@ultimat3/admin 31.16.0 → 31.18.0

package/README.md

@@ -85,6 +85,12 @@ the actor may not list has no tile, no segment and no matrix; one that did not o
 no tile and never fails the page. A count reads no row, so it is not audited. Each matrix is a
 closed `<details>` whose summary reads "N of M allowed".
 
+`count: 'estimate'` instead reads `AdminRepo.approximateCount()` — the planner's whole-table
+figure, constant time — when the resource declares no `rows` scope and the estimate is at least
+10,000 rows; the tile reads `~1,200,000` (`admin.dashboard.records.approximate`). Anything else —
+a row scope, a small or never-analysed table, a tenant-scoped or soft-deleting one the estimate
+refuses — is the exact `count()`.
+
 | Input | What it is | Omitted |
 |---|---|---|
 | `entities` | the objects `entity()` returned — `adminEntitiesOf(db)` is every entity the handle serves | required |
@@ -127,7 +133,7 @@ unfiltered list. An empty value is no parameter: a GET form submits every input
 
 | Filter shape | Derived for | Control | Operators (first is the default) |
 |---|---|---|---|
-| `text` | a text column `LIKE` runs against — the label always, others when indexed | search box | `contains` `eq` `neq` `is-null` |
+| `text` | a text column `contains` runs against — the label always, others when indexed; case-insensitive (`ilike`, served by a `gin_trgm_ops` index) | search box | `contains` `eq` `neq` `is-null` |
 | `exact` | a uuid, `bigint` or `numeric` column | text box | `eq` `neq` `in` `is-null` |
 | `choice` | an enum (its own values, labelled by the catalog), a locale, a zone | select | `eq` `neq` `in` `is-null` |
 | `boolean` | a boolean | any / yes / no | `eq` |
@@ -164,6 +170,7 @@ defineAdmin({
 |---|---|
 | `scopes.<name>` | `where` is predicates or `(actor) => predicates`; `default: true` at most once; `count: true` reads `AdminRepo.count` — never the caller's filters, so a tab's number is the scope's size |
 | `rows` | applied by every read of the resource; a row outside it is "not found", exactly as a missing one |
+| a declared `contains` | in `rows` or a scope's `where`: case-SENSITIVE (`like`, `caseSensitive: true` on the filter), on the read and the write — a row scope is authorization and never widens. Only what an operator types — search, list filter, lookup — ignores case |
 | `columns.<name>` | `render`: `badge` · `relative-time` · `money` · `truncate` · `link` · `json`, or `(props) => JSX`; the row it reads carries no sealed column; a name that is also an entity column is refused |
 | `labelField` | what a reference to this resource SHOWS, linked to the row; read once per page per target, never per row |
 
@@ -474,6 +481,8 @@ Reads are audited too, and on both branches: `adminDetail` keys its entry on the
 `adminList` and `adminSearch` key theirs on the table (`entityId: null`), and a refusal is an
 entry of its own. `AdminSearchResult.audit` carries one entry per resource the call decided
 about — searched or refused — so a jump box that walked every readable entity leaves a trace.
+Search is the entity's `contains` per text field — case-insensitive, the `ilike` a `gin_trgm_ops`
+index serves — at most three statements per resource, resources read four at a time.
 
 ## AI-first
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/admin",
-  "version": "31.16.0",
+  "version": "31.18.0",
   "description": "Two dashboards: the /_x framework dev panels and the generated, AI-first app admin",
   "keywords": [
     "ultimate",
@@ -46,21 +46,21 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/action": "31.16.0",
-    "@ultimat3/ai": "31.16.0",
-    "@ultimat3/cache": "31.16.0",
-    "@ultimat3/core": "31.16.0",
-    "@ultimat3/db": "31.16.0",
-    "@ultimat3/entity": "31.16.0",
-    "@ultimat3/http": "31.16.0",
-    "@ultimat3/i18n": "31.16.0",
-    "@ultimat3/jobs": "31.16.0",
-    "@ultimat3/mcp": "31.16.0",
-    "@ultimat3/money": "31.16.0",
-    "@ultimat3/policy": "31.16.0",
-    "@ultimat3/query": "31.16.0",
-    "@ultimat3/render": "31.16.0",
-    "@ultimat3/schema": "31.16.0",
-    "@ultimat3/ui": "31.16.0"
+    "@ultimat3/action": "31.18.0",
+    "@ultimat3/ai": "31.18.0",
+    "@ultimat3/cache": "31.18.0",
+    "@ultimat3/core": "31.18.0",
+    "@ultimat3/db": "31.18.0",
+    "@ultimat3/entity": "31.18.0",
+    "@ultimat3/http": "31.18.0",
+    "@ultimat3/i18n": "31.18.0",
+    "@ultimat3/jobs": "31.18.0",
+    "@ultimat3/mcp": "31.18.0",
+    "@ultimat3/money": "31.18.0",
+    "@ultimat3/policy": "31.18.0",
+    "@ultimat3/query": "31.18.0",
+    "@ultimat3/render": "31.18.0",
+    "@ultimat3/schema": "31.18.0",
+    "@ultimat3/ui": "31.18.0"
   }
 }

package/src/fields.ts

@@ -232,8 +232,8 @@ export function sortable(type: AdminFieldType, column: AdminColumnFacts): boolea
  *
  * It has to be the KIND and not the field type, because several kinds render in a text box and
  * only two of them can be searched: `adminSearch` issues one `contains` filter per searchable
- * field and the driver compiles `contains` to `<column> like $1` with NO cast
- * (`packages/entity/src/pg-sql.ts`), so a searchable column of any other kind makes the admin's
+ * field and the driver compiles `contains` to `<column> ilike $1` with NO cast
+ * (`packages/entity/src/text-contains.ts`), so a searchable column of any other kind makes the admin's
  * search box answer a database error rather than an empty result.
  */
 const LIKE_ABLE_COLUMN_KINDS: ReadonlySet<string> = new Set(['text', 'char']);

package/src/jobs/overview-data.ts

@@ -3,7 +3,12 @@
 // from `overviewData`, so the chart's bucketing is tested without a queue.
 
 import { expectedQueryLoop } from '@ultimat3/db';
-import { type CounterTotals, inspectQueues, type JobCounter } from '@ultimat3/jobs';
+import {
+  type CounterTotals,
+  inspectQueues,
+  type JobCounter,
+  type JobIntrospection,
+} from '@ultimat3/jobs';
 import { AdminFilterInvalidError } from '../errors';
 import { jobsOperator } from './operator';
 
@@ -90,6 +95,22 @@ export function nameRowsOf(totals: readonly CounterTotals[]): readonly NameRow[]
   });
 }
 
+/** The fallback for a driver that ships no `countersMany`: one read per name, declared. */
+function countersPerName(
+  introspect: JobIntrospection,
+  jobs: readonly string[],
+  sinceMs: number,
+): Promise<readonly JobCounter[]> {
+  return expectedQueryLoop(
+    'the jobs overview reads each settled job name’s counter buckets: this driver has no countersMany',
+    async () => {
+      const all: JobCounter[] = [];
+      for (const job of jobs) all.push(...(await introspect.counters({ job, sinceMs })));
+      return all;
+    },
+  );
+}
+
 export interface OverviewData {
   readonly totals: Awaited<ReturnType<typeof inspectQueues>>['totals'];
   readonly oldestReadyMs: number;
@@ -99,9 +120,10 @@ export interface OverviewData {
 }
 
 /**
- * Two statements and one per job name that settled in the range: the totals say which names have
- * buckets at all, and each one's buckets are read by name — the store keys counters by job. The
- * loop is declared rather than hidden: it is bounded by the app's registered job names.
+ * Four statements whatever the app's size: queue depth, the worker registry, the totals (which
+ * names have buckets at all), then every one of those names' buckets in ONE `countersMany` read.
+ * A driver without it is read one `counters` call per name — declared, bounded by the app's
+ * registered job names.
  */
 export async function overviewData(range: OverviewRange, nowMs: number): Promise<OverviewData> {
   const { driver, introspect } = jobsOperator();
@@ -111,14 +133,11 @@ export async function overviewData(range: OverviewRange, nowMs: number): Promise
     introspect.workers(),
     introspect.counterTotals(sinceMs),
   ]);
-  const counters = await expectedQueryLoop(
-    'the jobs overview reads each settled job name’s counter buckets; the store keys them by name',
-    async () => {
-      const all: JobCounter[] = [];
-      for (const row of totals) all.push(...(await introspect.counters({ job: row.job, sinceMs })));
-      return all;
-    },
-  );
+  const jobs = totals.map((row) => row.job);
+  const counters =
+    introspect.countersMany === undefined
+      ? await countersPerName(introspect, jobs, sinceMs)
+      : await introspect.countersMany({ jobs, sinceMs });
   return {
     totals: depth.totals,
     oldestReadyMs: depth.oldestReadyMs,

package/src/list-filters.ts

@@ -216,7 +216,7 @@ export function checkedFilter(resource: AdminResource, asked: AskedFilter): Admi
  * Predicates the APP declared — a scope's `where`, a resource's `rows` — held to a narrower rule
  * than a caller's: any column of the entity may be named (the app knows which of its columns are
  * indexed), but never one that is not a column and never a sealed one, whose ciphertext no
- * predicate can be written against.
+ * predicate can be written against. A declared `contains` comes back `caseSensitive`.
  */
 export function declaredFilters(
   resource: Pick<AdminResource, 'name' | 'entity'>,
@@ -242,5 +242,9 @@ export function declaredFilters(
     if (!open.includes(filter.field)) refuse('names a field that is not a column', open);
     if (!isOp(filter.op)) refuse('names an operator the admin does not have', FILTER_OPS);
   }
-  return where;
+  // Marked, so the read (`repo-entity.ts`) and the write (`row-scope-write.ts`) both keep a
+  // declared `contains` exact — the case-insensitive one is for what an operator types.
+  return where.map((filter) =>
+    filter.op === 'contains' ? { ...filter, caseSensitive: true as const } : filter,
+  );
 }

package/src/registry.ts

@@ -122,6 +122,8 @@ export interface AdminTableRead {
   all(): Promise<readonly AdminRow[]>;
   one(): Promise<AdminRow | null>;
   count(): Promise<number>;
+  /** The planner's whole-table estimate, `null` when it has none. Optional: a slice may lack it. */
+  approximateCount?(): Promise<number | null>;
   /** Read for the entity NAME only: it is how a handle is matched to the entity it serves. */
   plan(): { readonly entity: string };
 }
@@ -171,6 +173,13 @@ export interface AdminFilter {
   readonly field: string;
   readonly op: FilterOp;
   readonly value: string | number | boolean | null | readonly string[];
+  /**
+   * Set on every predicate the APP declared — a `rows` scope, a scope tab's `where` — by
+   * `declaredFilters`, and never on one a caller typed: such a `contains` is the exact,
+   * case-sensitive substring it shipped as, because a row scope is authorization and folding case
+   * would widen it. A caller's `contains` (search box, list filter, lookup) ignores case.
+   */
+  readonly caseSensitive?: true;
 }
 
 export interface AdminSort {
@@ -216,6 +225,12 @@ export interface AdminRepo<Row> {
   update(id: string, patch: Readonly<Record<string, unknown>>): Promise<Row>;
   destroy(id: string): Promise<void>;
   count?(where?: readonly AdminFilter[]): Promise<number>;
+  /**
+   * The store's whole-table estimate in constant time — `null` when it has none, a rejection when
+   * the table cannot be estimated whole (a tenant-scoped one). What `count: 'estimate'` reads;
+   * never asked with a predicate.
+   */
+  approximateCount?(): Promise<number | null>;
 }
 
 /** What the admin runs an action with. The action's own `ctx` is richer; this is the slice

package/src/repo-entity.ts

@@ -20,13 +20,16 @@ import type {
 type TableOperator = Parameters<AdminTableRead['andWhere']>[1];
 
 /**
- * `contains` is the admin's word for it; `like` with both wildcards is what a driver runs. A Map,
- * so an operator that is not one of the seven answers `undefined` rather than a prototype member.
+ * Every admin operator is the handle's own, `contains` included: on a `text()`/`char()` column the
+ * entity's `contains` is a case-insensitive substring, compiled to the bound `ilike` a
+ * `gin_trgm_ops` index serves (`packages/entity/src/text-contains.ts`) and escaped there, so a `%`
+ * an operator types is a percent sign. A declared one (`caseSensitive`) stays an exact `like`.
+ * A Map, so an operator that is not one of these answers `undefined` rather than a prototype member.
  */
 const OPERATOR_OF: ReadonlyMap<AdminFilter['op'], TableOperator> = new Map([
   ['eq', 'eq'],
   ['neq', 'neq'],
-  ['contains', 'like'],
+  ['contains', 'contains'],
   ['gt', 'gt'],
   ['gte', 'gte'],
   ['lt', 'lt'],
@@ -35,7 +38,7 @@ const OPERATOR_OF: ReadonlyMap<AdminFilter['op'], TableOperator> = new Map([
   ['is-null', 'is-null'],
 ]);
 
-/** `%` and `_` are wildcards to `LIKE`; a `contains` matches the text an operator typed. */
+/** `%` and `_` are wildcards to `LIKE`; a declared `contains` matches the exact text it names. */
 const literal = (text: string): string => text.replace(/[\\%_]/g, (wild) => `\\${wild}`);
 
 /**
@@ -65,9 +68,13 @@ const typedBy = (entity: AdminEntity): Typed => {
 const predicate =
   (typed: Typed) =>
   (read: AdminTableRead, filter: AdminFilter): AdminTableRead => {
-    if (filter.op === 'contains') {
+    // An app-declared `contains` (a row scope is authorization) keeps its case-sensitive `like`.
+    if (filter.op === 'contains' && filter.caseSensitive === true) {
       return read.andWhere(filter.field, 'like', `%${literal(String(filter.value))}%`);
     }
+    if (filter.op === 'contains') {
+      return read.andWhere(filter.field, 'contains', String(filter.value));
+    }
     // One admin operator, two of the handle's: `false` asks for the rows that HAVE a value.
     if (filter.op === 'is-null') {
       return read.andWhere(filter.field, filter.value === false ? 'is-not-null' : 'is-null');
@@ -162,6 +169,7 @@ export function adminRepoFor(entity: AdminEntity, table: AdminTable): AdminRepo<
     update: async (id, patch) => table.update(idOf(id), patch),
     destroy: async (id) => table.delete(idOf(id)),
     count: async (where) => filtered(table, where ?? [], typed).count(),
+    approximateCount: async () => (await table.approximateCount?.()) ?? null,
   };
 }
 

package/src/resource-list.ts

@@ -132,14 +132,14 @@ export function scopesOf(
       );
     }
     const where = scope.where;
-    if (typeof where !== 'function') declaredFilters(resource, where, declaredAs);
+    const fixed = typeof where === 'function' ? [] : declaredFilters(resource, where, declaredAs);
     return {
       name,
       labelKey: scope.labelKey ?? `admin.${resource.name}.scope.${name}`,
       default: scope.default === true,
       count: scope.count === true,
       where: (actor) =>
-        typeof where === 'function' ? declaredFilters(resource, where(actor), declaredAs) : where,
+        typeof where === 'function' ? declaredFilters(resource, where(actor), declaredAs) : fixed,
     };
   });
 }

package/src/resource.ts

@@ -74,9 +74,11 @@ export interface AdminResourceOptions<Row extends AdminRow = AdminRow> {
    * Show this resource's row count on the `/admin` home. Opt-in, as a scope tab's `count` is: the
    * figure is one full `count()` over the actor's rows on EVERY visit to the front page, so on a
    * big table any operator reloading it is a load generator. Absent: no tile, the resource is still
-   * listed in the permission matrix.
+   * listed in the permission matrix. `'estimate'`: the planner's figure (`approximateCount()`,
+   * constant time) where the row scope is the whole predicate and the estimate is at least
+   * `ESTIMATE_COUNT_FLOOR` — the tile then reads `~` — and the exact count everywhere else.
    */
-  readonly count?: boolean;
+  readonly count?: boolean | 'estimate';
   /**
    * The rows this ACTOR may see at all. Applied to every read of the resource — list, search,
    * detail, lookup, labels, MCP — so it is the one place a second audience is declared.
@@ -142,8 +144,10 @@ export interface AdminResource<Row extends AdminRow = AdminRow> {
   readonly columns: readonly AdminComputedColumn[];
   /** Declared scopes, in tab order. Empty for a resource that declares none. */
   readonly scopes: readonly AdminScope[];
-  /** The `/admin` home counts this resource — `count: true` declared. */
+  /** The `/admin` home counts this resource — `count: true` or `count: 'estimate'` declared. */
   readonly count: boolean;
+  /** `count: 'estimate'`: the home may show the planner's figure. Absent or `false`: exact. */
+  readonly countEstimate?: boolean;
   /** `rows`, validated per call. Absent for a resource every permitted actor sees whole. */
   readonly rowScope?: AdminRowScope;
   /** The detail page's groups. Always at least one: undeclared fields have a default section. */
@@ -319,7 +323,8 @@ export function adminResource<Row extends AdminRow = AdminRow>(
     searchFields: fields.filter((field) => field.searchable),
     columns: computedColumnsOf(declared, opts.columns),
     scopes: scopesOf(declared, opts.scopes, opts.repo),
-    count: opts.count === true,
+    count: opts.count === true || opts.count === 'estimate',
+    countEstimate: opts.count === 'estimate',
     ...(rowScope === undefined ? {} : { rowScope }),
     sections: layoutOf(
       {

package/src/row-scope-write.ts

@@ -66,7 +66,8 @@ function satisfies(row: AdminRow, filter: AdminFilter): boolean | undefined {
     case 'in':
       return Array.isArray(filter.value) && filter.value.some((one) => equal(held, one));
     case 'contains':
-      // `LIKE` is case-sensitive and collation-free for a literal substring.
+      // A row scope is authorization: its `contains` is the exact, case-sensitive substring the
+      // read runs as `like` (`repo-entity.ts`, `caseSensitive`) — folding case here would widen it.
       return typeof held === 'string' ? held.includes(String(filter.value)) : undefined;
     default: {
       const order = ordered(held, filter.value);

package/src/screen-home-counts.ts

@@ -1,20 +1,53 @@
 // The `/admin` home's figures: how many rows of each resource this actor could open. One
 // `AdminRepo.count` per resource that declared `count: true`, over its row scope and nothing else
 // — `rowWhere`, the predicate every list read starts from — so a tile never counts a hidden row.
+// `count: 'estimate'` reads the planner's figure instead, where that is still the same question.
 
 import type { AdminActor } from './authz';
 import { rowWhere } from './list-scope';
+import type { AdminFilter } from './registry';
 import type { AdminResource } from './resource';
 
+/**
+ * Below this many rows an exact `COUNT(*)` is cheap and the planner's figure is at its least
+ * reliable (a table analysed when it was empty), so the exact count is the one shown.
+ */
+export const ESTIMATE_COUNT_FLOOR = 10_000;
+
 export interface ResourceCount {
   readonly resource: AdminResource;
   readonly count: number;
+  /** The planner's estimate (`count: 'estimate'`), drawn `~`. Absent or `false`: exact. */
+  readonly approximate?: boolean;
+}
+
+type Counted = { readonly count: number; readonly approximate: boolean };
+
+/**
+ * The estimate is a WHOLE-TABLE figure, so it answers the tile's question only when the row scope
+ * adds no predicate; `null` (never analysed), a refusal (a tenant-scoped table) or a small table
+ * all fall through to the exact count — never a guess shown as a number.
+ */
+async function countOne(
+  resource: AdminResource,
+  count: (where: readonly AdminFilter[]) => Promise<number>,
+  actor: AdminActor,
+): Promise<Counted> {
+  const where = rowWhere(resource, actor);
+  const estimate = resource.repo?.approximateCount;
+  if (resource.countEstimate === true && where.length === 0 && estimate !== undefined) {
+    const figure = await estimate.call(resource.repo).catch(() => null);
+    if (figure !== null && figure >= ESTIMATE_COUNT_FLOOR) {
+      return { count: figure, approximate: true };
+    }
+  }
+  return { count: await count(where), approximate: false };
 }
 
 /**
- * The count of every resource handed in that declared `count: true`, in the order handed in. The caller hands in only what the
- * actor may LIST (`canOperate(…, 'list', …)`): a size is a fact about a table, and a resource the
- * actor may not open must not leak one. A repo with no `count()` — a hand-written one may leave it
+ * The count of every resource handed in that declared `count: true` (or `'estimate'`), in the order
+ * handed in. The caller hands in only what the actor may LIST (`canOperate(…, 'list', …)`): a size
+ * is a fact about a table, and a resource the actor may not open must not leak one. A repo with no `count()` — a hand-written one may leave it
  * out — has no figure, so it is left out rather than shown as a zero it never measured.
  *
  * In parallel: these are independent reads, and the home page is the front door. A count the
@@ -33,10 +66,10 @@ export async function resourceCounts(
     return count === undefined ? [] : [{ resource, count: count.bind(resource.repo) }];
   });
   const totals = await Promise.allSettled(
-    countable.map(({ resource, count }) => count(rowWhere(resource, actor))),
+    countable.map(({ resource, count }) => countOne(resource, count, actor)),
   );
   return countable.flatMap(({ resource }, index) => {
     const total = totals[index];
-    return total?.status === 'fulfilled' ? [{ resource, count: total.value }] : [];
+    return total?.status === 'fulfilled' ? [{ resource, ...total.value }] : [];
   });
 }

package/src/screen-home-kpis.tsx

@@ -30,12 +30,18 @@ export function HomeKpis(props: HomeKpisProps): JSX.Element {
         {t('admin.dashboard.records.title')}
       </h2>
       <ul class={styles['kpis']}>
-        {props.counts.map(({ resource, count: total }) => (
+        {props.counts.map(({ resource, count: total, approximate }) => (
           <li>
             <a class={styles['kpi']} href={`${props.basePath}${resource.path}`}>
               <StatTile
                 label={t(resource.titleKey)}
-                value={count.format(total)}
+                value={
+                  // The planner's figure (`count: 'estimate'`) says so: `~1,200,000`, never a
+                  // number that reads as exact.
+                  approximate === true
+                    ? t('admin.dashboard.records.approximate', { figure: count.format(total) })
+                    : count.format(total)
+                }
                 stat={countStat(resource.name)}
               />
             </a>

package/src/search.ts

@@ -2,7 +2,7 @@
 // search config to drift from the entities, and no result an actor could not have opened —
 // the same `admin:read` + `<entity>:read` pair gates the hit and the detail page it links to.
 
-import { finiteCount } from '@ultimat3/core';
+import { finiteCount, mapBounded } from '@ultimat3/core';
 import { expectedQueryLoop } from '@ultimat3/db';
 import { type AuditEntry, deniedDraft } from './audit';
 import type { AdminActor } from './authz';
@@ -18,6 +18,11 @@ import { type AdminResource, repoOf } from './resource';
 /** Per resource, and per field within it. Search is a jump box, not a report. */
 const MAX_FIELDS_PER_RESOURCE = 3;
 const DEFAULT_LIMIT_PER_RESOURCE = 5;
+/**
+ * Resources read at once. Independent reads, so their latencies overlap rather than add — and a
+ * bound, so an admin of fifty resources never holds fifty pool connections for one keystroke.
+ */
+const SEARCH_WIDTH = 4;
 
 export interface AdminSearchHit {
   readonly entity: string;
@@ -53,9 +58,10 @@ export interface AdminSearchInput {
 }
 
 /**
- * One query per searchable field rather than one query with an OR: the admin's query IR is
- * a conjunction by design (each filter maps to an indexed predicate), and three small
- * indexed lookups beat one unindexed disjunction.
+ * One `contains` per searchable field rather than one query with an OR: the admin's query IR is a
+ * conjunction by design, and each field's `contains` is the entity's case-insensitive `ilike` —
+ * served by that column's `gin_trgm_ops` index where the app declared one (`X_QUERY_UNINDEXED`
+ * names the declaration where it did not), which one OR across columns could not use.
  *
  * That argument is declared to the runtime and not only to the reader — `expectedQueryLoop`
  * carries it onto every statement the loop issues, so a statement diagnostic reports the loops
@@ -129,6 +135,10 @@ export async function adminSearch(input: AdminSearchInput): Promise<AdminSearchR
   // reaches a repo.
   if (term === '') return { term, hits: [], searched: [], skipped: [], audit: [] };
 
+  // Decided and audited in resource order, every entry appended BEFORE any read — so a repo that
+  // throws still leaves the record that the rows were asked for (`audit.ts`: if it isn't logged,
+  // it didn't happen) — and only then read, side by side.
+  const readable: AdminResource[] = [];
   for (const resource of input.resources) {
     const offered = resource.operations.includes('search');
     const decision = decideOperation(resource, 'search', ctx);
@@ -161,8 +171,6 @@ export async function adminSearch(input: AdminSearchInput): Promise<AdminSearchR
       skipped.push({ entity: resource.name, reason: 'admin.search.skipped.no-repo' });
       continue;
     }
-    // Appended BEFORE the read, so a repo that throws still leaves the record that the rows were
-    // asked for — `audit.ts`: if it isn't logged, it didn't happen.
     audit.push(
       await ctx.audit.append({
         requestId: ctx.requestId,
@@ -176,15 +184,31 @@ export async function adminSearch(input: AdminSearchInput): Promise<AdminSearchR
         reason: decision.reason,
       }),
     );
-    try {
-      hits.push(...(await searchResource(resource, ctx.actor, term, limit)));
-      searched.push(resource.name);
-    } catch {
-      // One resource whose repo fails is a resource this search could not read — listed, so the
-      // operator is never silently shown a subset — never a 500 for every other one. Nothing is
-      // read off the thrown value: a reason is a key.
+    readable.push(resource);
+  }
+
+  const answers = await mapBounded(
+    readable,
+    async (resource) => {
+      try {
+        return await searchResource(resource, ctx.actor, term, limit);
+      } catch {
+        // One resource whose repo fails is a resource this search could not read — listed, so the
+        // operator is never silently shown a subset — never a 500 for every other one. Nothing is
+        // read off the thrown value: a reason is a key.
+        return undefined;
+      }
+    },
+    { width: SEARCH_WIDTH },
+  );
+  for (const [index, resource] of readable.entries()) {
+    const found = answers[index];
+    if (found === undefined) {
       skipped.push({ entity: resource.name, reason: SKIPPED_FAILED });
+      continue;
     }
+    hits.push(...found);
+    searched.push(resource.name);
   }
 
   return { term, hits, searched, skipped, audit };