizationId?: string | null): Promise<boolean>
   getActiveJobs(ctx: ProgressServiceContext): Promise<ProgressJob[]>
   getRecentlyCompletedJobs(ctx: ProgressServiceContext, sinceSeconds?: number): Promise<ProgressJob[]>
   getJob(jobId: string, ctx: ProgressServiceContext): Promise<ProgressJob | null>
-  markStaleJobsFailed(tenantId: string, timeoutSeconds?: number): Promise<number>
+  markStaleJobsFailed(tenantId: string, timeoutSeconds?: number, organizationId?: string | null): Promise<number>
 }
 
 export const HEARTBEAT_INTERVAL_MS = 5000

package/src/modules/progress/lib/progressServiceImpl.ts

@@ -54,7 +54,11 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
     },
 
     async startJob(jobId, ctx) {
-      const job = await em.findOneOrFail(ProgressJob, { id: jobId, tenantId: ctx.tenantId })
+      const job = await em.findOneOrFail(ProgressJob, {
+        id: jobId,
+        tenantId: ctx.tenantId,
+        ...(ctx.organizationId ? { organizationId: ctx.organizationId } : {}),
+      })
       if (job.status === 'cancelled') {
         return job
       }
@@ -120,7 +124,11 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
     },
 
     async incrementProgress(jobId, delta, ctx) {
-      const job = await em.findOneOrFail(ProgressJob, { id: jobId, tenantId: ctx.tenantId })
+      const job = await em.findOneOrFail(ProgressJob, {
+        id: jobId,
+        tenantId: ctx.tenantId,
+        ...(ctx.organizationId ? { organizationId: ctx.organizationId } : {}),
+      })
       if (job.status === 'completed' || job.status === 'failed' || job.status === 'cancelled') {
         return job
       }
@@ -147,7 +155,11 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
     },
 
     async completeJob(jobId, input, ctx) {
-      const job = await em.findOne(ProgressJob, { id: jobId, tenantId: ctx.tenantId })
+      const job = await em.findOne(ProgressJob, {
+        id: jobId,
+        tenantId: ctx.tenantId,
+        ...(ctx.organizationId ? { organizationId: ctx.organizationId } : {}),
+      })
       if (!job) throw new Error(`Job ${jobId} not found`)
       if (job.status === 'cancelled') {
         return job
@@ -174,7 +186,11 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
     },
 
     async failJob(jobId, input, ctx) {
-      const job = await em.findOne(ProgressJob, { id: jobId, tenantId: ctx.tenantId })
+      const job = await em.findOne(ProgressJob, {
+        id: jobId,
+        tenantId: ctx.tenantId,
+        ...(ctx.organizationId ? { organizationId: ctx.organizationId } : {}),
+      })
       if (!job) throw new Error(`Job ${jobId} not found`)
       if (job.status === 'cancelled') {
         return job
@@ -226,7 +242,11 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
     },
 
     async markCancelled(jobId, ctx) {
-      const job = await em.findOne(ProgressJob, { id: jobId, tenantId: ctx.tenantId })
+      const job = await em.findOne(ProgressJob, {
+        id: jobId,
+        tenantId: ctx.tenantId,
+        ...(ctx.organizationId ? { organizationId: ctx.organizationId } : {}),
+      })
       if (!job) throw new Error(`Job ${jobId} not found`)
       if (job.status === 'cancelled') {
         return job
@@ -249,8 +269,12 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
       return job
     },
 
-    async isCancellationRequested(jobId, tenantId) {
-      const job = await findOneWithDecryption(em, ProgressJob, { id: jobId, tenantId })
+    async isCancellationRequested(jobId, tenantId, organizationId) {
+      const job = await findOneWithDecryption(em, ProgressJob, {
+        id: jobId,
+        tenantId,
+        ...(organizationId ? { organizationId } : {}),
+      })
       return job?.cancelRequestedAt != null
     },
 
@@ -288,11 +312,12 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
       })
     },
 
-    async markStaleJobsFailed(tenantId: string, timeoutSeconds = STALE_JOB_TIMEOUT_SECONDS) {
+    async markStaleJobsFailed(tenantId: string, timeoutSeconds = STALE_JOB_TIMEOUT_SECONDS, organizationId?: string | null) {
       const cutoff = new Date(Date.now() - timeoutSeconds * 1000)
 
       const staleJobs = await em.find(ProgressJob, {
         tenantId,
+        ...(organizationId ? { organizationId } : {}),
         status: 'running',
         $or: [
           { heartbeatAt: { $lt: cutoff } },

package/src/modules/query_index/api/status.ts

@@ -4,7 +4,8 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { sql } from 'kysely'
-import { readCoverageSnapshot, refreshCoverageSnapshot } from '../lib/coverage'
+import { readCoverageSnapshots, refreshCoverageSnapshot } from '../lib/coverage'
+import { mapWithConcurrency } from '@open-mercato/shared/lib/query/bounded-decrypt'
 import type { FullTextSearchStrategy } from '@open-mercato/search/strategies'
 import type { SearchModuleConfig } from '@open-mercato/shared/modules/search'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -146,6 +147,7 @@ export async function GET(req: Request) {
 
   const HEARTBEAT_STALE_MS = 60_000
   const COVERAGE_STALE_MS = 60_000
+  const COVERAGE_REFRESH_CONCURRENCY = 8
 
   async function fetchJobSummary(entityType: string, tenantIdParam: string | null, organizationIdParam: string | null) {
     try {
@@ -288,40 +290,31 @@ export async function GET(req: Request) {
     return Number.isFinite(parsed) ? parsed : null
   }
 
-  const coverageSnapshots: Array<Awaited<ReturnType<typeof readCoverageSnapshot>>> = []
+  const coverageScope = {
+    tenantId: tenantId ?? null,
+    organizationId,
+    withDeleted: false,
+  } as const
   const entitiesNeedingRefresh = new Set<string>()
-  for (const entityId of entityIds) {
-    const scope = {
-      entityType: entityId,
-      tenantId: tenantId ?? null,
-      organizationId,
-      withDeleted: false,
-    } as const
-    const ensureSnapshot = async () => {
-      let snapshot = await readCoverageSnapshot(db, scope)
-      const refreshedAt = snapshot?.refreshed_at instanceof Date
-        ? snapshot.refreshed_at
-        : snapshot?.refreshed_at
-          ? new Date(snapshot.refreshed_at)
-          : null
-      const stale = !snapshot || !refreshedAt || (Date.now() - refreshedAt.getTime() > COVERAGE_STALE_MS)
-      if (forceRefresh || stale) {
-        await refreshCoverageSnapshot(em, scope).catch(() => undefined)
-        snapshot = await readCoverageSnapshot(db, scope)
-      }
-      const finalRefreshed = snapshot?.refreshed_at instanceof Date
-        ? snapshot.refreshed_at
-        : snapshot?.refreshed_at
-          ? new Date(snapshot.refreshed_at)
-          : null
-      if (!snapshot || !finalRefreshed || (Date.now() - finalRefreshed.getTime() > COVERAGE_STALE_MS)) {
-        entitiesNeedingRefresh.add(entityId)
-      }
-      return snapshot
-    }
-    coverageSnapshots.push(await ensureSnapshot())
+
+  // Read every entity's coverage snapshot in a single batched query. This endpoint is
+  // polled by the status table every few seconds, so the poll path must stay read-cheap:
+  // stale snapshots are refreshed asynchronously via the query_index.coverage.refresh
+  // event emitted below, never inline per entity.
+  const snapshotByEntity = await readCoverageSnapshots(db, { entityTypes: entityIds, ...coverageScope })
+
+  // An explicit refresh action (?refresh) is allowed to block: recompute every entity's
+  // coverage with bounded concurrency, then re-read the freshly written snapshots.
+  if (forceRefresh && entityIds.length > 0) {
+    await mapWithConcurrency(entityIds, COVERAGE_REFRESH_CONCURRENCY, (entityId) =>
+      refreshCoverageSnapshot(em, { entityType: entityId, ...coverageScope }).catch(() => undefined),
+    )
+    const refreshed = await readCoverageSnapshots(db, { entityTypes: entityIds, ...coverageScope })
+    for (const [entityId, snapshot] of refreshed) snapshotByEntity.set(entityId, snapshot)
   }
 
+  const coverageSnapshots = entityIds.map((entityId) => snapshotByEntity.get(entityId) ?? null)
+
   const jobs = await Promise.all(entityIds.map((eid) => fetchJobSummary(eid, tenantId, organizationId)))
 
   const items: any[] = []
@@ -467,6 +460,9 @@ export async function GET(req: Request) {
 
   const response = NextResponse.json({ items, errors, logs })
   const partial = items.find((item) => {
+    // Coverage not computed yet (no snapshot) — pending an async refresh, not a partial
+    // index. Do not raise the partial-index warning while counts are still unknown.
+    if (item.baseCount == null && item.indexCount == null) return false
     if (item.baseCount == null || item.indexCount == null) return true
     return item.baseCount !== item.indexCount
   })

package/src/modules/query_index/lib/coverage.ts

@@ -16,6 +16,19 @@ type CoverageRow = {
   refreshed_at: Date | string | null
 }
 
+export type CoverageSnapshot = CoverageRow & {
+  baseCount: number
+  indexedCount: number
+  vectorIndexedCount: number
+}
+
+export type CoverageBatchScope = {
+  entityTypes: readonly string[]
+  tenantId?: string | null
+  organizationId?: string | null
+  withDeleted?: boolean
+}
+
 export type CoverageAdjustment = {
   entityType: string
   tenantId: string | null
@@ -186,6 +199,56 @@ export async function readCoverageSnapshot(
   }
 }
 
+export async function readCoverageSnapshots(
+  db: Kysely<any>,
+  batch: CoverageBatchScope
+): Promise<Map<string, CoverageSnapshot>> {
+  const entityTypes = Array.from(
+    new Set((batch.entityTypes ?? []).map((id) => String(id || '')).filter((id) => id.length > 0))
+  )
+  const result = new Map<string, CoverageSnapshot>()
+  if (entityTypes.length === 0) return result
+
+  const withDeleted = batch.withDeleted === true
+  let query = db
+    .selectFrom('entity_index_coverage' as any)
+    .select([
+      'entity_type' as any,
+      'base_count' as any,
+      'indexed_count' as any,
+      'vector_indexed_count' as any,
+      'refreshed_at' as any,
+      'organization_id' as any,
+    ])
+    .where('entity_type' as any, 'in', entityTypes)
+    .where('with_deleted' as any, '=', withDeleted)
+    .orderBy('refreshed_at' as any, 'desc')
+  query = batch.tenantId == null
+    ? query.where('tenant_id' as any, 'is', null as any)
+    : query.where('tenant_id' as any, '=', batch.tenantId)
+  query = applyOrganizationCondition(query as any, 'organization_id', batch.organizationId ?? null)
+
+  const rows = await query.execute() as Array<CoverageRow & { entity_type: string }>
+  for (const row of rows ?? []) {
+    const entityType = String(row.entity_type || '')
+    // Rows are ordered by refreshed_at desc, so the first row seen per entity is the latest.
+    if (!entityType || result.has(entityType)) continue
+    const refreshedAt = row.refreshed_at instanceof Date
+      ? row.refreshed_at
+      : (row.refreshed_at ? new Date(row.refreshed_at) : null)
+    result.set(entityType, {
+      base_count: row.base_count,
+      indexed_count: row.indexed_count,
+      vector_indexed_count: row.vector_indexed_count,
+      refreshed_at: refreshedAt ?? null,
+      baseCount: toCount(row.base_count),
+      indexedCount: toCount(row.indexed_count),
+      vectorIndexedCount: toCount(row.vector_indexed_count),
+    })
+  }
+  return result
+}
+
 export async function applyCoverageAdjustments(
   em: EntityManager,
   adjustments: CoverageAdjustment[]

package/src/modules/query_index/lib/engine.ts

@@ -3,6 +3,7 @@ import { SortDir } from '@open-mercato/shared/lib/query/types'
 import type { EntityId } from '@open-mercato/shared/modules/entities'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { BasicQueryEngine, resolveEntityTableName, resolveRegisteredEntityTableName } from '@open-mercato/shared/lib/query/engine'
+import { isOrmBackedSystemEntityId } from '@open-mercato/shared/lib/data/engine'
 import { type Kysely, sql, type RawBuilder } from 'kysely'
 import type { EventBus } from '@open-mercato/events'
 import { readCoverageSnapshot, refreshCoverageSnapshot } from './coverage'
@@ -1064,32 +1065,44 @@ export class HybridQueryEngine implements QueryEngine {
     if (cached !== undefined) return cached
     let result = false
     try {
-      const db = this.getDb() as any
-      const row = await db
-        .selectFrom('custom_entities')
-        .select('id')
-        .where('entity_id', '=', entity)
-        .where('is_active', '=', true)
-        .executeTakeFirst()
-      if (row) {
-        result = true
-      } else if (resolveRegisteredEntityTableName(this.em, entity) !== null) {
-        // An id backed by a registered ORM table is never doc-storage-backed by
-        // inference: stray `custom_entities_storage` rows for such an id (e.g. written
-        // through the generic entities data engine) must not hijack every list/detail
-        // read for the whole entity type away from its base table (#2939). Surfaces
-        // that intentionally read doc records for a dual-declared id pass
-        // `forceCustomEntityStorage` in QueryOptions instead.
+      if (isOrmBackedSystemEntityId(this.em, entity)) {
+        // An id backed by a registered ORM table is never doc-storage-backed. Classify it
+        // as its base table BEFORE probing `custom_entities`, so neither a stray
+        // `custom_entities_storage` row nor an active `custom_entities` row (e.g. a
+        // presentation-metadata overlay for a system entity) can hijack every list/detail
+        // read for the whole entity type away from its base table (#2939). This mirrors the
+        // ORM-backed-first ordering already used by the records API (`classifyRecordsEntity`)
+        // and the doc-storage write guard (`assertCustomEntityStorageEntityId`); without it
+        // the read classifier alone trusted an active registration row over ORM-table
+        // resolution. Surfaces that intentionally read doc records for a dual-declared id
+        // pass `forceCustomEntityStorage` in QueryOptions instead.
         result = false
       } else {
-        // Read/write symmetry. Records written through the entities data engine
-        // (`de.createCustomEntityRecord`) always land in `custom_entities_storage`,
-        // even for module-declared custom entities whose id is also a frozen system
-        // id — those are NEVER registered in `custom_entities` (install treats a
-        // system id as non-registrable). Without this fallback the query routes to
-        // the empty ORM/index path and those records are write-only (created with
-        // 200 but unreadable on the edit form).
-        result = await this.hasCustomEntityStorageRows(entity)
+        const db = this.getDb() as any
+        const row = await db
+          .selectFrom('custom_entities')
+          .select('id')
+          .where('entity_id', '=', entity)
+          .where('is_active', '=', true)
+          .executeTakeFirst()
+        if (row) {
+          result = true
+        } else if (resolveRegisteredEntityTableName(this.em, entity) !== null) {
+          // A non-registry id whose entity segment collides with an ORM class name (e.g.
+          // `user:todo` vs the example module's `Todo`) resolves to a table but is NOT an
+          // ORM-backed system entity, so it is not short-circuited above. Stray
+          // `custom_entities_storage` rows for such an id must not hijack reads either.
+          result = false
+        } else {
+          // Read/write symmetry. Records written through the entities data engine
+          // (`de.createCustomEntityRecord`) always land in `custom_entities_storage`,
+          // even for module-declared custom entities whose id is also a frozen system
+          // id — those are NEVER registered in `custom_entities` (install treats a
+          // system id as non-registrable). Without this fallback the query routes to
+          // the empty ORM/index path and those records are write-only (created with
+          // 200 but unreadable on the edit form).
+          result = await this.hasCustomEntityStorageRows(entity)
+        }
       }
     } catch {
       result = false