@open-mercato/core 0.8.1-develop.7225.1.73190a4a95 → 0.8.1-develop.7228.1.b7ea09d2d3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.8.1-develop.7225.1.73190a4a95",
+  "version": "0.8.1-develop.7228.1.b7ea09d2d3",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -253,16 +253,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.8.1-develop.7225.1.73190a4a95",
-    "@open-mercato/shared": "0.8.1-develop.7225.1.73190a4a95",
-    "@open-mercato/ui": "0.8.1-develop.7225.1.73190a4a95",
+    "@open-mercato/ai-assistant": "0.8.1-develop.7228.1.b7ea09d2d3",
+    "@open-mercato/shared": "0.8.1-develop.7228.1.b7ea09d2d3",
+    "@open-mercato/ui": "0.8.1-develop.7228.1.b7ea09d2d3",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.8.1-develop.7225.1.73190a4a95",
-    "@open-mercato/shared": "0.8.1-develop.7225.1.73190a4a95",
-    "@open-mercato/ui": "0.8.1-develop.7225.1.73190a4a95",
+    "@open-mercato/ai-assistant": "0.8.1-develop.7228.1.b7ea09d2d3",
+    "@open-mercato/shared": "0.8.1-develop.7228.1.b7ea09d2d3",
+    "@open-mercato/ui": "0.8.1-develop.7228.1.b7ea09d2d3",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/communication_channels/api/post/channels/[id]/import-history/route.ts

@@ -8,6 +8,7 @@ import type { CrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { CommunicationChannel } from '../../../../../data/entities'
 import { ChannelAccessDeniedError, assertCanManageChannel } from '../../../../../lib/access-control'
 import {
+  getQueueImportHistorySchema,
   queueImportHistory,
   queueImportHistorySchema,
 } from '../../../../../commands/queue-import-history'
@@ -50,6 +51,10 @@ type RouteContext = {
 
 const bodySchema = queueImportHistorySchema.omit({ channelId: true })
 
+function buildBodySchema() {
+  return getQueueImportHistorySchema().omit({ channelId: true })
+}
+
 export async function POST(req: Request, context: RouteContext): Promise<Response> {
   const { id } = await context.params
   if (!z.string().uuid().safeParse(id).success) {
@@ -70,7 +75,7 @@ export async function POST(req: Request, context: RouteContext): Promise<Respons
   } catch {
     return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })
   }
-  const parsed = bodySchema.safeParse(rawBody)
+  const parsed = buildBodySchema().safeParse(rawBody)
   if (!parsed.success) {
     const first = parsed.error.issues[0]
     return NextResponse.json(

package/src/modules/communication_channels/backend/profile/communication-channels/page.tsx

@@ -2,6 +2,7 @@
 
 import * as React from 'react'
 import { extensionPoints } from '@open-mercato/core/modules/communication_channels/extension-points'
+import { getImportHistoryLimits } from '@open-mercato/core/modules/communication_channels/lib/import-history-limits'
 import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { useRouter, useSearchParams } from 'next/navigation'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
@@ -574,6 +575,7 @@ type ImportHistoryDialogProps = {
 
 function ImportHistoryDialog({ channel, onClose, onQueued }: ImportHistoryDialogProps): React.JSX.Element {
   const t = useT()
+  const importLimits = React.useMemo(() => getImportHistoryLimits(channel?.providerKey), [channel?.providerKey])
   const [sinceDays, setSinceDays] = React.useState('30')
   const [contactEmails, setContactEmails] = React.useState('')
   const [maxMessages, setMaxMessages] = React.useState('500')
@@ -599,16 +601,18 @@ function ImportHistoryDialog({ channel, onClose, onQueued }: ImportHistoryDialog
     const sinceNum = Number.parseInt(sinceDays, 10)
     const maxNum = Number.parseInt(maxMessages, 10)
     const errors: Record<string, string> = {}
-    if (!Number.isFinite(sinceNum) || sinceNum < 1 || sinceNum > 365) {
+    if (!Number.isFinite(sinceNum) || sinceNum < 1 || sinceNum > importLimits.maxSinceDays) {
       errors.sinceDays = t(
         'communication_channels.profile.importHistory.errors.sinceDays',
-        'Choose a number between 1 and 365 days.',
+        'Choose a number between 1 and {max} days.',
+        { max: importLimits.maxSinceDays },
       )
     }
-    if (!Number.isFinite(maxNum) || maxNum < 1 || maxNum > 5000) {
+    if (!Number.isFinite(maxNum) || maxNum < 1 || maxNum > importLimits.maxMessages) {
       errors.maxMessages = t(
         'communication_channels.profile.importHistory.errors.maxMessages',
-        'Choose a number between 1 and 5000 messages.',
+        'Choose a number between 1 and {max} messages.',
+        { max: importLimits.maxMessages },
       )
     }
     const parsedEmails = contactEmails
@@ -686,7 +690,7 @@ function ImportHistoryDialog({ channel, onClose, onQueued }: ImportHistoryDialog
       'success',
     )
     onQueued()
-  }, [channel, sinceDays, maxMessages, contactEmails, submitting, t, onQueued, retryLastMutation, runMutation])
+  }, [channel, sinceDays, maxMessages, contactEmails, submitting, t, onQueued, retryLastMutation, runMutation, importLimits])
 
   const handleKeyDown = React.useCallback(
     (event: React.KeyboardEvent) => {
@@ -722,7 +726,7 @@ function ImportHistoryDialog({ channel, onClose, onQueued }: ImportHistoryDialog
               id="import-history-since"
               type="number"
               min={1}
-              max={365}
+              max={importLimits.maxSinceDays}
               value={sinceDays}
               onChange={(e) => setSinceDays(e.target.value)}
               aria-invalid={Boolean(fieldErrors.sinceDays)}
@@ -770,7 +774,7 @@ function ImportHistoryDialog({ channel, onClose, onQueued }: ImportHistoryDialog
               id="import-history-max"
               type="number"
               min={1}
-              max={5000}
+              max={importLimits.maxMessages}
               value={maxMessages}
               onChange={(e) => setMaxMessages(e.target.value)}
               aria-invalid={Boolean(fieldErrors.maxMessages)}

package/src/modules/communication_channels/commands/queue-import-history.ts

@@ -10,6 +10,11 @@ import type {
 import { CommunicationChannel } from '../data/entities'
 import { getChannelAdapterRegistry } from '../lib/adapter-registry-singleton'
 import { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from '../lib/queue'
+import {
+  IMPORT_HISTORY_MAX_CONTACT_EMAILS,
+  getImportHistoryLimits,
+  type ImportHistoryLimits,
+} from '../lib/import-history-limits'
 
 /**
  * Spec B § Phase B6 — operator-triggered backlog import.
@@ -24,17 +29,40 @@ import { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from '..
  * dropped guard is still safe.
  */
 
-export const queueImportHistorySchema = z.object({
-  channelId: z.string().uuid(),
-  sinceDays: z.number().int().min(1).max(365).default(30),
-  contactEmails: z
-    .array(z.string().email().max(255))
-    .max(200)
-    .optional(),
-  maxMessages: z.number().int().min(1).max(5000).default(1000),
-})
+export function createQueueImportHistorySchema(limits: ImportHistoryLimits = getImportHistoryLimits()) {
+  return z.object({
+    channelId: z.string().uuid(),
+    sinceDays: z.number().int().min(1).max(limits.maxSinceDays).default(limits.defaultSinceDays),
+    contactEmails: z
+      .array(z.string().email().max(255))
+      .max(IMPORT_HISTORY_MAX_CONTACT_EMAILS)
+      .optional(),
+    maxMessages: z.number().int().min(1).max(limits.maxMessages).default(limits.defaultMaxMessages),
+  })
+}
+
+export type QueueImportHistorySchema = ReturnType<typeof createQueueImportHistorySchema>
+
+let cachedSchema: { key: string; schema: QueueImportHistorySchema } | null = null
+
+/**
+ * The ceilings come from env, which a test may change after this module was
+ * imported, so the schema is rebuilt whenever the effective limits differ from
+ * the ones the cached instance was built with.
+ */
+export function getQueueImportHistorySchema(): QueueImportHistorySchema {
+  const limits = getImportHistoryLimits()
+  const key = `${limits.maxSinceDays}:${limits.maxMessages}`
+  if (!cachedSchema || cachedSchema.key !== key) {
+    cachedSchema = { key, schema: createQueueImportHistorySchema(limits) }
+  }
+  return cachedSchema.schema
+}
+
+/** Retained for callers that need a statically typed schema instance. */
+export const queueImportHistorySchema = getQueueImportHistorySchema()
 
-export type QueueImportHistoryInput = z.infer<typeof queueImportHistorySchema>
+export type QueueImportHistoryInput = z.infer<QueueImportHistorySchema>
 
 export interface QueueImportHistoryScope {
   tenantId: string
@@ -63,7 +91,7 @@ export async function queueImportHistory(params: {
   scope: QueueImportHistoryScope
   input: QueueImportHistoryInput
 }): Promise<QueueImportHistoryResult> {
-  const input = queueImportHistorySchema.parse(params.input)
+  const input = getQueueImportHistorySchema().parse(params.input)
   const { container, scope } = params
 
   const em = (container.resolve('em') as EntityManager).fork()
@@ -117,6 +145,26 @@ export async function queueImportHistory(params: {
     )
   }
 
+  // The schema above validated against the deployment-wide ceiling; some
+  // providers (IMAP) have a lower ceiling of their own (see
+  // `import-history-limits.ts`). Reject rather than silently truncate — the
+  // adapter itself has no way to report back "I clamped your request".
+  const providerLimits = getImportHistoryLimits(channel.providerKey)
+  if (input.sinceDays > providerLimits.maxSinceDays) {
+    throw createCrudFormError(
+      'sinceDays exceeds the limit for this provider',
+      { sinceDays: `Provider "${channel.providerKey}" supports at most ${providerLimits.maxSinceDays} days` },
+      { status: 400 },
+    )
+  }
+  if (input.maxMessages > providerLimits.maxMessages) {
+    throw createCrudFormError(
+      'maxMessages exceeds the limit for this provider',
+      { maxMessages: `Provider "${channel.providerKey}" supports at most ${providerLimits.maxMessages} messages` },
+      { status: 400 },
+    )
+  }
+
   const progressService = container.resolve('progressService') as ProgressService
   const progressContext: ProgressServiceContext = {
     tenantId: scope.tenantId,

package/src/modules/communication_channels/i18n/de.json

@@ -110,8 +110,8 @@
   "communication_channels.profile.importHistory.cancel": "Abbrechen",
   "communication_channels.profile.importHistory.description": "Ältere Nachrichten abrufen, die dieser Kanal beim Verbinden noch nicht gesehen hat. Filter schränken die Suche serverseitig ein.",
   "communication_channels.profile.importHistory.errors.contactEmails": "Mindestens ein Eintrag ist keine gültige E-Mail-Adresse.",
-  "communication_channels.profile.importHistory.errors.maxMessages": "Wählen Sie eine Zahl zwischen 1 und 5000 Nachrichten.",
-  "communication_channels.profile.importHistory.errors.sinceDays": "Wählen Sie eine Zahl zwischen 1 und 365 Tagen.",
+  "communication_channels.profile.importHistory.errors.maxMessages": "Wählen Sie eine Zahl zwischen 1 und {max} Nachrichten.",
+  "communication_channels.profile.importHistory.errors.sinceDays": "Wählen Sie eine Zahl zwischen 1 und {max} Tagen.",
   "communication_channels.profile.importHistory.fields.contactEmails": "Nach Absender filtern (optional)",
   "communication_channels.profile.importHistory.fields.contactEmailsHint": "Leer lassen, um alle Absender im Zeitraum zu scannen.",
   "communication_channels.profile.importHistory.fields.contactEmailsPlaceholder": "alice@example.com, bob@example.com",

package/src/modules/communication_channels/i18n/en.json

@@ -110,8 +110,8 @@
   "communication_channels.profile.importHistory.cancel": "Cancel",
   "communication_channels.profile.importHistory.description": "Pull older messages this channel never observed at connect-time. Filters narrow the search server-side.",
   "communication_channels.profile.importHistory.errors.contactEmails": "One or more entries is not a valid email address.",
-  "communication_channels.profile.importHistory.errors.maxMessages": "Choose a number between 1 and 5000 messages.",
-  "communication_channels.profile.importHistory.errors.sinceDays": "Choose a number between 1 and 365 days.",
+  "communication_channels.profile.importHistory.errors.maxMessages": "Choose a number between 1 and {max} messages.",
+  "communication_channels.profile.importHistory.errors.sinceDays": "Choose a number between 1 and {max} days.",
   "communication_channels.profile.importHistory.fields.contactEmails": "Filter by sender (optional)",
   "communication_channels.profile.importHistory.fields.contactEmailsHint": "Leave empty to scan all senders in the window.",
   "communication_channels.profile.importHistory.fields.contactEmailsPlaceholder": "alice@example.com, bob@example.com",

package/src/modules/communication_channels/i18n/es.json

@@ -110,8 +110,8 @@
   "communication_channels.profile.importHistory.cancel": "Cancelar",
   "communication_channels.profile.importHistory.description": "Recupera mensajes anteriores que este canal no vio al conectarse. Los filtros restringen la búsqueda en el servidor.",
   "communication_channels.profile.importHistory.errors.contactEmails": "Una o más entradas no es una dirección de correo válida.",
-  "communication_channels.profile.importHistory.errors.maxMessages": "Elige un número entre 1 y 5000 mensajes.",
-  "communication_channels.profile.importHistory.errors.sinceDays": "Elige un número entre 1 y 365 días.",
+  "communication_channels.profile.importHistory.errors.maxMessages": "Elige un número entre 1 y {max} mensajes.",
+  "communication_channels.profile.importHistory.errors.sinceDays": "Elige un número entre 1 y {max} días.",
   "communication_channels.profile.importHistory.fields.contactEmails": "Filtrar por remitente (opcional)",
   "communication_channels.profile.importHistory.fields.contactEmailsHint": "Déjalo vacío para analizar todos los remitentes en el rango.",
   "communication_channels.profile.importHistory.fields.contactEmailsPlaceholder": "alice@example.com, bob@example.com",

package/src/modules/communication_channels/i18n/ko.json

@@ -110,8 +110,8 @@
   "communication_channels.profile.importHistory.cancel": "취소",
   "communication_channels.profile.importHistory.description": "연결 시점에 확인되지 않았던 이전 메시지를 가져옵니다. 필터는 서버 측에서 검색 범위를 좁힙니다.",
   "communication_channels.profile.importHistory.errors.contactEmails": "하나 이상의 항목이 유효한 이메일 주소가 아닙니다.",
-  "communication_channels.profile.importHistory.errors.maxMessages": "1에서 5000 사이의 메시지 수를 선택하세요.",
-  "communication_channels.profile.importHistory.errors.sinceDays": "1에서 365일 사이의 일 수를 선택하세요.",
+  "communication_channels.profile.importHistory.errors.maxMessages": "1에서 {max} 사이의 메시지 수를 선택하세요.",
+  "communication_channels.profile.importHistory.errors.sinceDays": "1에서 {max}일 사이의 일 수를 선택하세요.",
   "communication_channels.profile.importHistory.fields.contactEmails": "발신자로 필터링 (선택 사항)",
   "communication_channels.profile.importHistory.fields.contactEmailsHint": "기간 내 모든 발신자를 검색하려면 비워두세요.",
   "communication_channels.profile.importHistory.fields.contactEmailsPlaceholder": "alice@example.com, bob@example.com",

package/src/modules/communication_channels/i18n/pl.json

@@ -110,8 +110,8 @@
   "communication_channels.profile.importHistory.cancel": "Anuluj",
   "communication_channels.profile.importHistory.description": "Pobierz starsze wiadomości, których kanał nie widział w momencie połączenia. Filtry zawężają wyszukiwanie po stronie serwera.",
   "communication_channels.profile.importHistory.errors.contactEmails": "Co najmniej jeden wpis nie jest poprawnym adresem e-mail.",
-  "communication_channels.profile.importHistory.errors.maxMessages": "Wybierz liczbę z zakresu od 1 do 5000 wiadomości.",
-  "communication_channels.profile.importHistory.errors.sinceDays": "Wybierz liczbę z zakresu od 1 do 365 dni.",
+  "communication_channels.profile.importHistory.errors.maxMessages": "Wybierz liczbę z zakresu od 1 do {max} wiadomości.",
+  "communication_channels.profile.importHistory.errors.sinceDays": "Wybierz liczbę z zakresu od 1 do {max} dni.",
   "communication_channels.profile.importHistory.fields.contactEmails": "Filtruj po nadawcy (opcjonalnie)",
   "communication_channels.profile.importHistory.fields.contactEmailsHint": "Pozostaw puste, aby skanować wszystkich nadawców w zakresie.",
   "communication_channels.profile.importHistory.fields.contactEmailsPlaceholder": "alice@example.com, bob@example.com",

package/src/modules/communication_channels/index.ts

@@ -3,6 +3,7 @@ export const metadata = {
   title: 'Communication Channels',
   description:
     'Unified hub bridging external chat/email channels (Slack, WhatsApp, Email) to the Messages module. Adapter contract, channel-native payload storage, reactions, and per-channel threading.',
+  requires: ['progress'],
 }
 
 export default metadata

package/src/modules/communication_channels/lib/adapter.ts

@@ -368,7 +368,10 @@ export interface ApplyPushNotificationInput {
 export interface ImportHistoryInput {
   credentials: Record<string, unknown>
   scope: TenantScope
-  /** Look back at most this many days. Clamped 1..365 by the hub. */
+  /**
+   * Look back at most this many days. The hub accepts 1..`OM_IMPORT_HISTORY_MAX_SINCE_DAYS`
+   * (default ceiling 3650, i.e. ten years) and defaults to 30 when omitted.
+   */
   sinceDays: number
   /**
    * Optional sender-filter hint. Adapters SHOULD use it for server-side
@@ -376,7 +379,10 @@ export interface ImportHistoryInput {
    * import scans the entire `SINCE` window.
    */
   contactEmails?: string[]
-  /** Total cap across all pages. Hub default 1000. Adapter MUST respect. */
+  /**
+   * Total cap across all pages. Hub default 1000, accepted up to
+   * `OM_IMPORT_HISTORY_MAX_MESSAGES` (default ceiling 50000). Adapter MUST respect.
+   */
   maxMessages?: number
   /** Opaque resumption cursor returned by the previous page. */
   cursor?: string

package/src/modules/communication_channels/lib/import-history-limits.ts

@@ -0,0 +1,109 @@
+/**
+ * Single source of truth for the operator-triggered history-import bounds.
+ *
+ * Defaults are the values a request gets when it omits the field; ceilings are
+ * the largest value the hub accepts. Ceilings are deliberately wide enough for
+ * a multi-year backfill and can be raised or lowered per deployment through
+ * `OM_IMPORT_HISTORY_MAX_SINCE_DAYS` / `OM_IMPORT_HISTORY_MAX_MESSAGES`.
+ *
+ * Env is read at call time (not module load) so a deployment can change the
+ * ceiling without a rebuild, and so tests can exercise the override. In the
+ * browser bundle the variables are absent and the built-in ceilings apply —
+ * client-side validation is a UX affordance, the API remains the authority.
+ */
+
+export const IMPORT_HISTORY_DEFAULT_SINCE_DAYS = 30
+export const IMPORT_HISTORY_DEFAULT_MAX_MESSAGES = 1000
+
+export const IMPORT_HISTORY_MAX_SINCE_DAYS_FALLBACK = 3650
+export const IMPORT_HISTORY_MAX_MESSAGES_FALLBACK = 50000
+
+export const IMPORT_HISTORY_MAX_CONTACT_EMAILS = 200
+
+export const IMPORT_HISTORY_MIN_PAGE_BUDGET = 100
+export const IMPORT_HISTORY_ABSOLUTE_MAX_PAGES = 10000
+
+/**
+ * Consecutive pages that may return no messages while the adapter still claims
+ * `hasMore` and advances its cursor. Empty pages are legitimate: the Gmail
+ * adapter drops messages that returned 404/410 between listing and fetching,
+ * and server-side filters can eliminate a whole page. A stuck adapter is caught
+ * by the repeated-cursor check, so this counter only has to bound the run when
+ * the cursor keeps moving but nothing is ever returned.
+ */
+export const IMPORT_HISTORY_MAX_EMPTY_PAGES = 10
+
+export const IMPORT_HISTORY_MAX_SINCE_DAYS_ENV = 'OM_IMPORT_HISTORY_MAX_SINCE_DAYS'
+export const IMPORT_HISTORY_MAX_MESSAGES_ENV = 'OM_IMPORT_HISTORY_MAX_MESSAGES'
+
+export type ImportHistoryLimits = {
+  defaultSinceDays: number
+  defaultMaxMessages: number
+  maxSinceDays: number
+  maxMessages: number
+}
+
+function readPositiveIntEnv(name: string, fallback: number): number {
+  const raw = typeof process !== 'undefined' ? process.env?.[name] : undefined
+  const parsed = Number.parseInt(raw ?? '', 10)
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback
+}
+
+export function getImportHistoryMaxSinceDays(): number {
+  return Math.max(
+    IMPORT_HISTORY_DEFAULT_SINCE_DAYS,
+    readPositiveIntEnv(IMPORT_HISTORY_MAX_SINCE_DAYS_ENV, IMPORT_HISTORY_MAX_SINCE_DAYS_FALLBACK),
+  )
+}
+
+export function getImportHistoryMaxMessages(): number {
+  return Math.max(
+    IMPORT_HISTORY_DEFAULT_MAX_MESSAGES,
+    readPositiveIntEnv(IMPORT_HISTORY_MAX_MESSAGES_ENV, IMPORT_HISTORY_MAX_MESSAGES_FALLBACK),
+  )
+}
+
+/**
+ * Per-provider ceilings, lower than the deployment-wide ceiling above.
+ *
+ * The IMAP adapter's cursor embeds the *entire* remaining UID list discovered
+ * by `SEARCH` (unlike Gmail's opaque `nextPageToken` cursor), so a wide ceiling
+ * there means a multi-megabyte cursor round-tripping through the worker on
+ * every page. Until that adapter gets a paging cursor of its own, its ceiling
+ * stays at the pre-widening values so the dialog, the hub's validation, and the
+ * adapter's own clamp (`packages/channel-imap/.../adapter.ts`) agree — a
+ * request above this is rejected rather than silently truncated.
+ */
+const PROVIDER_MAX_SINCE_DAYS: Record<string, number> = {
+  imap: 365,
+}
+const PROVIDER_MAX_MESSAGES: Record<string, number> = {
+  imap: 5000,
+}
+
+export function getImportHistoryLimits(providerKey?: string): ImportHistoryLimits {
+  const maxSinceDays = getImportHistoryMaxSinceDays()
+  const maxMessages = getImportHistoryMaxMessages()
+  const providerMaxSinceDays = providerKey ? PROVIDER_MAX_SINCE_DAYS[providerKey] : undefined
+  const providerMaxMessages = providerKey ? PROVIDER_MAX_MESSAGES[providerKey] : undefined
+  return {
+    defaultSinceDays: IMPORT_HISTORY_DEFAULT_SINCE_DAYS,
+    defaultMaxMessages: IMPORT_HISTORY_DEFAULT_MAX_MESSAGES,
+    maxSinceDays: providerMaxSinceDays !== undefined ? Math.min(maxSinceDays, providerMaxSinceDays) : maxSinceDays,
+    maxMessages: providerMaxMessages !== undefined ? Math.min(maxMessages, providerMaxMessages) : maxMessages,
+  }
+}
+
+/**
+ * Page budget for the import drain loop, derived from the effective message cap
+ * so a large import is never truncated before it reaches that cap. It is only a
+ * backstop: an adapter that never makes progress is stopped much earlier by the
+ * consecutive-empty-page guard.
+ */
+export function resolveImportHistoryPageBudget(maxMessages: number): number {
+  if (!Number.isFinite(maxMessages) || maxMessages <= 0) return IMPORT_HISTORY_MIN_PAGE_BUDGET
+  return Math.min(
+    IMPORT_HISTORY_ABSOLUTE_MAX_PAGES,
+    Math.max(IMPORT_HISTORY_MIN_PAGE_BUDGET, Math.ceil(maxMessages)),
+  )
+}

package/src/modules/communication_channels/workers/channel-import-history.ts

@@ -10,6 +10,10 @@ import {
 import { COMMUNICATION_CHANNELS_QUEUES } from '../lib/queue'
 import { refreshCredentialsIfNeeded } from '../lib/credential-refresh'
 import { classifyOutboundError } from '../lib/error-classification'
+import {
+  IMPORT_HISTORY_MAX_EMPTY_PAGES,
+  resolveImportHistoryPageBudget,
+} from '../lib/import-history-limits'
 import type { ChannelAdapterRegistry } from '../lib/registry'
 import type {
   ChannelImportHistoryJobPayload,
@@ -159,16 +163,21 @@ export default async function handle(
     let totalCount = maxMessages
     let firstPage = true
 
-    // Bounded loop guards against a misbehaving adapter (infinite hasMore).
-    // 100 pages * HARD_CAP (default 200) = 20k messages — far above the 5k cap
-    // enforced by the schema, so this only trips on adapter bugs.
-    const MAX_PAGES = 100
-    for (let pageIndex = 0; pageIndex < MAX_PAGES; pageIndex += 1) {
+    // Guards against an adapter that claims `hasMore` forever. An empty page is
+    // NOT a fault on its own — adapters legitimately drop every message on a
+    // page (Gmail 404/410 between listing and fetching, server-side filters) —
+    // so the hard stop is a cursor that stops advancing; the empty-page counter
+    // and the page budget are backstops.
+    const maxPages = resolveImportHistoryPageBudget(maxMessages)
+    let consecutiveEmptyPages = 0
+    let truncationReason: string | null = null
+    for (let pageIndex = 0; pageIndex < maxPages; pageIndex += 1) {
       if (await progressService.isCancellationRequested(progressJobId, scope.tenantId, scope.organizationId)) {
         await progressService.markCancelled(progressJobId, progressContext)
         return
       }
 
+      const requestedCursor = cursor
       const page = await adapter.importHistory!({
         credentials,
         scope: { tenantId: scope.tenantId, organizationId: scope.organizationId },
@@ -178,6 +187,21 @@ export default async function handle(
         cursor,
       })
 
+      if (page.hasMore && page.nextCursor !== undefined && page.nextCursor === requestedCursor) {
+        truncationReason = 'adapter repeated the same pagination cursor'
+        break
+      }
+
+      if (page.messages.length === 0 && page.hasMore) {
+        consecutiveEmptyPages += 1
+        if (consecutiveEmptyPages >= IMPORT_HISTORY_MAX_EMPTY_PAGES) {
+          truncationReason = `adapter returned no messages on ${consecutiveEmptyPages} consecutive pages`
+          break
+        }
+      } else {
+        consecutiveEmptyPages = 0
+      }
+
       if (firstPage && typeof page.totalCandidates === 'number') {
         totalCount = Math.min(maxMessages, page.totalCandidates)
         await progressService.updateProgress(
@@ -225,6 +249,23 @@ export default async function handle(
       if (processedCount >= maxMessages) break
       if (!page.hasMore || !page.nextCursor) break
       cursor = page.nextCursor
+      if (pageIndex === maxPages - 1) {
+        truncationReason = `page budget of ${maxPages} exhausted while the adapter still reported more messages`
+      }
+    }
+
+    if (truncationReason) {
+      // Surfaced as a failed job on purpose: the operator must see that the
+      // backlog is incomplete rather than a clean "imported N" summary.
+      logger.warn('history import stopped early', { channelId: channel.id, reason: truncationReason, processedCount })
+      await progressService.failJob(
+        progressJobId,
+        {
+          errorMessage: `History import stopped early after ${processedCount} messages: ${truncationReason}`,
+        },
+        progressContext,
+      )
+      return
     }
 
     await progressService.completeJob(

package/src/modules/query_index/lib/engine.ts

@@ -38,6 +38,7 @@ import { resolveListCountCap } from '@open-mercato/shared/lib/query/count-cap'
 import { mapWithConcurrency } from '@open-mercato/shared/lib/query/bounded-decrypt'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { parseNumberWithDefault } from '@open-mercato/shared/lib/number'
+import { createBoundedTtlMemo } from '@open-mercato/shared/lib/query/bounded-ttl-memo'
 
 const logger = createLogger('query_index').child({ component: 'engine' })
 
@@ -83,6 +84,24 @@ function markAutoReindexScheduled(key: string, debounceMs: number, now: number):
   return true
 }
 
+/** Only `true` is cached: a cached `false` would keep routing to the fallback engine after a migration creates the table. */
+const baseTableExistsCache = createBoundedTtlMemo<true>({
+  ttlEnv: 'OM_QUERY_INDEX_BASE_TABLE_EXISTS_CACHE_MS',
+  maxEntriesEnv: 'OM_QUERY_INDEX_BASE_TABLE_EXISTS_CACHE_MAX_ENTRIES',
+  defaultTtlMs: 3_600_000,
+  defaultMaxEntries: 1_000,
+})
+
+/** Test-only: the module-scoped memo would otherwise leak state across specs. */
+export function clearBaseTableExistsCache(): void {
+  baseTableExistsCache.clear()
+}
+
+/** Test-only: entry count of the table-existence memo, for the cap regression test. */
+export function baseTableExistsCacheSize(): number {
+  return baseTableExistsCache.size()
+}
+
 function buildFilterableCustomFieldJoins(
   sources: QueryCustomFieldSource[] | undefined,
 ): Array<{
@@ -2162,13 +2181,16 @@ export class HybridQueryEngine implements QueryEngine {
   }
 
   private async tableExists(table: string): Promise<boolean> {
+    if (baseTableExistsCache.get(table)) return true
     const db = this.getDb() as any
     const exists = await db
       .selectFrom('information_schema.tables')
       .select(sql<number>`1`.as('one'))
       .where('table_name', '=', table)
       .executeTakeFirst()
-    return !!exists
+    const present = !!exists
+    if (present) baseTableExistsCache.set(table, true)
+    return present
   }
 
   private async resolveAvailableCustomFieldKeys(entityIds: string[], tenantId: string | null): Promise<string[]> {