@open-mercato/core 0.6.5-develop.4534.1.b459babe6d → 0.6.5-develop.4544.1.71c003c861

package/src/modules/perspectives/services/perspectiveService.ts

@@ -1,5 +1,6 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { CacheStrategy } from '@open-mercato/cache'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { Perspective, RolePerspective } from '../data/entities'
 import type {
   PerspectiveSettings,
@@ -216,7 +217,12 @@ export async function loadPerspectivesState(
 export async function saveUserPerspective(
   em: EntityManager,
   cache: CacheStrategy | null | undefined,
-  options: { scope: PerspectiveScope; tableId: string; input: PerspectiveSaveInput },
+  options: {
+    scope: PerspectiveScope
+    tableId: string
+    input: PerspectiveSaveInput
+    request?: Request | Headers | null
+  },
 ): Promise<ResolvedPerspective> {
   const { scope, tableId, input } = options
   const tenantId = scope.tenantId ?? null
@@ -235,6 +241,12 @@ export async function saveUserPerspective(
     if (!entity) {
       throw Object.assign(new Error('Perspective not found'), { code: 'NOT_FOUND' })
     }
+    enforceCommandOptimisticLock({
+      resourceKind: 'perspectives.perspective',
+      resourceId: entity.id,
+      current: entity.updatedAt ?? null,
+      request: options.request ?? null,
+    })
   } else {
     entity = await em.findOne(Perspective, {
       userId: scope.userId,

package/src/modules/planner/backend/planner/availability-rulesets/[id]/page.tsx

@@ -8,7 +8,6 @@ import { ErrorMessage, RecordNotFoundState } from '@open-mercato/ui/backend/deta
 import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { updateCrud, deleteCrud } from '@open-mercato/ui/backend/utils/crud'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
-import { normalizeCrudServerError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { AvailabilityRulesEditor, type AvailabilityScheduleItemBuilder } from '@open-mercato/core/modules/planner/components/AvailabilityRulesEditor'
 import { parseAvailabilityRuleWindow } from '@open-mercato/core/modules/planner/lib/availabilitySchedule'
 import { extractCustomFieldEntries } from '@open-mercato/shared/lib/crud/custom-fields-client'
@@ -29,6 +28,7 @@ type RuleSetRecord = {
   description?: string | null
   timezone: string
   updatedAt?: string | null
+  updated_at?: string | null
   name_raw?: string | null
 } & Record<string, unknown>
 
@@ -40,6 +40,7 @@ export default function PlannerAvailabilityRuleSetDetailPage({ params }: { param
   const rulesetId = params?.id
   const translate = useT()
   const router = useRouter()
+  // optimistic-lock: AvailabilityRuleSetForm forwards optimisticLockUpdatedAt from initialValues.updatedAt (wrapper auto-derives the header on save + delete).
   const [initialValues, setInitialValues] = React.useState<AvailabilityRuleSetFormValues | null>(null)
   const [error, setError] = React.useState<string | null>(null)
   const [isNotFound, setIsNotFound] = React.useState(false)
@@ -73,6 +74,11 @@ export default function PlannerAvailabilityRuleSetDetailPage({ params }: { param
             name: record.name ?? record.name_raw ?? '',
             description: record.description ?? '',
             timezone: record.timezone ?? 'UTC',
+            updatedAt: typeof record.updatedAt === 'string'
+              ? record.updatedAt
+              : typeof record.updated_at === 'string'
+                ? record.updated_at
+                : null,
             ...customFields,
           })
         }
@@ -106,19 +112,15 @@ export default function PlannerAvailabilityRuleSetDetailPage({ params }: { param
 
   const handleDelete = React.useCallback(async () => {
     if (!rulesetId) return
-    try {
-      await deleteCrud('planner/availability-rule-sets', rulesetId, {
-        errorMessage: translate('planner.availabilityRuleSets.form.errors.delete', 'Failed to delete schedule.'),
-      })
-      flash(translate('planner.availabilityRuleSets.form.flash.deleted', 'Schedule deleted.'), 'success')
-      router.push('/backend/planner/availability-rulesets')
-    } catch (error) {
-      const normalized = normalizeCrudServerError(error)
-      flash(
-        normalized.message ?? translate('planner.availabilityRuleSets.form.errors.delete', 'Failed to delete schedule.'),
-        'error',
-      )
-    }
+    // Let a non-ok DELETE (e.g. the 409 optimistic-lock conflict) propagate so
+    // CrudForm surfaces the unified conflict bar and skips its success toast.
+    // Swallowing the error here made CrudForm treat the delete as successful and
+    // show a false "Schedule deleted." toast even though the record was kept.
+    await deleteCrud('planner/availability-rule-sets', rulesetId, {
+      errorMessage: translate('planner.availabilityRuleSets.form.errors.delete', 'Failed to delete schedule.'),
+    })
+    flash(translate('planner.availabilityRuleSets.form.flash.deleted', 'Schedule deleted.'), 'success')
+    router.push('/backend/planner/availability-rulesets')
   }, [router, rulesetId, translate])
 
   const buildScheduleItems: AvailabilityScheduleItemBuilder = React.useCallback(({ availabilityRules, bookedEvents, translate: translateLabel }) => {

package/src/modules/planner/backend/planner/availability-rulesets/page.tsx

@@ -9,8 +9,9 @@ import { markdownToPlainText } from '@open-mercato/ui/backend/markdown/markdownT
 import { DataTable, withDataTableNamespaces } from '@open-mercato/ui/backend/DataTable'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { Button } from '@open-mercato/ui/primitives/button'
-import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
 import { deleteCrud } from '@open-mercato/ui/backend/utils/crud'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { normalizeCrudServerError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
@@ -126,7 +127,10 @@ export default function PlannerAvailabilityRuleSetsPage() {
     })
     if (!confirmed) return
     try {
-      await deleteCrud('planner/availability-rule-sets', entry.id, { errorMessage: labels.errors.delete })
+      const headers = buildOptimisticLockHeader(entry.updatedAt)
+      await withScopedApiRequestHeaders(headers, () => (
+        deleteCrud('planner/availability-rule-sets', entry.id, { errorMessage: labels.errors.delete })
+      ))
       flash(labels.messages.deleted, 'success')
       handleRefresh()
     } catch (error) {
@@ -237,4 +241,3 @@ function mapRuleSet(item: Record<string, unknown>): RuleSetRow {
     updatedAt,
   }, item)
 }
-

package/src/modules/planner/components/AvailabilityRuleSetForm.tsx

@@ -12,6 +12,7 @@ export type AvailabilityRuleSetFormValues = {
   name?: string
   description?: string | null
   timezone?: string
+  updatedAt?: string | null
 } & Record<string, unknown>
 
 export type AvailabilityRuleSetFormProps = {
@@ -92,6 +93,8 @@ export function AvailabilityRuleSetForm(props: AvailabilityRuleSetFormProps) {
       groups={groups}
       entityId={E.planner.planner_availability_rule_set}
       initialValues={initialValues}
+      hideFooterActions
+      optimisticLockUpdatedAt={initialValues.updatedAt}
       onSubmit={onSubmit}
       onDelete={onDelete}
       isLoading={isLoading}

package/src/modules/planner/components/AvailabilityRulesEditor.tsx

@@ -14,8 +14,9 @@ import {
   SelectValue,
 } from '@open-mercato/ui/primitives/select'
 import { LoadingMessage, ErrorMessage } from '@open-mercato/ui/backend/detail'
-import { apiCall, apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, apiCallOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
 import { createCrud, deleteCrud, updateCrud } from '@open-mercato/ui/backend/utils/crud'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
 import { ComboboxInput, TimePicker } from '@open-mercato/ui/backend/inputs'
@@ -53,12 +54,16 @@ type AvailabilityRule = {
   unavailabilityReasonEntryId?: string | null
   unavailabilityReasonValue?: string | null
   createdAt?: string | null
+  updatedAt?: string | null
+  updated_at?: string | null
 }
 
 type AvailabilityRuleSet = {
   id: string
   name: string
   timezone: string
+  updatedAt?: string | null
+  updated_at?: string | null
 }
 
 export type AvailabilityBookedEvent = {
@@ -95,6 +100,14 @@ type RuleSetFormValues = {
 }
 type WeeklyWindows = TimeWindow[][]
 
+function withOptimisticLockForRule<T>(rule: AvailabilityRule, mutation: () => Promise<T>): Promise<T> {
+  return withScopedApiRequestHeaders(buildOptimisticLockHeader(rule.updatedAt ?? rule.updated_at ?? null), mutation)
+}
+
+function withOptimisticLockForRuleSet<T>(ruleSet: AvailabilityRuleSet | null | undefined, mutation: () => Promise<T>): Promise<T> {
+  return withScopedApiRequestHeaders(buildOptimisticLockHeader(ruleSet?.updatedAt ?? ruleSet?.updated_at ?? null), mutation)
+}
+
 const DAY_LABELS = [
   { code: 'SU', short: 'S', nameKey: 'schedule.weekday.sunday', fallback: 'Sunday' },
   { code: 'MO', short: 'M', nameKey: 'schedule.weekday.monday', fallback: 'Monday' },
@@ -886,16 +899,21 @@ export function AvailabilityRulesEditor({
     try {
       const updates: Array<Promise<unknown>> = []
       rulesToUpdate.forEach((rule) => {
-        updates.push(updateCrud('planner/availability', {
-          id: rule.id,
-          timezone: trimmedTimezone,
-        }))
+        updates.push(withOptimisticLockForRule(rule, () => (
+          updateCrud('planner/availability', {
+            id: rule.id,
+            timezone: trimmedTimezone,
+          })
+        )))
       })
       if (rulesetTimezoneId) {
-        updates.push(updateCrud('planner/availability-rule-sets', {
-          id: rulesetTimezoneId,
-          timezone: trimmedTimezone,
-        }))
+        const ruleSet = ruleSets.find((entry) => entry.id === rulesetTimezoneId) ?? null
+        updates.push(withOptimisticLockForRuleSet(ruleSet, () => (
+          updateCrud('planner/availability-rule-sets', {
+            id: rulesetTimezoneId,
+            timezone: trimmedTimezone,
+          })
+        )))
       }
       if (updates.length) {
         await Promise.all(updates)
@@ -915,6 +933,7 @@ export function AvailabilityRulesEditor({
     listLabels.timezoneSaveError,
     refreshAvailability,
     refreshRuleSetRules,
+    ruleSets,
     effectiveRulesetId,
     subjectId,
     subjectType,
@@ -979,8 +998,14 @@ export function AvailabilityRulesEditor({
     }
     try {
       const idsToDelete = selectCustomRuleIdsToDelete('reset', availabilityRules)
+      const idsToDeleteSet = new Set(idsToDelete)
       await Promise.all(
-        idsToDelete.map((id) => deleteCrud('planner/availability', id, { errorMessage: listLabels.saveWeeklyError })),
+        availabilityRules
+          .filter((rule) => idsToDeleteSet.has(rule.id))
+          .map((rule) => withOptimisticLockForRule(
+            rule,
+            () => deleteCrud('planner/availability', rule.id, { errorMessage: listLabels.saveWeeklyError }),
+          )),
       )
       setCustomOverridesEnabled(false)
       await refreshAvailability()
@@ -996,8 +1021,14 @@ export function AvailabilityRulesEditor({
     // Switching preserves saved custom hours (#2325); only an explicit reset clears them.
     const idsToDelete = selectCustomRuleIdsToDelete('switch', availabilityRules)
     if (idsToDelete.length) {
+      const idsToDeleteSet = new Set(idsToDelete)
       await Promise.all(
-        idsToDelete.map((id) => deleteCrud('planner/availability', id, { errorMessage: listLabels.saveWeeklyError })),
+        availabilityRules
+          .filter((rule) => idsToDeleteSet.has(rule.id))
+          .map((rule) => withOptimisticLockForRule(
+            rule,
+            () => deleteCrud('planner/availability', rule.id, { errorMessage: listLabels.saveWeeklyError }),
+          )),
       )
     }
     setSelectedRulesetId(nextId)
@@ -1030,7 +1061,11 @@ export function AvailabilityRulesEditor({
         variant: 'destructive',
       }),
       deleteRuleSet: async (id) => {
-        await deleteCrud('planner/availability-rule-sets', id, { errorMessage: listLabels.ruleSetDeleteError })
+        // Version-check the schedule delete (the list page already does; the editor
+        // previously sent no header → last-write-wins on delete). #2055 round-5.
+        await withOptimisticLockForRuleSet(selected, () => (
+          deleteCrud('planner/availability-rule-sets', id, { errorMessage: listLabels.ruleSetDeleteError })
+        ))
       },
       clearAssignment: async () => {
         setCustomOverridesEnabled(false)
@@ -1258,9 +1293,12 @@ export function AvailabilityRulesEditor({
         }, { errorMessage: listLabels.saveDateError })
       } else {
         const rulesToDelete = editorRules
-        const uniqueRuleIds = Array.from(new Set(rulesToDelete.map((rule) => rule.id)))
+        const uniqueRulesById = new Map(rulesToDelete.map((rule) => [rule.id, rule]))
         await Promise.all(
-          uniqueRuleIds.map((id) => deleteCrud('planner/availability', id, { errorMessage: listLabels.saveDateError })),
+          Array.from(uniqueRulesById.values()).map((rule) => withOptimisticLockForRule(
+            rule,
+            () => deleteCrud('planner/availability', rule.id, { errorMessage: listLabels.saveDateError }),
+          )),
         )
 
         const creations: Array<Promise<unknown>> = []
@@ -1607,7 +1645,12 @@ export function AvailabilityRulesEditor({
                                 variant="outline"
                                 size="icon"
                                 onClick={async () => {
-                                  await Promise.all(rules.map((rule) => deleteCrud('planner/availability', rule.id)))
+                                  await Promise.all(
+                                    rules.map((rule) => withOptimisticLockForRule(
+                                      rule,
+                                      () => deleteCrud('planner/availability', rule.id),
+                                    )),
+                                  )
                                   await refreshAvailability()
                                   await refreshRuleSetRules()
                                 }}

package/src/modules/planner/components/AvailabilitySchedule.tsx

@@ -12,6 +12,8 @@ import { Input } from '@open-mercato/ui/primitives/input'
 import { LoadingMessage, ErrorMessage } from '@open-mercato/ui/backend/detail'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { parseAvailabilityRuleWindow } from '@open-mercato/core/modules/planner/lib/availabilitySchedule'
 import { GanttChart } from 'lucide-react'
 
@@ -27,6 +29,8 @@ export type AvailabilityRule = {
   kind?: 'availability' | 'unavailability'
   note?: string | null
   createdAt?: string | null
+  updatedAt?: string | null
+  updated_at?: string | null
 }
 
 export type AvailabilityScheduleItemBuilder = (params: {
@@ -368,9 +372,12 @@ export function AvailabilitySchedule({
       exdates: normalizeExdatesInput(values.exdates),
     }
     if (editingRule) {
-      await updateCrud('planner/availability', { id: editingRule.id, ...payload }, {
-        errorMessage: availabilityLabels.updateError,
-      })
+      const headers = buildOptimisticLockHeader(editingRule.updatedAt ?? editingRule.updated_at ?? null)
+      await withScopedApiRequestHeaders(headers, () => (
+        updateCrud('planner/availability', { id: editingRule.id, ...payload }, {
+          errorMessage: availabilityLabels.updateError,
+        })
+      ))
       flash(availabilityLabels.updatedFlash, 'success')
     } else {
       await createCrud('planner/availability', payload, {
@@ -386,10 +393,17 @@ export function AvailabilitySchedule({
 
   const handleAvailabilityDelete = React.useCallback(async () => {
     if (!editingRule) return
-    await deleteCrud('planner/availability', editingRule.id, {
-      errorMessage: availabilityLabels.deleteError,
-    })
-    flash(availabilityLabels.deletedFlash, 'success')
+    const headers = buildOptimisticLockHeader(editingRule.updatedAt ?? editingRule.updated_at ?? null)
+    await withScopedApiRequestHeaders(headers, () => (
+      deleteCrud('planner/availability', editingRule.id, {
+        errorMessage: availabilityLabels.deleteError,
+      })
+    ))
+    // Success/conflict UX is owned by the host CrudForm (it flashes delete success
+    // and surfaces an optimistic-lock 409 on the conflict bar). Do NOT flash success
+    // here: deleteCrud throws on a 409 so this line only ran on a real delete, but the
+    // extra toast duplicated CrudForm's and read as a misleading success (#2409). The
+    // side effects below still run only after a successful delete.
     setDialogOpen(false)
     setEditingRule(null)
     setSlotSeed(null)
@@ -477,6 +491,7 @@ export function AvailabilitySchedule({
             embedded
             fields={availabilityFields}
             initialValues={availabilityInitialValues}
+            optimisticLockUpdatedAt={editingRule?.updatedAt ?? editingRule?.updated_at ?? null}
             submitLabel={editingRule ? availabilityLabels.submitSave : availabilityLabels.submitCreate}
             onSubmit={handleAvailabilitySubmit}
             onDelete={editingRule ? handleAvailabilityDelete : undefined}

package/src/modules/query_index/lib/engine.ts

@@ -113,6 +113,7 @@ export class HybridQueryEngine implements QueryEngine {
   private customFieldKeysCache = new Map<string, { expiresAt: number; value: string[] }>()
   private customFieldKeysTtlMs: number
   private columnCache = new Map<string, boolean>()
+  private customEntityCache = new Map<string, boolean>()
   private debugVerbosity: boolean | null = null
   private sqlDebugEnabled: boolean | null = null
   private forcePartialIndexEnabled: boolean | null = null
@@ -973,6 +974,9 @@ export class HybridQueryEngine implements QueryEngine {
   }
 
   private async isCustomEntity(entity: string): Promise<boolean> {
+    const cached = this.customEntityCache.get(entity)
+    if (cached !== undefined) return cached
+    let result = false
     try {
       const db = this.getDb() as any
       const row = await db
@@ -981,6 +985,36 @@ export class HybridQueryEngine implements QueryEngine {
         .where('entity_id', '=', entity)
         .where('is_active', '=', true)
         .executeTakeFirst()
+      if (row) {
+        result = true
+      } else {
+        // Read/write symmetry. Records written through the entities data engine
+        // (`de.createCustomEntityRecord`) always land in `custom_entities_storage`,
+        // even for module-declared custom entities whose id is also a frozen system
+        // id — those are NEVER registered in `custom_entities` (install treats a
+        // system id as non-registrable). Without this fallback the query routes to
+        // the empty ORM/index path and those records are write-only (created with
+        // 200 but unreadable on the edit form). A real ORM entity never writes rows
+        // to `custom_entities_storage`, so this can only ever re-classify genuine
+        // doc-storage entities — it cannot misroute table-backed entities.
+        result = await this.hasCustomEntityStorageRows(entity)
+      }
+    } catch {
+      result = false
+    }
+    this.customEntityCache.set(entity, result)
+    return result
+  }
+
+  private async hasCustomEntityStorageRows(entity: string): Promise<boolean> {
+    try {
+      const db = this.getDb() as any
+      const row = await db
+        .selectFrom('custom_entities_storage')
+        .select(sql<number>`1`.as('one'))
+        .where('entity_type', '=', entity)
+        .limit(1)
+        .executeTakeFirst()
       return !!row
     } catch {
       return false

package/src/modules/resources/backend/resources/resource-types/[id]/edit/page.tsx

@@ -54,8 +54,13 @@ export default function ResourcesResourceTypeEditPage({ params }: { params?: { i
                 ? item.appearanceColor
                 : typeof item.appearance_color === 'string'
                   ? item.appearance_color
-                  : null,
+                : null,
             },
+            updatedAt: typeof item.updatedAt === 'string'
+              ? item.updatedAt
+              : typeof item.updated_at === 'string'
+                ? item.updated_at
+                : null,
             ...customValues,
           })
           setResourceCount(typeof item.resourceCount === 'number'
@@ -104,6 +109,7 @@ export default function ResourcesResourceTypeEditPage({ params }: { params?: { i
         {error ? (
           <ErrorMessage label={error} />
         ) : null}
+        {/* optimistic-lock: ResourceTypeCrudForm forwards optimisticLockUpdatedAt from initialValues.updatedAt (auto-derives the header on save + delete). */}
         <ResourceTypeCrudForm
           mode="edit"
           initialValues={initialValues ?? { id: resourceTypeId, name: '', description: '', appearance: { icon: null, color: null } }}

package/src/modules/resources/backend/resources/resource-types/page.tsx

@@ -10,8 +10,9 @@ import { DataTable, withDataTableNamespaces } from '@open-mercato/ui/backend/Dat
 import { Button } from '@open-mercato/ui/primitives/button'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
-import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
 import { deleteCrud } from '@open-mercato/ui/backend/utils/crud'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { renderDictionaryColor, renderDictionaryIcon } from '@open-mercato/core/modules/dictionaries/components/dictionaryAppearance'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
 import { Package } from 'lucide-react'
@@ -228,7 +229,10 @@ export default function ResourcesResourceTypesPage() {
     })
     if (!confirmed) return
     try {
-      await deleteCrud('resources/resource-types', entry.id, { errorMessage: translations.errors.delete })
+      const headers = buildOptimisticLockHeader(entry.updatedAt)
+      await withScopedApiRequestHeaders(headers, () => (
+        deleteCrud('resources/resource-types', entry.id, { errorMessage: translations.errors.delete })
+      ))
       flash(translations.messages.deleted, 'success')
       handleRefresh()
     } catch (error) {
@@ -314,4 +318,3 @@ function mapApiResourceType(item: Record<string, unknown>): ResourceTypeRow {
       : 0
   return withDataTableNamespaces({ id, name, description, appearanceIcon, appearanceColor, updatedAt, resourceCount }, item)
 }
-

package/src/modules/resources/backend/resources/resources/[id]/page.tsx

@@ -5,7 +5,8 @@ import { useRouter, useSearchParams } from 'next/navigation'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { FormHeader } from '@open-mercato/ui/backend/forms'
 import { Button } from '@open-mercato/ui/primitives/button'
-import { apiCallOrThrow, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCallOrThrow, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { collectCustomFieldValues } from '@open-mercato/ui/backend/utils/customFieldValues'
 import { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { updateCrud, deleteCrud } from '@open-mercato/ui/backend/utils/crud'
@@ -446,6 +447,12 @@ export default function ResourcesResourceDetailPage({ params }: { params?: { id?
             capacityUnitValue: resource.capacityUnitValue ?? '',
             appearance: { icon: resource.appearanceIcon ?? null, color: resource.appearanceColor ?? null },
             isActive: resource.isActive ?? true,
+            updatedAt:
+              typeof resource.updatedAt === 'string'
+                ? resource.updatedAt
+                : typeof resource.updated_at === 'string'
+                  ? resource.updated_at
+                  : null,
             customFieldsetCode: resource.resourceTypeId
               ? resolveFieldsetCode(resource.resourceTypeId)
               : RESOURCES_RESOURCE_FIELDSET_DEFAULT,
@@ -472,12 +479,20 @@ export default function ResourcesResourceDetailPage({ params }: { params?: { id?
 
   const handleRulesetChange = React.useCallback(async (nextId: string | null) => {
     if (!resourceId) return
-    await updateCrud('resources/resources', { id: resourceId, availabilityRuleSetId: nextId }, {
+    const updateSchedule = () => updateCrud('resources/resources', { id: resourceId, availabilityRuleSetId: nextId }, {
       errorMessage: t('resources.resources.availability.ruleset.updateError', 'Failed to update schedule.'),
     })
+    const resourceOptimisticLockHeader = buildOptimisticLockHeader(
+      typeof initialValues?.updatedAt === 'string' ? initialValues.updatedAt : null,
+    )
+    if (Object.keys(resourceOptimisticLockHeader).length > 0) {
+      await withScopedApiRequestHeaders(resourceOptimisticLockHeader, updateSchedule)
+    } else {
+      await updateSchedule()
+    }
     setAvailabilityRuleSetId(nextId)
     flash(t('resources.resources.availability.ruleset.updateSuccess', 'Schedule updated.'), 'success')
-  }, [resourceId, t])
+  }, [initialValues?.updatedAt, resourceId, t])
 
   const resourceTitle =
     typeof initialValues?.name === 'string' && initialValues.name.trim().length > 0
@@ -647,6 +662,11 @@ export default function ResourcesResourceDetailPage({ params }: { params?: { id?
                   successRedirect="/backend/resources/resources"
                   formConfig={formConfig}
                   initialValues={initialValues ?? undefined}
+                  optimisticLockUpdatedAt={
+                    typeof initialValues?.updatedAt === 'string'
+                      ? initialValues.updatedAt
+                      : null
+                  }
                   onSubmit={handleSubmit}
                   onDelete={handleDelete}
                   isLoading={!initialValues}

package/src/modules/resources/backend/resources/resources/page.tsx

@@ -9,8 +9,9 @@ import { DataTable, withDataTableNamespaces } from '@open-mercato/ui/backend/Dat
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { BooleanIcon } from '@open-mercato/ui/backend/ValueIcons'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
 import { deleteCrud } from '@open-mercato/ui/backend/utils/crud'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import type { FilterDef, FilterOption, FilterValues } from '@open-mercato/ui/backend/FilterOverlay'
 import type { TagOption } from '@open-mercato/ui/backend/detail'
@@ -31,6 +32,7 @@ type ResourceRow = {
   isActive: boolean
   appearanceIcon?: string | null
   appearanceColor?: string | null
+  updatedAt?: string | null
 }
 
 type ResourceTypeRow = {
@@ -349,9 +351,12 @@ export default function ResourcesResourcesPage() {
     })
     if (!confirmed) return
     try {
-      await deleteCrud('resources/resources', row.id, {
-        errorMessage: t('resources.resources.list.error.delete', 'Failed to delete resource.'),
-      })
+      const headers = buildOptimisticLockHeader(row.updatedAt)
+      await withScopedApiRequestHeaders(headers, () => (
+        deleteCrud('resources/resources', row.id, {
+          errorMessage: t('resources.resources.list.error.delete', 'Failed to delete resource.'),
+        })
+      ))
       flash(t('resources.resources.list.flash.deleted', 'Resource deleted.'), 'success')
       setPage(1)
       router.refresh()
@@ -536,6 +541,11 @@ function mapApiResource(item: Record<string, unknown>): ResourceRow {
       ? item.appearance_color
       : null
   const tags = Array.isArray(item.tags) ? item.tags as TagOption[] : []
+  const updatedAt = typeof item.updatedAt === 'string'
+    ? item.updatedAt
+    : typeof item.updated_at === 'string'
+      ? item.updated_at
+      : null
   return withDataTableNamespaces({
     id,
     name,
@@ -545,5 +555,6 @@ function mapApiResource(item: Record<string, unknown>): ResourceRow {
     isActive,
     appearanceIcon,
     appearanceColor,
+    updatedAt,
   }, item)
 }

package/src/modules/resources/components/ResourceCrudForm.tsx

@@ -316,6 +316,7 @@ export type ResourcesResourceFormProps = {
   embedded?: boolean
   successRedirect?: string
   initialValues?: Record<string, unknown>
+  optimisticLockUpdatedAt?: string | null
   onSubmit: (values: Record<string, unknown>) => Promise<void>
   onDelete?: () => Promise<void>
   isLoading?: boolean
@@ -332,6 +333,7 @@ export function ResourcesResourceForm(props: ResourcesResourceFormProps) {
     embedded = false,
     successRedirect,
     initialValues,
+    optimisticLockUpdatedAt,
     onSubmit,
     onDelete,
     isLoading,
@@ -368,6 +370,7 @@ export function ResourcesResourceForm(props: ResourcesResourceFormProps) {
       fields={formConfig.fields}
       groups={groups}
       initialValues={initialValues}
+      optimisticLockUpdatedAt={optimisticLockUpdatedAt}
       entityId={E.resources.resources_resource}
       customFieldsetBindings={{ [E.resources.resources_resource]: { valueKey: 'customFieldsetCode' } }}
       onSubmit={onSubmit}

package/src/modules/resources/components/ResourceTypeCrudForm.tsx

@@ -13,6 +13,7 @@ export type ResourceTypeFormValues = {
   name: string
   description?: string
   appearance?: { icon?: string | null; color?: string | null }
+  updatedAt?: string | null
 } & Record<string, unknown>
 
 type ResourceTypeCrudFormProps = {
@@ -118,6 +119,7 @@ export function ResourceTypeCrudForm({
       groups={groups}
       entityId={E.resources.resources_resource_type}
       initialValues={initialValues}
+      optimisticLockUpdatedAt={mode === 'edit' ? initialValues.updatedAt : undefined}
       isLoading={isLoading}
       onSubmit={onSubmit}
       onDelete={mode === 'edit' ? onDelete : undefined}

package/src/modules/sales/api/documents/factory.ts

@@ -202,6 +202,12 @@ const mapUpdateResponse = (entity: any) => {
     paymentMethodId: entity?.paymentMethodId ?? null,
     paymentMethodCode: entity?.paymentMethodCode ?? null,
     paymentMethodSnapshot: normalizeJsonRecord(entity?.paymentMethodSnapshot),
+    // Return the fresh version so the client can refresh its optimistic-lock
+    // token after a successful inline save — otherwise a second save on the same
+    // page sends the now-stale updatedAt and falsely 409s (#2055 QA).
+    updatedAt: entity?.updatedAt
+      ? (entity.updatedAt instanceof Date ? entity.updatedAt.toISOString() : entity.updatedAt)
+      : null,
   }
 }
 
@@ -492,7 +498,13 @@ export function buildDocumentCrudOptions(binding: DocumentBinding) {
           const organizationId =
             typeof item?.organizationId === 'string' ? item.organizationId : ctx?.selectedOrganizationId ?? ctx?.auth?.orgId ?? null
           if (orderId && tenantId && organizationId) {
-            const em = ctx?.container?.resolve?.('em') as import('@mikro-orm/postgresql').EntityManager | undefined
+            const requestEm = ctx?.container?.resolve?.('em') as import('@mikro-orm/postgresql').EntityManager | undefined
+            // Display-only totals recalculation: run on a forked EntityManager so
+            // the order/line/adjustment entities loaded here never enter the
+            // request's Unit of Work. This guarantees a GET can never flush an
+            // UPDATE (and thus never advance `updated_at`), which would otherwise
+            // surface as a spurious optimistic-lock 409 in another tab.
+            const em = requestEm?.fork()
             if (em) {
               const totals = await recalculateOrderTotalsForDisplay(
                 em,