@open-mercato/core 0.6.4-develop.4371.1.8f3030407e → 0.6.4

package/src/modules/planner/components/AvailabilityRuleSetForm.tsx

@@ -12,6 +12,7 @@ export type AvailabilityRuleSetFormValues = {
   name?: string
   description?: string | null
   timezone?: string
+  updatedAt?: string | null
 } & Record<string, unknown>
 
 export type AvailabilityRuleSetFormProps = {
@@ -73,7 +74,7 @@ export function AvailabilityRuleSetForm(props: AvailabilityRuleSetFormProps) {
       id: 'description',
       label: translate('planner.availabilityRuleSets.form.fields.description', 'Description'),
       type: 'richtext',
-      editor: 'html',
+      editor: 'uiw',
     },
   ], [translate])
 
@@ -92,6 +93,8 @@ export function AvailabilityRuleSetForm(props: AvailabilityRuleSetFormProps) {
       groups={groups}
       entityId={E.planner.planner_availability_rule_set}
       initialValues={initialValues}
+      hideFooterActions
+      optimisticLockUpdatedAt={initialValues.updatedAt}
       onSubmit={onSubmit}
       onDelete={onDelete}
       isLoading={isLoading}

package/src/modules/planner/components/AvailabilityRulesEditor.tsx

@@ -14,8 +14,9 @@ import {
   SelectValue,
 } from '@open-mercato/ui/primitives/select'
 import { LoadingMessage, ErrorMessage } from '@open-mercato/ui/backend/detail'
-import { apiCall, apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, apiCallOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
 import { createCrud, deleteCrud, updateCrud } from '@open-mercato/ui/backend/utils/crud'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
 import { ComboboxInput, TimePicker } from '@open-mercato/ui/backend/inputs'
@@ -53,12 +54,16 @@ type AvailabilityRule = {
   unavailabilityReasonEntryId?: string | null
   unavailabilityReasonValue?: string | null
   createdAt?: string | null
+  updatedAt?: string | null
+  updated_at?: string | null
 }
 
 type AvailabilityRuleSet = {
   id: string
   name: string
   timezone: string
+  updatedAt?: string | null
+  updated_at?: string | null
 }
 
 export type AvailabilityBookedEvent = {
@@ -95,6 +100,14 @@ type RuleSetFormValues = {
 }
 type WeeklyWindows = TimeWindow[][]
 
+function withOptimisticLockForRule<T>(rule: AvailabilityRule, mutation: () => Promise<T>): Promise<T> {
+  return withScopedApiRequestHeaders(buildOptimisticLockHeader(rule.updatedAt ?? rule.updated_at ?? null), mutation)
+}
+
+function withOptimisticLockForRuleSet<T>(ruleSet: AvailabilityRuleSet | null | undefined, mutation: () => Promise<T>): Promise<T> {
+  return withScopedApiRequestHeaders(buildOptimisticLockHeader(ruleSet?.updatedAt ?? ruleSet?.updated_at ?? null), mutation)
+}
+
 const DAY_LABELS = [
   { code: 'SU', short: 'S', nameKey: 'schedule.weekday.sunday', fallback: 'Sunday' },
   { code: 'MO', short: 'M', nameKey: 'schedule.weekday.monday', fallback: 'Monday' },
@@ -593,13 +606,26 @@ export function AvailabilityRulesEditor({
       const params = new URLSearchParams({ page: '1', pageSize: '100' })
       const call = await apiCall<{ items?: AvailabilityRuleSet[] }>(`/api/planner/availability-rule-sets?${params.toString()}`)
       const items = Array.isArray(call.result?.items) ? call.result.items : []
-      setRuleSets(items)
+      if (!effectiveRulesetId || items.some((entry) => entry.id === effectiveRulesetId)) {
+        setRuleSets(items)
+        return
+      }
+      const selectedParams = new URLSearchParams({
+        page: '1',
+        pageSize: '1',
+        ids: effectiveRulesetId,
+      })
+      const selectedCall = await apiCall<{ items?: AvailabilityRuleSet[] }>(
+        `/api/planner/availability-rule-sets?${selectedParams.toString()}`,
+      )
+      const selected = Array.isArray(selectedCall.result?.items) ? selectedCall.result.items[0] : null
+      setRuleSets(selected ? [selected, ...items] : items)
     } catch {
       setRuleSets([])
     } finally {
       setRuleSetsLoading(false)
     }
-  }, [onRulesetChange])
+  }, [effectiveRulesetId, onRulesetChange])
 
   const fetchUnavailabilityReasonOptions = React.useCallback(async () => {
     const entries = await loadUnavailabilityReasonEntries(subjectType)
@@ -886,16 +912,21 @@ export function AvailabilityRulesEditor({
     try {
       const updates: Array<Promise<unknown>> = []
       rulesToUpdate.forEach((rule) => {
-        updates.push(updateCrud('planner/availability', {
-          id: rule.id,
-          timezone: trimmedTimezone,
-        }))
+        updates.push(withOptimisticLockForRule(rule, () => (
+          updateCrud('planner/availability', {
+            id: rule.id,
+            timezone: trimmedTimezone,
+          })
+        )))
       })
       if (rulesetTimezoneId) {
-        updates.push(updateCrud('planner/availability-rule-sets', {
-          id: rulesetTimezoneId,
-          timezone: trimmedTimezone,
-        }))
+        const ruleSet = ruleSets.find((entry) => entry.id === rulesetTimezoneId) ?? null
+        updates.push(withOptimisticLockForRuleSet(ruleSet, () => (
+          updateCrud('planner/availability-rule-sets', {
+            id: rulesetTimezoneId,
+            timezone: trimmedTimezone,
+          })
+        )))
       }
       if (updates.length) {
         await Promise.all(updates)
@@ -915,6 +946,7 @@ export function AvailabilityRulesEditor({
     listLabels.timezoneSaveError,
     refreshAvailability,
     refreshRuleSetRules,
+    ruleSets,
     effectiveRulesetId,
     subjectId,
     subjectType,
@@ -979,8 +1011,14 @@ export function AvailabilityRulesEditor({
     }
     try {
       const idsToDelete = selectCustomRuleIdsToDelete('reset', availabilityRules)
+      const idsToDeleteSet = new Set(idsToDelete)
       await Promise.all(
-        idsToDelete.map((id) => deleteCrud('planner/availability', id, { errorMessage: listLabels.saveWeeklyError })),
+        availabilityRules
+          .filter((rule) => idsToDeleteSet.has(rule.id))
+          .map((rule) => withOptimisticLockForRule(
+            rule,
+            () => deleteCrud('planner/availability', rule.id, { errorMessage: listLabels.saveWeeklyError }),
+          )),
       )
       setCustomOverridesEnabled(false)
       await refreshAvailability()
@@ -996,8 +1034,14 @@ export function AvailabilityRulesEditor({
     // Switching preserves saved custom hours (#2325); only an explicit reset clears them.
     const idsToDelete = selectCustomRuleIdsToDelete('switch', availabilityRules)
     if (idsToDelete.length) {
+      const idsToDeleteSet = new Set(idsToDelete)
       await Promise.all(
-        idsToDelete.map((id) => deleteCrud('planner/availability', id, { errorMessage: listLabels.saveWeeklyError })),
+        availabilityRules
+          .filter((rule) => idsToDeleteSet.has(rule.id))
+          .map((rule) => withOptimisticLockForRule(
+            rule,
+            () => deleteCrud('planner/availability', rule.id, { errorMessage: listLabels.saveWeeklyError }),
+          )),
       )
     }
     setSelectedRulesetId(nextId)
@@ -1030,7 +1074,11 @@ export function AvailabilityRulesEditor({
         variant: 'destructive',
       }),
       deleteRuleSet: async (id) => {
-        await deleteCrud('planner/availability-rule-sets', id, { errorMessage: listLabels.ruleSetDeleteError })
+        // Version-check the schedule delete (the list page already does; the editor
+        // previously sent no header → last-write-wins on delete). #2055 round-5.
+        await withOptimisticLockForRuleSet(selected, () => (
+          deleteCrud('planner/availability-rule-sets', id, { errorMessage: listLabels.ruleSetDeleteError })
+        ))
       },
       clearAssignment: async () => {
         setCustomOverridesEnabled(false)
@@ -1258,9 +1306,12 @@ export function AvailabilityRulesEditor({
         }, { errorMessage: listLabels.saveDateError })
       } else {
         const rulesToDelete = editorRules
-        const uniqueRuleIds = Array.from(new Set(rulesToDelete.map((rule) => rule.id)))
+        const uniqueRulesById = new Map(rulesToDelete.map((rule) => [rule.id, rule]))
         await Promise.all(
-          uniqueRuleIds.map((id) => deleteCrud('planner/availability', id, { errorMessage: listLabels.saveDateError })),
+          Array.from(uniqueRulesById.values()).map((rule) => withOptimisticLockForRule(
+            rule,
+            () => deleteCrud('planner/availability', rule.id, { errorMessage: listLabels.saveDateError }),
+          )),
         )
 
         const creations: Array<Promise<unknown>> = []
@@ -1607,7 +1658,12 @@ export function AvailabilityRulesEditor({
                                 variant="outline"
                                 size="icon"
                                 onClick={async () => {
-                                  await Promise.all(rules.map((rule) => deleteCrud('planner/availability', rule.id)))
+                                  await Promise.all(
+                                    rules.map((rule) => withOptimisticLockForRule(
+                                      rule,
+                                      () => deleteCrud('planner/availability', rule.id),
+                                    )),
+                                  )
                                   await refreshAvailability()
                                   await refreshRuleSetRules()
                                 }}
@@ -1789,6 +1845,7 @@ export function AvailabilityRulesEditor({
                                   createOption={createUnavailabilityReasonOption}
                                   labels={unavailableReasonLabels}
                                   selectClassName="w-full"
+                                  sortOptions="none"
                                   manageHref="/backend/config/dictionaries"
                                   disabled={!canManageUnavailability}
                                 />

package/src/modules/planner/components/AvailabilitySchedule.tsx

@@ -12,6 +12,8 @@ import { Input } from '@open-mercato/ui/primitives/input'
 import { LoadingMessage, ErrorMessage } from '@open-mercato/ui/backend/detail'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { parseAvailabilityRuleWindow } from '@open-mercato/core/modules/planner/lib/availabilitySchedule'
 import { GanttChart } from 'lucide-react'
 
@@ -27,6 +29,8 @@ export type AvailabilityRule = {
   kind?: 'availability' | 'unavailability'
   note?: string | null
   createdAt?: string | null
+  updatedAt?: string | null
+  updated_at?: string | null
 }
 
 export type AvailabilityScheduleItemBuilder = (params: {
@@ -368,9 +372,12 @@ export function AvailabilitySchedule({
       exdates: normalizeExdatesInput(values.exdates),
     }
     if (editingRule) {
-      await updateCrud('planner/availability', { id: editingRule.id, ...payload }, {
-        errorMessage: availabilityLabels.updateError,
-      })
+      const headers = buildOptimisticLockHeader(editingRule.updatedAt ?? editingRule.updated_at ?? null)
+      await withScopedApiRequestHeaders(headers, () => (
+        updateCrud('planner/availability', { id: editingRule.id, ...payload }, {
+          errorMessage: availabilityLabels.updateError,
+        })
+      ))
       flash(availabilityLabels.updatedFlash, 'success')
     } else {
       await createCrud('planner/availability', payload, {
@@ -386,10 +393,17 @@ export function AvailabilitySchedule({
 
   const handleAvailabilityDelete = React.useCallback(async () => {
     if (!editingRule) return
-    await deleteCrud('planner/availability', editingRule.id, {
-      errorMessage: availabilityLabels.deleteError,
-    })
-    flash(availabilityLabels.deletedFlash, 'success')
+    const headers = buildOptimisticLockHeader(editingRule.updatedAt ?? editingRule.updated_at ?? null)
+    await withScopedApiRequestHeaders(headers, () => (
+      deleteCrud('planner/availability', editingRule.id, {
+        errorMessage: availabilityLabels.deleteError,
+      })
+    ))
+    // Success/conflict UX is owned by the host CrudForm (it flashes delete success
+    // and surfaces an optimistic-lock 409 on the conflict bar). Do NOT flash success
+    // here: deleteCrud throws on a 409 so this line only ran on a real delete, but the
+    // extra toast duplicated CrudForm's and read as a misleading success (#2409). The
+    // side effects below still run only after a successful delete.
     setDialogOpen(false)
     setEditingRule(null)
     setSlotSeed(null)
@@ -477,6 +491,7 @@ export function AvailabilitySchedule({
             embedded
             fields={availabilityFields}
             initialValues={availabilityInitialValues}
+            optimisticLockUpdatedAt={editingRule?.updatedAt ?? editingRule?.updated_at ?? null}
             submitLabel={editingRule ? availabilityLabels.submitSave : availabilityLabels.submitCreate}
             onSubmit={handleAvailabilitySubmit}
             onDelete={editingRule ? handleAvailabilityDelete : undefined}

package/src/modules/portal/frontend/[orgSlug]/portal/login/page.tsx

@@ -7,6 +7,8 @@ import { PasswordInput } from '@open-mercato/ui/primitives/password-input'
 import { Label } from '@open-mercato/ui/primitives/label'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Alert, AlertDescription } from '@open-mercato/ui/primitives/alert'
+import { EmptyState } from '@open-mercato/ui/primitives/empty-state'
+import { SearchX } from 'lucide-react'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
 import { usePortalContext } from '@open-mercato/ui/portal/PortalContext'
@@ -30,7 +32,7 @@ export default function PortalLoginPage({ params }: Props) {
       event.preventDefault()
       setError(null)
 
-      if (!tenant.tenantId) {
+      if (!tenant.organizationId) {
         setError(t('portal.org.invalid', 'Organization not found.'))
         return
       }
@@ -41,7 +43,7 @@ export default function PortalLoginPage({ params }: Props) {
           method: 'POST',
           headers: { 'Content-Type': 'application/json' },
           credentials: 'include',
-          body: JSON.stringify({ email, password, tenantId: tenant.tenantId }),
+          body: JSON.stringify({ email, password, organizationId: tenant.organizationId }),
         })
 
         if (result.ok && result.result?.ok) {
@@ -49,16 +51,10 @@ export default function PortalLoginPage({ params }: Props) {
           return
         }
 
-        if (result.status === 423) {
-          setError(t('portal.login.error.locked', 'Account locked. Try again later.'))
-        } else if (result.status === 401 && result.result?.error === 'Account is deactivated') {
-          setError(
-            t(
-              'portal.login.error.inactive',
-              'Your account is not active yet. An administrator must activate it before you can log in.',
-            ),
-          )
-        } else if (result.status === 401) {
+        if (result.status === 401) {
+          // The login API intentionally returns a single generic 401 for unknown, inactive,
+          // locked, and unverified accounts so account existence cannot be enumerated.
+          // Lockout/deactivation guidance is delivered out-of-band (e.g. email), never here.
           setError(t('portal.login.error.invalidCredentials', 'Invalid email or password.'))
         } else {
           setError(result.result?.error || t('portal.login.error.generic', 'Login failed. Please try again.'))
@@ -69,7 +65,7 @@ export default function PortalLoginPage({ params }: Props) {
         setSubmitting(false)
       }
     },
-    [email, password, tenant.tenantId, orgSlug, t],
+    [email, password, tenant.organizationId, orgSlug, t],
   )
 
   const injectionContext = useMemo(
@@ -84,9 +80,12 @@ export default function PortalLoginPage({ params }: Props) {
   if (tenant.error) {
     return (
       <div className="mx-auto w-full max-w-md py-12">
-        <Alert variant="destructive">
-          <AlertDescription>{t('portal.org.invalid', 'Organization not found.')}</AlertDescription>
-        </Alert>
+        <EmptyState
+          variant="subtle"
+          size="lg"
+          icon={<SearchX className="h-6 w-6" aria-hidden />}
+          title={t('portal.org.invalid', 'Organization not found.')}
+        />
       </div>
     )
   }

package/src/modules/portal/frontend/[orgSlug]/portal/page.tsx

@@ -5,7 +5,8 @@ import { useRouter } from 'next/navigation'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
-import { Alert, AlertDescription } from '@open-mercato/ui/primitives/alert'
+import { EmptyState } from '@open-mercato/ui/primitives/empty-state'
+import { SearchX, ShoppingBag, User, Shield } from 'lucide-react'
 import { usePortalContext } from '@open-mercato/ui/portal/PortalContext'
 import { PortalFeatureCard } from '@open-mercato/ui/portal/components/PortalFeatureCard'
 import { InjectionSpot } from '@open-mercato/ui/backend/injection/InjectionSpot'
@@ -13,30 +14,6 @@ import { PortalInjectionSpots } from '@open-mercato/ui/backend/injection/spotIds
 
 type Props = { params: { orgSlug: string } }
 
-function ShoppingBagIcon({ className }: { className?: string }) {
-  return (
-    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="1.5" strokeLinecap="round" strokeLinejoin="round" className={className}>
-      <path d="M6 2 3 6v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V6l-3-4Z" /><line x1="3" x2="21" y1="6" y2="6" /><path d="M16 10a4 4 0 0 1-8 0" />
-    </svg>
-  )
-}
-
-function UserIcon({ className }: { className?: string }) {
-  return (
-    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="1.5" strokeLinecap="round" strokeLinejoin="round" className={className}>
-      <path d="M19 21v-2a4 4 0 0 0-4-4H9a4 4 0 0 0-4 4v2" /><circle cx="12" cy="7" r="4" />
-    </svg>
-  )
-}
-
-function ShieldIcon({ className }: { className?: string }) {
-  return (
-    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="1.5" strokeLinecap="round" strokeLinejoin="round" className={className}>
-      <path d="M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z" />
-    </svg>
-  )
-}
-
 export default function PortalLandingPage({ params }: Props) {
   const t = useT()
   const router = useRouter()
@@ -62,9 +39,12 @@ export default function PortalLandingPage({ params }: Props) {
   if (tenant.error) {
     return (
       <div className="mx-auto w-full max-w-md py-12">
-        <Alert variant="destructive">
-          <AlertDescription>{t('portal.org.invalid', 'Organization not found.')}</AlertDescription>
-        </Alert>
+        <EmptyState
+          variant="subtle"
+          size="lg"
+          icon={<SearchX className="h-6 w-6" aria-hidden />}
+          title={t('portal.org.invalid', 'Organization not found.')}
+        />
       </div>
     )
   }
@@ -98,17 +78,17 @@ export default function PortalLandingPage({ params }: Props) {
 
       <section className="grid gap-4 sm:grid-cols-3">
         <PortalFeatureCard
-          icon={<ShoppingBagIcon className="size-5" />}
+          icon={<ShoppingBag className="size-5" />}
           title={t('portal.landing.feature.orders', 'Orders & Invoices')}
           description={t('portal.landing.feature.orders.description', 'Track your orders, download invoices, and view delivery status in real time.')}
         />
         <PortalFeatureCard
-          icon={<UserIcon className="size-5" />}
+          icon={<User className="size-5" />}
           title={t('portal.landing.feature.account', 'Account Management')}
           description={t('portal.landing.feature.account.description', 'Update your profile, manage team members, and configure your preferences.')}
         />
         <PortalFeatureCard
-          icon={<ShieldIcon className="size-5" />}
+          icon={<Shield className="size-5" />}
           title={t('portal.landing.feature.security', 'Secure Access')}
           description={t('portal.landing.feature.security.description', 'Role-based permissions, session management, and full audit trail.')}
         />

package/src/modules/portal/frontend/[orgSlug]/portal/reset-password/page.tsx

@@ -7,6 +7,8 @@ import { PasswordInput } from '@open-mercato/ui/primitives/password-input'
 import { Label } from '@open-mercato/ui/primitives/label'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Alert, AlertDescription } from '@open-mercato/ui/primitives/alert'
+import { EmptyState } from '@open-mercato/ui/primitives/empty-state'
+import { SearchX } from 'lucide-react'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
 import { usePortalContext } from '@open-mercato/ui/portal/PortalContext'
@@ -96,9 +98,12 @@ export default function PortalResetPasswordPage({ params }: Props) {
   if (tenant.error) {
     return (
       <div className="mx-auto w-full max-w-md py-12">
-        <Alert variant="destructive">
-          <AlertDescription>{t('portal.org.invalid', 'Organization not found.')}</AlertDescription>
-        </Alert>
+        <EmptyState
+          variant="subtle"
+          size="lg"
+          icon={<SearchX className="h-6 w-6" aria-hidden />}
+          title={t('portal.org.invalid', 'Organization not found.')}
+        />
       </div>
     )
   }

package/src/modules/portal/frontend/[orgSlug]/portal/signup/page.tsx

@@ -8,6 +8,8 @@ import { PasswordInput } from '@open-mercato/ui/primitives/password-input'
 import { Label } from '@open-mercato/ui/primitives/label'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Alert, AlertDescription } from '@open-mercato/ui/primitives/alert'
+import { EmptyState } from '@open-mercato/ui/primitives/empty-state'
+import { SearchX, Check } from 'lucide-react'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
 import { usePortalContext } from '@open-mercato/ui/portal/PortalContext'
@@ -34,7 +36,7 @@ export default function PortalSignupPage({ params }: Props) {
       event.preventDefault()
       setError(null)
 
-      if (!tenant.tenantId || !tenant.organizationId) {
+      if (!tenant.organizationId) {
         setError(t('portal.org.invalid', 'Organization not found.'))
         return
       }
@@ -44,7 +46,7 @@ export default function PortalSignupPage({ params }: Props) {
         const result = await apiCall<SignupResponse>('/api/customer_accounts/signup', {
           method: 'POST',
           headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ email, password, displayName, tenantId: tenant.tenantId, organizationId: tenant.organizationId }),
+          body: JSON.stringify({ email, password, displayName, organizationId: tenant.organizationId }),
         })
 
         if (result.status === 202 && result.result?.ok) {
@@ -59,7 +61,7 @@ export default function PortalSignupPage({ params }: Props) {
         setSubmitting(false)
       }
     },
-    [displayName, email, password, tenant.tenantId, tenant.organizationId, t],
+    [displayName, email, password, tenant.organizationId, t],
   )
 
   const injectionContext = useMemo(
@@ -74,9 +76,12 @@ export default function PortalSignupPage({ params }: Props) {
   if (tenant.error) {
     return (
       <div className="mx-auto w-full max-w-md py-12">
-        <Alert variant="destructive">
-          <AlertDescription>{t('portal.org.invalid', 'Organization not found.')}</AlertDescription>
-        </Alert>
+        <EmptyState
+          variant="subtle"
+          size="lg"
+          icon={<SearchX className="h-6 w-6" aria-hidden />}
+          title={t('portal.org.invalid', 'Organization not found.')}
+        />
       </div>
     )
   }
@@ -85,9 +90,7 @@ export default function PortalSignupPage({ params }: Props) {
     return (
       <div className="mx-auto w-full max-w-sm text-center">
         <div className="mx-auto mb-4 flex size-12 items-center justify-center rounded-full bg-foreground text-background">
-          <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" className="size-6">
-            <polyline points="20 6 9 17 4 12" />
-          </svg>
+          <Check className="size-6" />
         </div>
         <h1 className="text-2xl font-bold tracking-tight">{t('portal.signup.success.title', 'Check your email')}</h1>
         <p className="mt-1.5 text-sm text-muted-foreground">{t(

package/src/modules/progress/api/jobs/[id]/route.ts

@@ -73,6 +73,12 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
   }
 
   const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const existing = await em.findOne(ProgressJob, { id: params.id, tenantId: auth.tenantId })
+  if (!existing) {
+    return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  }
+
   const progressService = container.resolve('progressService') as ProgressService
 
   const job = await progressService.updateProgress(params.id, parsed.data, {
@@ -122,6 +128,7 @@ export const openApi = {
     responses: {
       200: { description: 'Progress updated' },
       400: { description: 'Invalid input' },
+      404: { description: 'Job not found' },
     },
   },
   DELETE: {

package/src/modules/query_index/api/openapi.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod'
+import { ENTITY_ID_PATTERN } from '@open-mercato/shared/lib/query/engine'
 
 export const queryIndexTag = 'Query Index'
 
@@ -80,7 +81,7 @@ export const queryIndexStatusResponseSchema = z.object({
 })
 
 export const queryIndexReindexRequestSchema = z.object({
-  entityType: z.string().min(1),
+  entityType: z.string().min(1).regex(ENTITY_ID_PATTERN),
   force: z.boolean().optional(),
   batchSize: z.number().int().positive().optional(),
   partitionCount: z.number().int().positive().optional(),

package/src/modules/query_index/api/reindex.ts

@@ -4,6 +4,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { queryIndexTag, queryIndexErrorSchema, queryIndexOkSchema, queryIndexReindexRequestSchema } from './openapi'
 import { recordIndexerLog } from '@open-mercato/shared/lib/indexers/status-log'
+import { isValidEntityIdShape } from '@open-mercato/shared/lib/query/engine'
 
 export const metadata = {
   POST: { requireAuth: true, requireFeatures: ['query_index.reindex'] },
@@ -15,6 +16,9 @@ export async function POST(req: Request) {
   const body = await req.json().catch(() => ({})) as any
   const entityType = String(body?.entityType || '')
   if (!entityType) return NextResponse.json({ error: 'Missing entityType' }, { status: 400 })
+  if (!isValidEntityIdShape(entityType)) {
+    return NextResponse.json({ error: 'Invalid entityType' }, { status: 400 })
+  }
   const force = Boolean(body?.force)
   const batchSize = Number.isFinite(body?.batchSize) ? Math.max(1, Math.trunc(body.batchSize)) : undefined
   const partitionCountInput = Number(body?.partitionCount)

package/src/modules/query_index/data/entities.ts

@@ -89,6 +89,16 @@ export class EntityIndexRow {
 
 // Track long-running index jobs (reindex/purge) per entity and org scope
 @Entity({ tableName: 'entity_index_jobs' })
+// Coalesced-scope unique index so prepareJob can upsert atomically and two
+// concurrent schedulers cannot insert duplicate rows for the same scope (#2739).
+// Declared via @Unique with a raw expression (not properties) because the scope
+// columns are nullable and NULLs must collapse to one bucket via coalesce; mirrors
+// the entity_indexes coalesced uniqueness and the domain_mappings expression unique.
+@Unique({
+  name: 'entity_index_jobs_scope_unique',
+  expression:
+    `create unique index "entity_index_jobs_scope_unique" on "entity_index_jobs" ("entity_type", coalesce("organization_id", '00000000-0000-0000-0000-000000000000'::uuid), coalesce("tenant_id", '00000000-0000-0000-0000-000000000000'::uuid), coalesce("partition_index", -1), coalesce("partition_count", -1))`,
+})
 export class EntityIndexJob {
   @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })
   id!: string