@open-mercato/core 0.8.1-develop.7294.1.0ef99fc518 → 0.8.1-develop.7296.1.2111d779db

package/dist/modules/query_index/lib/stale.js

@@ -1,4 +1,9 @@
 import { sql } from "kysely";
+import { recordIndexerError } from "@open-mercato/shared/lib/indexers/error-log";
+async function searchTokensTableExists(db) {
+  const row = await db.selectFrom("information_schema.tables").select(sql`1`.as("one")).where("table_name", "=", "search_tokens").limit(1).executeTakeFirst();
+  return !!row;
+}
 async function purgeOrphans(db, options) {
   const { entityType, tenantId, partitionIndex, partitionCount, startedAt } = options;
   let q = db.deleteFrom("entity_indexes").where("entity_type", "=", entityType);
@@ -16,6 +21,43 @@ async function purgeOrphans(db, options) {
     q = q.where("entity_id", "not in", options.excludeRecordIds);
   }
   await q.execute();
+  try {
+    if (!await searchTokensTableExists(db)) return;
+    let tokens = db.deleteFrom("search_tokens").where("entity_type", "=", entityType);
+    if (tenantId !== void 0) {
+      tokens = tenantId === null ? tokens.where("tenant_id", "is", null) : tokens.where("tenant_id", "=", tenantId);
+    }
+    if (options.organizationId !== void 0) {
+      tokens = options.organizationId === null ? tokens.where("organization_id", "is", null) : tokens.where("organization_id", "=", options.organizationId);
+    }
+    if (partitionIndex != null && partitionCount != null) {
+      tokens = tokens.where(sql`mod(abs(hashtext(entity_id::text)), ${partitionCount}) = ${partitionIndex}`);
+    }
+    tokens = tokens.where("created_at", "<", startedAt);
+    if (options.excludeRecordIds?.length) {
+      tokens = tokens.where("entity_id", "not in", options.excludeRecordIds);
+    }
+    tokens = tokens.where(sql`not exists (
+      select 1 from entity_indexes as surviving
+      where surviving.entity_type = ${entityType}
+        and surviving.entity_id = search_tokens.entity_id
+        and surviving.tenant_id is not distinct from search_tokens.tenant_id
+        and surviving.organization_id is not distinct from search_tokens.organization_id
+    )`);
+    await tokens.execute();
+  } catch (searchTokenError) {
+    await recordIndexerError(
+      { db },
+      {
+        source: "fulltext",
+        handler: "query_index:purge-orphans",
+        error: searchTokenError,
+        entityType,
+        tenantId: tenantId ?? null,
+        organizationId: options.organizationId ?? null
+      }
+    ).catch(() => void 0);
+  }
 }
 export {
   purgeOrphans

package/dist/modules/query_index/lib/stale.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/query_index/lib/stale.ts"],
-  "sourcesContent": ["import { type Kysely, sql } from 'kysely'\n\ntype PurgeOrphansOptions = {\n  entityType: string\n  tenantId?: string | null\n  organizationId?: string | null\n  partitionIndex: number | null\n  partitionCount: number | null\n  startedAt: Date\n  /**\n   * Records whose index rows must be preserved even though this run did not refresh\n   * them. A row that failed to be written still looks untouched to the `updated_at`\n   * predicate below, so without this the purge would delete the very entries the run\n   * failed to rebuild.\n   */\n  excludeRecordIds?: string[]\n}\n\nexport async function purgeOrphans(\n  db: Kysely<any>,\n  options: PurgeOrphansOptions,\n): Promise<void> {\n  const { entityType, tenantId, partitionIndex, partitionCount, startedAt } = options\n  let q = db.deleteFrom('entity_indexes' as any).where('entity_type' as any, '=', entityType)\n  if (tenantId !== undefined) {\n    q = q.where(sql<boolean>`tenant_id is not distinct from ${tenantId ?? null}`)\n  }\n  if (options.organizationId !== undefined) {\n    q = q.where(sql<boolean>`organization_id is not distinct from ${options.organizationId ?? null}`)\n  }\n  if (partitionIndex != null && partitionCount != null) {\n    q = q.where(sql<boolean>`mod(abs(hashtext(entity_id::text)), ${partitionCount}) = ${partitionIndex}`)\n  }\n  q = q.where('updated_at' as any, '<', startedAt as any)\n  if (options.excludeRecordIds?.length) {\n    q = q.where('entity_id' as any, 'not in', options.excludeRecordIds)\n  }\n  await q.execute()\n}\n"],
-  "mappings": "AAAA,SAAsB,WAAW;AAkBjC,eAAsB,aACpB,IACA,SACe;AACf,QAAM,EAAE,YAAY,UAAU,gBAAgB,gBAAgB,UAAU,IAAI;AAC5E,MAAI,IAAI,GAAG,WAAW,gBAAuB,EAAE,MAAM,eAAsB,KAAK,UAAU;AAC1F,MAAI,aAAa,QAAW;AAC1B,QAAI,EAAE,MAAM,qCAA8C,YAAY,IAAI,EAAE;AAAA,EAC9E;AACA,MAAI,QAAQ,mBAAmB,QAAW;AACxC,QAAI,EAAE,MAAM,2CAAoD,QAAQ,kBAAkB,IAAI,EAAE;AAAA,EAClG;AACA,MAAI,kBAAkB,QAAQ,kBAAkB,MAAM;AACpD,QAAI,EAAE,MAAM,0CAAmD,cAAc,OAAO,cAAc,EAAE;AAAA,EACtG;AACA,MAAI,EAAE,MAAM,cAAqB,KAAK,SAAgB;AACtD,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,QAAI,EAAE,MAAM,aAAoB,UAAU,QAAQ,gBAAgB;AAAA,EACpE;AACA,QAAM,EAAE,QAAQ;AAClB;",
+  "sourcesContent": ["import { type Kysely, sql } from 'kysely'\nimport { recordIndexerError } from '@open-mercato/shared/lib/indexers/error-log'\n\ntype PurgeOrphansOptions = {\n  entityType: string\n  tenantId?: string | null\n  organizationId?: string | null\n  partitionIndex: number | null\n  partitionCount: number | null\n  startedAt: Date\n  /**\n   * Records whose index rows must be preserved even though this run did not refresh\n   * them. A row that failed to be written still looks untouched to the `updated_at`\n   * predicate below, so without this the purge would delete the very entries the run\n   * failed to rebuild.\n   */\n  excludeRecordIds?: string[]\n}\n\n/**\n * `entity_indexes` ships in an earlier migration than `search_tokens`, so a deployment\n * running this code against a not-yet-migrated database has the projection table and not\n * the token table. The query engine probes the same way before reading the table\n * (`shared/lib/search/availability.ts`).\n */\nasync function searchTokensTableExists(db: Kysely<any>): Promise<boolean> {\n  const row = await db\n    .selectFrom('information_schema.tables' as any)\n    .select(sql<number>`1`.as('one') as any)\n    .where('table_name' as any, '=', 'search_tokens')\n    .limit(1)\n    .executeTakeFirst()\n  return !!row\n}\n\nexport async function purgeOrphans(\n  db: Kysely<any>,\n  options: PurgeOrphansOptions,\n): Promise<void> {\n  const { entityType, tenantId, partitionIndex, partitionCount, startedAt } = options\n\n  let q = db.deleteFrom('entity_indexes' as any).where('entity_type' as any, '=', entityType)\n  if (tenantId !== undefined) {\n    q = q.where(sql<boolean>`tenant_id is not distinct from ${tenantId ?? null}`)\n  }\n  if (options.organizationId !== undefined) {\n    q = q.where(sql<boolean>`organization_id is not distinct from ${options.organizationId ?? null}`)\n  }\n  if (partitionIndex != null && partitionCount != null) {\n    q = q.where(sql<boolean>`mod(abs(hashtext(entity_id::text)), ${partitionCount}) = ${partitionIndex}`)\n  }\n  q = q.where('updated_at' as any, '<', startedAt as any)\n  if (options.excludeRecordIds?.length) {\n    q = q.where('entity_id' as any, 'not in', options.excludeRecordIds)\n  }\n  await q.execute()\n\n  // The token sweep runs as its own statement, after the projection delete has committed, and\n  // deliberately cannot fail the run. Its anti-join only needs those deletes to be *visible*,\n  // and a committed delete is as visible as an uncommitted one inside a shared transaction \u2014\n  // so wrapping the pair buys no correctness, only a new fatal path: `reindexer.ts` does not\n  // guard this call and marks the whole job failed on a throw, so a statement timeout on a\n  // large token delete would discard a rebuild whose projections all wrote successfully. The\n  // fallback is the pre-fix steady state: orphan tokens survive, benign, until the next run\n  // sweeps them. This matches how the module already treats token-side failures \u2014\n  // `batch.ts` records a failed token write via `recordIndexerError` rather than counting it\n  // as a write failure, and `indexer.ts` swallows the token delete outside a transaction.\n  try {\n    if (!(await searchTokensTableExists(db))) return\n\n    // Search tokens are written from the same (entity_type, entity_id, tenant_id,\n    // organization_id) tuple as the projection, but nothing above ever touched them, so\n    // every record this run stopped covering kept a queryable token with no presenter \u2014\n    // and token-only orphans left by earlier runs survived every rebuild since.\n    let tokens = db.deleteFrom('search_tokens' as any).where('entity_type' as any, '=', entityType)\n    // `= / is null` rather than the projection sweep's `is not distinct from`: these are bound\n    // constants, so the two spellings are semantically identical here, but only the former can\n    // serve as a btree index condition. Without it the delete uses just the `entity_type` prefix\n    // of `search_tokens_presence_idx (entity_type, tenant_id, organization_id)` and a\n    // tenant-scoped, unpartitioned run reads every tenant's tokens for that entity type \u2014\n    // the same planner trap `shared/lib/search/availability.ts` documents for this table (#4723).\n    // The anti-join below keeps the null-safe form: it compares columns, not constants.\n    if (tenantId !== undefined) {\n      tokens = tenantId === null\n        ? tokens.where('tenant_id' as any, 'is', null)\n        : tokens.where('tenant_id' as any, '=', tenantId)\n    }\n    if (options.organizationId !== undefined) {\n      tokens = options.organizationId === null\n        ? tokens.where('organization_id' as any, 'is', null)\n        : tokens.where('organization_id' as any, '=', options.organizationId)\n    }\n    if (partitionIndex != null && partitionCount != null) {\n      tokens = tokens.where(sql<boolean>`mod(abs(hashtext(entity_id::text)), ${partitionCount}) = ${partitionIndex}`)\n    }\n    // Secondary guard only. `replaceSearchTokensForBatch` returns early for a record whose\n    // tokens are unchanged, so a perfectly current record keeps tokens older than this run\n    // \u2014 a timestamp-driven sweep would make live records unfindable. What this predicate\n    // does earn is the concurrent-writer case: a batch inserts tokens before the matching\n    // projection, so a token written during the run can outrun its own presenter.\n    tokens = tokens.where('created_at' as any, '<', startedAt as any)\n    if (options.excludeRecordIds?.length) {\n      tokens = tokens.where('entity_id' as any, 'not in', options.excludeRecordIds)\n    }\n    // The load-bearing predicate: a token survives while any projection for its own record\n    // and scope survives, soft-deleted ones included. `search_tokens` has a second writer \u2014\n    // `@open-mercato/search`'s token strategy writes rows for the same records under its own\n    // `field` spellings \u2014 and this sweep is safe for those rows only because that strategy\n    // draws its record set from the query engine, i.e. from the very projections consulted\n    // here. Changing where that strategy gets its records would make this delete eat its rows.\n    tokens = tokens.where(sql<boolean>`not exists (\n      select 1 from entity_indexes as surviving\n      where surviving.entity_type = ${entityType}\n        and surviving.entity_id = search_tokens.entity_id\n        and surviving.tenant_id is not distinct from search_tokens.tenant_id\n        and surviving.organization_id is not distinct from search_tokens.organization_id\n    )`)\n    await tokens.execute()\n  } catch (searchTokenError) {\n    await recordIndexerError(\n      { db },\n      {\n        source: 'fulltext',\n        handler: 'query_index:purge-orphans',\n        error: searchTokenError,\n        entityType,\n        tenantId: tenantId ?? null,\n        organizationId: options.organizationId ?? null,\n      },\n    ).catch(() => undefined)\n  }\n}\n"],
+  "mappings": "AAAA,SAAsB,WAAW;AACjC,SAAS,0BAA0B;AAwBnC,eAAe,wBAAwB,IAAmC;AACxE,QAAM,MAAM,MAAM,GACf,WAAW,2BAAkC,EAC7C,OAAO,OAAe,GAAG,KAAK,CAAQ,EACtC,MAAM,cAAqB,KAAK,eAAe,EAC/C,MAAM,CAAC,EACP,iBAAiB;AACpB,SAAO,CAAC,CAAC;AACX;AAEA,eAAsB,aACpB,IACA,SACe;AACf,QAAM,EAAE,YAAY,UAAU,gBAAgB,gBAAgB,UAAU,IAAI;AAE5E,MAAI,IAAI,GAAG,WAAW,gBAAuB,EAAE,MAAM,eAAsB,KAAK,UAAU;AAC1F,MAAI,aAAa,QAAW;AAC1B,QAAI,EAAE,MAAM,qCAA8C,YAAY,IAAI,EAAE;AAAA,EAC9E;AACA,MAAI,QAAQ,mBAAmB,QAAW;AACxC,QAAI,EAAE,MAAM,2CAAoD,QAAQ,kBAAkB,IAAI,EAAE;AAAA,EAClG;AACA,MAAI,kBAAkB,QAAQ,kBAAkB,MAAM;AACpD,QAAI,EAAE,MAAM,0CAAmD,cAAc,OAAO,cAAc,EAAE;AAAA,EACtG;AACA,MAAI,EAAE,MAAM,cAAqB,KAAK,SAAgB;AACtD,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,QAAI,EAAE,MAAM,aAAoB,UAAU,QAAQ,gBAAgB;AAAA,EACpE;AACA,QAAM,EAAE,QAAQ;AAYhB,MAAI;AACF,QAAI,CAAE,MAAM,wBAAwB,EAAE,EAAI;AAM1C,QAAI,SAAS,GAAG,WAAW,eAAsB,EAAE,MAAM,eAAsB,KAAK,UAAU;AAQ9F,QAAI,aAAa,QAAW;AAC1B,eAAS,aAAa,OAClB,OAAO,MAAM,aAAoB,MAAM,IAAI,IAC3C,OAAO,MAAM,aAAoB,KAAK,QAAQ;AAAA,IACpD;AACA,QAAI,QAAQ,mBAAmB,QAAW;AACxC,eAAS,QAAQ,mBAAmB,OAChC,OAAO,MAAM,mBAA0B,MAAM,IAAI,IACjD,OAAO,MAAM,mBAA0B,KAAK,QAAQ,cAAc;AAAA,IACxE;AACA,QAAI,kBAAkB,QAAQ,kBAAkB,MAAM;AACpD,eAAS,OAAO,MAAM,0CAAmD,cAAc,OAAO,cAAc,EAAE;AAAA,IAChH;AAMA,aAAS,OAAO,MAAM,cAAqB,KAAK,SAAgB;AAChE,QAAI,QAAQ,kBAAkB,QAAQ;AACpC,eAAS,OAAO,MAAM,aAAoB,UAAU,QAAQ,gBAAgB;AAAA,IAC9E;AAOA,aAAS,OAAO,MAAM;AAAA;AAAA,sCAEY,UAAU;AAAA;AAAA;AAAA;AAAA,MAI1C;AACF,UAAM,OAAO,QAAQ;AAAA,EACvB,SAAS,kBAAkB;AACzB,UAAM;AAAA,MACJ,EAAE,GAAG;AAAA,MACL;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,OAAO;AAAA,QACP;AAAA,QACA,UAAU,YAAY;AAAA,QACtB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC5C;AAAA,IACF,EAAE,MAAM,MAAM,MAAS;AAAA,EACzB;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.8.1-develop.7294.1.0ef99fc518",
+  "version": "0.8.1-develop.7296.1.2111d779db",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -253,16 +253,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.8.1-develop.7294.1.0ef99fc518",
-    "@open-mercato/shared": "0.8.1-develop.7294.1.0ef99fc518",
-    "@open-mercato/ui": "0.8.1-develop.7294.1.0ef99fc518",
+    "@open-mercato/ai-assistant": "0.8.1-develop.7296.1.2111d779db",
+    "@open-mercato/shared": "0.8.1-develop.7296.1.2111d779db",
+    "@open-mercato/ui": "0.8.1-develop.7296.1.2111d779db",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.8.1-develop.7294.1.0ef99fc518",
-    "@open-mercato/shared": "0.8.1-develop.7294.1.0ef99fc518",
-    "@open-mercato/ui": "0.8.1-develop.7294.1.0ef99fc518",
+    "@open-mercato/ai-assistant": "0.8.1-develop.7296.1.2111d779db",
+    "@open-mercato/shared": "0.8.1-develop.7296.1.2111d779db",
+    "@open-mercato/ui": "0.8.1-develop.7296.1.2111d779db",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/query_index/lib/engine.ts

@@ -39,10 +39,12 @@ import {
   type SearchTokenProbeQueryBuilder,
 } from '@open-mercato/shared/lib/search/availability'
 import { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'
+import { buildContainmentPatterns } from '@open-mercato/shared/lib/search/containment'
 import { runBeforeQueryPipeline, runAfterQueryPipeline, type QueryExtensionContext } from '@open-mercato/shared/lib/query/query-extension-runner'
 import { warnOnCiphertextLikeFallback } from '@open-mercato/shared/lib/query/ciphertext-search-warning'
 import { resolveEncryptedSortFields, resolveEncryptedSortMaxRows, sortRowsInMemory } from '@open-mercato/shared/lib/query/encrypted-sort'
 import { resolveListCountCap } from '@open-mercato/shared/lib/query/count-cap'
+import { resolveCfDefIndexOrgCandidates } from '@open-mercato/shared/lib/crud/custom-field-definition-index'
 import { mapWithConcurrency } from '@open-mercato/shared/lib/query/bounded-decrypt'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { parseNumberWithDefault } from '@open-mercato/shared/lib/number'
@@ -71,6 +73,9 @@ const CF_FILTER_SUPPORTED_OPS = new Set<FilterOp>([
   'eq', 'ne', 'in', 'nin', 'like', 'ilike', 'exists', 'gt', 'gte', 'lt', 'lte',
 ])
 
+/** Custom field kinds stored numerically (`custom_field_values.value_int`/`value_float`) — sort numerically, not as text (#5674). */
+const NUMERIC_CF_SORT_KINDS = new Set(['integer', 'float'])
+
 const DECRYPT_CONCURRENCY = 8
 const AUTO_REINDEX_DEBOUNCE_DEFAULT_MS = 30_000
 const AUTO_REINDEX_DEBOUNCE_MAX_SCOPES = 10_000
@@ -245,6 +250,7 @@ export class HybridQueryEngine implements QueryEngine {
   private coverageStatsTtlMs: number
   private customFieldDefsCache = new Map<string, { expiresAt: number; value: CustomFieldDefRow[] }>()
   private customFieldKeysTtlMs: number
+  private customFieldKindCache = new Map<string, { expiresAt: number; value: Map<string, string> }>()
   private columnCache = new Map<string, boolean>()
   private customEntityCache = new Map<string, boolean>()
   private debugVerbosity: boolean | null = null
@@ -568,6 +574,8 @@ export class HybridQueryEngine implements QueryEngine {
         searchConfig.useIlikeForNonEncryptedFields === true &&
         sourceSearchFilters.some((filter) => !String(filter.field).startsWith('cf:'))
       ) {
+        // Gated on OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS (default false per #5383; set it
+        // to true to opt into the #5803 fix ahead of that follow-up).
         // `ignoreRuntimeHealth` asks the on-disk question -- a column holds ciphertext even while
         // the KMS is down -- so an outage keeps encrypted columns on the token path (#4622).
         // `organizationId: null` is deliberate, not an omission: the service then unions in every
@@ -781,6 +789,18 @@ export class HybridQueryEngine implements QueryEngine {
       )
       const requiresPlaintextSort = encryptedSortFields.size > 0
 
+      const cfSortKeys = Array.from(new Set(
+        resolvedSorts.filter((sort) => sort.field.startsWith('cf:')).map((sort) => sort.field.slice(3))
+      ))
+      const cfSortKinds = cfSortKeys.length
+        ? await this.resolveCustomFieldSortKinds(
+            indexSources.map((source) => String(source.entityId)),
+            opts.tenantId ?? null,
+            resolveCfDefIndexOrgCandidates(opts.organizationIds, fallbackOrgId),
+            cfSortKeys,
+          )
+        : new Map<string, string>()
+
       // ────────────────────────────────────────────────────────────────
       // Build a reusable "applyQueryShape" function that applies every
       // WHERE/JOIN/scope to a fresh SelectQueryBuilder. We use this in
@@ -1188,7 +1208,22 @@ export class HybridQueryEngine implements QueryEngine {
             const textExpr = this.buildCfTextExprSql(fieldName, indexSources)
             if (textExpr) {
               const direction = sql.raw(coerceSortDirection(s.dir))
-              next = next.orderBy(sql`${textExpr} ${direction}`)
+              const kind = cfSortKinds.get(fieldName.slice(3))
+              let sortExpr: RawBuilder<unknown> = textExpr
+              if (kind && NUMERIC_CF_SORT_KINDS.has(kind)) {
+                const jsonExpr = this.buildCfJsonExprSql(fieldName, indexSources)
+                // The index doc does not guarantee a numeric scalar for a
+                // numeric-kind field (ciphertext on an encrypted field, a JSON
+                // array from a multi-value/duplicated-row source, or a stale
+                // value from before the kind changed) — casting unconditionally
+                // turns one bad row into a 500 for the whole list. Only cast
+                // when the doc value is actually a JSON number; anything else
+                // sorts as NULL, same as an unset field (#5674 review).
+                sortExpr = jsonExpr
+                  ? sql`CASE WHEN jsonb_typeof(${jsonExpr}) = 'number' THEN (${textExpr})::numeric END`
+                  : textExpr
+              }
+              next = next.orderBy(sql`${sortExpr} ${direction} NULLS LAST`)
             }
           } else {
             const baseField = resolveBaseColumn(fieldName)
@@ -1196,6 +1231,10 @@ export class HybridQueryEngine implements QueryEngine {
             next = next.orderBy(qualify(baseField), s.dir ?? SortDir.Asc)
           }
         }
+        const lastSortField = resolvedSorts.length ? String(resolvedSorts[resolvedSorts.length - 1].field) : null
+        if (resolvedSorts.length && lastSortField !== 'id') {
+          next = next.orderBy(qualify('id'), SortDir.Asc)
+        }
         return next
       }
 
@@ -1995,6 +2034,20 @@ export class HybridQueryEngine implements QueryEngine {
         ? sql<boolean>`false`
         : sql<boolean>`true`
     }
+    // Reaching here with a resolved encryption map means this is a PLAINTEXT column the gate above
+    // deliberately kept off the token path. Apply the declared containment per word so the token
+    // path's word-order-independent matching survives the reroute (#5803 / TC-RESO-009).
+    if (
+      (filter.op === 'like' || filter.op === 'ilike') &&
+      typeof filter.value === 'string' &&
+      searchRuntime?.enabled &&
+      searchRuntime.encryptedFields != null
+    ) {
+      const patterns = buildContainmentPatterns(filter.value)
+      if (patterns.length > 1) {
+        return eb.and(patterns.map((pattern) => eb(qualify(baseField), filter.op, pattern)))
+      }
+    }
     return this.buildColumnFilterExpression(eb, qualify(baseField), filter.op, filter.value)
   }
 
@@ -2277,6 +2330,64 @@ export class HybridQueryEngine implements QueryEngine {
     return result.slice()
   }
 
+  /**
+   * Resolve the declared `kind` for a set of `cf:` sort keys so `applySort` can
+   * cast numeric kinds instead of ordering by jsonb text (#5674). A same-org
+   * definition wins over a tenant-wide one, which wins over a global one, for
+   * the same key — a same-key definition scoped to a *different* organization
+   * in the tenant never gets to decide the kind (#5674 review).
+   */
+  private async resolveCustomFieldSortKinds(
+    entityIds: string[],
+    tenantId: string | null,
+    organizationIds: string[],
+    keys: string[]
+  ): Promise<Map<string, string>> {
+    if (!entityIds.length || !keys.length) return new Map()
+    const sortedOrgIds = organizationIds.slice().sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))
+    const cacheKey = `${this.customFieldKeysCacheKey(entityIds, tenantId)}|org:${sortedOrgIds.join(',')}|${keys.slice().sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)).join(',')}`
+    const now = Date.now()
+    const cached = this.customFieldKindCache.get(cacheKey)
+    if (cached && cached.expiresAt > now) return new Map(cached.value)
+
+    const db = this.getDb() as any
+    const rows = await db
+      .selectFrom('custom_field_defs')
+      .select(['key', 'kind', 'organization_id', 'tenant_id'])
+      .where('entity_id', 'in', entityIds)
+      .where('key', 'in', keys)
+      .where('is_active', '=', true)
+      .where((eb: any) => eb.or([
+        eb('tenant_id', '=', tenantId),
+        eb('tenant_id', 'is', null),
+      ]))
+      .where((eb: any) => sortedOrgIds.length
+        ? eb.or([
+            eb('organization_id', 'is', null),
+            eb('organization_id', 'in', sortedOrgIds),
+          ])
+        : eb('organization_id', 'is', null))
+      .execute() as Array<{ key: unknown; kind: unknown; organization_id: unknown; tenant_id: unknown }>
+
+    const winners = new Map<string, { kind: string; specificity: number }>()
+    for (const row of rows) {
+      const key = typeof row.key === 'string' ? row.key : String(row.key)
+      const kind = typeof row.kind === 'string' ? row.kind : null
+      if (!kind) continue
+      // Org-scoped beats tenant-wide beats global for the same key; rows from
+      // an unrelated org were already excluded by the WHERE clause above.
+      const specificity = row.organization_id != null ? 2 : row.tenant_id != null ? 1 : 0
+      const existing = winners.get(key)
+      if (!existing || specificity >= existing.specificity) winners.set(key, { kind, specificity })
+    }
+    const result = new Map<string, string>()
+    for (const [key, entry] of winners) result.set(key, entry.kind)
+    if (this.customFieldKeysTtlMs > 0) {
+      this.customFieldKindCache.set(cacheKey, { expiresAt: now + this.customFieldKeysTtlMs, value: new Map(result) })
+    }
+    return result
+  }
+
   private async resolveAvailableCustomFieldKeys(entityIds: string[], tenantId: string | null): Promise<string[]> {
     const defs = await this.resolveCustomFieldDefs(entityIds, tenantId)
     return Array.from(new Set(defs.map((def) => def.key)))
@@ -2735,6 +2846,21 @@ export class HybridQueryEngine implements QueryEngine {
       return q
     }
     const col: any = column
+    // A PLAINTEXT column the gate kept off the token path: AND one containment predicate per word,
+    // which is what the token subquery matched (#5803 / TC-RESO-009). Chained `where`s ARE the AND.
+    if (
+      (filter.op === 'like' || filter.op === 'ilike') &&
+      typeof filter.value === 'string' &&
+      search?.enabled &&
+      search.encryptedFields != null
+    ) {
+      const patterns = buildContainmentPatterns(filter.value)
+      if (patterns.length > 1) {
+        let next = q
+        for (const pattern of patterns) next = next.where(col, filter.op, pattern as any)
+        return next
+      }
+    }
     switch (filter.op) {
       case 'eq':
         return filter.value === null

package/src/modules/query_index/lib/stale.ts

@@ -1,4 +1,5 @@
 import { type Kysely, sql } from 'kysely'
+import { recordIndexerError } from '@open-mercato/shared/lib/indexers/error-log'
 
 type PurgeOrphansOptions = {
   entityType: string
@@ -16,11 +17,28 @@ type PurgeOrphansOptions = {
   excludeRecordIds?: string[]
 }
 
+/**
+ * `entity_indexes` ships in an earlier migration than `search_tokens`, so a deployment
+ * running this code against a not-yet-migrated database has the projection table and not
+ * the token table. The query engine probes the same way before reading the table
+ * (`shared/lib/search/availability.ts`).
+ */
+async function searchTokensTableExists(db: Kysely<any>): Promise<boolean> {
+  const row = await db
+    .selectFrom('information_schema.tables' as any)
+    .select(sql<number>`1`.as('one') as any)
+    .where('table_name' as any, '=', 'search_tokens')
+    .limit(1)
+    .executeTakeFirst()
+  return !!row
+}
+
 export async function purgeOrphans(
   db: Kysely<any>,
   options: PurgeOrphansOptions,
 ): Promise<void> {
   const { entityType, tenantId, partitionIndex, partitionCount, startedAt } = options
+
   let q = db.deleteFrom('entity_indexes' as any).where('entity_type' as any, '=', entityType)
   if (tenantId !== undefined) {
     q = q.where(sql<boolean>`tenant_id is not distinct from ${tenantId ?? null}`)
@@ -36,4 +54,79 @@ export async function purgeOrphans(
     q = q.where('entity_id' as any, 'not in', options.excludeRecordIds)
   }
   await q.execute()
+
+  // The token sweep runs as its own statement, after the projection delete has committed, and
+  // deliberately cannot fail the run. Its anti-join only needs those deletes to be *visible*,
+  // and a committed delete is as visible as an uncommitted one inside a shared transaction —
+  // so wrapping the pair buys no correctness, only a new fatal path: `reindexer.ts` does not
+  // guard this call and marks the whole job failed on a throw, so a statement timeout on a
+  // large token delete would discard a rebuild whose projections all wrote successfully. The
+  // fallback is the pre-fix steady state: orphan tokens survive, benign, until the next run
+  // sweeps them. This matches how the module already treats token-side failures —
+  // `batch.ts` records a failed token write via `recordIndexerError` rather than counting it
+  // as a write failure, and `indexer.ts` swallows the token delete outside a transaction.
+  try {
+    if (!(await searchTokensTableExists(db))) return
+
+    // Search tokens are written from the same (entity_type, entity_id, tenant_id,
+    // organization_id) tuple as the projection, but nothing above ever touched them, so
+    // every record this run stopped covering kept a queryable token with no presenter —
+    // and token-only orphans left by earlier runs survived every rebuild since.
+    let tokens = db.deleteFrom('search_tokens' as any).where('entity_type' as any, '=', entityType)
+    // `= / is null` rather than the projection sweep's `is not distinct from`: these are bound
+    // constants, so the two spellings are semantically identical here, but only the former can
+    // serve as a btree index condition. Without it the delete uses just the `entity_type` prefix
+    // of `search_tokens_presence_idx (entity_type, tenant_id, organization_id)` and a
+    // tenant-scoped, unpartitioned run reads every tenant's tokens for that entity type —
+    // the same planner trap `shared/lib/search/availability.ts` documents for this table (#4723).
+    // The anti-join below keeps the null-safe form: it compares columns, not constants.
+    if (tenantId !== undefined) {
+      tokens = tenantId === null
+        ? tokens.where('tenant_id' as any, 'is', null)
+        : tokens.where('tenant_id' as any, '=', tenantId)
+    }
+    if (options.organizationId !== undefined) {
+      tokens = options.organizationId === null
+        ? tokens.where('organization_id' as any, 'is', null)
+        : tokens.where('organization_id' as any, '=', options.organizationId)
+    }
+    if (partitionIndex != null && partitionCount != null) {
+      tokens = tokens.where(sql<boolean>`mod(abs(hashtext(entity_id::text)), ${partitionCount}) = ${partitionIndex}`)
+    }
+    // Secondary guard only. `replaceSearchTokensForBatch` returns early for a record whose
+    // tokens are unchanged, so a perfectly current record keeps tokens older than this run
+    // — a timestamp-driven sweep would make live records unfindable. What this predicate
+    // does earn is the concurrent-writer case: a batch inserts tokens before the matching
+    // projection, so a token written during the run can outrun its own presenter.
+    tokens = tokens.where('created_at' as any, '<', startedAt as any)
+    if (options.excludeRecordIds?.length) {
+      tokens = tokens.where('entity_id' as any, 'not in', options.excludeRecordIds)
+    }
+    // The load-bearing predicate: a token survives while any projection for its own record
+    // and scope survives, soft-deleted ones included. `search_tokens` has a second writer —
+    // `@open-mercato/search`'s token strategy writes rows for the same records under its own
+    // `field` spellings — and this sweep is safe for those rows only because that strategy
+    // draws its record set from the query engine, i.e. from the very projections consulted
+    // here. Changing where that strategy gets its records would make this delete eat its rows.
+    tokens = tokens.where(sql<boolean>`not exists (
+      select 1 from entity_indexes as surviving
+      where surviving.entity_type = ${entityType}
+        and surviving.entity_id = search_tokens.entity_id
+        and surviving.tenant_id is not distinct from search_tokens.tenant_id
+        and surviving.organization_id is not distinct from search_tokens.organization_id
+    )`)
+    await tokens.execute()
+  } catch (searchTokenError) {
+    await recordIndexerError(
+      { db },
+      {
+        source: 'fulltext',
+        handler: 'query_index:purge-orphans',
+        error: searchTokenError,
+        entityType,
+        tenantId: tenantId ?? null,
+        organizationId: options.organizationId ?? null,
+      },
+    ).catch(() => undefined)
+  }
 }