@open-mercato/core 0.6.7 → 0.6.8-develop.6874.1.982d6097d8

package/src/modules/query_index/lib/engine.ts

@@ -20,15 +20,60 @@ import {
   type ResolvedJoin,
 } from '@open-mercato/shared/lib/query/join-utils'
 import { resolveSearchConfig, type SearchConfig } from '@open-mercato/shared/lib/search/config'
+import {
+  createSearchTokenAvailability,
+  isSearchFilterOp,
+  hasSearchFilter,
+  type SearchTokenAvailability,
+  type SearchTokenProbeDb,
+  type SearchTokenProbeQueryBuilder,
+} from '@open-mercato/shared/lib/search/availability'
 import { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'
 import { runBeforeQueryPipeline, runAfterQueryPipeline, type QueryExtensionContext } from '@open-mercato/shared/lib/query/query-extension-runner'
+import { warnOnCiphertextLikeFallback } from '@open-mercato/shared/lib/query/ciphertext-search-warning'
 import { resolveEncryptedSortFields, resolveEncryptedSortMaxRows, sortRowsInMemory } from '@open-mercato/shared/lib/query/encrypted-sort'
 import { mapWithConcurrency } from '@open-mercato/shared/lib/query/bounded-decrypt'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { parseNumberWithDefault } from '@open-mercato/shared/lib/number'
 
 const logger = createLogger('query_index').child({ component: 'engine' })
 
 const DECRYPT_CONCURRENCY = 8
+const AUTO_REINDEX_DEBOUNCE_DEFAULT_MS = 30_000
+const AUTO_REINDEX_DEBOUNCE_MAX_SCOPES = 10_000
+const AUTO_REINDEX_SCHEDULED_AT_KEY = Symbol.for('@open-mercato/query-index/auto-reindex-scheduled-at')
+
+type GlobalWithAutoReindexSchedule = typeof globalThis & {
+  [AUTO_REINDEX_SCHEDULED_AT_KEY]?: Map<string, number>
+}
+
+function getAutoReindexScheduledAt(): Map<string, number> {
+  const globalScope = globalThis as GlobalWithAutoReindexSchedule
+  if (!globalScope[AUTO_REINDEX_SCHEDULED_AT_KEY]) {
+    globalScope[AUTO_REINDEX_SCHEDULED_AT_KEY] = new Map<string, number>()
+  }
+  return globalScope[AUTO_REINDEX_SCHEDULED_AT_KEY]
+}
+
+function markAutoReindexScheduled(key: string, debounceMs: number, now: number): boolean {
+  const autoReindexScheduledAt = getAutoReindexScheduledAt()
+  const previous = autoReindexScheduledAt.get(key)
+  if (previous !== undefined && now - previous < debounceMs) return false
+
+  if (autoReindexScheduledAt.size >= AUTO_REINDEX_DEBOUNCE_MAX_SCOPES) {
+    for (const [scopeKey, scheduledAt] of autoReindexScheduledAt) {
+      if (now - scheduledAt >= debounceMs) autoReindexScheduledAt.delete(scopeKey)
+    }
+    if (autoReindexScheduledAt.size >= AUTO_REINDEX_DEBOUNCE_MAX_SCOPES) {
+      const oldestKey = autoReindexScheduledAt.keys().next().value
+      if (oldestKey !== undefined) autoReindexScheduledAt.delete(oldestKey)
+    }
+  }
+
+  autoReindexScheduledAt.delete(key)
+  autoReindexScheduledAt.set(key, now)
+  return true
+}
 
 function buildFilterableCustomFieldJoins(
   sources: QueryCustomFieldSource[] | undefined,
@@ -143,8 +188,10 @@ export class HybridQueryEngine implements QueryEngine {
   private sqlDebugEnabled: boolean | null = null
   private forcePartialIndexEnabled: boolean | null = null
   private autoReindexEnabled: boolean | null = null
+  private autoReindexDebounceMs: number | null = null
   private coverageOptimizationEnabled: boolean | null = null
   private pendingCoverageRefreshKeys = new Set<string>()
+  private searchAvailabilityInstance: SearchTokenAvailability | null = null
 
   constructor(
     private em: EntityManager,
@@ -173,6 +220,22 @@ export class HybridQueryEngine implements QueryEngine {
     throw new Error('HybridQueryEngine requires an EntityManager exposing getKysely() (MikroORM v7)')
   }
 
+  private searchAvailability(): SearchTokenAvailability {
+    if (!this.searchAvailabilityInstance) {
+      this.searchAvailabilityInstance = createSearchTokenAvailability({
+        getDb: () => this.getDb() as unknown as SearchTokenProbeDb,
+        getConfig: resolveSearchConfig,
+        applyOrganizationScope: (query, column, scope) => this.applyOrganizationScope(
+          query as unknown as AnyBuilder,
+          column,
+          scope,
+        ) as unknown as SearchTokenProbeQueryBuilder,
+        logDebug: (event, payload) => this.logSearchDebug(event, payload),
+      })
+    }
+    return this.searchAvailabilityInstance
+  }
+
   async query<T = unknown>(entity: EntityId, opts: QueryOptions = {}): Promise<QueryResult<T>> {
     const ext: QueryExtensionsConfig | undefined = opts.extensions
     let hybridExtCtx: QueryExtensionContext | null = null
@@ -250,7 +313,7 @@ export class HybridQueryEngine implements QueryEngine {
       profiler.mark('query:base_table_resolved')
       const searchConfig = resolveSearchConfig()
       const orgScope = this.resolveOrganizationScope(opts)
-      const searchEnabled = searchConfig.enabled && await this.tableExists('search_tokens')
+      const searchEnabled = await this.searchAvailability().staticEnabled()
 
       const baseExists = await profiler.measure('base_table_exists', () => this.tableExists(baseTable))
       if (!baseExists) {
@@ -415,12 +478,19 @@ export class HybridQueryEngine implements QueryEngine {
       const searchSources: SearchTokenSource[] = indexSources
         .map((src) => ({ entity: String(src.entityId), recordIdColumn: src.recordIdColumn }))
         .filter((src) => src.recordIdColumn && src.entity)
-      const hasSearchTokens = searchEnabled && searchSources.length
-        ? await this.searchSourcesHaveTokens(searchSources, opts.tenantId ?? null, orgScope)
+      const searchFilters = normalizedFilters.filter((filter) => isSearchFilterOp(filter.op))
+      const sourceSearchFilters = [
+        ...baseFilters,
+        ...normalizedFilters.filter((filter) => String(filter.field).startsWith('cf:')),
+      ].filter((filter) => isSearchFilterOp(filter.op))
+      // Probe `search_tokens` only when this query actually searches (#4723). Every consumer of
+      // `searchRuntime.enabled` already sits behind a like/ilike guard, so on a plain list load the
+      // answer is unused — and the probe is a `LIMIT 1` the planner can resolve as a seq scan over a
+      // large `search_tokens`. The join path below already probes lazily for the same reason.
+      const hasSearchTokens = searchEnabled && searchSources.length && sourceSearchFilters.length
+        ? await this.searchAvailability().anySourceHasTokens(searchSources, opts.tenantId ?? null, orgScope)
         : false
       const searchRuntime: SearchRuntime = { ...searchRuntimeBase, searchSources, enabled: searchEnabled && hasSearchTokens }
-      const joinSearchAvailability = new Map<string, boolean>()
-      const searchFilters = normalizeFilters(opts.filters).filter((filter) => filter.op === 'like' || filter.op === 'ilike')
       if (searchFilters.length) {
         this.logSearchDebug('search:init', {
           entity,
@@ -446,6 +516,46 @@ export class HybridQueryEngine implements QueryEngine {
           organizationScope: orgScope,
           searchSources,
         })
+        const baseSearchFilters = [...baseFilters, ...cfFilters]
+          .filter((filter) => filter.op === 'like' || filter.op === 'ilike')
+        const fallbackFields = baseSearchFilters
+          .filter((filter) => !searchRuntime.enabled || typeof filter.value !== 'string' || tokenizeText(filter.value, searchConfig).hashes.length === 0)
+          .map((filter) => String(filter.field))
+        if (fallbackFields.length) {
+          await warnOnCiphertextLikeFallback({
+            entity: String(entity),
+            fields: fallbackFields,
+            tenantId: opts.tenantId ?? null,
+            // `searchEnabled` also folds in the missing-table case, which is
+            // "no usable tokens" rather than "the operator switched search off".
+            reason: searchRuntime.enabled
+              ? 'no-indexable-tokens'
+              : searchConfig.enabled ? 'no-search-tokens' : 'search-disabled',
+            service: this.getEncryptionService(),
+          })
+        }
+      }
+      for (const [alias, joinedFilters] of joinFilters) {
+        const filters = joinedFilters.filter((entry) => entry.op === 'like' || entry.op === 'ilike')
+        if (!filters.length) continue
+        const join = joinMap.get(alias)
+        if (!join?.entityId) continue
+        const hasJoinedTokens = searchEnabled
+          ? await this.searchAvailability().hasTokens(String(join.entityId), opts.tenantId ?? null, orgScope)
+          : false
+        const fallbackFields = filters
+          .filter((filter) => !hasJoinedTokens || typeof filter.value !== 'string' || tokenizeText(filter.value, searchConfig).hashes.length === 0)
+          .map((filter) => filter.column)
+        if (!fallbackFields.length) continue
+        await warnOnCiphertextLikeFallback({
+          entity: String(join.entityId),
+          fields: fallbackFields,
+          tenantId: opts.tenantId ?? null,
+          reason: hasJoinedTokens
+            ? 'no-indexable-tokens'
+            : searchConfig.enabled ? 'no-search-tokens' : 'search-disabled',
+          service: this.getEncryptionService(),
+        })
       }
       const hasNonBaseSearchSource = searchSources.some(
         (src) => src.entity !== String(entity) || src.recordIdColumn !== 'b.id'
@@ -738,11 +848,7 @@ export class HybridQueryEngine implements QueryEngine {
         if (!['like', 'ilike'].includes(filter.op)) return false
         if (typeof filter.value !== 'string' || filter.value.trim().length === 0) return false
 
-        let searchAvailable = joinSearchAvailability.get(join.entityId)
-        if (searchAvailable === undefined) {
-          searchAvailable = await this.hasSearchTokens(String(join.entityId), opts.tenantId ?? null, orgScope)
-          joinSearchAvailability.set(join.entityId, searchAvailable)
-        }
+        const searchAvailable = await this.searchAvailability().hasTokens(String(join.entityId), opts.tenantId ?? null, orgScope)
         if (!searchAvailable) return false
 
         const tokens = tokenizeText(String(filter.value), searchConfig)
@@ -1636,10 +1742,12 @@ export class HybridQueryEngine implements QueryEngine {
     const orgScope = this.resolveOrganizationScope(opts)
     if (!opts.tenantId) throw new Error('QueryEngine: tenantId is required')
 
+    const normalizedFilters = normalizeFilters(opts.filters)
     const searchConfig = resolveSearchConfig()
-    const searchEnabled = searchConfig.enabled && await this.tableExists('search_tokens')
-    const hasSearchTokens = searchEnabled
-      ? await this.hasSearchTokens(entity, opts.tenantId ?? null, orgScope)
+    const searchEnabled = await this.searchAvailability().staticEnabled()
+    // Same gate as `query()` (#4723): without a like/ilike filter the probe's answer is never read.
+    const hasSearchTokens = searchEnabled && hasSearchFilter(normalizedFilters)
+      ? await this.searchAvailability().hasTokens(entity, opts.tenantId ?? null, orgScope)
       : false
     const searchRuntime: SearchRuntime = {
       enabled: searchEnabled && hasSearchTokens,
@@ -1649,8 +1757,6 @@ export class HybridQueryEngine implements QueryEngine {
       mintAlias: createSearchAliasMinter(),
     }
 
-    const normalizedFilters = normalizeFilters(opts.filters)
-
     const applyScope = (q: AnyBuilder): AnyBuilder => {
       let next = q
         .where(`${alias}.entity_type`, '=', entity)
@@ -1781,50 +1887,6 @@ export class HybridQueryEngine implements QueryEngine {
     return !!exists
   }
 
-  private async hasSearchTokens(
-    entity: string,
-    tenantId: string | null,
-    orgScope?: { ids: string[]; includeNull: boolean } | null
-  ): Promise<boolean> {
-    try {
-      const db = this.getDb() as any
-      let query = db
-        .selectFrom('search_tokens')
-        .select(sql<number>`1`.as('one'))
-        .where('entity_type', '=', entity)
-      if (tenantId !== undefined) {
-        query = query.where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)
-      }
-      if (orgScope) {
-        query = this.applyOrganizationScope(query, 'search_tokens.organization_id', orgScope)
-      }
-      const row = await query.limit(1).executeTakeFirst()
-      return !!row
-    } catch (err) {
-      this.logSearchDebug('search:has-tokens-error', {
-        entity, tenantId, organizationScope: orgScope,
-        error: err instanceof Error ? err.message : String(err),
-      })
-      return false
-    }
-  }
-
-  private async searchSourcesHaveTokens(
-    sources: SearchTokenSource[],
-    tenantId: string | null,
-    orgScope?: { ids: string[]; includeNull: boolean } | null
-  ): Promise<boolean> {
-    for (const source of sources) {
-      const ok = await this.hasSearchTokens(source.entity, tenantId, orgScope)
-      this.logSearchDebug('search:source-has-tokens', {
-        entity: source.entity, recordIdColumn: source.recordIdColumn,
-        tenantId, organizationScope: orgScope, hasTokens: ok,
-      })
-      if (ok) return true
-    }
-    return false
-  }
-
   private async resolveAvailableCustomFieldKeys(entityIds: string[], tenantId: string | null): Promise<string[]> {
     if (!entityIds.length) return []
     const cacheKey = this.customFieldKeysCacheKey(entityIds, tenantId)
@@ -1973,6 +2035,11 @@ export class HybridQueryEngine implements QueryEngine {
       organizationId: organizationIdOverride ?? opts.organizationId ?? null,
       force: false,
     }
+    const debounceMs = this.getAutoReindexDebounceMs()
+    if (debounceMs > 0) {
+      const key = [payload.entityType, payload.tenantId ?? '__tenant__', payload.organizationId ?? '__org__'].join('|')
+      if (!markAutoReindexScheduled(key, debounceMs, Date.now())) return
+    }
     const context = stats
       ? { entity, tenantId: payload.tenantId, organizationId: payload.organizationId, baseCount: stats.baseCount, indexedCount: stats.indexedCount }
       : { entity, tenantId: payload.tenantId, organizationId: payload.organizationId }
@@ -2042,6 +2109,16 @@ export class HybridQueryEngine implements QueryEngine {
     return this.autoReindexEnabled
   }
 
+  private getAutoReindexDebounceMs(): number {
+    if (this.autoReindexDebounceMs != null) return this.autoReindexDebounceMs
+    this.autoReindexDebounceMs = parseNumberWithDefault(
+      process.env.OM_QUERY_INDEX_AUTO_REINDEX_DEBOUNCE_MS,
+      AUTO_REINDEX_DEBOUNCE_DEFAULT_MS,
+      { integer: true, min: 0 },
+    )
+    return this.autoReindexDebounceMs
+  }
+
   private isCoverageOptimizationEnabled(): boolean {
     if (this.coverageOptimizationEnabled != null) return this.coverageOptimizationEnabled
     const raw = (process.env.OPTIMIZE_INDEX_COVERAGE_STATS ?? '').trim().toLowerCase()

package/src/modules/query_index/lib/indexer.ts

@@ -2,10 +2,21 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'
 import { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'
 import { decryptIndexDocForSearch, encryptIndexDocForStorage } from '@open-mercato/shared/lib/encryption/indexDoc'
-import { sql } from 'kysely'
+import {
+  buildCustomFieldDefinitionIndexFromRows,
+  normalizeDefinitionKey,
+  selectDefinitionForRecord,
+  type CustomFieldDefinitionRow,
+} from '@open-mercato/shared/lib/crud/custom-field-definition-index'
+import { type Kysely, type Transaction, sql } from 'kysely'
+import { createLogger } from '@open-mercato/shared/lib/logger'
 import { replaceSearchTokensForRecord, deleteSearchTokensForRecord } from './search-tokens'
 import { attachAggregateSearchField } from './document'
 
+const logger = createLogger('query_index').child({ component: 'indexer' })
+
+type QueryIndexExecutor = Kysely<any> | Transaction<any>
+
 type BuildDocParams = {
   entityType: string // '<module>:<entity>'
   recordId: string
@@ -93,9 +104,74 @@ export async function buildIndexDoc(em: EntityManager, params: BuildDocParams):
     if (!cfMap[cfKey]) cfMap[cfKey] = []
     cfMap[cfKey].push(val)
   }
+
+  const multiKeys = new Set<string>()
+  const fieldKeys = Object.keys(cfMap).map((key) => key.slice(3))
+  if (fieldKeys.length > 0) {
+    let defQuery = db
+      .selectFrom('custom_field_defs' as any)
+      .select([
+        'key' as any,
+        'kind' as any,
+        'config_json' as any,
+        'organization_id' as any,
+        'tenant_id' as any,
+        'deleted_at' as any,
+        'updated_at' as any,
+      ])
+      .where('entity_id' as any, '=', params.entityType)
+      .where('key' as any, 'in', fieldKeys)
+      .where('is_active' as any, '=', true)
+      .where('deleted_at' as any, 'is', null)
+
+    if (params.organizationId != null) {
+      defQuery = defQuery.where((eb: any) => eb.or([
+        eb('organization_id' as any, '=', params.organizationId),
+        eb('organization_id' as any, 'is', null),
+      ]))
+    } else {
+      defQuery = defQuery.where('organization_id' as any, 'is', null)
+    }
+
+    if (params.tenantId != null) {
+      defQuery = defQuery.where((eb: any) => eb.or([
+        eb('tenant_id' as any, '=', params.tenantId),
+        eb('tenant_id' as any, 'is', null),
+      ]))
+    } else {
+      defQuery = defQuery.where('tenant_id' as any, 'is', null)
+    }
+
+    const defRows = await defQuery.execute() as Array<Record<string, any>>
+    const definitionIndex = buildCustomFieldDefinitionIndexFromRows(
+      defRows.map((row): CustomFieldDefinitionRow => ({
+        key: String(row.key ?? ''),
+        entityId: params.entityType,
+        kind: typeof row.kind === 'string' ? row.kind : null,
+        configJson: row.config_json,
+        organizationId: row.organization_id ?? null,
+        tenantId: row.tenant_id ?? null,
+        deletedAt: row.deleted_at ?? null,
+        updatedAt: row.updated_at ?? null,
+      })),
+      { organizationIds: params.organizationId ? [params.organizationId] : [] },
+    )
+    for (const key of fieldKeys) {
+      const definitions = definitionIndex.get(normalizeDefinitionKey(key)) ?? []
+      const definition = selectDefinitionForRecord(
+        definitions,
+        params.organizationId ?? null,
+        params.tenantId ?? null,
+      )
+      if (definition?.multi) multiKeys.add(key)
+    }
+  }
+
   for (const [key, arr] of Object.entries(cfMap)) {
-    // Store singletons as simple value; multis as array
-    doc[key] = arr.length <= 1 ? arr[0] : arr
+    // Cardinality belongs to the field definition, not the current row count:
+    // a multi field containing one value must still hydrate as an array.
+    const fieldKey = key.slice(3)
+    doc[key] = multiKeys.has(fieldKey) || arr.length > 1 ? arr : arr[0]
   }
 
   // Attach translations under flat keys 'l10n:{locale}:{field}'
@@ -121,8 +197,12 @@ export async function buildIndexDoc(em: EntityManager, params: BuildDocParams):
     }
   } catch {}
 
+  // Kept outside the guard below: a failure while building the aggregate search field is a
+  // bug in the aggregation or its configuration, and must surface instead of being mistaken
+  // for an encryption failure and silently skipping encryption.
+  doc = attachAggregateSearchField(doc, { entityType: params.entityType })
+
   try {
-    doc = attachAggregateSearchField(doc)
     const encryption = resolveTenantEncryptionService(em as any)
     doc = await encryptIndexDocForStorage(
       params.entityType,
@@ -130,7 +210,23 @@ export async function buildIndexDoc(em: EntityManager, params: BuildDocParams):
       { tenantId: params.tenantId ?? null, organizationId: params.organizationId ?? null },
       encryption,
     )
-  } catch {}
+  } catch (error) {
+    // `encryptIndexDocForStorage` already returns the document untouched when encryption is
+    // absent or disabled, so a throw here is always a genuine encryption failure. Returning
+    // `doc` would hand the caller the plaintext document to write into `entity_indexes`,
+    // which must stay encrypted at rest; returning `null` would mean "record gone" and make
+    // `upsertIndexRow` delete a healthy index row. Fail loudly instead: the projection keeps
+    // its previous, correctly encrypted contents and the `query_index.upsert_one` subscriber
+    // persists the error via `recordIndexerError`.
+    logger.error('Index document encryption failed; refusing to return an unencrypted document', {
+      entityType: params.entityType,
+      recordId: params.recordId,
+      tenantId: params.tenantId ?? null,
+      organizationId: params.organizationId ?? null,
+      err: error,
+    })
+    throw error
+  }
 
   return doc
 }
@@ -158,12 +254,13 @@ function scopeEntityIndexes<QB extends { where: (...args: any[]) => QB }>(
 
 export async function upsertIndexRow(
   em: EntityManager,
-  args: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null; searchTokenDoc?: Record<string, unknown> | null; deferSearchTokens?: boolean }
+  args: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null; searchTokenDoc?: Record<string, unknown> | null; deferSearchTokens?: boolean; trx?: QueryIndexExecutor }
 ): Promise<UpsertIndexResult> {
   const db = (em as any).getKysely()
+  const executor = args.trx ?? db
 
   const existing = await scopeEntityIndexes(
-    db.selectFrom('entity_indexes' as any).select(['id' as any, 'deleted_at' as any]),
+    executor.selectFrom('entity_indexes' as any).select(['id' as any, 'deleted_at' as any]),
     args,
   ).executeTakeFirst() as { id: string; deleted_at: Date | null } | undefined
 
@@ -182,12 +279,15 @@ export async function upsertIndexRow(
           organizationId: args.organizationId ?? null,
           tenantId: args.tenantId ?? null,
           doc: null,
+          trx: args.trx,
         })
-      } catch {}
+      } catch (error) {
+        if (args.trx) throw error
+      }
     }
     if (existed) {
       await scopeEntityIndexes(
-        db.deleteFrom('entity_indexes' as any) as any,
+        executor.deleteFrom('entity_indexes' as any) as any,
         args,
       ).execute()
     }
@@ -207,7 +307,7 @@ export async function upsertIndexRow(
 
   // Prefer modern upsert keyed by coalesced org id when available; fallback to update-then-insert
   try {
-    await db
+    await executor
       .insertInto('entity_indexes' as any)
       .values({ ...payload, created_at: sql`now()` } as any)
       .onConflict((oc: any) => oc
@@ -223,16 +323,18 @@ export async function upsertIndexRow(
   } catch {
     // Fallback for schemas without organization_id_coalesced column/index
     const updated = await scopeEntityIndexes(
-      db.updateTable('entity_indexes' as any).set(payload as any) as any,
+      executor.updateTable('entity_indexes' as any).set(payload as any) as any,
       args,
     ).executeTakeFirst() as { numUpdatedRows?: bigint | number } | undefined
     if (!updated || Number(updated.numUpdatedRows ?? 0) === 0) {
       try {
-        await db
+        await executor
           .insertInto('entity_indexes' as any)
           .values({ ...payload, created_at: sql`now()` } as any)
           .execute()
-      } catch {}
+      } catch (error) {
+        if (args.trx) throw error
+      }
     }
   }
 
@@ -250,8 +352,11 @@ export async function upsertIndexRow(
         tenantId: args.tenantId ?? null,
         doc,
         searchTokenDoc: args.searchTokenDoc ?? null,
+        trx: args.trx,
       })
-    } catch {}
+    } catch (error) {
+      if (args.trx) throw error
+    }
   }
   return { doc, existed, wasDeleted, created, revived }
 }
@@ -271,6 +376,7 @@ export async function reindexSearchTokensForRecord(
     tenantId?: string | null
     doc: Record<string, any> | null
     searchTokenDoc?: Record<string, unknown> | null
+    trx?: QueryIndexExecutor
   },
 ): Promise<void> {
   const db = (em as any).getKysely()
@@ -280,7 +386,7 @@ export async function reindexSearchTokensForRecord(
       recordId: args.recordId,
       organizationId: args.organizationId ?? null,
       tenantId: args.tenantId ?? null,
-    })
+    }, { trx: args.trx })
     return
   }
   const tokenDoc = args.searchTokenDoc ?? (() => {
@@ -300,16 +406,17 @@ export async function reindexSearchTokensForRecord(
     organizationId: args.organizationId ?? null,
     tenantId: args.tenantId ?? null,
     doc: await tokenDoc,
-  })
+  }, { trx: args.trx })
 }
 
 export async function markDeleted(
   em: EntityManager,
-  args: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null }
+  args: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null; trx?: QueryIndexExecutor }
 ): Promise<{ wasActive: boolean }> {
   const db = (em as any).getKysely()
+  const executor = args.trx ?? db
   const existing = await scopeEntityIndexes(
-    db.selectFrom('entity_indexes' as any).select(['deleted_at' as any]),
+    executor.selectFrom('entity_indexes' as any).select(['deleted_at' as any]),
     args,
   ).executeTakeFirst() as { deleted_at: Date | null } | undefined
 
@@ -322,10 +429,12 @@ export async function markDeleted(
         recordId: args.recordId,
         organizationId: args.organizationId ?? null,
         tenantId: args.tenantId ?? null,
-      })
-    } catch {}
+      }, { trx: args.trx })
+    } catch (error) {
+      if (args.trx) throw error
+    }
     await scopeEntityIndexes(
-      db.deleteFrom('entity_indexes' as any) as any,
+      executor.deleteFrom('entity_indexes' as any) as any,
       args,
     ).execute()
   }

package/src/modules/query_index/lib/reindexer.ts

@@ -323,55 +323,77 @@ export async function reindexEntity(
 
   options?.onProgress?.({ processed, total, chunkSize: 0 })
 
-  if (resetCoverage) {
-    if (force) {
+  // Partitions run concurrently, so a scope-wide purge here would delete rows a sibling
+  // partition has already written and never rebuild them (the run still reports success
+  // because progress counts attempted writes). Each partition therefore purges only the
+  // slice it is about to rebuild, and every partition purges — restricting the purge to
+  // the coverage-resetting partition would otherwise leave the other slices' stale rows
+  // behind on a forced rebuild.
+  if (force && (resetCoverage || usingPartitions)) {
+    try {
+      let purgeQuery = db
+        .deleteFrom('entity_indexes' as any)
+        .where('entity_type' as any, '=', entityType)
+      if (tenantId !== undefined) {
+        purgeQuery = purgeQuery.where(sql<boolean>`tenant_id is not distinct from ${tenantId ?? null}`)
+      }
+      if (organizationId !== undefined) {
+        purgeQuery = purgeQuery.where(sql<boolean>`organization_id is not distinct from ${organizationId ?? null}`)
+      }
+      if (usingPartitions && partitionIndex !== null) {
+        purgeQuery = purgeQuery.where(
+          sql<boolean>`mod(abs(hashtext(entity_id::text)), ${partitionCountRaw}) = ${partitionIndex}`,
+        )
+      }
+      await purgeQuery.execute()
+    } catch (error) {
+      logger.warn('Failed to purge index rows before force reindex', {
+        entityType,
+        tenantId: tenantId ?? null,
+        organizationId: organizationId ?? null,
+        partitionIndex: usingPartitions ? partitionIndex : null,
+        error: error instanceof Error ? error.message : error,
+      })
+    }
+  }
+
+  // The vector purge is scope-wide and cannot be partitioned — the queued job deletes every
+  // vector for the scope. Emitting it from one partition while siblings are already queueing
+  // per-record vectorize jobs is the same race the row purge just had, so a partitioned run
+  // leaves it to the caller that owns the fan-out (`api/reindex.ts` queues it once, before
+  // dispatching any partition).
+  if (force && resetCoverage && !usingPartitions && emitVectorize && eventBus) {
+    if (tenantId !== undefined) {
+      const payload: Record<string, unknown> = {
+        entityType,
+        tenantId: tenantId ?? null,
+      }
+      if (organizationId !== undefined) payload.organizationId = organizationId ?? null
       try {
-        let purgeQuery = db
-          .deleteFrom('entity_indexes' as any)
-          .where('entity_type' as any, '=', entityType)
-        if (tenantId !== undefined) {
-          purgeQuery = purgeQuery.where(sql<boolean>`tenant_id is not distinct from ${tenantId ?? null}`)
-        }
-        if (organizationId !== undefined) {
-          purgeQuery = purgeQuery.where(sql<boolean>`organization_id is not distinct from ${organizationId ?? null}`)
-        }
-        await purgeQuery.execute()
-      } catch (error) {
-        logger.warn('Failed to purge index rows before force reindex', {
+        await eventBus.emitEvent('query_index.vectorize_purge', payload)
+      } catch (err) {
+        logger.warn('Failed to queue vector purge before force reindex', {
           entityType,
           tenantId: tenantId ?? null,
           organizationId: organizationId ?? null,
-          error: error instanceof Error ? error.message : error,
+          error: err instanceof Error ? err.message : err,
         })
       }
-
-      if (emitVectorize && eventBus) {
-        if (tenantId !== undefined) {
-          const payload: Record<string, unknown> = {
-            entityType,
-            tenantId: tenantId ?? null,
-          }
-          if (organizationId !== undefined) payload.organizationId = organizationId ?? null
-          try {
-            await eventBus.emitEvent('query_index.vectorize_purge', payload)
-          } catch (err) {
-            logger.warn('Failed to queue vector purge before force reindex', {
-              entityType,
-              tenantId: tenantId ?? null,
-              organizationId: organizationId ?? null,
-              error: err instanceof Error ? err.message : err,
-            })
-          }
-        } else {
-          logger.warn('Skipping vector purge for force reindex without tenant scope', {
-            entityType,
-          })
-        }
-      }
+    } else {
+      logger.warn('Skipping vector purge for force reindex without tenant scope', {
+        entityType,
+      })
     }
+  }
 
+  if (resetCoverage) {
+    // Only meaningful for an unpartitioned run: `baseCounts` holds this partition's slice,
+    // so writing it as the scope's base count under-reports by the partition factor, and
+    // zeroing indexed_count scope-wide discards deltas siblings have already applied. The
+    // authoritative `refreshCoverageSnapshot` at the end of every partition owns the counts
+    // for partitioned runs.
     const nowTs = Date.now()
-    for (const scope of baseCounts.values()) {
+    for (const scope of usingPartitions ? [] : baseCounts.values()) {
       const key = `${entityType}|${scopeKey(scope.tenantId, scope.organizationId)}`
       const last = lastCoverageReset.get(key) ?? 0
       if (force || nowTs - last >= COVERAGE_REFRESH_THROTTLE_MS) {