@open-mercato/core 0.10.1-develop.7728.1.6b52eb2849 → 0.10.1-develop.7741.1.61a2652671

package/src/modules/sales/commands/returns.ts

@@ -15,7 +15,7 @@ import type { SalesCalculationService } from '../services/salesCalculationServic
 import type { SalesAdjustmentDraft, SalesLineSnapshot, SalesDocumentCalculationResult } from '../lib/types'
 import { isExternalAmountsMode } from '../lib/calculations'
 import { readPersistedHeaderTotals } from '../lib/externalAmounts'
-import { cloneJson, deriveLineNetFromGross, ensureOrganizationScope, ensureSameScope, ensureTenantScope, extractUndoPayload, toNumericString, enforceSalesDocumentOptimisticLock, SALES_RESOURCE_KIND_ORDER, SALES_RESOURCE_KIND_RETURN } from './shared'
+import { cloneJson, deriveLineNetFromGross, ensureOrganizationScope, ensureSameScope, ensureTenantScope, extractUndoPayload, toNumericString, enforceSalesDocumentOptimisticLock, lockSalesDocumentRow, SALES_RESOURCE_KIND_ORDER, SALES_RESOURCE_KIND_RETURN } from './shared'
 import { resolveRedoSnapshot } from '@open-mercato/shared/lib/commands/redo'
 import { SalesOrder, SalesOrderAdjustment, SalesOrderLine, SalesReturn, SalesReturnLine } from '../data/entities'
 import { mapOrderLineEntityToSnapshot } from '../lib/lineSnapshots'
@@ -317,6 +317,21 @@ async function loadReturnHeaderSnapshot(em: EntityManager, id: string): Promise<
   }
 }
 
+async function lockReturnOrder(
+  em: EntityManager,
+  orderId: string,
+  scope: { tenantId: string; organizationId: string },
+): Promise<SalesOrder | null> {
+  if (!(await lockSalesDocumentRow(em, 'sales_orders', orderId, scope))) return null
+  return findOneWithDecryption(
+    em,
+    SalesOrder,
+    { id: orderId, deletedAt: null, ...scope },
+    { refresh: true },
+    scope,
+  )
+}
+
 /**
  * Reverse the order-level effects of a return: restore each order line's
  * `returnedQuantity`, drop the return's line-scoped credit adjustments, remove
@@ -337,20 +352,17 @@ async function reverseReturnEffects(
   salesCalculationService: SalesCalculationService,
   snapshot: ReturnSnapshot,
 ): Promise<void> {
-  const order = await findOneWithDecryption(
-    em,
-    SalesOrder,
-    { id: snapshot.orderId, deletedAt: null },
-    {},
-    { tenantId: snapshot.tenantId, organizationId: snapshot.organizationId },
-  )
-  if (!order) return
-
+  let order: SalesOrder | null = null
   let lines: SalesOrderLine[] = []
   await withAtomicFlush(
     em,
     [
       async () => {
+        order = await lockReturnOrder(em, snapshot.orderId, {
+          tenantId: snapshot.tenantId,
+          organizationId: snapshot.organizationId,
+        })
+        if (!order) return
         lines = await findWithDecryption(
           em,
           SalesOrderLine,
@@ -369,6 +381,7 @@ async function reverseReturnEffects(
         })
       },
       async () => {
+        if (!order) return
         if (snapshot.adjustmentIds.length) {
           const adjustments = await findWithDecryption(
             em,
@@ -450,17 +463,24 @@ async function restoreReturnEffects(
     em,
     [
       async () => {
-        const order = await findOneWithDecryption(
+        const existingOrder = await findOneWithDecryption(
           em,
           SalesOrder,
           { id: snapshot.orderId, deletedAt: null },
           {},
           { tenantId: snapshot.tenantId, organizationId: snapshot.organizationId },
         )
+        if (!existingOrder) {
+          throw notFound(translate('sales.returns.orderMissing', 'Order not found.'))
+        }
+        ensureSameScope(existingOrder, snapshot.organizationId, snapshot.tenantId)
+        const order = await lockReturnOrder(em, existingOrder.id, {
+          tenantId: snapshot.tenantId,
+          organizationId: snapshot.organizationId,
+        })
         if (!order) {
           throw notFound(translate('sales.returns.orderMissing', 'Order not found.'))
         }
-        ensureSameScope(order, snapshot.organizationId, snapshot.tenantId)
 
         const orderLines = await findWithDecryption(
           em,
@@ -643,17 +663,24 @@ const createReturnCommand: CommandHandler<ReturnCreateInput, { returnId: string
 
     const salesCalculationService = ctx.container.resolve<SalesCalculationService>('salesCalculationService')
     const { header, createdLines, order } = await em.transactional(async (tx) => {
-      const order = await findOneWithDecryption(
+      const existingOrder = await findOneWithDecryption(
         tx,
         SalesOrder,
         { id: input.orderId, deletedAt: null },
         {},
         { tenantId: input.tenantId, organizationId: input.organizationId },
       )
+      if (!existingOrder) {
+        throw notFound(translate('sales.returns.orderMissing', 'Order not found.'))
+      }
+      ensureSameScope(existingOrder, input.organizationId, input.tenantId)
+      const order = await lockReturnOrder(tx, existingOrder.id, {
+        tenantId: input.tenantId,
+        organizationId: input.organizationId,
+      })
       if (!order) {
         throw notFound(translate('sales.returns.orderMissing', 'Order not found.'))
       }
-      ensureSameScope(order, input.organizationId, input.tenantId)
       await enforceSalesDocumentOptimisticLock(ctx, order, SALES_RESOURCE_KIND_ORDER)
 
       const orderLines = await findWithDecryption(

package/src/modules/sales/commands/shared.ts

@@ -49,6 +49,46 @@ export async function enforceSalesDocumentOptimisticLock(
   })
 }
 
+type SalesDocumentLockTable = 'sales_orders' | 'sales_quotes'
+type SalesDocumentLockRow = {
+  id: string
+  tenant_id: string
+  organization_id: string
+  deleted_at: Date | null
+}
+type SalesDocumentLockDatabase = Record<SalesDocumentLockTable, SalesDocumentLockRow>
+
+/**
+ * Take the parent-document row lock that serializes every write deriving the
+ * order/quote header (totals, line count, paid amounts) or the document's child
+ * rows (lines, adjustments, returned/fulfilled quantities) inside the caller's
+ * transaction. Acquire it BEFORE reading the child rows the header is
+ * recalculated from, and before locking those child rows, so all writers use the
+ * same parent-then-children lock order (#6463).
+ *
+ * `FOR NO KEY UPDATE` conflicts with other writers of the same document, including
+ * the `FOR UPDATE` locks taken by payments and undo, while still allowing the
+ * `KEY SHARE` locks that foreign-key inserts (for example shipments) take on the
+ * parent row. Returns false when no live row matches the scoped id.
+ */
+export async function lockSalesDocumentRow(
+  em: EntityManager,
+  table: SalesDocumentLockTable,
+  id: string,
+  scope: { tenantId: string; organizationId: string },
+): Promise<boolean> {
+  const locked = await em.getKysely<SalesDocumentLockDatabase>()
+    .selectFrom(table)
+    .select('id')
+    .where('id', '=', id)
+    .where('tenant_id', '=', scope.tenantId)
+    .where('organization_id', '=', scope.organizationId)
+    .where('deleted_at', 'is', null)
+    .forNoKeyUpdate()
+    .executeTakeFirst()
+  return Boolean(locked)
+}
+
 export { cloneJson } from '../lib/json'
 
 export function toNumericString(value: number | null | undefined): string | null {

package/src/modules/sales/commands/shipments.ts

@@ -31,6 +31,7 @@ import {
   ensureTenantScope,
   extractUndoPayload,
   enforceSalesDocumentOptimisticLock,
+  lockSalesDocumentRow,
   SALES_RESOURCE_KIND_ORDER,
 } from './shared'
 import { resolveDictionaryEntryValue } from '../lib/dictionaries'
@@ -312,8 +313,16 @@ async function deleteShipmentWithItems(em: EntityManager, shipment: SalesShipmen
   await em.flush()
 }
 
+async function lockOrderBeforeLines(em: EntityManager, order: SalesOrder): Promise<void> {
+  await lockSalesDocumentRow(em, 'sales_orders', order.id, {
+    tenantId: order.tenantId,
+    organizationId: order.organizationId,
+  })
+}
+
 async function recomputeFulfilledQuantities(em: EntityManager, order: SalesOrder): Promise<void> {
   const scope = { tenantId: order.tenantId, organizationId: order.organizationId }
+  await lockOrderBeforeLines(em, order)
   const shipments = await findWithDecryption(em, SalesShipment, { order, deletedAt: null }, {}, scope)
   const shipmentIds = shipments.map((entry) => entry.id)
   const shipmentItems = shipmentIds.length
@@ -386,6 +395,7 @@ async function validateShipmentItems(params: {
     throw new CrudHttpError(400, { error: translate('sales.shipments.items_required', 'Add at least one line to ship.') })
   }
   const scope = { tenantId: order.tenantId, organizationId: order.organizationId }
+  if (lockOrderLines) await lockOrderBeforeLines(em, order)
   const orderLines = await findWithDecryption(
     em,
     SalesOrderLine,

package/src/modules/staff/api/timesheets/time-projects/route.ts

@@ -379,9 +379,13 @@ const crud = makeCrudRoute({
           .filter((value) => value.length > 0)
       }
       if (parseBooleanFlag(query.mine) && ctx.auth) {
+        const tenantId = ctx.auth.tenantId ?? null
+        const organizationId = ctx.selectedOrganizationId ?? ctx.auth.orgId ?? null
+        if (!tenantId || !organizationId) {
+          filters[F.id] = { $in: [IMPOSSIBLE_PROJECT_ID] }
+          return filters
+        }
         const em = ctx.container.resolve('em') as EntityManager
-        const tenantId = ctx.auth.tenantId ?? ''
-        const organizationId = ctx.selectedOrganizationId ?? ctx.auth.orgId ?? ''
         const assigned = await resolveCallerAssignedProjectIds(
           em,
           ctx.auth.sub,

package/src/modules/workflows/api/portal/tasks/[id]/complete/route.ts

@@ -128,7 +128,11 @@ export async function POST(request: NextRequest, { params }: { params: { id: str
     // Anything the handler refuses on ownership or status grounds collapses into
     // the same 404 the predicate would have produced, so the act path discloses
     // no more than the read path.
-    if (code === 'TASK_NOT_FOUND' || code === 'TASK_ASSIGNED_TO_ANOTHER_USER') {
+    if (
+      code === 'TASK_NOT_FOUND' ||
+      code === 'TASK_ASSIGNED_TO_ANOTHER_USER' ||
+      code === 'WORKFLOW_NOT_ACTIVE'
+    ) {
       return NextResponse.json(PORTAL_TASK_REFUSAL.body, { status: PORTAL_TASK_REFUSAL.status })
     }
     logger.error('Error completing portal task', { err: error })

package/src/modules/workflows/api/tasks/[id]/complete/route.ts

@@ -164,6 +164,12 @@ export async function POST(
           { status: 409 }
         )
       }
+      if ((error as { code?: unknown }).code === 'WORKFLOW_NOT_ACTIVE') {
+        return NextResponse.json(
+          { error: error.message, code: 'WORKFLOW_NOT_ACTIVE' },
+          { status: 409 }
+        )
+      }
       if (error.message.includes('not found')) {
         return NextResponse.json(
           { error: error.message },
@@ -213,7 +219,7 @@ export const openApi: OpenApiRouteDoc = {
         { status: 401, description: 'Unauthorized', schema: workflowErrorSchema },
         { status: 403, description: 'The task is visible to the caller but is not theirs to act on — it has no assignee and no role queue, so it must be reassigned first (§6.4: administration widens seeing, never acting).', schema: workflowErrorSchema },
         { status: 404, description: 'Task not found, or not visible to the caller', schema: workflowErrorSchema },
-        { status: 409, description: 'Task already completed', schema: workflowErrorSchema },
+        { status: 409, description: 'Task already completed, assigned to another user, or its workflow run is no longer active (`code: WORKFLOW_NOT_ACTIVE` — the run is completed, failed, cancelled, compensating or compensated)', schema: workflowErrorSchema },
         { status: 500, description: 'Internal server error', schema: workflowErrorSchema },
       ],
     },

package/src/modules/workflows/backend/tasks/[id]/page.tsx

@@ -222,8 +222,12 @@ export default function UserTaskDetailPage({ params }: { params: { id: string }
           flash(t('workflows.tasks.messages.completed'), 'success')
           refreshTask()
         } else {
-          const failure = result.result as { error?: string } | null
-          flash(failure?.error || t('workflows.tasks.messages.completeFailed'), 'error')
+          const failure = result.result as { error?: string; code?: string } | null
+          const failureMessage =
+            failure?.code === 'WORKFLOW_NOT_ACTIVE'
+              ? t('workflows.tasks.messages.workflowNotActive')
+              : failure?.error || t('workflows.tasks.messages.completeFailed')
+          flash(failureMessage, 'error')
         }
       } catch (err) {
         logger.error('Error completing task', { err })

package/src/modules/workflows/i18n/de.json

@@ -729,6 +729,7 @@
   "workflows.events.types.TransitionFired": "Übergang ausgelöst",
   "workflows.events.types.TransitionPausedForActivities": "Übergang für Aktivitäten pausiert",
   "workflows.events.types.USER_TASK_ASSIGNED": "Benutzeraufgabe zugewiesen",
+  "workflows.events.types.USER_TASK_CANCELLED": "Benutzeraufgabe abgebrochen",
   "workflows.events.types.USER_TASK_CLAIMED": "Benutzeraufgabe übernommen",
   "workflows.events.types.USER_TASK_COMPLETED": "Benutzeraufgabe abgeschlossen",
   "workflows.events.types.USER_TASK_CREATED": "Benutzeraufgabe erstellt",
@@ -1851,6 +1852,7 @@
   "workflows.tasks.messages.loadFailed": "Benutzeraufgaben konnten nicht geladen werden",
   "workflows.tasks.messages.reassignFailed": "Aufgabe konnte nicht neu zugewiesen werden",
   "workflows.tasks.messages.reassigned": "Aufgabe erfolgreich neu zugewiesen",
+  "workflows.tasks.messages.workflowNotActive": "Der Workflow ist nicht mehr aktiv",
   "workflows.tasks.myTasks": "Meine Aufgaben",
   "workflows.tasks.overdue": "Überfällig",
   "workflows.tasks.plural": "Benutzeraufgaben",

package/src/modules/workflows/i18n/en.json

@@ -729,6 +729,7 @@
   "workflows.events.types.TransitionFired": "Transition Fired",
   "workflows.events.types.TransitionPausedForActivities": "Transition Paused for Activities",
   "workflows.events.types.USER_TASK_ASSIGNED": "User Task Assigned",
+  "workflows.events.types.USER_TASK_CANCELLED": "User Task Cancelled",
   "workflows.events.types.USER_TASK_CLAIMED": "User Task Claimed",
   "workflows.events.types.USER_TASK_COMPLETED": "User Task Completed",
   "workflows.events.types.USER_TASK_CREATED": "User Task Created",
@@ -1851,6 +1852,7 @@
   "workflows.tasks.messages.loadFailed": "Failed to load user tasks",
   "workflows.tasks.messages.reassignFailed": "Failed to reassign task",
   "workflows.tasks.messages.reassigned": "Task reassigned successfully",
+  "workflows.tasks.messages.workflowNotActive": "Workflow is no longer active",
   "workflows.tasks.myTasks": "My Tasks",
   "workflows.tasks.overdue": "Overdue",
   "workflows.tasks.plural": "User Tasks",

package/src/modules/workflows/i18n/es.json

@@ -729,6 +729,7 @@
   "workflows.events.types.TransitionFired": "Transicion activada",
   "workflows.events.types.TransitionPausedForActivities": "Transicion pausada por actividades",
   "workflows.events.types.USER_TASK_ASSIGNED": "Tarea de usuario asignada",
+  "workflows.events.types.USER_TASK_CANCELLED": "Tarea de usuario cancelada",
   "workflows.events.types.USER_TASK_CLAIMED": "Tarea de usuario reclamada",
   "workflows.events.types.USER_TASK_COMPLETED": "Tarea de usuario completada",
   "workflows.events.types.USER_TASK_CREATED": "Tarea de usuario creada",
@@ -1851,6 +1852,7 @@
   "workflows.tasks.messages.loadFailed": "No se pudieron cargar las tareas de usuario",
   "workflows.tasks.messages.reassignFailed": "No se pudo reasignar la tarea",
   "workflows.tasks.messages.reassigned": "Tarea reasignada correctamente",
+  "workflows.tasks.messages.workflowNotActive": "El flujo de trabajo ya no está activo",
   "workflows.tasks.myTasks": "Mis tareas",
   "workflows.tasks.overdue": "Vencida",
   "workflows.tasks.plural": "Tareas de usuario",

package/src/modules/workflows/i18n/ko.json

@@ -729,6 +729,7 @@
   "workflows.events.types.TransitionFired": "전환 발동됨",
   "workflows.events.types.TransitionPausedForActivities": "활동 대기로 전환 일시 중지",
   "workflows.events.types.USER_TASK_ASSIGNED": "사용자 작업 할당됨",
+  "workflows.events.types.USER_TASK_CANCELLED": "사용자 작업 취소됨",
   "workflows.events.types.USER_TASK_CLAIMED": "사용자 작업 수령됨",
   "workflows.events.types.USER_TASK_COMPLETED": "사용자 작업 완료",
   "workflows.events.types.USER_TASK_CREATED": "사용자 작업 생성됨",
@@ -1851,6 +1852,7 @@
   "workflows.tasks.messages.loadFailed": "사용자 작업을 불러오지 못했습니다",
   "workflows.tasks.messages.reassignFailed": "Failed to reassign task",
   "workflows.tasks.messages.reassigned": "Task reassigned successfully",
+  "workflows.tasks.messages.workflowNotActive": "워크플로가 더 이상 활성 상태가 아닙니다",
   "workflows.tasks.myTasks": "내 작업",
   "workflows.tasks.overdue": "기한 초과",
   "workflows.tasks.plural": "사용자 작업",

package/src/modules/workflows/i18n/pl.json

@@ -729,6 +729,7 @@
   "workflows.events.types.TransitionFired": "Przejście Wykonane",
   "workflows.events.types.TransitionPausedForActivities": "Przejście Wstrzymane dla Działań",
   "workflows.events.types.USER_TASK_ASSIGNED": "Zadanie Użytkownika Przypisane",
+  "workflows.events.types.USER_TASK_CANCELLED": "Zadanie Użytkownika Anulowane",
   "workflows.events.types.USER_TASK_CLAIMED": "Zadanie Użytkownika Przejęte",
   "workflows.events.types.USER_TASK_COMPLETED": "Zadanie Użytkownika Ukończone",
   "workflows.events.types.USER_TASK_CREATED": "Zadanie Użytkownika Utworzone",
@@ -1851,6 +1852,7 @@
   "workflows.tasks.messages.loadFailed": "Nie udało się załadować zadań użytkowników",
   "workflows.tasks.messages.reassignFailed": "Nie udało się ponownie przypisać zadania",
   "workflows.tasks.messages.reassigned": "Zadanie zostało ponownie przypisane",
+  "workflows.tasks.messages.workflowNotActive": "Przepływ pracy nie jest już aktywny",
   "workflows.tasks.myTasks": "Moje Zadania",
   "workflows.tasks.overdue": "Po Terminie",
   "workflows.tasks.plural": "Zadania Użytkownika",

package/src/modules/workflows/lib/instance-status.ts

@@ -0,0 +1,29 @@
+/**
+ * Workflow instance statuses a user-task completion or a user-task SLA job must
+ * not touch.
+ *
+ * PURE: a type-only import, so the engine does not depend on the metrics
+ * module's `WORKFLOW_TERMINAL_STATUSES` for a runtime decision.
+ *
+ * The name means "a completion must not touch this run", NOT "its tasks are
+ * closed": a FAILED run keeps its open task so a retry can pick it up.
+ * `COMPENSATING` is included although it is not terminal — `compensateWorkflow`
+ * holds it while rollback activities run and then overwrites it with
+ * `COMPENSATED` or `FAILED`, and a completion in that window would advance a
+ * run that is being rolled back.
+ */
+
+import type { WorkflowInstanceStatus } from '../data/entities'
+
+export const RUN_STATUSES_CLOSED_TO_USER_TASKS: readonly WorkflowInstanceStatus[] = [
+  'COMPLETED',
+  'FAILED',
+  'CANCELLED',
+  'COMPENSATING',
+  'COMPENSATED',
+]
+
+export function isRunClosedToUserTasks(status: string | null | undefined): boolean {
+  if (!status) return false
+  return (RUN_STATUSES_CLOSED_TO_USER_TASKS as readonly string[]).includes(status)
+}

package/src/modules/workflows/lib/task-handler.ts

@@ -27,6 +27,7 @@ import {
 } from './task-decisions'
 import { loadTaskDecisionContext } from './task-decision-context'
 import { readRequiredFormFields } from './task-form-schema'
+import { isRunClosedToUserTasks } from './instance-status'
 import * as stepHandler from './step-handler'
 import * as transitionHandler from './transition-handler'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -174,6 +175,23 @@ export async function completeUserTask(
     )
   }
 
+  const instance = await em.findOne(WorkflowInstance, task.workflowInstanceId)
+  if (!instance) {
+    throw new UserTaskError(
+      'Workflow instance not found',
+      'INSTANCE_NOT_FOUND',
+      { workflowInstanceId: task.workflowInstanceId }
+    )
+  }
+
+  if (isRunClosedToUserTasks(instance.status)) {
+    throw new UserTaskError(
+      'Workflow is no longer active',
+      'WORKFLOW_NOT_ACTIVE',
+      { taskId, workflowInstanceId: instance.id, status: instance.status }
+    )
+  }
+
   // The chosen decision rides along inside the completion payload the task
   // already persists — no new column, and downstream route conditions can read
   // it once the payload is merged into the run context.
@@ -190,16 +208,6 @@ export async function completeUserTask(
 
   await em.flush()
 
-  // Fetch workflow instance
-  const instance = await em.findOne(WorkflowInstance, task.workflowInstanceId)
-  if (!instance) {
-    throw new UserTaskError(
-      'Workflow instance not found',
-      'INSTANCE_NOT_FOUND',
-      { workflowInstanceId: task.workflowInstanceId }
-    )
-  }
-
   // Branch-scoped completion: when the task belongs to a parallel branch,
   // merge form data into the branch namespace and resume just that branch.
   //

package/src/modules/workflows/lib/task-sla.ts

@@ -32,6 +32,7 @@ import {
   type AgentReviewStepLike,
 } from './agent-review'
 import { findDefinitionForInstance } from './find-definition'
+import { isRunClosedToUserTasks } from './instance-status'
 import { emitWorkflowsEvent } from '../events'
 import type * as stepHandlerModule from './step-handler'
 import type * as transitionHandlerModule from './transition-handler'
@@ -300,7 +301,9 @@ type BreachOutcome =
   | 'reassigned'
   | 'routed'
   | 'route_skipped_branch'
+  | 'route_skipped_closed_run'
   | 'attention'
+  | 'attention_skipped_closed_run'
 
 interface AppliedBreachHandling {
   outcome: BreachOutcome
@@ -393,6 +396,9 @@ async function applyBreachHandling(
 
   if (resolution.kind === 'attention') {
     if (!instance) return { outcome: 'none' }
+    if (isRunClosedToUserTasks(instance.status)) {
+      return { outcome: 'attention_skipped_closed_run', detail: { stepId, status: instance.status } }
+    }
     await markInstanceForAttention(em, instance, stepId, task, now)
     return { outcome: 'attention', detail: { stepId } }
   }
@@ -430,6 +436,13 @@ async function applyBreachHandling(
       return { outcome: 'route_skipped_branch', detail: { transitionId: resolution.transition.transitionId } }
     }
 
+    if (isRunClosedToUserTasks(instance?.status)) {
+      return {
+        outcome: 'route_skipped_closed_run',
+        detail: { transitionId: resolution.transition.transitionId, status: instance?.status },
+      }
+    }
+
     // The task is superseded by the route, not abandoned: `ESCALATED` is an
     // existing `UserTaskStatus`, so no state machine changes.
     task.status = 'ESCALATED'

package/src/modules/workflows/lib/workflow-executor.ts

@@ -13,8 +13,9 @@
 import { EntityManager, LockMode } from '@mikro-orm/core'
 import type { EntityManager as PostgreSqlEntityManager } from '@mikro-orm/postgresql'
 import type { AwilixContainer } from 'awilix'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import {
+  UserTask,
   WorkflowDefinition,
   WorkflowInstance,
   WorkflowEvent,
@@ -1487,6 +1488,28 @@ export async function completeWorkflow(
   }
 
   // Original completion logic (no compensation needed or status is COMPLETED/CANCELLED)
+
+  // A cancelled run has no recovery path, so its open tasks can never become
+  // actionable again: close them in the same flush as the status. CANCELLED
+  // only — a FAILED run parked on a task is retried against that same task.
+  // Loaded before the run is mutated so no read sits between a scalar change
+  // and the flush that persists it.
+  const cancelledTasks =
+    status === 'CANCELLED'
+      ? await findWithDecryption(
+          em as PostgreSqlEntityManager,
+          UserTask,
+          {
+            workflowInstanceId: instance.id,
+            tenantId: instance.tenantId,
+            organizationId: instance.organizationId,
+            status: { $in: ['PENDING', 'IN_PROGRESS'] },
+          },
+          undefined,
+          { tenantId: instance.tenantId, organizationId: instance.organizationId }
+        )
+      : []
+
   const now = new Date()
   instance.status = status
   instance.updatedAt = now
@@ -1514,8 +1537,27 @@ export async function completeWorkflow(
 
   await writeRunOutcome(em, instance, status)
 
+  for (const task of cancelledTasks) {
+    task.status = 'CANCELLED'
+    task.updatedAt = now
+  }
+
   await em.flush()
 
+  // Logged before the terminal event so WORKFLOW_CANCELLED stays last in the
+  // run's timeline.
+  for (const task of cancelledTasks) {
+    await logWorkflowEvent(em, {
+      workflowInstanceId: instanceId,
+      stepInstanceId: task.stepInstanceId,
+      ...(task.branchInstanceId ? { branchInstanceId: task.branchInstanceId } : {}),
+      eventType: 'USER_TASK_CANCELLED',
+      eventData: { taskId: task.id, taskName: task.taskName, reason: 'workflow-cancelled' },
+      tenantId: instance.tenantId,
+      organizationId: instance.organizationId,
+    })
+  }
+
   // Log completion event
   const eventType =
     status === 'COMPLETED'
@@ -2044,6 +2086,7 @@ async function logWorkflowEvent(
   event: {
     workflowInstanceId: string
     stepInstanceId?: string
+    branchInstanceId?: string
     eventType: string
     eventData: any
     userId?: string