@open-mercato/core 0.6.8-develop.7004.1.7e7dd67d56 → 0.6.8-develop.7008.1.1ab31c0ca9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.8-develop.7004.1.7e7dd67d56",
+  "version": "0.6.8-develop.7008.1.1ab31c0ca9",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -254,16 +254,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.7004.1.7e7dd67d56",
-    "@open-mercato/shared": "0.6.8-develop.7004.1.7e7dd67d56",
-    "@open-mercato/ui": "0.6.8-develop.7004.1.7e7dd67d56",
+    "@open-mercato/ai-assistant": "0.6.8-develop.7008.1.1ab31c0ca9",
+    "@open-mercato/shared": "0.6.8-develop.7008.1.1ab31c0ca9",
+    "@open-mercato/ui": "0.6.8-develop.7008.1.1ab31c0ca9",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.7004.1.7e7dd67d56",
-    "@open-mercato/shared": "0.6.8-develop.7004.1.7e7dd67d56",
-    "@open-mercato/ui": "0.6.8-develop.7004.1.7e7dd67d56",
+    "@open-mercato/ai-assistant": "0.6.8-develop.7008.1.1ab31c0ca9",
+    "@open-mercato/shared": "0.6.8-develop.7008.1.1ab31c0ca9",
+    "@open-mercato/ui": "0.6.8-develop.7008.1.1ab31c0ca9",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.1",

package/src/modules/customers/components/detail/EntityTagsDialog.tsx

@@ -6,6 +6,7 @@ import { EmptyState } from '@open-mercato/ui/primitives/empty-state'
 import { VisuallyHidden } from '@radix-ui/react-visually-hidden'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { cn, slugifyTagLabel } from '@open-mercato/shared/lib/utils'
+import { hasMoreFromPage } from '@open-mercato/shared/lib/pagination/load-more'
 import { apiCall, apiCallOrThrow, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
@@ -388,8 +389,19 @@ export function EntityTagsDialog({
   const [creatingKind, setCreatingKind] = React.useState<string | null>(null)
   const [manageTagsOpen, setManageTagsOpen] = React.useState(false)
   const [activeCategoryPage, setActiveCategoryPage] = React.useState(1)
-  const [activeCategoryTotalPages, setActiveCategoryTotalPages] = React.useState(1)
+  // Short-page termination instead of `page < totalPages` — see
+  // `hasMoreFromPage`. Like the page number it belongs to whichever category is
+  // active: the fetch effect below rewrites it on every category, search and
+  // page change, and the reset effect clears it alongside the page so a
+  // category with more entries never leaves the affordance behind on one
+  // without.
+  const [activeCategoryHasMore, setActiveCategoryHasMore] = React.useState(false)
   const [activeCategoryLoading, setActiveCategoryLoading] = React.useState(false)
+  // A transport failure is not an end-of-list signal: it leaves the affordance
+  // in place and turns the next click into a retry of the page that failed,
+  // rather than advancing past it.
+  const [activeCategoryLoadFailed, setActiveCategoryLoadFailed] = React.useState(false)
+  const [activeCategoryReloadToken, setActiveCategoryReloadToken] = React.useState(0)
   const creationInFlightRef = React.useRef<string | null>(null)
   const mutationContextId = React.useMemo(
     () => `customer-tags:${entityType}:${entityId}`,
@@ -713,12 +725,15 @@ export function EntityTagsDialog({
   React.useEffect(() => {
     if (!open) return
     setActiveCategoryPage(1)
+    setActiveCategoryHasMore(false)
+    setActiveCategoryLoadFailed(false)
   }, [activeCategoryKind, open, searchValue])
 
   React.useEffect(() => {
     if (!open || !activeCategoryKindValue || (activeCategorySource !== 'tags' && activeCategorySource !== 'labels')) {
       setActiveCategoryLoading(false)
-      setActiveCategoryTotalPages(1)
+      setActiveCategoryHasMore(false)
+      setActiveCategoryLoadFailed(false)
       return
     }
 
@@ -752,16 +767,36 @@ export function EntityTagsDialog({
       }))
 
     setActiveCategoryLoading(true)
-    void apiCall<{ items?: Array<DictEntry | LabelItem>; totalPages?: number }>(endpoint, {
+    void apiCall<{ items?: Array<DictEntry | LabelItem>; page?: number }>(endpoint, {
       cache: 'no-store',
       headers: { 'x-om-unauthorized-redirect': '0' },
     })
       .then((response) => {
-        if (!response.ok || cancelled) return
-        const fetchedEntries = mapEntries(Array.isArray(response.result?.items) ? response.result.items : [])
-        setActiveCategoryTotalPages(
-          typeof response.result?.totalPages === 'number' ? response.result.totalPages : 1,
+        if (cancelled) return
+        if (!response.ok) {
+          setActiveCategoryLoadFailed(true)
+          return
+        }
+        setActiveCategoryLoadFailed(false)
+        const servedEntries = Array.isArray(response.result?.items) ? response.result.items : []
+        const fetchedEntries = mapEntries(servedEntries)
+        // The two sources paginate differently. `/api/customers/tags` is a
+        // query-engine list, so a page past the end comes back empty and the
+        // served count alone terminates the sequence. `/api/customers/labels`
+        // clamps the requested page to the last one and re-serves it in full
+        // forever, so short-page termination needs the second half of the
+        // helper's obligation 2: take an echoed page below the one asked for as
+        // the end of the list. Same guard as `AttachmentsSection`, whose
+        // endpoint clamps the same way.
+        const returnedPage =
+          typeof response.result?.page === 'number' ? response.result.page : activeCategoryPage
+        const servedRequestedPage = returnedPage >= activeCategoryPage
+        // Measured on what the endpoint served, before `mergeOptions` folds the
+        // page into the entries already on screen.
+        setActiveCategoryHasMore(
+          servedRequestedPage && hasMoreFromPage(servedEntries.length, REMOTE_CATEGORY_PAGE_SIZE),
         )
+        if (!servedRequestedPage) return
         updateCategoryEntries(activeCategoryKindValue, (currentEntries) =>
           activeCategoryPage <= 1
             ? mergeOptions(seedEntries, fetchedEntries)
@@ -770,8 +805,10 @@ export function EntityTagsDialog({
       })
       .catch(() => {
         if (cancelled) return
-        setActiveCategoryTotalPages(1)
-        updateCategoryEntries(activeCategoryKindValue, () => seedEntries)
+        setActiveCategoryLoadFailed(true)
+        if (activeCategoryPage <= 1) {
+          updateCategoryEntries(activeCategoryKindValue, () => seedEntries)
+        }
       })
       .finally(() => {
         if (!cancelled) {
@@ -785,6 +822,7 @@ export function EntityTagsDialog({
   }, [
     activeCategoryKindValue,
     activeCategoryPage,
+    activeCategoryReloadToken,
     activeCategorySource,
     entityId,
     entityOrganizationId,
@@ -1250,15 +1288,23 @@ export function EntityTagsDialog({
                               {t('customers.personTags.loading', 'Loading...')}
                             </div>
                           ) : null}
-                          {(activeCategory.source === 'tags' || activeCategory.source === 'labels') && activeCategoryPage < activeCategoryTotalPages ? (
+                          {(activeCategory.source === 'tags' || activeCategory.source === 'labels') && activeCategoryHasMore ? (
                             <Button
                               type="button"
                               variant="outline"
                               size="sm"
                               className="rounded-lg px-3 text-xs"
-                              onClick={() => setActiveCategoryPage((current) => current + 1)}
+                              onClick={() => {
+                                if (activeCategoryLoadFailed) {
+                                  setActiveCategoryReloadToken((current) => current + 1)
+                                  return
+                                }
+                                setActiveCategoryPage((current) => current + 1)
+                              }}
                             >
-                              {t('customers.activities.loadMore', 'Load more')}
+                              {activeCategoryLoadFailed
+                                ? t('customers.personTags.retry', 'Retry')
+                                : t('customers.activities.loadMore', 'Load more')}
                             </Button>
                           ) : null}
                         </div>

package/src/modules/customers/components/detail/hooks/usePersonTasks.ts

@@ -7,6 +7,7 @@ import { resolveTodoApiPath } from '../utils'
 import type { TodoLinkSummary } from '../types'
 import { generateTempId } from '@open-mercato/core/modules/customers/lib/detailHelpers'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
+import { hasMoreFromPage } from '@open-mercato/shared/lib/pagination/load-more'
 import { CUSTOMER_INTERACTION_TASK_SOURCE } from '../../../lib/interactionCompatibility'
 
 const DEFAULT_TODO_SOURCE = CUSTOMER_INTERACTION_TASK_SOURCE
@@ -29,12 +30,15 @@ type CustomerTodoRow = {
   createdAt: string
 }
 
+// `/api/customers/todos` also reports `totalPages`, deliberately left out of
+// this type: the load-more affordance terminates on a short page instead — see
+// `hasMoreFromPage`. `total` stays because it feeds the section's count badge,
+// where an under-report is cosmetic rather than a way to strand rows.
 type CustomerTodosResponse = {
   items: CustomerTodoRow[]
   total: number
   page: number
   pageSize: number
-  totalPages: number
 }
 
 export type TaskFormPayload = {
@@ -172,9 +176,9 @@ export function usePersonTasks({
   pageSize = 20,
 }: UsePersonTasksOptions): UsePersonTasksResult {
   const [tasks, setTasks] = React.useState<TodoLinkSummary[]>(initialTasks)
-  const [pageInfo, setPageInfo] = React.useState<{ page: number; totalPages: number; total: number }>({
+  const [pageInfo, setPageInfo] = React.useState<{ page: number; hasMore: boolean; total: number }>({
     page: 1,
-    totalPages: 1,
+    hasMore: false,
     total: initialTasks.length,
   })
   const [isInitialLoading, setIsInitialLoading] = React.useState<boolean>(() => Boolean(entityId))
@@ -187,12 +191,18 @@ export function usePersonTasks({
     const mapped = Array.isArray(payload.items) ? payload.items.map(mapRowToSummary) : []
     setPageInfo({
       page: payload.page ?? 1,
-      totalPages: payload.totalPages ?? 0,
+      // Short-page termination instead of `page < totalPages` — see
+      // `hasMoreFromPage`. `mapRowToSummary` is a 1:1 map and the `mergeUnique`
+      // dedupe happens after this, so `mapped.length` is what the server served.
+      // Measured against the page size the server echoed rather than the one
+      // requested, so a page size the endpoint narrows server-side cannot make a
+      // full page read as short and silently end the sequence.
+      hasMore: hasMoreFromPage(mapped.length, payload.pageSize ?? pageSize),
       total: payload.total ?? mapped.length,
     })
     setError(null)
     return mapped
-  }, [])
+  }, [pageSize])
 
   const fetchPage = React.useCallback(
     async (page: number): Promise<CustomerTodosResponse> => {
@@ -202,7 +212,6 @@ export function usePersonTasks({
           total: 0,
           page: 1,
           pageSize,
-          totalPages: 1,
         }
       }
       const params = new URLSearchParams({
@@ -222,7 +231,7 @@ export function usePersonTasks({
   const refresh = React.useCallback(async () => {
     if (!entityId) {
       setTasks([])
-      setPageInfo({ page: 1, totalPages: 1, total: 0 })
+      setPageInfo({ page: 1, hasMore: false, total: 0 })
       return
     }
     setIsInitialLoading(true)
@@ -242,7 +251,7 @@ export function usePersonTasks({
   const loadMore = React.useCallback(async () => {
     if (!entityId) return
     if (isLoadingMore) return
-    if (pageInfo.page >= pageInfo.totalPages) return
+    if (!pageInfo.hasMore) return
     setIsLoadingMore(true)
     try {
       const payload = await fetchPage(pageInfo.page + 1)
@@ -255,12 +264,12 @@ export function usePersonTasks({
     } finally {
       setIsLoadingMore(false)
     }
-  }, [entityId, fetchPage, isLoadingMore, mapResponse, pageInfo.page, pageInfo.totalPages])
+  }, [entityId, fetchPage, isLoadingMore, mapResponse, pageInfo.hasMore, pageInfo.page])
 
   React.useEffect(() => {
     if (!entityId) {
       setTasks([])
-      setPageInfo({ page: 1, totalPages: 1, total: 0 })
+      setPageInfo({ page: 1, hasMore: false, total: 0 })
       setError(null)
       setIsInitialLoading(false)
       return
@@ -268,7 +277,7 @@ export function usePersonTasks({
     setTasks(initialTasks)
     setPageInfo({
       page: 1,
-      totalPages: 1,
+      hasMore: false,
       total: initialTasks.length,
     })
     setError(null)
@@ -342,7 +351,7 @@ export function usePersonTasks({
         setTasks((prev) => [newTask, ...prev])
         setPageInfo((prev) => ({
           page: 1,
-          totalPages: prev.totalPages,
+          hasMore: prev.hasMore,
           total: prev.total + 1,
         }))
         await refresh()
@@ -466,7 +475,7 @@ export function usePersonTasks({
         setTasks((prev) => prev.filter((item) => item.id !== task.id))
         setPageInfo((prev) => ({
           page: prev.page,
-          totalPages: prev.totalPages,
+          hasMore: prev.hasMore,
           total: Math.max(0, prev.total - 1),
         }))
       } finally {
@@ -476,7 +485,7 @@ export function usePersonTasks({
     [],
   )
 
-  const hasMore = entityId != null && pageInfo.page < pageInfo.totalPages
+  const hasMore = entityId != null && pageInfo.hasMore
 
   return {
     tasks,

package/src/modules/customers/i18n/de.json

@@ -2409,6 +2409,7 @@
   "customers.personTags.newLabel": "New label",
   "customers.personTags.newLabelPlaceholder": "Label name...",
   "customers.personTags.newTag": "Neuer Tag",
+  "customers.personTags.retry": "Erneut versuchen",
   "customers.personTags.save": "Save",
   "customers.personTags.saveError": "Failed to save tags",
   "customers.personTags.saveSuccess": "Tags updated.",

package/src/modules/customers/i18n/en.json

@@ -2409,6 +2409,7 @@
   "customers.personTags.newLabel": "New label",
   "customers.personTags.newLabelPlaceholder": "Label name...",
   "customers.personTags.newTag": "New tag",
+  "customers.personTags.retry": "Retry",
   "customers.personTags.save": "Save",
   "customers.personTags.saveError": "Failed to save tags",
   "customers.personTags.saveSuccess": "Tags updated.",

package/src/modules/customers/i18n/es.json

@@ -2409,6 +2409,7 @@
   "customers.personTags.newLabel": "New label",
   "customers.personTags.newLabelPlaceholder": "Label name...",
   "customers.personTags.newTag": "Nueva etiqueta",
+  "customers.personTags.retry": "Reintentar",
   "customers.personTags.save": "Save",
   "customers.personTags.saveError": "Failed to save tags",
   "customers.personTags.saveSuccess": "Tags updated.",

package/src/modules/customers/i18n/ko.json

@@ -2409,6 +2409,7 @@
   "customers.personTags.newLabel": "새 라벨",
   "customers.personTags.newLabelPlaceholder": "라벨 이름...",
   "customers.personTags.newTag": "새 태그",
+  "customers.personTags.retry": "다시 시도",
   "customers.personTags.save": "저장",
   "customers.personTags.saveError": "태그 저장에 실패했습니다",
   "customers.personTags.saveSuccess": "태그가 업데이트되었습니다.",

package/src/modules/customers/i18n/pl.json

@@ -2409,6 +2409,7 @@
   "customers.personTags.newLabel": "Nowa etykieta",
   "customers.personTags.newLabelPlaceholder": "Nazwa etykiety...",
   "customers.personTags.newTag": "Nowy tag",
+  "customers.personTags.retry": "Ponów próbę",
   "customers.personTags.save": "Zapisz",
   "customers.personTags.saveError": "Nie udało się zapisać tagów",
   "customers.personTags.saveSuccess": "Tagi zostały zaktualizowane.",

package/src/modules/query_index/lib/engine.ts

@@ -20,6 +20,8 @@ import {
   type ResolvedJoin,
 } from '@open-mercato/shared/lib/query/join-utils'
 import { resolveSearchConfig, type SearchConfig } from '@open-mercato/shared/lib/search/config'
+import { isEncryptedLikeField, resolveEncryptedLikeFieldSet } from '@open-mercato/shared/lib/query/engine'
+import { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
 import {
   createSearchTokenAvailability,
   isSearchFilterOp,
@@ -148,13 +150,25 @@ type SearchRuntime = {
   organizationScope?: { ids: string[]; includeNull: boolean } | null
   tenantId?: string | null
   searchSources?: SearchTokenSource[]
+  /**
+   * Base-column fields whose stored value is ciphertext, so a like/ilike on them can only be
+   * answered via search tokens. A plaintext column keeps exact SQL ILIKE instead: the token
+   * rewrite is approximate -- it splits on non-alphanumerics and drops tokens shorter than
+   * minTokenLength, so a document-number search like "ZK 1/2026" degrades to the tokens
+   * {202, 2026} and matches every record from that year, and an all-short term like "ZK"
+   * produces no tokens and silently drops the predicate. `null`/absent = the encryption
+   * service could not answer (or a caller predates this field); keep the old rewrite then,
+   * because guessing "plaintext" would turn encrypted-column search into an
+   * ILIKE-on-ciphertext that matches nothing.
+   */
+  encryptedFields?: Set<string> | null
   /** Per-`query()` alias minter for `search_tokens` subqueries (see #2738). */
   mintAlias: () => string
 }
 
 type EncryptionResolver = () => {
   decryptEntityPayload?: (entityId: EntityId, payload: Record<string, unknown>, tenantId?: string | null, organizationId?: string | null) => Promise<Record<string, unknown>>
-  getEncryptedFieldNames?: (entityId: EntityId, tenantId?: string | null, organizationId?: string | null) => Promise<readonly string[]>
+  getEncryptedFieldNames?: (entityId: EntityId, tenantId?: string | null, organizationId?: string | null, options?: { ignoreRuntimeHealth?: boolean }) => Promise<readonly string[]>
   isEnabled?: () => boolean
 } | null
 
@@ -496,6 +510,51 @@ export class HybridQueryEngine implements QueryEngine {
         ? await this.searchAvailability().anySourceHasTokens(searchSources, opts.tenantId ?? null, orgScope)
         : false
       const searchRuntime: SearchRuntime = { ...searchRuntimeBase, searchSources, enabled: searchEnabled && hasSearchTokens }
+      if (
+        searchRuntime.enabled &&
+        searchConfig.useIlikeForNonEncryptedFields === true &&
+        sourceSearchFilters.some((filter) => !String(filter.field).startsWith('cf:'))
+      ) {
+        // `ignoreRuntimeHealth` asks the on-disk question -- a column holds ciphertext even while
+        // the KMS is down -- so an outage keeps encrypted columns on the token path (#4622).
+        // `organizationId: null` is deliberate, not an omission: the service then unions in every
+        // organization's map (`fetchAllOrganizationFieldNames`), so a field any org encrypts stays
+        // on the token path -- a wider set fails safe. Passing the request's org instead would
+        // silently break encrypted-column search for orgs without their own map. That union is an
+        // UNCACHED `encryption_maps` read, one extra round-trip per searched list request.
+        try {
+          const encryptionService = this.getEncryptionService()
+          const readEncryptedFieldNames = encryptionService?.getEncryptedFieldNames?.bind(encryptionService)
+          if (readEncryptedFieldNames) {
+            searchRuntime.encryptedFields = await resolveEncryptedLikeFieldSet(
+              () => readEncryptedFieldNames(
+                entity as EntityId,
+                opts.tenantId ?? null,
+                null,
+                { ignoreRuntimeHealth: true },
+              ),
+              String(entity),
+              opts.tenantId ?? null,
+            )
+          } else if (isTenantDataEncryptionEnabled()) {
+            // Encryption is on but the service is unreachable (a swallowed DI failure looks
+            // exactly like "no service"): treat the map as UNKNOWN and keep the token rewrite,
+            // rather than guessing "plaintext" and running ILIKE against ciphertext.
+            searchRuntime.encryptedFields = null
+          } else {
+            // Encryption disabled: nothing is ciphertext at rest, exact ILIKE is always right.
+            searchRuntime.encryptedFields = new Set()
+          }
+        } catch (err) {
+          // The fallback is safe (the old rewrite-everything behavior), but taking it silently
+          // would hide that the gate has stopped working.
+          logger.warn('search: encrypted-field map unavailable; keeping the token rewrite for all columns', {
+            entity: String(entity),
+            error: err instanceof Error ? err.message : String(err),
+          })
+          searchRuntime.encryptedFields = null
+        }
+      }
       if (searchFilters.length) {
         this.logSearchDebug('search:init', {
           entity,
@@ -1743,11 +1802,13 @@ export class HybridQueryEngine implements QueryEngine {
       return this.buildIndexDocFilterExpression(eb, 'ei', entity, fieldName, filter.op, filter.value, 'b.id', searchRuntime)
     }
     // For like/ilike with active search-tokens, route through hashed-token EXISTS subquery
-    // so encrypted-at-rest columns can still be searched.
+    // so encrypted-at-rest columns can still be searched. Plaintext base columns keep exact
+    // SQL ILIKE -- see SearchRuntime.encryptedFields.
     if (
       (filter.op === 'like' || filter.op === 'ilike') &&
       searchRuntime?.enabled &&
-      typeof filter.value === 'string'
+      typeof filter.value === 'string' &&
+      (searchRuntime.encryptedFields == null || isEncryptedLikeField(searchRuntime.encryptedFields, fieldName))
     ) {
       const tokens = tokenizeText(String(filter.value), searchRuntime.config)
       if (tokens.hashes.length) {
@@ -1771,10 +1832,14 @@ export class HybridQueryEngine implements QueryEngine {
           )
         }
       }
-      // Tokenizer produced no hashes (e.g. value too short). Match the regular-base-filter
-      // path's behavior of skipping the predicate (no filter), which is preferable to
-      // silently turning into a plain `ilike` against an encrypted column.
-      return sql<boolean>`true`
+      // Tokenizer produced no hashes (e.g. value too short) or no source is usable. For a
+      // column KNOWN to be encrypted, `false` is the honest answer for an OR leaf -- `true`
+      // would widen the whole disjunction to match everything, on exactly the columns ILIKE
+      // cannot serve. Every other case (gate off, custom-entity runtime, resolution failure)
+      // keeps the legacy predicate-skipping `true`.
+      return searchRuntime?.encryptedFields != null && isEncryptedLikeField(searchRuntime.encryptedFields, fieldName)
+        ? sql<boolean>`false`
+        : sql<boolean>`true`
     }
     return this.buildColumnFilterExpression(eb, qualify(baseField), filter.op, filter.value)
   }
@@ -1853,6 +1918,9 @@ export class HybridQueryEngine implements QueryEngine {
     const hasSearchTokens = searchEnabled && hasSearchFilter(normalizedFilters)
       ? await this.searchAvailability().hasTokens(entity, opts.tenantId ?? null, orgScope)
       : false
+    // `encryptedFields` is deliberately NOT resolved here: custom-entity rows live in the
+    // `entity_indexes` doc store, whose fields the base-column encryption map does not describe,
+    // so the ILIKE gate stays inert on this path and like/ilike keeps its previous semantics.
     const searchRuntime: SearchRuntime = {
       enabled: searchEnabled && hasSearchTokens,
       config: searchConfig,
@@ -2384,7 +2452,11 @@ export class HybridQueryEngine implements QueryEngine {
     if (
       (filter.op === 'like' || filter.op === 'ilike') &&
       search?.enabled &&
-      typeof filter.value === 'string'
+      typeof filter.value === 'string' &&
+      // Plaintext base columns keep exact SQL ILIKE -- see SearchRuntime.encryptedFields.
+      // Membership runs across name-shape candidates: maps may declare `displayName` while the
+      // filter carries the column name `display_name`.
+      (search.encryptedFields == null || isEncryptedLikeField(search.encryptedFields, search.field))
     ) {
       const tokens = tokenizeText(String(filter.value), search.config)
       const hashes = tokens.hashes
@@ -2413,10 +2485,23 @@ export class HybridQueryEngine implements QueryEngine {
           })
           return q
         }
+        // Hashes exist but no usable search source: same reasoning as the no-hash branch below --
+        // a KNOWN-encrypted column must fail closed rather than drop the predicate (which would
+        // return the full list on exactly the columns ILIKE cannot serve).
+        if (search.encryptedFields != null && isEncryptedLikeField(search.encryptedFields, search.field)) {
+          return q.where(sql<boolean>`false`)
+        }
       } else {
         this.logSearchDebug('search:skip-empty-hashes', {
           entity: search.entity, field: search.field, value: filter.value,
         })
+        // A column KNOWN to be encrypted has no way to match the term except the token index:
+        // dropping the predicate would return every row for a term merely too short to tokenize.
+        // Every other case (gate off, custom-entity runtime, resolution failure) keeps the
+        // legacy behavior of skipping the predicate.
+        if (search.encryptedFields != null && isEncryptedLikeField(search.encryptedFields, search.field)) {
+          return q.where(sql<boolean>`false`)
+        }
       }
       return q
     }