@open-mercato/core 0.6.8-develop.7099.1.7ba2771d06 → 0.7.0

package/src/modules/payment_gateways/lib/webhook-processor.ts

@@ -1,13 +1,9 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { getGatewayAdapter, type WebhookEvent } from '@open-mercato/shared/modules/payment_gateways/types'
-import { isTrustedWebhookDispatch } from '@open-mercato/shared/lib/queue/dispatchOrigin'
-import { createLogger } from '@open-mercato/shared/lib/logger'
 import type { IntegrationLogService } from '../../integrations/lib/log-service'
 import type { PaymentGatewayService } from './gateway-service'
 import { claimWebhookProcessing, releaseWebhookClaim } from './webhook-utils'
 
-const logger = createLogger('payment_gateways').child({ component: 'webhook-processor' })
-
 export type PaymentGatewayWebhookJobPayload = {
   providerKey: string
   event: WebhookEvent
@@ -57,13 +53,6 @@ export async function processPaymentGatewayWebhookJob(
 ): Promise<void> {
   const { em, paymentGatewayService, integrationLogService } = deps
   const { providerKey, event } = payload
-  // Fail closed on untrusted dispatch origins (#5213): only jobs enqueued by the
-  // inbound webhook route (signature verified) may drive payment state. Jobs that
-  // arrive through any other path — e.g. a scheduled queue target — are dropped.
-  if (!isTrustedWebhookDispatch(payload)) {
-    logger.error('Dropping webhook job with missing or untrusted dispatch origin', { providerKey, eventType: event?.eventType ?? null })
-    return
-  }
   // Scope MUST come from the trusted route layer (derived from a verified GatewayTransaction).
   // Never fall back to attacker-controlled metadata on `event.data.metadata` — that was the
   // vector that allowed forged mock webhooks to mutate another tenant's payment state.

package/src/modules/planner/backend/planner/availability-rulesets/page.tsx

@@ -39,7 +39,6 @@ type RuleSetResponse = {
   items?: Array<Record<string, unknown>>
   total?: number
   totalPages?: number
-  totalIsCapped?: boolean
 }
 
 export default function PlannerAvailabilityRuleSetsPage() {
@@ -68,7 +67,6 @@ export default function PlannerAvailabilityRuleSetsPage() {
   const [page, setPage] = React.useState(1)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
-  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [sorting, setSorting] = React.useState<SortingState>([{ id: 'name', desc: false }])
   const [search, setSearch] = React.useState('')
   const [isLoading, setIsLoading] = React.useState(true)
@@ -122,7 +120,6 @@ export default function PlannerAvailabilityRuleSetsPage() {
       setRows(items.map(mapRuleSet))
       setTotal(typeof payload.total === 'number' ? payload.total : items.length)
       setTotalPages(typeof payload.totalPages === 'number' ? payload.totalPages : Math.max(1, Math.ceil(items.length / PAGE_SIZE)))
-      setTotalIsCapped(payload?.totalIsCapped === true)
     } catch (error) {
       logger.error('Failed to list availability rule sets', { err: error })
       flash(labels.errors.load, 'error')
@@ -232,7 +229,6 @@ export default function PlannerAvailabilityRuleSetsPage() {
             pageSize: PAGE_SIZE,
             total,
             totalPages,
-            totalIsCapped,
             onPageChange: setPage,
           }}
           rowActions={(row) => (

package/src/modules/push_notifications/backend/push_notifications/page.tsx

@@ -32,7 +32,6 @@ type ResponsePayload = {
   page?: number
   pageSize?: number
   totalPages: number
-  totalIsCapped?: boolean
 }
 
 const statusVariant: StatusMap<PushDeliveryStatus> = {
@@ -60,7 +59,6 @@ export default function PushDeliveriesListPage() {
   const [page, setPage] = React.useState(1)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
-  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [isLoading, setIsLoading] = React.useState(true)
   const scopeVersion = useOrganizationScopeVersion()
   const t = useT()
@@ -158,7 +156,6 @@ export default function PushDeliveriesListPage() {
           setRows(Array.isArray(payload.items) ? payload.items : [])
           setTotal(payload.total || 0)
           setTotalPages(payload.totalPages || 1)
-          setTotalIsCapped(payload?.totalIsCapped === true)
         }
       } catch (error) {
         if (!cancelled) {
@@ -232,7 +229,7 @@ export default function PushDeliveriesListPage() {
           onFiltersClear={() => { setFilterValues({}); setPage(1) }}
           perspective={{ tableId: 'push_notifications.deliveries' }}
           onRowClick={(row) => { window.location.href = `/backend/push_notifications/${row.id}` }}
-          pagination={{ page, pageSize: 50, total, totalPages, totalIsCapped, onPageChange: setPage }}
+          pagination={{ page, pageSize: 50, total, totalPages, onPageChange: setPage }}
           isLoading={isLoading}
           emptyState={t('push_notifications.deliveries.empty')}
         />

package/src/modules/push_notifications/backend/push_notifications/send/page.tsx

@@ -70,7 +70,7 @@ function DeviceField({ value, setValue, setFormValue, values, onState }: CrudCus
     let cancelled = false
     setLoading(true)
     const params = new URLSearchParams({ userId, pageSize: '50' })
-    apiCall<{ items?: Array<{ id: string; deviceId: string; platform: string; pushProvider?: string | null }> }>(
+    apiCall<{ items?: Array<{ id: string; device_id: string; platform: string; push_provider?: string | null }> }>(
       `/api/devices/admin/devices?${params.toString()}`,
       { headers: { 'x-om-forbidden-redirect': '0' } },
       { fallback: null },
@@ -80,9 +80,9 @@ function DeviceField({ value, setValue, setFormValue, values, onState }: CrudCus
         if (cancelled) return
         const items = (call && call.ok ? call.result?.items : []) ?? []
         const opts = items
-          .filter((d): d is { id: string; deviceId: string; platform: string; pushProvider?: string | null } =>
-            !!d && typeof d.id === 'string' && !!d.pushProvider)
-          .map((d) => ({ id: d.id, label: `${d.deviceId} · ${d.platform}${d.pushProvider ? ` · ${d.pushProvider}` : ''}`, platform: d.platform }))
+          .filter((d): d is { id: string; device_id: string; platform: string; push_provider?: string | null } =>
+            !!d && typeof d.id === 'string' && !!d.push_provider)
+          .map((d) => ({ id: d.id, label: `${d.device_id} · ${d.platform}${d.push_provider ? ` · ${d.push_provider}` : ''}`, platform: d.platform }))
         setDevices(opts)
         if (selected && !opts.some((o) => o.id === selected)) setValue('')
       })

package/src/modules/query_index/lib/engine.ts

@@ -1,4 +1,4 @@
-import type { QueryEngine, QueryOptions, QueryResult, QueryResultMeta, EncryptedSortRowCapWarning, ListCountCapWarning, FilterOp, Filter, QueryCustomFieldSource, PartialIndexWarning, QueryExtensionsConfig, Sort } from '@open-mercato/shared/lib/query/types'
+import type { QueryEngine, QueryOptions, QueryResult, QueryResultMeta, EncryptedSortRowCapWarning, FilterOp, Filter, QueryCustomFieldSource, PartialIndexWarning, QueryExtensionsConfig, Sort } from '@open-mercato/shared/lib/query/types'
 import { SortDir } from '@open-mercato/shared/lib/query/types'
 import type { EntityId } from '@open-mercato/shared/modules/entities'
 import type { EntityManager } from '@mikro-orm/postgresql'
@@ -20,8 +20,6 @@ import {
   type ResolvedJoin,
 } from '@open-mercato/shared/lib/query/join-utils'
 import { resolveSearchConfig, type SearchConfig } from '@open-mercato/shared/lib/search/config'
-import { isEncryptedLikeField, resolveEncryptedLikeFieldSet } from '@open-mercato/shared/lib/query/engine'
-import { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
 import {
   createSearchTokenAvailability,
   isSearchFilterOp,
@@ -34,7 +32,6 @@ import { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'
 import { runBeforeQueryPipeline, runAfterQueryPipeline, type QueryExtensionContext } from '@open-mercato/shared/lib/query/query-extension-runner'
 import { warnOnCiphertextLikeFallback } from '@open-mercato/shared/lib/query/ciphertext-search-warning'
 import { resolveEncryptedSortFields, resolveEncryptedSortMaxRows, sortRowsInMemory } from '@open-mercato/shared/lib/query/encrypted-sort'
-import { resolveListCountCap } from '@open-mercato/shared/lib/query/count-cap'
 import { mapWithConcurrency } from '@open-mercato/shared/lib/query/bounded-decrypt'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { parseNumberWithDefault } from '@open-mercato/shared/lib/number'
@@ -151,25 +148,13 @@ type SearchRuntime = {
   organizationScope?: { ids: string[]; includeNull: boolean } | null
   tenantId?: string | null
   searchSources?: SearchTokenSource[]
-  /**
-   * Base-column fields whose stored value is ciphertext, so a like/ilike on them can only be
-   * answered via search tokens. A plaintext column keeps exact SQL ILIKE instead: the token
-   * rewrite is approximate -- it splits on non-alphanumerics and drops tokens shorter than
-   * minTokenLength, so a document-number search like "ZK 1/2026" degrades to the tokens
-   * {202, 2026} and matches every record from that year, and an all-short term like "ZK"
-   * produces no tokens and silently drops the predicate. `null`/absent = the encryption
-   * service could not answer (or a caller predates this field); keep the old rewrite then,
-   * because guessing "plaintext" would turn encrypted-column search into an
-   * ILIKE-on-ciphertext that matches nothing.
-   */
-  encryptedFields?: Set<string> | null
   /** Per-`query()` alias minter for `search_tokens` subqueries (see #2738). */
   mintAlias: () => string
 }
 
 type EncryptionResolver = () => {
   decryptEntityPayload?: (entityId: EntityId, payload: Record<string, unknown>, tenantId?: string | null, organizationId?: string | null) => Promise<Record<string, unknown>>
-  getEncryptedFieldNames?: (entityId: EntityId, tenantId?: string | null, organizationId?: string | null, options?: { ignoreRuntimeHealth?: boolean }) => Promise<readonly string[]>
+  getEncryptedFieldNames?: (entityId: EntityId, tenantId?: string | null, organizationId?: string | null) => Promise<readonly string[]>
   isEnabled?: () => boolean
 } | null
 
@@ -511,51 +496,6 @@ export class HybridQueryEngine implements QueryEngine {
         ? await this.searchAvailability().anySourceHasTokens(searchSources, opts.tenantId ?? null, orgScope)
         : false
       const searchRuntime: SearchRuntime = { ...searchRuntimeBase, searchSources, enabled: searchEnabled && hasSearchTokens }
-      if (
-        searchRuntime.enabled &&
-        searchConfig.useIlikeForNonEncryptedFields === true &&
-        sourceSearchFilters.some((filter) => !String(filter.field).startsWith('cf:'))
-      ) {
-        // `ignoreRuntimeHealth` asks the on-disk question -- a column holds ciphertext even while
-        // the KMS is down -- so an outage keeps encrypted columns on the token path (#4622).
-        // `organizationId: null` is deliberate, not an omission: the service then unions in every
-        // organization's map (`fetchAllOrganizationFieldNames`), so a field any org encrypts stays
-        // on the token path -- a wider set fails safe. Passing the request's org instead would
-        // silently break encrypted-column search for orgs without their own map. That union is an
-        // UNCACHED `encryption_maps` read, one extra round-trip per searched list request.
-        try {
-          const encryptionService = this.getEncryptionService()
-          const readEncryptedFieldNames = encryptionService?.getEncryptedFieldNames?.bind(encryptionService)
-          if (readEncryptedFieldNames) {
-            searchRuntime.encryptedFields = await resolveEncryptedLikeFieldSet(
-              () => readEncryptedFieldNames(
-                entity as EntityId,
-                opts.tenantId ?? null,
-                null,
-                { ignoreRuntimeHealth: true },
-              ),
-              String(entity),
-              opts.tenantId ?? null,
-            )
-          } else if (isTenantDataEncryptionEnabled()) {
-            // Encryption is on but the service is unreachable (a swallowed DI failure looks
-            // exactly like "no service"): treat the map as UNKNOWN and keep the token rewrite,
-            // rather than guessing "plaintext" and running ILIKE against ciphertext.
-            searchRuntime.encryptedFields = null
-          } else {
-            // Encryption disabled: nothing is ciphertext at rest, exact ILIKE is always right.
-            searchRuntime.encryptedFields = new Set()
-          }
-        } catch (err) {
-          // The fallback is safe (the old rewrite-everything behavior), but taking it silently
-          // would hide that the gate has stopped working.
-          logger.warn('search: encrypted-field map unavailable; keeping the token rewrite for all columns', {
-            entity: String(entity),
-            error: err instanceof Error ? err.message : String(err),
-          })
-          searchRuntime.encryptedFields = null
-        }
-      }
       if (searchFilters.length) {
         this.logSearchDebug('search:init', {
           entity,
@@ -845,9 +785,10 @@ export class HybridQueryEngine implements QueryEngine {
         return next
       }
 
-      // Also used by the count shape: cf leaves (and doc-based base leaves) reference
-      // the index rowset aliases, so any group containing one routes the whole
-      // disjunction inside the seeded-rowset EXISTS, where those aliases exist.
+      // Also used by the optimized count path, which builds from a bare base table with
+      // no index/custom-field joins. Emitting a cf predicate there would reference an
+      // alias that query has never joined, so this stays safe only while
+      // `canOptimizeCount` is false whenever any cf filter exists (see `hasCustomFieldFilters`).
       const applyOrGroupedBaseFilters = (q: AnyBuilder): AnyBuilder => {
         if (orGroupFilters.length === 0 && orGroupCfFilters.length === 0) return q
         // `BaseFilter` here is just the normalized-leaf shape; the `cf` bucket holds
@@ -996,101 +937,6 @@ export class HybridQueryEngine implements QueryEngine {
       const hasCustomFieldFilters = cfFilters.length > 0
       const canOptimizeCount = !hasCustomFieldFilters && !hasNonBaseSearchSource
 
-      // ── Count shape (#4552 Phase 2) ─────────────────────────────────
-      // The count query is rebuilt rather than derived from the display shape:
-      // base scope + filters only. Predicates that read the left-joined index
-      // rowset (cf filters, doc filters, or-groups with doc members, token
-      // searches over joined sources) evaluate against the *same* rowset as the
-      // display query, but confined inside a single correlated EXISTS built
-      // from a one-row seed — so the per-base-row rowset is identical, yet a
-      // semi-join cannot multiply base rows. The count therefore needs no
-      // DISTINCT or GROUP BY, and an outer LIMIT actually bounds the scan (no
-      // blocking aggregate between the LIMIT and the scan).
-      const isRowsetDependentFilter = (filter: BaseFilter): boolean => {
-        const baseField = resolveBaseColumn(String(filter.field))
-        if (!baseField) return true
-        // Token search may probe joined sources' record ids, which only exist
-        // on the index rowset.
-        if (
-          (filter.op === 'like' || filter.op === 'ilike') &&
-          searchRuntime.enabled &&
-          typeof filter.value === 'string' &&
-          hasNonBaseSearchSource
-        ) return true
-        return false
-      }
-      const rowsetRegularFilters = regularBaseFilters.filter((filter) => isRowsetDependentFilter(filter))
-      const outerRegularFilters = regularBaseFilters.filter((filter) => !isRowsetDependentFilter(filter))
-      // Or-groups are disjuncts of one $or, so they cannot be split between the
-      // outer query and the rowset — one doc-dependent member moves them all in.
-      const orGroupsRowsetDependent =
-        orGroupCfFilters.length > 0 ||
-        orGroupFilters.some((filter) => isRowsetDependentFilter(filter))
-      const hasInnerTypedCfSource = preparedCfSources.some((source) =>
-        ((opts.customFieldSources ?? []).find((s) => s && (s.alias ?? undefined) === source.alias)?.join?.type ?? 'left') === 'inner')
-      const needsIndexRowset =
-        hasCustomFieldFilters ||
-        rowsetRegularFilters.length > 0 ||
-        orGroupsRowsetDependent ||
-        hasInnerTypedCfSource
-
-      const applyCountShape = async (q: AnyBuilder): Promise<AnyBuilder> => {
-        let next = applyBaseScope(q)
-        for (const filter of outerRegularFilters) {
-          const baseField = resolveBaseColumn(String(filter.field))
-          if (!baseField) continue
-          next = this.applyColumnFilter(next, qualify(baseField), filter, {
-            ...searchRuntime, entity, field: String(filter.field), recordIdColumn: qualify('id'),
-          })
-        }
-        if (!orGroupsRowsetDependent) next = applyOrGroupedBaseFilters(next)
-        if (needsIndexRowset) {
-          // One seed row per base row, then the display query's own join
-          // builders — the rowset inside the EXISTS is the display rowset.
-          // Built from `db` (not the where-callback's expression builder),
-          // matching applyJoinFilters' detached-subquery idiom; correlated
-          // references to the outer base alias resolve at compile time.
-          let rowset: AnyBuilder = db
-            .selectFrom(sql`(select 1)`.as('om_count_seed'))
-            .select(sql<number>`1`.as('one'))
-          rowset = applyEntityIndexesJoin(rowset)
-          rowset = applyCustomFieldSourceJoins(rowset)
-          rowset = applyCfFilters(rowset)
-          for (const filter of rowsetRegularFilters) {
-            const baseField = resolveBaseColumn(String(filter.field))
-            if (!baseField) {
-              rowset = this.applyIndexDocFilterFromAlias(
-                rowset, 'ei', entity, String(filter.field), filter.op, filter.value, qualify('id'), searchRuntime,
-              )
-              continue
-            }
-            rowset = this.applyColumnFilter(rowset, qualify(baseField), filter, {
-              ...searchRuntime, entity, field: String(filter.field), recordIdColumn: qualify('id'),
-            })
-          }
-          if (orGroupsRowsetDependent) rowset = applyOrGroupedBaseFilters(rowset)
-          const capturedRowset = rowset
-          next = next.where((eb: any) => eb.exists(capturedRowset))
-        }
-        next = await applyJoinFilters({
-          db,
-          baseTable,
-          builder: next,
-          joinMap,
-          joinFilters,
-          aliasTables,
-          qualifyBase: (column) => qualify(column),
-          applyAliasScope: async (target: any, alias: string) => applyAliasScopes(target as AnyBuilder, alias),
-          applyFilterOp: (target, column, op, value) => applyJoinFilterOpFn(target as AnyBuilder, column, op, value),
-          applyJoinFilterOp: async (target, filter, qualified, join) => {
-            const applied = await applyJoinSearchFilterOp(target as AnyBuilder, filter, qualified, join)
-            return { applied, builder: target }
-          },
-          columnExists: (tbl, column) => this.columnExists(tbl, column),
-        })
-        return next
-      }
-
       // Selection (for data query)
       const selectFieldSet = new Set<string>((opts.fields && opts.fields.length) ? opts.fields.map(String) : Array.from(columns.keys()))
       if (requiresPlaintextSort) {
@@ -1151,23 +997,33 @@ export class HybridQueryEngine implements QueryEngine {
       const pageSize = opts.page?.pageSize ?? 20
       const sqlDebugEnabled = this.isSqlDebugEnabled()
 
-      const countCap = resolveListCountCap()
+      let total: number
 
-      // Both count paths build the same rebuilt shape; for `canOptimizeCount`
-      // queries `needsIndexRowset` is false, so the shape degenerates to
-      // base-scope + filters exactly as the optimized path always had.
-      // `wasOptimizable` carries NO control flow — it only labels the debug
-      // timing so operators can keep telling the two shapes apart.
-      // TODO(2026-08-12): remove `canOptimizeCount` once the shape convergence
-      // has soaked (tracked in the #4552 spec as the Phase 2 follow-up).
-      const runBoundedCount = async (wasOptimizable: boolean): Promise<{ total: number; warning?: ListCountCapWarning }> => {
-        const countRoot = db.selectFrom(`${baseTable} as b` as any)
-        const shape = await applyCountShape(countRoot)
-        const countQuery = countCap !== null
-          ? db
-              .selectFrom(shape.select(sql<number>`1`.as('one')).limit(countCap + 1).as('om_count_probe') as any)
-              .select(sql<string>`count(*)`.as('count'))
-          : shape.select(sql<string>`count(*)`.as('count'))
+      if (canOptimizeCount) {
+        // Optimized count: apply only base-scope + regular filters + or-group filters (no index joins).
+        const optimizedRoot = db.selectFrom(`${baseTable} as b` as any)
+        let countCore = applyBaseScope(optimizedRoot)
+        countCore = applyRegularBaseFilters(countCore)
+        countCore = applyOrGroupedBaseFilters(countCore)
+        // joinFilters still need to be re-applied in the optimized path
+        countCore = await applyJoinFilters({
+          db,
+          baseTable,
+          builder: countCore,
+          joinMap,
+          joinFilters,
+          aliasTables,
+          qualifyBase: (column) => qualify(column),
+          applyAliasScope: async (target: any, alias: string) => applyAliasScopes(target as AnyBuilder, alias),
+          applyFilterOp: (target, column, op, value) => applyJoinFilterOpFn(target as AnyBuilder, column, op, value),
+          applyJoinFilterOp: async (target, filter, qualified, join) => {
+            const applied = await applyJoinSearchFilterOp(target as AnyBuilder, filter, qualified, join)
+            return { applied, builder: target }
+          },
+          columnExists: (tbl, column) => this.columnExists(tbl, column),
+        })
+        const sub = countCore.select(sql.ref(qualify('id')).as('id')).groupBy(qualify('id')).as('sq')
+        const countQuery = db.selectFrom(sub as any).select(sql<string>`count(*)`.as('count'))
         if (debugEnabled && sqlDebugEnabled) {
           const compiled = countQuery.compile()
           this.debug('query:sql:count', { entity, sql: compiled.sql, bindings: compiled.parameters })
@@ -1175,19 +1031,25 @@ export class HybridQueryEngine implements QueryEngine {
         const countRow = await this.captureSqlTiming(
           'query:sql:count', entity,
           () => countQuery.executeTakeFirst(),
-          { optimized: wasOptimizable }, profiler,
+          { optimized: true }, profiler,
         )
-        const probed = this.parseCount(countRow)
-        if (countCap !== null && probed > countCap) {
-          return { total: countCap, warning: { entity, cap: countCap } }
+        total = this.parseCount(countRow)
+      } else {
+        const countRoot = db.selectFrom(`${baseTable} as b` as any)
+        const countBuilder = (await applyQueryShape(countRoot))
+          .select(sql<string>`count(distinct ${sql.ref(qualify('id'))})`.as('count'))
+        if (debugEnabled && sqlDebugEnabled) {
+          const compiled = countBuilder.compile()
+          this.debug('query:sql:count', { entity, sql: compiled.sql, bindings: compiled.parameters })
         }
-        return { total: probed }
+        const countRow = await this.captureSqlTiming(
+          'query:sql:count', entity,
+          () => countBuilder.executeTakeFirst(),
+          { optimized: false }, profiler,
+        )
+        total = this.parseCount(countRow)
       }
 
-      const counted = await runBoundedCount(canOptimizeCount)
-      const total: number = counted.total
-      const listCountCapWarning: ListCountCapWarning | undefined = counted.warning
-
       const dekKeyCache = new Map<string | null, string | null>()
 
       const decryptRow = async (item: Record<string, unknown>): Promise<Record<string, unknown>> => {
@@ -1238,29 +1100,24 @@ export class HybridQueryEngine implements QueryEngine {
         const sortFieldNames = Array.from(new Set(['id', ...scopeFieldNames, ...resolvedSorts.map((s) => String(s.field))]))
         phase1 = applySelection(phase1, sortFieldNames)
         if (cap !== null) {
-          // Probe one row past the cap: truncation is detected from the candidate
-          // scan itself, not by comparing against `total` — which may itself be
-          // capped (`OM_LIST_COUNT_CAP`) and would then never exceed the sort cap.
-          phase1 = phase1.limit(cap + 1).orderBy(qualify('id'), 'asc' as any)
+          phase1 = phase1.limit(cap).orderBy(qualify('id'), 'asc' as any)
         }
         if (debugEnabled && sqlDebugEnabled) {
           const compiled = phase1.compile()
           this.debug('query:sql:data:phase1', { entity, sql: compiled.sql, bindings: compiled.parameters })
         }
-        const candidateRowsRaw = await this.captureSqlTiming(
+        const candidateRows = await this.captureSqlTiming(
           'query:sql:data:phase1', entity,
           () => phase1.execute(),
           { phase: 1 }, profiler,
         ) as Record<string, unknown>[]
-        const sortTruncated = cap !== null && candidateRowsRaw.length > cap
-        const candidateRows = sortTruncated && cap !== null ? candidateRowsRaw.slice(0, cap) : candidateRowsRaw
         const decryptedCandidates = await mapWithConcurrency(candidateRows, DECRYPT_CONCURRENCY, decryptRow)
         const orderedCandidates = sortRowsInMemory(decryptedCandidates, resolvedSorts)
         const pageIds = orderedCandidates
           .slice((page - 1) * pageSize, page * pageSize)
           .map((row) => row.id)
 
-        if (sortTruncated && cap !== null) {
+        if (cap !== null && total > cap) {
           encryptedSortRowCapWarning = {
             entity,
             sortFields: resolvedSorts.map((s) => String(s.field)),
@@ -1316,11 +1173,10 @@ export class HybridQueryEngine implements QueryEngine {
 
       const typedItems = items as unknown as T[]
       let result: QueryResult<T> = { items: typedItems, page, pageSize, total }
-      if (partialIndexWarning || encryptedSortRowCapWarning || listCountCapWarning) {
+      if (partialIndexWarning || encryptedSortRowCapWarning) {
         const meta: QueryResultMeta = {}
         if (partialIndexWarning) meta.partialIndexWarning = partialIndexWarning
         if (encryptedSortRowCapWarning) meta.encryptedSortRowCapWarning = encryptedSortRowCapWarning
-        if (listCountCapWarning) meta.listCountCapWarning = listCountCapWarning
         result.meta = meta
       }
 
@@ -1887,13 +1743,11 @@ export class HybridQueryEngine implements QueryEngine {
       return this.buildIndexDocFilterExpression(eb, 'ei', entity, fieldName, filter.op, filter.value, 'b.id', searchRuntime)
     }
     // For like/ilike with active search-tokens, route through hashed-token EXISTS subquery
-    // so encrypted-at-rest columns can still be searched. Plaintext base columns keep exact
-    // SQL ILIKE -- see SearchRuntime.encryptedFields.
+    // so encrypted-at-rest columns can still be searched.
     if (
       (filter.op === 'like' || filter.op === 'ilike') &&
       searchRuntime?.enabled &&
-      typeof filter.value === 'string' &&
-      (searchRuntime.encryptedFields == null || isEncryptedLikeField(searchRuntime.encryptedFields, fieldName))
+      typeof filter.value === 'string'
     ) {
       const tokens = tokenizeText(String(filter.value), searchRuntime.config)
       if (tokens.hashes.length) {
@@ -1917,14 +1771,10 @@ export class HybridQueryEngine implements QueryEngine {
           )
         }
       }
-      // Tokenizer produced no hashes (e.g. value too short) or no source is usable. For a
-      // column KNOWN to be encrypted, `false` is the honest answer for an OR leaf -- `true`
-      // would widen the whole disjunction to match everything, on exactly the columns ILIKE
-      // cannot serve. Every other case (gate off, custom-entity runtime, resolution failure)
-      // keeps the legacy predicate-skipping `true`.
-      return searchRuntime?.encryptedFields != null && isEncryptedLikeField(searchRuntime.encryptedFields, fieldName)
-        ? sql<boolean>`false`
-        : sql<boolean>`true`
+      // Tokenizer produced no hashes (e.g. value too short). Match the regular-base-filter
+      // path's behavior of skipping the predicate (no filter), which is preferable to
+      // silently turning into a plain `ilike` against an encrypted column.
+      return sql<boolean>`true`
     }
     return this.buildColumnFilterExpression(eb, qualify(baseField), filter.op, filter.value)
   }
@@ -2003,9 +1853,6 @@ export class HybridQueryEngine implements QueryEngine {
     const hasSearchTokens = searchEnabled && hasSearchFilter(normalizedFilters)
       ? await this.searchAvailability().hasTokens(entity, opts.tenantId ?? null, orgScope)
       : false
-    // `encryptedFields` is deliberately NOT resolved here: custom-entity rows live in the
-    // `entity_indexes` doc store, whose fields the base-column encryption map does not describe,
-    // so the ILIKE gate stays inert on this path and like/ilike keeps its previous semantics.
     const searchRuntime: SearchRuntime = {
       enabled: searchEnabled && hasSearchTokens,
       config: searchConfig,
@@ -2121,35 +1968,17 @@ export class HybridQueryEngine implements QueryEngine {
     const page = opts.page?.page ?? 1
     const pageSize = opts.page?.pageSize ?? 20
 
-    // Single-table count: `applyScope` adds only WHERE predicates (cf filters
-    // included — no join), and doc storage holds one row per record within a
-    // scope, so `count(*)` needs no DISTINCT and — when the cap is active — a
-    // LIMIT on the row-producing inner query bounds the scan (#4552 Phase 2).
-    const countCap = resolveListCountCap()
     const root = db.selectFrom(`custom_entities_storage as ${alias}`)
-    const countShape = applyScope(root)
-    const countQuery = countCap !== null
-      ? db
-          .selectFrom(countShape.select(sql<number>`1`.as('one')).limit(countCap + 1).as('om_count_probe') as any)
-          .select(sql<string>`count(*)`.as('count'))
-      : countShape.select(sql<string>`count(*)`.as('count'))
+    const countQuery = applyScope(root).select(sql<string>`count(distinct ${sql.ref(`${alias}.entity_id`)})`.as('count'))
     const countRow = await countQuery.executeTakeFirst()
-    const probed = this.parseCount(countRow)
-    let total = probed
-    let listCountCapWarning: ListCountCapWarning | undefined
-    if (countCap !== null && probed > countCap) {
-      total = countCap
-      listCountCapWarning = { entity: entity as EntityId, cap: countCap }
-    }
+    const total = this.parseCount(countRow)
 
     let dataQuery = applyScope(db.selectFrom(`custom_entities_storage as ${alias}`))
     dataQuery = applySelection(dataQuery)
     dataQuery = applySort(dataQuery)
     dataQuery = dataQuery.limit(pageSize).offset((page - 1) * pageSize)
     const items = await dataQuery.execute()
-    const result: QueryResult<T> = { items, page, pageSize, total }
-    if (listCountCapWarning) result.meta = { listCountCapWarning }
-    return result
+    return { items, page, pageSize, total }
   }
 
   private async tableExists(table: string): Promise<boolean> {
@@ -2555,11 +2384,7 @@ export class HybridQueryEngine implements QueryEngine {
     if (
       (filter.op === 'like' || filter.op === 'ilike') &&
       search?.enabled &&
-      typeof filter.value === 'string' &&
-      // Plaintext base columns keep exact SQL ILIKE -- see SearchRuntime.encryptedFields.
-      // Membership runs across name-shape candidates: maps may declare `displayName` while the
-      // filter carries the column name `display_name`.
-      (search.encryptedFields == null || isEncryptedLikeField(search.encryptedFields, search.field))
+      typeof filter.value === 'string'
     ) {
       const tokens = tokenizeText(String(filter.value), search.config)
       const hashes = tokens.hashes
@@ -2588,23 +2413,10 @@ export class HybridQueryEngine implements QueryEngine {
           })
           return q
         }
-        // Hashes exist but no usable search source: same reasoning as the no-hash branch below --
-        // a KNOWN-encrypted column must fail closed rather than drop the predicate (which would
-        // return the full list on exactly the columns ILIKE cannot serve).
-        if (search.encryptedFields != null && isEncryptedLikeField(search.encryptedFields, search.field)) {
-          return q.where(sql<boolean>`false`)
-        }
       } else {
         this.logSearchDebug('search:skip-empty-hashes', {
           entity: search.entity, field: search.field, value: filter.value,
         })
-        // A column KNOWN to be encrypted has no way to match the term except the token index:
-        // dropping the predicate would return every row for a term merely too short to tokenize.
-        // Every other case (gate off, custom-entity runtime, resolution failure) keeps the
-        // legacy behavior of skipping the predicate.
-        if (search.encryptedFields != null && isEncryptedLikeField(search.encryptedFields, search.field)) {
-          return q.where(sql<boolean>`false`)
-        }
       }
       return q
     }