@blamejs/blamejs-shop 0.4.63 → 0.4.65

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- v0.4.65 (2026-06-19) — **Dropship-forwarding and scheduled-export status transitions are now claimed atomically.** Closes two status-transition races in modules that validated the transition with the state-machine primitive but then persisted it with an unconditional update keyed only on the row id. Because the state-machine validation runs in process (each request rebuilds the machine from a fresh row), two concurrent transitions on the same row both passed validation and the second write silently clobbered the first — for example a dropship forwarding being marked shipped while a retry marks it failed, or a scheduled export being cancelled while a worker marks it running. Both now gate the write on the row still being in the state that was validated against (the same single-statement compare-and-swap the order and inventory-receipt lifecycles already use), so exactly one transition lands and a concurrent loser is refused rather than overwriting it. No API change. **Fixed:** *Dropship-forwarding transitions claim the from-state* — Every dropship-forwarding lifecycle edge routes through one helper that validated the transition against the state machine and then wrote UPDATE … WHERE id = ?. The write now also requires the row to still be in the state the transition was validated against (… AND status = <from>) and treats a zero-row result as a lost race (a typed refusal), so two concurrent vendor callbacks (e.g. accept racing ship, or a retry) can't both advance the row and silently overwrite each other. · *Scheduled-export status writers claim the from-state* — The four scheduled-export transitions (cancel, mark-running, mark-complete, mark-failed) validated against the export state machine and then wrote keyed only on the export id. Each now gates the write on the observed from-state and refuses on a zero-row result, so a cancel racing a mark-running (or a duplicate worker callback) no longer last-writer-wins into an illegal state. The state machine still enforces the legal-edge validation; the conditional update is the atomic claim.
+
+- v0.4.64 (2026-06-19) — **A failed side-effect can no longer strand a claimed record.** Hardens the atomic-claim concurrency fixes (shipped over the previous releases) against the case where the side-effect fails or the worker crashes AFTER a record was claimed. Each claim now restores or recovers the record so a transient failure can't leave it permanently stuck. A scheduled payment retry that is claimed out of the due set but then fails to advance (a malformed policy or a database write error) restores its next-retry time, so the retry isn't silently dropped. Approving a seller application that crashes between claiming the approval and persisting the vendor is now recoverable — an application left approved with no vendor can be approved again rather than being stranded in a terminal state. A survey response whose insert fails after the invitation was claimed reverts the invitation to issued so it can be answered. A reorder reminder or wishlist digest whose send fails defers the retry to a later tick on a distinct cursor, so a concurrent overlapping tick can't pick up the rolled-back row and send a duplicate in the same window. No API change. **Fixed:** *Payment retry restores its schedule on a failed advance* — The retry scheduler claims an enrollment out of the due set by clearing its next-retry time before doing processor work. If advancing the enrollment then throws (a malformed retry policy, or a database write failure while recording the attempt), the next-retry time is restored to the value the tick observed, so a later tick re-attempts the retry. Previously the enrollment was left active with no next-retry time, and the due query (which requires a next-retry time) would never pick it up again, silently stopping the customer's recovery retries. · *Seller approval is recoverable after a mid-approval crash* — Approving a seller application claims the in-review-to-approved transition before registering the vendor. If the worker crashes or times out between the claim and persisting the vendor, the application is left approved with no vendor — a terminal state the rest of the primitive could never move out of. Approval now treats an approved application that has no vendor attached as re-approvable, so the registration can be retried and the application recovered instead of stranded. · *Survey response keeps the invitation retryable on insert failure* — Submitting a survey response claims the invitation (issued to responded) before inserting the response row. If that insert fails (a transient write error), the invitation is reverted to issued so the response can be submitted again, rather than being stuck responded with no response recorded and every retry rejected as already-responded. · *Reorder reminder and wishlist digest defer a failed send instead of re-firing it* — When a reorder reminder or a wishlist digest send fails after the row was claimed, the schedule cursor is rolled to a value distinct from the one the tick observed (still due, so a later tick retries) rather than back to the exact observed value. A concurrent overlapping tick that read the same cursor was waiting to claim it; restoring the exact value let it match and send a duplicate in the same window. The retry is now deferred to a later tick with no duplicate.
+
 - v0.4.63 (2026-06-19) — **Fulfillment and customer-data actions can't double-fire under concurrent calls.** Closes a further set of concurrency races where a fulfillment or customer-data action read a row, checked its status in application code, and then performed an irreversible side-effect (open an inventory hold, create shipments, restock received stock, create an order, reparent customer records, requeue a print job, mint child carts) before an unconditional update committed — so two concurrent calls could both pass the check and both perform the side-effect. Each now claims the transition with a single conditional update and performs the side-effect only when that claim wins, reverting the claim if the side-effect then fails so a row is never stranded. Approving an exchange opens its replacement hold once; executing a split-shipment plan creates the parcels once; recording a partial purchase-order receipt restocks each line once (claimed per line); completing a pick list creates its shipment once; converting or launching a pre-order creates the order once and a reservation can't oversell its cap; merging or rolling back a customer reparents the records once; an impersonation notice, a duplicate-suggestion link, a print-job retry, and a cart split each happen once. Behavior for a single sequential caller is unchanged. **Fixed:** *Fulfillment transitions claim before their side-effect* — Approving an exchange now claims pending-to-approved (WHERE id = ? AND status = 'pending') before opening the replacement inventory hold, reverting to pending if the hold fails. Executing a split-shipment plan claims proposed-to-executed before creating any shipment. Recording a partial purchase-order receipt claims each receipt line by advancing its received quantity conditionally before restocking, rolling the claimed lines back if a later line fails. Completing a pick list claims its completion before creating the shipment. In each case two concurrent calls can no longer both create the holds / shipments / restock for one row. · *Pre-order conversion, launch, cancel, and reserve are atomic* — Converting a reservation to an order claims active-to-converted before creating the order (reverting on failure), so a reservation can't spawn two orders; launching a campaign claims active-to-launched before walking reservations; cancelling claims active-to-cancelled before decrementing the reserved counter. Reserving now enforces the campaign cap inside the increment itself (units_reserved + qty <= max_units_available in the update's WHERE), so concurrent reservations can't oversell the pool; a reservation that loses the cap is compensated. · *Customer merge/rollback, impersonation notice, suggestion dedup, print retry, and cart split run once* — Executing or rolling back a customer merge claims the transition before reparenting records, reverting if the reparent fails. Sending the 'an operator viewed your account' notice claims the notified stamp (WHERE customer_notified_at IS NULL) before enqueuing, so it's sent once. Linking a duplicate suggestion claims the source before migrating its votes to the canonical row. Marking a print job failed claims the transition before inserting the retry job, so a job isn't reprinted twice. Splitting a cart claims the source's abandon before minting the child carts, so a concurrent split can't create two sets of children.
 
 - v0.4.62 (2026-06-19) — **Money and approval actions can't double-fire under concurrent calls.** Closes a set of concurrency races in money- and approval-critical paths where the action read a row, checked its status in application code, and then performed an irreversible side-effect (retry a card, execute an approved action, register a vendor, bill a subscription change) before an unconditional update committed — so two concurrent calls could both pass the check and both perform the side-effect. Each now claims the transition with a single conditional update and performs the side-effect only when that claim wins. A scheduled payment retry is claimed out of the due set before the processor is called, so an overlapping scheduler tick can't retry the same card twice; a payment outcome is claimed by its attempt number before the attempt is recorded, so a redelivered webhook can't double-count it. Executing an approved operator request claims the approved-to-executed transition before returning success, so the underlying money move runs once. Approving a seller application claims the in-review-to-approved transition before registering the vendor (rolling back to in-review if registration fails), so one application can't create two vendors. Applying scheduled subscription plan changes claims each pending change before updating the plan and recording its proration invoice, and stamps a deterministic idempotency key on the invoice, so an overlapping or retried scheduler run can't bill the proration twice. Behavior for a single sequential caller is unchanged. **Fixed:** *Scheduled payment retries and recorded outcomes claim before acting* — The retry scheduler now claims each due enrollment (nulling its next-retry time, conditional on the value the tick observed) before composing the processor retry, so two overlapping ticks can't both retry the same card for one scheduled slot — only the claim winner calls the processor. Recording a retry outcome claims the enrollment by bumping its attempt count conditionally on the observed value before writing the attempt row, so a redelivered webhook (or a manual record racing it) can't write a duplicate attempt or double-count toward the cap; the loser returns the already-advanced row. · *Executing an approved request runs the action once* — markExecuted now flips the request from approved to executed with a conditional update (WHERE id = ? AND status = 'approved') and returns success only when that update changes one row; a concurrent second call is refused with a typed error before the application runs the underlying action (a large refund, vendor payout, or bulk operation) a second time. · *Approving a seller application creates one vendor* — approveApplication now claims the in-review-to-approved transition first and registers the vendor only when the claim wins, so two concurrent approvals can't both register a vendor for one application. If vendor registration fails after the claim, the application is rolled back to in-review so it can be approved again rather than stranded as approved with no vendor. · *Applying scheduled plan changes bills the proration once* — applyScheduledChanges now claims each pending change (WHERE id = ? AND status = 'pending') before updating the subscription plan and recording the proration invoice, so an overlapping or retried scheduler run skips an already-applied change instead of billing it twice. Both the scheduled and the immediate plan-change paths now stamp a deterministic idempotency key on the proration invoice, so even a re-run that reached the billing call would dedupe against the unique invoice id rather than write a second charge. A regression test asserts a second apply pass records no additional invoice.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.63",
+  "version": "0.4.65",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/customer-surveys.js

@@ -749,11 +749,26 @@ function create(opts) {
     }
 
     var responseId = b.uuid.v7();
-    await query(
-      "INSERT INTO survey_responses (id, invitation_id, answers_json, occurred_at) " +
-      "VALUES (?1, ?2, ?3, ?4)",
-      [responseId, invitation.id, JSON.stringify(canonicalAnswers), occurredAt],
-    );
+    try {
+      await query(
+        "INSERT INTO survey_responses (id, invitation_id, answers_json, occurred_at) " +
+        "VALUES (?1, ?2, ?3, ?4)",
+        [responseId, invitation.id, JSON.stringify(canonicalAnswers), occurredAt],
+      );
+    } catch (insErr) {
+      // The claim above already flipped the invitation to 'responded'. If
+      // the response insert fails (a transient D1/SQLite write error),
+      // revert the claim to 'issued' so the invitation stays retryable —
+      // otherwise it is stranded 'responded' with no response row and
+      // every retry is rejected as ALREADY_RESPONDED, so the response can
+      // never be recorded.
+      await query(
+        "UPDATE survey_invitations SET status = 'issued', responded_at = NULL " +
+        "WHERE id = ?1 AND status = 'responded'",
+        [invitation.id],
+      );
+      throw insErr;
+    }
 
     return {
       response_id:    responseId,

package/lib/dropship-forwarding.js

@@ -95,6 +95,33 @@ var MAX_LINES              = 1000;
 
 // ---- FSM definition -----------------------------------------------------
 
+// The legal edges, hoisted so the same table drives both b.fsm's
+// in-memory validation AND the side-effect-free (from,event)->to
+// resolver below. Keeping one source means the resolver can never
+// drift from the machine the guard validates against.
+var DROPSHIP_TRANSITIONS = [
+  { from: "queued",    to: "accepted",  on: "accept"   },
+  { from: "queued",    to: "failed",    on: "fail"     },
+  { from: "accepted",  to: "shipped",   on: "ship"     },
+  { from: "accepted",  to: "failed",    on: "fail"     },
+  { from: "shipped",   to: "delivered", on: "deliver"  },
+  { from: "shipped",   to: "failed",    on: "fail"     },
+  { from: "shipped",   to: "returned",  on: "return"   },
+  { from: "delivered", to: "returned",  on: "return"   },
+];
+
+// (from,event) -> to-state. State + event names are identifier-shaped
+// (no whitespace, enforced by b.fsm at define time), so a single space
+// is an unambiguous key separator. Lets us compute the destination
+// status for the atomic-claim UPDATE without calling b.fsm.transition()
+// (which would emit a "success" audit event before we know the claim
+// actually won the race).
+var _DROPSHIP_TO = Object.create(null);
+for (var _dti = 0; _dti < DROPSHIP_TRANSITIONS.length; _dti += 1) {
+  _DROPSHIP_TO[DROPSHIP_TRANSITIONS[_dti].from + " " + DROPSHIP_TRANSITIONS[_dti].on] =
+    DROPSHIP_TRANSITIONS[_dti].to;
+}
+
 var _dsFsm = null;
 function _getDropshipFsm() {
   if (_dsFsm) return _dsFsm;
@@ -113,16 +140,7 @@ function _getDropshipFsm() {
       failed:    {},
       returned:  {},
     },
-    transitions: [
-      { from: "queued",    to: "accepted",  on: "accept"   },
-      { from: "queued",    to: "failed",    on: "fail"     },
-      { from: "accepted",  to: "shipped",   on: "ship"     },
-      { from: "accepted",  to: "failed",    on: "fail"     },
-      { from: "shipped",   to: "delivered", on: "deliver"  },
-      { from: "shipped",   to: "failed",    on: "fail"     },
-      { from: "shipped",   to: "returned",  on: "return"   },
-      { from: "delivered", to: "returned",  on: "return"   },
-    ],
+    transitions: DROPSHIP_TRANSITIONS,
   });
   return _dsFsm;
 }
@@ -288,16 +306,25 @@ function create(opts) {
       history: [],
       context: {},
     });
-    try {
-      await instance.transition(event, null);
-    } catch (e) {
-      var err = new Error("dropship-forwarding: forwarding transition refused — " + (e && e.message || e));
-      err.code  = (e && e.code) || "DROPSHIP_FORWARDING_TRANSITION_REFUSED";
-      err.cause = e;
+    // Validate the legal edge IN MEMORY with `can` — it runs the same
+    // edge + guard check `transition` does but is side-effect-free (no
+    // state mutation, no audit emit). We DON'T call `transition` here:
+    // it emits a "success" `fsm.dropship_forwarding.transition` audit
+    // event, and emitting before the atomic claim below would record a
+    // phantom success for a caller that goes on to LOSE the race (the
+    // conditional UPDATE matches zero rows). The real transition() emit
+    // is deferred to the winning branch.
+    if (!instance.can(event)) {
+      var err = new Error("dropship-forwarding: forwarding transition refused — illegal edge '" +
+        event + "' from state '" + current.status + "'");
+      err.code = "DROPSHIP_FORWARDING_TRANSITION_REFUSED";
       throw err;
     }
+    // `can` returned true, so (current.status, event) is a declared edge
+    // and the resolver always has its to-state.
+    var toState = _DROPSHIP_TO[current.status + " " + event];
     var sets = ["status = ?1"];
-    var params = [instance.state];
+    var params = [toState];
     var p = 2;
     var keys = Object.keys(patch || {});
     for (var i = 0; i < keys.length; i += 1) {
@@ -316,11 +343,36 @@ function create(opts) {
       params.push(patch[k]);
       p += 1;
     }
-    params.push(forwardingId);
-    await query(
-      "UPDATE dropship_forwardings SET " + sets.join(", ") + " WHERE id = ?" + p,
+    params.push(forwardingId);       // ?p
+    params.push(current.status);     // ?(p+1)
+    // Cross-instance atomic claim — the transaction substitute on the D1
+    // bridge. b.fsm `can` above only validates the legal edge IN MEMORY
+    // (its lock is per-instance, and each request restores a fresh
+    // instance), so two concurrent transitions on the same row both pass
+    // it. Gating the write on the row STILL being in the from-state we
+    // validated against (`AND status = <from>`) is the single-statement
+    // serialization point: exactly one writer changes the row, the loser
+    // changes zero rows and is refused (no stale-edge clobber).
+    var upd = await query(
+      "UPDATE dropship_forwardings SET " + sets.join(", ") +
+      " WHERE id = ?" + p + " AND status = ?" + (p + 1),
       params,
     );
+    if (Number(upd.rowCount || 0) !== 1) {
+      var raced = new Error("dropship-forwarding: forwarding " + forwardingId +
+        " changed state concurrently (no longer " + current.status + ") — transition refused");
+      raced.code = "DROPSHIP_FORWARDING_TRANSITION_REFUSED";
+      throw raced;
+    }
+    // We won the atomic claim — the row really did advance
+    // current.status -> toState. NOW drive the transition through b.fsm
+    // so its `fsm.dropship_forwarding.transition=success` audit event
+    // fires exactly once and only for the writer that actually changed
+    // the row. `can` above already validated this edge, so transition()
+    // cannot refuse; its own audit emit is drop-silent, and the row is
+    // already persisted, so a throw here must never fail the caller.
+    try { await instance.transition(event, null); }
+    catch (_emitErr) { /* edge pre-validated by can(); audit emit is best-effort */ }
     return await _getForwardingRow(forwardingId);
   }
 

package/lib/order-export.js

@@ -576,18 +576,42 @@ function create(opts) {
       if (!row) throw new TypeError("order-export.cancelExport: " + exportId + " not found");
       var fsm = _getExportFsm();
       var inst = fsm.restore({ state: row.status, history: [], context: {} });
-      try { await inst.transition("cancel", null); }
-      catch (e) {
-        var err = new Error("order-export.cancelExport: refused — " + (e && e.message || e));
-        err.code = (e && e.code) || "ORDER_EXPORT_CANCEL_REFUSED";
-        err.cause = e;
+      // Validate the legal edge with `can` — same edge + guard check as
+      // transition() but side-effect-free (no state mutation, no audit
+      // emit). We deliberately do NOT call transition() here: it emits a
+      // "success" fsm.scheduled_export.transition audit event, and
+      // emitting before the atomic claim below would record a phantom
+      // success for a caller that then LOSES the race (the conditional
+      // UPDATE matches zero rows). transition()'s real emit is deferred
+      // to the winning branch.
+      if (!inst.can("cancel")) {
+        var err = new Error("order-export.cancelExport: refused — illegal edge 'cancel' from state '" + row.status + "'");
+        err.code = "ORDER_EXPORT_CANCEL_REFUSED";
         throw err;
       }
       var ts = _now();
-      await query(
-        "UPDATE scheduled_exports SET status = 'cancelled', completed_at = ?1 WHERE id = ?2",
-        [ts, exportId],
+      // Atomic claim — the cross-instance serialization point. b.fsm
+      // validated the edge IN MEMORY only (per-request instance, per-
+      // instance lock), so two concurrent transitions (e.g. cancel racing
+      // markExportRunning) both pass it; gating the write on the row STILL
+      // being in the from-state we read makes the loser change 0 rows.
+      var upd = await query(
+        "UPDATE scheduled_exports SET status = 'cancelled', completed_at = ?1 " +
+        "WHERE id = ?2 AND status = ?3",
+        [ts, exportId, row.status],
       );
+      if (Number(upd.rowCount || 0) !== 1) {
+        var raced = new Error("order-export.cancelExport: " + exportId +
+          " changed state concurrently (no longer " + row.status + ") — refused");
+        raced.code = "ORDER_EXPORT_CANCEL_REFUSED";
+        throw raced;
+      }
+      // Won the claim — drive the real transition so its audit event
+      // fires exactly once, only for the writer that changed the row.
+      // can() pre-validated the edge; transition()'s emit is drop-silent
+      // and the row is already persisted, so its throw never reaches the
+      // caller.
+      try { await inst.transition("cancel", null); } catch (_emitErr) { /* audit emit best-effort */ }
       return await _getExport(exportId);
     },
 
@@ -626,18 +650,28 @@ function create(opts) {
       if (!row) throw new TypeError("order-export.markExportRunning: " + exportId + " not found");
       var fsm = _getExportFsm();
       var inst = fsm.restore({ state: row.status, history: [], context: {} });
-      try { await inst.transition("start", null); }
-      catch (e) {
-        var err = new Error("order-export.markExportRunning: refused — " + (e && e.message || e));
-        err.code = (e && e.code) || "ORDER_EXPORT_START_REFUSED";
-        err.cause = e;
+      // Validate with side-effect-free `can` (no audit emit); defer the
+      // real transition() emit to the winning branch (see cancelExport).
+      if (!inst.can("start")) {
+        var err = new Error("order-export.markExportRunning: refused — illegal edge 'start' from state '" + row.status + "'");
+        err.code = "ORDER_EXPORT_START_REFUSED";
         throw err;
       }
       var ts = _now();
-      await query(
-        "UPDATE scheduled_exports SET status = 'running', started_at = ?1 WHERE id = ?2",
-        [ts, exportId],
+      // Atomic claim (see cancelExport): gate on the observed from-state.
+      var upd = await query(
+        "UPDATE scheduled_exports SET status = 'running', started_at = ?1 " +
+        "WHERE id = ?2 AND status = ?3",
+        [ts, exportId, row.status],
       );
+      if (Number(upd.rowCount || 0) !== 1) {
+        var raced = new Error("order-export.markExportRunning: " + exportId +
+          " changed state concurrently (no longer " + row.status + ") — refused");
+        raced.code = "ORDER_EXPORT_START_REFUSED";
+        throw raced;
+      }
+      // Won the claim — emit the real transition (see cancelExport).
+      try { await inst.transition("start", null); } catch (_emitErr) { /* audit emit best-effort */ }
       return await _getExport(exportId);
     },
 
@@ -655,19 +689,28 @@ function create(opts) {
       if (!row) throw new TypeError("order-export.markExportComplete: " + input.export_id + " not found");
       var fsm = _getExportFsm();
       var inst = fsm.restore({ state: row.status, history: [], context: {} });
-      try { await inst.transition("complete", null); }
-      catch (e) {
-        var err = new Error("order-export.markExportComplete: refused — " + (e && e.message || e));
-        err.code = (e && e.code) || "ORDER_EXPORT_COMPLETE_REFUSED";
-        err.cause = e;
+      // Validate with side-effect-free `can` (no audit emit); defer the
+      // real transition() emit to the winning branch (see cancelExport).
+      if (!inst.can("complete")) {
+        var err = new Error("order-export.markExportComplete: refused — illegal edge 'complete' from state '" + row.status + "'");
+        err.code = "ORDER_EXPORT_COMPLETE_REFUSED";
         throw err;
       }
       var ts = _now();
-      await query(
+      // Atomic claim (see cancelExport): gate on the observed from-state.
+      var upd = await query(
         "UPDATE scheduled_exports SET status = 'complete', row_count = ?1, " +
-        "byte_size = ?2, file_sha3_512 = ?3, completed_at = ?4 WHERE id = ?5",
-        [input.row_count, input.byte_size, input.file_sha3_512, ts, input.export_id],
+        "byte_size = ?2, file_sha3_512 = ?3, completed_at = ?4 WHERE id = ?5 AND status = ?6",
+        [input.row_count, input.byte_size, input.file_sha3_512, ts, input.export_id, row.status],
       );
+      if (Number(upd.rowCount || 0) !== 1) {
+        var raced = new Error("order-export.markExportComplete: " + input.export_id +
+          " changed state concurrently (no longer " + row.status + ") — refused");
+        raced.code = "ORDER_EXPORT_COMPLETE_REFUSED";
+        throw raced;
+      }
+      // Won the claim — emit the real transition (see cancelExport).
+      try { await inst.transition("complete", null); } catch (_emitErr) { /* audit emit best-effort */ }
       return await _getExport(input.export_id);
     },
 
@@ -687,18 +730,28 @@ function create(opts) {
       if (!row) throw new TypeError("order-export.markExportFailed: " + input.export_id + " not found");
       var fsm = _getExportFsm();
       var inst = fsm.restore({ state: row.status, history: [], context: {} });
-      try { await inst.transition("fail", null); }
-      catch (e) {
-        var err = new Error("order-export.markExportFailed: refused — " + (e && e.message || e));
-        err.code = (e && e.code) || "ORDER_EXPORT_FAIL_REFUSED";
-        err.cause = e;
+      // Validate with side-effect-free `can` (no audit emit); defer the
+      // real transition() emit to the winning branch (see cancelExport).
+      if (!inst.can("fail")) {
+        var err = new Error("order-export.markExportFailed: refused — illegal edge 'fail' from state '" + row.status + "'");
+        err.code = "ORDER_EXPORT_FAIL_REFUSED";
         throw err;
       }
       var ts = _now();
-      await query(
-        "UPDATE scheduled_exports SET status = 'failed', error = ?1, completed_at = ?2 WHERE id = ?3",
-        [errorText, ts, input.export_id],
+      // Atomic claim (see cancelExport): gate on the observed from-state.
+      var upd = await query(
+        "UPDATE scheduled_exports SET status = 'failed', error = ?1, completed_at = ?2 " +
+        "WHERE id = ?3 AND status = ?4",
+        [errorText, ts, input.export_id, row.status],
       );
+      if (Number(upd.rowCount || 0) !== 1) {
+        var raced = new Error("order-export.markExportFailed: " + input.export_id +
+          " changed state concurrently (no longer " + row.status + ") — refused");
+        raced.code = "ORDER_EXPORT_FAIL_REFUSED";
+        throw raced;
+      }
+      // Won the claim — emit the real transition (see cancelExport).
+      try { await inst.transition("fail", null); } catch (_emitErr) { /* audit emit best-effort */ }
       return await _getExport(input.export_id);
     },
 

package/lib/payment-retries.js

@@ -604,19 +604,50 @@ function create(opts) {
         );
         if (Number(claim.rowCount || 0) !== 1) continue;   // another tick claimed it
 
-        var policy = await _getPolicy(enrollment.policy_slug);
-        if (!policy) {
-          // Policy went missing between enrollment + tick — close
-          // as abandoned so the row doesn't spin forever.
+        // Pre-charge prep. The claim above nulled next_retry_at to take
+        // the row out of the due set; a throw HERE (a missing policy /
+        // malformed retry schedule) is BEFORE any processor work, so it is
+        // safe to restore the observed next_retry_at (only while still
+        // NULL, so a partial re-stamp isn't clobbered) and let a later
+        // tick re-attempt — otherwise the enrollment is stranded active
+        // with next_retry_at NULL and the due SELECT (next_retry_at IS NOT
+        // NULL) never picks it up again.
+        var policy, schedule;
+        try {
+          policy = await _getPolicy(enrollment.policy_slug);
+          if (!policy) {
+            // Policy went missing between enrollment + tick — close
+            // as abandoned so the row doesn't spin forever.
+            await query(
+              "UPDATE payment_retry_enrollments SET status = 'abandoned', next_retry_at = NULL, " +
+              "ended_at = ?1, end_reason = 'policy_missing' WHERE id = ?2",
+              [now, enrollment.id],
+            );
+            advanced.push(await _refetchEnrollment(enrollment.id));
+            continue;
+          }
+          schedule = _parseSchedule(policy.retry_schedule_json);
+        } catch (prepErr) {
           await query(
-            "UPDATE payment_retry_enrollments SET status = 'abandoned', next_retry_at = NULL, " +
-            "ended_at = ?1, end_reason = 'policy_missing' WHERE id = ?2",
-            [now, enrollment.id],
+            "UPDATE payment_retry_enrollments SET next_retry_at = ?1 " +
+            "WHERE id = ?2 AND status = 'active' AND next_retry_at IS NULL",
+            [enrollment.next_retry_at, enrollment.id],
           );
-          advanced.push(await _refetchEnrollment(enrollment.id));
-          continue;
+          throw prepErr;
         }
-        var schedule = _parseSchedule(policy.retry_schedule_json);
+
+        // _tickAdvance composes paymentHandle.retryIntent — the real
+        // card-charge retry — which runs BEFORE the attempt-ledger and
+        // status writes. By the time any throw escapes _tickAdvance the
+        // charge has already been submitted, so DO NOT restore
+        // next_retry_at on such a throw: re-stamping it would let a later
+        // or overlapping tick call retryIntent AGAIN for the same attempt
+        // and double-move money. The enrollment is left active with
+        // next_retry_at NULL for a recovery sweep / operator to advance;
+        // retryIntent is passed attempt_number as its idempotency
+        // dimension, so a conformant handle de-dupes a deliberate
+        // re-attempt at the same number. (Not stranding without a charge
+        // is the prep branch above; not double-charging is here.)
         var refreshed = await _tickAdvance(enrollment, policy, schedule, now);
         advanced.push(refreshed);
       }

package/lib/reorder-reminders.js

@@ -561,16 +561,20 @@ function create(opts) {
             fail_reason:   null,
           }));
         } else {
-          // The send failed after we won the claim. Roll the cursor
-          // back to the observed value so the retry sweep picks this
-          // row up on the next tick (failed rows stay due — matching
-          // the single-caller contract). The rollback is guarded on
-          // the value we set so a concurrent re-enrolment that moved
-          // the cursor forward in the meantime isn't clobbered.
+          // The send failed after we won the claim. Roll the cursor to a
+          // value DISTINCT from the one this tick observed (observed + 1ms),
+          // NOT back to the exact observed value: a concurrent overlapping
+          // tick that read the same observed cursor is waiting to claim
+          // `next_remind_at = observed`, and restoring the exact observed
+          // value would let it match and re-send in the same overlap.
+          // observed+1 is still <= now, so the row stays due and a LATER
+          // tick retries it (deferred, not re-fired in this overlap). The
+          // guard on the value we set means a concurrent re-enrolment that
+          // moved the cursor forward isn't clobbered.
           await query(
             "UPDATE reorder_enrollments SET next_remind_at = ?1 " +
             "WHERE id = ?2 AND next_remind_at = ?3",
-            [enrollment.next_remind_at, enrollment.id, nextRemindAt],
+            [enrollment.next_remind_at + 1, enrollment.id, nextRemindAt],
           );
           await query(
             "INSERT INTO reorder_dispatches (id, enrollment_id, status, occurred_at, fail_reason) " +

package/lib/seller-signup.js

@@ -826,14 +826,21 @@ function create(opts) {
         miss.code = "APPLICATION_NOT_FOUND";
         throw miss;
       }
-      if (TERMINAL_APPLICATION_STATUSES.indexOf(app.status) !== -1) {
+      // A stranded approval: a prior approve claimed 'approved' but the
+      // vendor was never persisted (the worker died / timed out between
+      // the status claim and the vendor_slug stamp). 'approved' is
+      // terminal, so without this the application could never be approved,
+      // rejected, or revised again. Treat an 'approved' row with no
+      // vendor_slug as re-approvable so the registration can be retried.
+      var recoverable = app.status === "approved" && app.vendor_slug == null;
+      if (TERMINAL_APPLICATION_STATUSES.indexOf(app.status) !== -1 && !recoverable) {
         var term = new Error(
           "seller-signup.approveApplication: refused — application is " + app.status + " (terminal)"
         );
         term.code = "APPLICATION_TERMINAL";
         throw term;
       }
-      if (app.status !== "in_review") {
+      if (app.status !== "in_review" && !recoverable) {
         var notReady = new Error(
           "seller-signup.approveApplication: refused — application is " + app.status +
           "; approve requires status='in_review' (all requested documents uploaded)"
@@ -851,15 +858,25 @@ function create(opts) {
       // the loser is refused before registering anything. vendor_slug is
       // stamped in a second UPDATE after the (winner-only) registration.
       var ts = _now();
+      // The recovery branch (re-approving a stranded 'approved' row with
+      // no vendor) must be EXCLUSIVE. Without gating on the observed
+      // approved_at, two concurrent recovery approvals would BOTH match
+      // (the UPDATE changes nothing that makes the recoverable predicate
+      // false) and both call registerVendor — the duplicate-vendor race
+      // the claim exists to prevent. Gating the recovery branch on
+      // `approved_at = <observed>` (while the UPDATE bumps approved_at to
+      // a fresh ts) makes a second concurrent caller's predicate no longer
+      // match. The in_review branch stays exclusive via the status flip.
       var claim = await query(
         "UPDATE seller_applications " +
         "SET status = 'approved', approved_at = ?1, approved_by = ?2, updated_at = ?1 " +
-        "WHERE id = ?3 AND status = 'in_review'",
-        [ts, approvedBy, applicationId],
+        "WHERE id = ?3 AND (status = 'in_review' " +
+        "OR (status = 'approved' AND vendor_slug IS NULL AND approved_at = ?4))",
+        [ts, approvedBy, applicationId, app.approved_at],
       );
       if (Number(claim.rowCount || 0) !== 1) {
         var raced = new Error(
-          "seller-signup.approveApplication: refused — application is no longer in_review (concurrent approval)"
+          "seller-signup.approveApplication: refused — application is not in an approvable state (concurrent approval)"
         );
         raced.code = "APPLICATION_NOT_READY";
         throw raced;
@@ -883,15 +900,17 @@ function create(opts) {
           status:               "active",
         });
       } catch (e) {
-        // Roll the claim back so the application returns to in_review and
-        // can be re-approved — the winning claim must not strand the app
-        // in 'approved' with no vendor behind it.
+        // Roll back ONLY the claim THIS call won, to in_review so it can be
+        // re-approved. Gate on `approved_at = ts` (our claim's stamp, never
+        // a subsequent re-claim's) AND `vendor_slug IS NULL` (no vendor was
+        // stamped) so a delayed rollback can't clobber another caller's
+        // successful approval.
         try {
           await query(
             "UPDATE seller_applications " +
             "SET status = 'in_review', approved_at = NULL, approved_by = NULL, updated_at = ?1 " +
-            "WHERE id = ?2 AND status = 'approved'",
-            [_now(), applicationId],
+            "WHERE id = ?2 AND status = 'approved' AND approved_at = ?3 AND vendor_slug IS NULL",
+            [_now(), applicationId, ts],
           );
         } catch (_e2) { /* drop-silent — the registerVendor error is the caller's signal */ }
         // Surface the vendors error with our typed-code wrapper so

package/lib/wishlist-digest.js

@@ -941,10 +941,19 @@ function create(opts) {
       // the cursor back to observedNext, guarded on the value we claimed
       // so a concurrent winner's advance is never clobbered.
       var _unclaim = async function () {
+        // Roll the cursor to a value DISTINCT from the one this tick
+        // observed (observedNext + 1ms), NOT back to the exact observed
+        // value: a concurrent overlapping tick that read the same cursor
+        // is waiting to claim `next_dispatch_at = observedNext`, and
+        // restoring the exact value would let it match and re-send the
+        // digest in the same overlap. observedNext+1 stays due, so a LATER
+        // tick re-attempts (deferred, not re-fired in this overlap); the
+        // guard on the claimed value means a concurrent winner's advance
+        // is never clobbered.
         await query(
           "UPDATE wishlist_digest_enrollments SET next_dispatch_at = ?1 " +
           "WHERE id = ?2 AND next_dispatch_at = ?3",
-          [observedNext, enrollment.id, nextDispatchAt],
+          [observedNext + 1, enrollment.id, nextDispatchAt],
         );
       };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.63",
+  "version": "0.4.65",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {