@open-mercato/core 0.6.5-develop.4534.1.b459babe6d → 0.6.5-develop.4559.1.839e136509

package/src/modules/directory/backend/directory/tenants/[id]/edit/page.tsx

@@ -6,7 +6,8 @@ import { CrudForm, type CrudField, type CrudFormGroup } from '@open-mercato/ui/b
 import { collectCustomFieldValues } from '@open-mercato/ui/backend/utils/customFieldValues'
 import { updateCrud } from '@open-mercato/ui/backend/utils/crud'
 import { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'
-import { readApiResultOrThrow, apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { readApiResultOrThrow, apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { ErrorMessage, RecordNotFoundState } from '@open-mercato/ui/backend/detail'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { extractCustomFieldEntries } from '@open-mercato/shared/lib/crud/custom-fields-client'
@@ -15,6 +16,7 @@ type TenantFormValues = {
   id: string
   name: string
   isActive: boolean
+  updatedAt?: string | null
 } & Record<string, unknown>
 
 export default function EditTenantPage({ params }: { params?: { id?: string } }) {
@@ -57,6 +59,11 @@ export default function EditTenantPage({ params }: { params?: { id?: string } })
           id: String(row.id),
           name: String(row.name),
           isActive: !!row.isActive,
+          updatedAt: typeof row.updatedAt === 'string'
+            ? row.updatedAt
+            : typeof row.updated_at === 'string'
+              ? row.updated_at
+              : null,
           ...cfValues,
         }
         if (!cancelled) setInitial(values)
@@ -114,6 +121,7 @@ export default function EditTenantPage({ params }: { params?: { id?: string } })
           groups={groups}
           entityId={E.directory.tenant}
           initialValues={(initial || { id: tenantId, name: '', isActive: true }) as Partial<TenantFormValues>}
+          optimisticLockUpdatedAt={initial?.updatedAt}
           isLoading={loading}
           loadingMessage={t('directory.tenants.form.loading', 'Loading tenant…')}
           submitLabel={t('common.save', 'Save')}
@@ -137,10 +145,13 @@ export default function EditTenantPage({ params }: { params?: { id?: string } })
             await updateCrud('directory/tenants', payload)
           }}
           onDelete={async () => {
-            const call = await apiCall(
-              `/api/directory/tenants?id=${encodeURIComponent(tenantId)}`,
-              { method: 'DELETE' },
-            )
+            const headers = buildOptimisticLockHeader(initial?.updatedAt)
+            const call = await withScopedApiRequestHeaders(headers, () => (
+              apiCall(
+                `/api/directory/tenants?id=${encodeURIComponent(tenantId)}`,
+                { method: 'DELETE' },
+              )
+            ))
             if (!call.ok) {
               await raiseCrudError(call.response, t('directory.tenants.form.errors.delete', 'Failed to delete tenant'))
             }

package/src/modules/directory/backend/directory/tenants/page.tsx

@@ -9,7 +9,8 @@ import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { BooleanIcon } from '@open-mercato/ui/backend/ValueIcons'
 import type { FilterValues } from '@open-mercato/ui/backend/FilterBar'
 import { Button } from '@open-mercato/ui/primitives/button'
-import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
@@ -125,9 +126,12 @@ export default function DirectoryTenantsPage() {
     if (!confirmed) return
 
     try {
-      const call = await apiCall(
-        `/api/directory/tenants?id=${encodeURIComponent(tenant.id)}`,
-        { method: 'DELETE' },
+      const call = await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(tenant.updatedAt),
+        () => apiCall(
+          `/api/directory/tenants?id=${encodeURIComponent(tenant.id)}`,
+          { method: 'DELETE' },
+        ),
       )
       if (!call.ok) {
         await raiseCrudError(call.response, t('directory.tenants.list.error.delete', 'Failed to delete tenant'))

package/src/modules/directory/commands/organizations.ts

@@ -689,7 +689,10 @@ const deleteOrganizationCommand: CommandHandler<{ body: any; query: Record<strin
         setInternalTenantId(deleted, tenantId)
         deleted.isActive = false
         deleted.parentId = null
-
+        resolvedDeleted = deleted
+      },
+      async () => {
+        const deleted = resolvedDeleted
         const childrenFilter: FilterQuery<Organization> = { tenant: tenantId, parentId: id, deletedAt: null }
         const children = await em.find(Organization, childrenFilter)
         const toPersist: Organization[] = []
@@ -698,11 +701,11 @@ const deleteOrganizationCommand: CommandHandler<{ body: any; query: Record<strin
           toPersist.push(child)
         }
         toPersist.push(deleted)
-        if (toPersist.length) await em.persist(toPersist).flush()
+        if (toPersist.length) em.persist(toPersist)
         setUndoMeta(deleted, { childParentsBefore: childSnapshotsBefore })
-
+      },
+      async () => {
         await rebuildHierarchyForTenant(em, tenantId)
-        resolvedDeleted = deleted
       },
     ], { transaction: true })
 

package/src/modules/entities/api/records.ts

@@ -10,6 +10,34 @@ import { parseBooleanToken, parseBooleanWithDefault } from '@open-mercato/shared
 import { setRecordCustomFields } from '../lib/helpers'
 import { CustomFieldValue } from '../data/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+
+const CUSTOM_ENTITY_RECORD_RESOURCE_KIND = 'entities.record'
+
+async function readCustomEntityRecordUpdatedAt(
+  em: any,
+  input: { entityType: string; entityId: string; organizationId: string | null },
+): Promise<string | null> {
+  try {
+    const db = em.getKysely()
+    let query = db
+      .selectFrom('custom_entities_storage' as any)
+      .select(['updated_at' as any])
+      .where('entity_type' as any, '=', input.entityType)
+      .where('entity_id' as any, '=', input.entityId)
+    query = input.organizationId === null
+      ? query.where('organization_id' as any, 'is', null as any)
+      : query.where('organization_id' as any, '=', input.organizationId)
+    const row = await query.executeTakeFirst()
+    const value = (row as any)?.updated_at
+    if (value instanceof Date) return value.toISOString()
+    if (typeof value === 'string' && value.length > 0) return value
+    return null
+  } catch {
+    return null
+  }
+}
 
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['entities.records.view'] },
@@ -85,6 +113,23 @@ export async function GET(req: Request) {
       const found = await em.findOne(CustomEntity as any, { entityId, isActive: true })
       isCustomEntity = !!found
     } catch {}
+    // Read/write symmetry: this endpoint writes every record to custom_entities_storage
+    // via the data engine, including module-declared custom entities whose id is a
+    // frozen system id and therefore never registered in `custom_entities`. Detect
+    // those by their doc-storage rows so `mapRow` strips the `cf_` prefix and the edit
+    // form can read back the saved values (mirrors HybridQueryEngine.isCustomEntity).
+    if (!isCustomEntity) {
+      try {
+        const db = em.getKysely()
+        const row = await db
+          .selectFrom('custom_entities_storage' as any)
+          .select(['entity_id' as any])
+          .where('entity_type' as any, '=', entityId)
+          .limit(1)
+          .executeTakeFirst()
+        isCustomEntity = !!row
+      } catch {}
+    }
     if (organizationIds && organizationIds.length === 0) {
       return NextResponse.json({ items: [], total: 0, page, pageSize, totalPages: 0 })
     }
@@ -164,6 +209,41 @@ export async function GET(req: Request) {
     const rawItems = res.items || []
     const viewPageItems = rawItems.map(mapRow)
     const fullPageItems = rawItems.map(mapFullRow)
+
+    // Expose `updated_at` on custom-entity records. The query engine returns only
+    // the `doc` fields + `id`, dropping the base `updated_at` column — which made
+    // optimistic locking impossible end-to-end (no version for the edit page to
+    // round-trip as the lock header). Batch-read it from storage and merge it in.
+    if (isCustomEntity && viewPageItems.length) {
+      try {
+        const recordIds = viewPageItems
+          .map((it: any) => it?.id)
+          .filter((v: any): v is string => typeof v === 'string' && v.length > 0)
+        if (recordIds.length) {
+          const db = em.getKysely()
+          const rows = await db
+            .selectFrom('custom_entities_storage' as any)
+            .select(['entity_id' as any, 'updated_at' as any])
+            .where('entity_type' as any, '=', entityId)
+            .where('entity_id' as any, 'in', recordIds as any)
+            .execute()
+          const updatedById = new Map<string, string>()
+          for (const row of rows as any[]) {
+            const value = row?.updated_at
+            const iso = value instanceof Date ? value.toISOString() : (typeof value === 'string' && value.length > 0 ? value : null)
+            if (iso && row?.entity_id) updatedById.set(String(row.entity_id), iso)
+          }
+          for (const item of viewPageItems as any[]) {
+            const iso = updatedById.get(String(item?.id))
+            if (iso) {
+              item.updated_at = iso
+              item.updatedAt = iso
+            }
+          }
+        }
+      } catch { /* best-effort: locking simply will not engage if storage is unavailable */ }
+    }
+
     const total = typeof res.total === 'number' ? res.total : rawItems.length
     const effectivePageSize = res.pageSize || pageSize
     const payload = {
@@ -343,6 +423,25 @@ export async function PUT(req: Request) {
       return NextResponse.json({ ok: true, item: { entityId, recordId: created.id } })
     }
 
+    try {
+      const currentUpdatedAt = await readCustomEntityRecordUpdatedAt(em, {
+        entityType: entityId,
+        entityId: rid,
+        organizationId: targetOrgId,
+      })
+      enforceCommandOptimisticLock({
+        resourceKind: CUSTOM_ENTITY_RECORD_RESOURCE_KIND,
+        resourceId: rid,
+        current: currentUpdatedAt,
+        request: req,
+      })
+    } catch (lockError) {
+      if (isCrudHttpError(lockError)) {
+        return NextResponse.json(lockError.body, { status: lockError.status })
+      }
+      throw lockError
+    }
+
     await de.updateCustomEntityRecord({
       entityId,
       recordId: rid,

package/src/modules/entities/backend/entities/user/[entityId]/records/[recordId]/page.tsx

@@ -79,6 +79,13 @@ export default function EditRecordPage({ params }: { params: { entityId?: string
       entityId={entityId}
       customEntity
       initialValues={initialValues || {}}
+      optimisticLockUpdatedAt={
+        typeof initialValues?.updatedAt === 'string'
+          ? initialValues.updatedAt
+          : typeof initialValues?.updated_at === 'string'
+            ? initialValues.updated_at
+            : null
+      }
       isLoading={loading}
       loadingMessage={t('entities.userEntities.records.loading', 'Loading record...')}
       submitLabel={t('entities.userEntities.records.form.submitSave', 'Save')}

package/src/modules/entities/backend/entities/user/[entityId]/records/page.tsx

@@ -11,7 +11,8 @@ import { ContextHelp } from '@open-mercato/ui/backend/ContextHelp'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import Link from 'next/link'
-import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
@@ -349,9 +350,12 @@ export RECORD_ID="<record uuid>"`}</code></pre>
                       variant: 'destructive',
                     })
                     if (!confirmed) return
-                    const deleteCall = await apiCall(
-                      `/api/entities/records?entityId=${encodeURIComponent(entityId)}&recordId=${encodeURIComponent(String((row as any).id))}`,
-                      { method: 'DELETE' },
+                    const deleteCall = await withScopedApiRequestHeaders(
+                      buildOptimisticLockHeader((row as any).updatedAt),
+                      () => apiCall(
+                        `/api/entities/records?entityId=${encodeURIComponent(entityId)}&recordId=${encodeURIComponent(String((row as any).id))}`,
+                        { method: 'DELETE' },
+                      ),
                     )
                     if (!deleteCall.ok) {
                       await raiseCrudError(deleteCall.response, 'Failed to delete record')

package/src/modules/entities/lib/helpers.ts

@@ -186,6 +186,23 @@ export async function setRecordCustomFields(
 
   if (toPersist.length) em.persist(toPersist)
   await em.flush()
+  if (process.env.OM_CF_DEBUG) {
+    try {
+      const conn = em.getConnection()
+      for (const fieldKey of keys) {
+        if (values[fieldKey] === undefined) continue
+        const rows = await conn.execute(
+          'select value_text, value_multiline, value_int, value_float, value_bool from custom_field_values where entity_id = ? and record_id = ? and field_key = ? and ((organization_id is null and ? is null) or organization_id = ?) and ((tenant_id is null and ? is null) or tenant_id = ?)',
+          [entityId, recordId, fieldKey, organizationId, organizationId, tenantId, tenantId],
+          'all',
+        ) as Array<Record<string, unknown>>
+        const persisted = rows.map((row) => row.value_text ?? row.value_multiline ?? row.value_int ?? row.value_float ?? row.value_bool)
+        console.warn(`[CF_DEBUG] setRecordCustomFields entityId=${entityId} recordId=${recordId} fieldKey=${fieldKey} input=${JSON.stringify(values[fieldKey])} persistedRows=${rows.length} persisted=${JSON.stringify(persisted)}`)
+      }
+    } catch (err) {
+      console.warn(`[CF_DEBUG] re-query failed: ${(err as Error)?.message ?? String(err)}`)
+    }
+  }
   // Emit hook for indexing if requested (outside CRUD flows)
   try {
     if (typeof opts.onChanged === 'function') {

package/src/modules/feature_toggles/api/global/[id]/override/route.ts

@@ -45,6 +45,7 @@ export async function GET(req: Request, { params }: { params: { id: string } })
     tenantName: tenant.name,
     tenantId: tenant.id,
     toggleType: toggle.type,
+    updatedAt: override?.updatedAt instanceof Date ? override.updatedAt.toISOString() : null,
   }
 
   await logCrudAccess({

package/src/modules/feature_toggles/api/overrides/route.ts

@@ -6,7 +6,9 @@ import type { CommandBus } from '@open-mercato/shared/lib/commands'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
 import { getOverrides } from '../../lib/queries'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'
+import { FeatureToggleOverride } from '../../data/entities'
 import { buildContext } from '../../lib/utils'
 import { resolveFeatureCheckContext } from "@open-mercato/core/modules/directory/utils/organizationScope"
 import { ProcessedChangeOverrideStateInput } from '../../data/validators'
@@ -87,6 +89,23 @@ export async function PUT(req: Request) {
       }, { status: 400 })
     }
 
+    // Optimistic lock: refuse a stale override overwrite when two admins edit the
+    // same global toggle override in parallel. Only enforced when an override row
+    // already exists (first set has no prior version). Strictly additive.
+    const em = ctx.container.resolve('em') as EntityManager
+    const existingOverride = await em.findOne(FeatureToggleOverride, {
+      tenantId: scope.tenantId,
+      toggle: { id: parsed.data.toggleId },
+    })
+    if (existingOverride) {
+      enforceCommandOptimisticLock({
+        resourceKind: 'feature_toggles.feature_toggle_override',
+        resourceId: existingOverride.id,
+        current: existingOverride.updatedAt ?? null,
+        request: req,
+      })
+    }
+
     const commandBus = ctx.container.resolve('commandBus') as CommandBus
     const { result, logEntry } = await commandBus.execute<ProcessedChangeOverrideStateInput, { overrideToggleId: string | null }>('feature_toggles.overrides.changeState', {
       input: {

package/src/modules/feature_toggles/backend/feature-toggles/global/[id]/edit/page.tsx

@@ -10,7 +10,6 @@ import { createFieldDefinitions, createFormGroups } from "@open-mercato/core/mod
 
 
 export default function EditFeatureTogglePage({ params }: { params?: { id?: string } }) {
-  const [initialValues, setInitialValues] = React.useState<any>(null)
   const { id } = params ?? {}
   const t = useT()
   const fields = createFieldDefinitions(t);
@@ -18,30 +17,37 @@ export default function EditFeatureTogglePage({ params }: { params?: { id?: stri
 
   const { data: featureToggleItem, isLoading } = useFeatureToggleItem(id)
 
-  React.useEffect(() => {
-    if (featureToggleItem) {
-      setInitialValues({
-        identifier: featureToggleItem.identifier,
-        name: featureToggleItem.name,
-        description: featureToggleItem.description,
-        category: featureToggleItem.category,
-
-        type: featureToggleItem.type,
-        defaultValue: featureToggleItem.defaultValue,
-      })
+  // Derive the form's initial values synchronously from the loaded record. Using
+  // a useState+useEffect here caused #2452: `isLoading` flips to false one render
+  // before the effect set `initialValues`, so CrudForm mounted with `{}` and the
+  // `type` SELECT captured an empty value (text inputs re-sync from the prop, the
+  // select does not). Deriving here means the value is present in the same render
+  // the data arrives; the `key` below also forces a clean remount on load.
+  const initialValues = React.useMemo(() => {
+    if (!featureToggleItem) return null
+    return {
+      id: featureToggleItem.id ?? (id ? String(id) : ''),
+      identifier: featureToggleItem.identifier,
+      name: featureToggleItem.name,
+      description: featureToggleItem.description,
+      category: featureToggleItem.category,
+      type: featureToggleItem.type,
+      defaultValue: featureToggleItem.defaultValue,
     }
-  }, [featureToggleItem])
+  }, [featureToggleItem, id])
 
   return (
     <Page>
       <PageBody>
         <CrudForm
+          key={initialValues ? 'ft-edit-loaded' : 'ft-edit-loading'}
           title={t('feature_toggles.form.title.edit', 'Edit Feature Toggle')}
           backHref="/backend/feature-toggles/global"
           versionHistory={{ resourceKind: 'feature_toggles.global', resourceId: id ? String(id) : '' }}
           fields={fields}
           entityId={E.feature_toggles.feature_toggle}
           initialValues={initialValues ?? {}}
+          optimisticLockUpdatedAt={featureToggleItem?.updatedAt ?? null}
           isLoading={isLoading}
           groups={formGroups}
           loadingMessage={t('feature_toggles.form.loading', 'Loading feature toggles')}

package/src/modules/feature_toggles/components/FeatureToggleOverrideCard.tsx

@@ -2,7 +2,9 @@
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@open-mercato/ui/primitives/card'
 import { DataLoader, ErrorNotice } from "@open-mercato/ui";
 import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
-import { apiCall } from "@open-mercato/ui/backend/utils/apiCall";
+import { apiCall, withScopedApiRequestHeaders } from "@open-mercato/ui/backend/utils/apiCall";
+import { buildOptimisticLockHeader } from "@open-mercato/ui/backend/utils/optimisticLock";
+import { surfaceRecordConflict } from "@open-mercato/ui/backend/conflicts";
 import { raiseCrudError } from "@open-mercato/ui/backend/utils/serverErrors";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
 import { CrudForm } from "@open-mercato/ui/backend/CrudForm";
@@ -28,23 +30,31 @@ export function FeatureToggleOverrideCard({ toggleId }: { toggleId: string }) {
 
     const mutation = useMutation({
         mutationFn: async (input: { toggleId: string; isOverride: boolean; overrideValue?: any; tenantId: string }) => {
-            const call = await apiCall<{ ok: boolean }>(
-                `/api/feature_toggles/overrides`,
-                {
-                    method: 'PUT',
-                    headers: { 'content-type': 'application/json' },
-                    body: JSON.stringify({
-                        toggleId: input.toggleId,
-                        isOverride: input.isOverride,
-                        overrideValue: input.overrideValue,
-                    }),
-                },
+            const call = await withScopedApiRequestHeaders(
+                buildOptimisticLockHeader(overrideData?.updatedAt ?? null),
+                () => apiCall<{ ok: boolean }>(
+                    `/api/feature_toggles/overrides`,
+                    {
+                        method: 'PUT',
+                        headers: { 'content-type': 'application/json' },
+                        body: JSON.stringify({
+                            toggleId: input.toggleId,
+                            isOverride: input.isOverride,
+                            overrideValue: input.overrideValue,
+                        }),
+                    },
+                ),
             )
             if (!call.ok) {
                 await raiseCrudError(call.response, t('feature_toggles.overrides.error.update', 'Failed to update override'))
             }
             return call.result
         },
+        onError: (err: unknown) => {
+            // Route an optimistic-lock 409 to the unified conflict bar; other errors
+            // already surfaced via raiseCrudError inside mutationFn.
+            surfaceRecordConflict(err, t)
+        },
         onSettled: async () => {
             await queryClient.invalidateQueries({ queryKey: ['feature_toggle_override', toggleId] })
             await queryClient.invalidateQueries({ queryKey: ['feature_toggle_overrides'] })

package/src/modules/feature_toggles/components/FeatureTogglesTable.tsx

@@ -2,7 +2,8 @@
 import { DataTable } from "@open-mercato/ui/backend/DataTable";
 import { RowActions } from "@open-mercato/ui/backend/RowActions";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { useQuery, useQueryClient } from '@tanstack/react-query'
 import type { ColumnDef, SortingState } from '@tanstack/react-table'
@@ -23,6 +24,7 @@ type Row = {
   description: string
   category?: string
   type: FeatureToggleType
+  updatedAt?: string | null
 }
 
 type BadgeVariant = 'default' | 'secondary' | 'destructive' | 'outline' | 'muted'
@@ -126,7 +128,10 @@ export function FeatureTogglesTable() {
 
   const deleteFeatureToggleMutation = useMutation({
     mutationFn: async (row: Row) => {
-      await deleteCrud('feature_toggles/global', row.id)
+      await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(row.updatedAt),
+        () => deleteCrud('feature_toggles/global', row.id),
+      )
     },
     onSuccess: async () => {
       await queryClient.invalidateQueries({ queryKey: ['feature_toggles'] })

package/src/modules/feature_toggles/components/formConfig.tsx

@@ -10,6 +10,7 @@ import {
   SelectValue,
 } from "@open-mercato/ui/primitives/select";
 import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { booleanOverrideSelectValue } from "./overrideFormConfig";
 
 
 export function renderDefaultValueCreateComponent(props: CrudCustomFieldRenderProps) {
@@ -22,7 +23,7 @@ export function renderDefaultValueCreateComponent(props: CrudCustomFieldRenderPr
                 <div>
                     <label className="block text-sm font-medium mb-2">{t('feature_toggles.form.fields.defaultValue.boolean.label', 'Default Value (Boolean)')}</label>
                     <Select
-                        value={props.value as string || 'false'}
+                        value={booleanOverrideSelectValue(props.value)}
                         onValueChange={(value) => props.setValue(value === 'true')}
                         disabled={props.disabled}
                     >

package/src/modules/feature_toggles/components/overrideFormConfig.tsx

@@ -11,6 +11,15 @@ import {
 } from "@open-mercato/ui/primitives/select";
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 
+/**
+ * Normalize a boolean override value (which may be stored as a real boolean or a
+ * 'true'/'false' string) to the string the `<Select>` needs. Passing a raw boolean
+ * to `Select.value` matched no `<SelectItem>` and rendered blank (#2410).
+ */
+export function booleanOverrideSelectValue(value: unknown): 'true' | 'false' {
+  return value === true || value === 'true' ? 'true' : 'false'
+}
+
 export function renderOverrideValueComponent(props: CrudCustomFieldRenderProps) {
     const t = useT()
     const toggleType = props.values?.toggleType as string;
@@ -30,7 +39,7 @@ export function renderOverrideValueComponent(props: CrudCustomFieldRenderProps)
                 <div>
                     <label className="block text-sm font-medium mb-2">{t('feature_toggles.override.fields.value.boolean.label', 'Override Value (Boolean)')}</label>
                     <Select
-                        value={props.value as string || 'false'}
+                        value={booleanOverrideSelectValue(props.value)}
                         onValueChange={(value) => props.setValue(value === 'true')}
                         disabled={props.disabled}
                     >

package/src/modules/feature_toggles/data/validators.ts

@@ -1,13 +1,20 @@
 import { z } from 'zod'
 
-export const IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]*$/
+// Namespaced feature-flag identifiers use dots and dashes as separators
+// (e.g. the seeded `customers.interactions.legacy-adapters`), so the validator
+// accepts lowercase letters, digits, `_`, `.`, and `-` after the leading
+// lowercase letter (#2055 QA round-6).
+export const IDENTIFIER_PATTERN = /^[a-z][a-z0-9_.-]*$/
+
+export const IDENTIFIER_PATTERN_MESSAGE =
+  'identifier must start with a lowercase letter and contain only lowercase letters, numbers, dots, dashes, and underscores'
 
 export const toggleTypeSchema = z.enum(['boolean', 'string', 'number', 'json'])
 
 export const toggleCreateSchema = z.object({
   identifier: z.string().min(1).regex(
     IDENTIFIER_PATTERN,
-    'identifier must start with a lowercase letter and contain only lowercase letters, numbers, and underscores',
+    IDENTIFIER_PATTERN_MESSAGE,
   ),
   name: z.string().min(1),
   description: z.string().nullable().optional(),
@@ -42,6 +49,7 @@ export const featureToggleOverrideResponseSchema = z.object({
   tenantName: z.string(),
   tenantId: z.string().uuid(),
   toggleType: toggleTypeSchema,
+  updatedAt: z.string().nullable().optional(),
 })
 
 export type FeatureToggleOverrideResponse = z.infer<typeof featureToggleOverrideResponseSchema>
@@ -70,7 +78,7 @@ export const featureToggleSchema = z.object({
   id: z.string().uuid().optional(),
   identifier: z.string().min(1).regex(
     IDENTIFIER_PATTERN,
-    'identifier must start with a lowercase letter and contain only lowercase letters, numbers, and underscores',
+    IDENTIFIER_PATTERN_MESSAGE,
   ),
   name: z.string().min(1),
   description: z.string().nullable().optional(),

package/src/modules/inbox_ops/api/settings/route.ts

@@ -2,6 +2,8 @@ import { NextResponse } from 'next/server'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { runWithCacheTenant } from '@open-mercato/cache'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { InboxSettings } from '../../data/entities'
 import { updateSettingsSchema } from '../../data/validators'
 import { resolveRequestContext, handleRouteError } from '../routeHelpers'
@@ -49,6 +51,7 @@ export async function GET(req: Request) {
         inboxAddress: settings.inboxAddress,
         isActive: settings.isActive,
         workingLanguage: settings.workingLanguage,
+        updatedAt: settings.updatedAt instanceof Date ? settings.updatedAt.toISOString() : (settings.updatedAt ?? null),
       } : null,
     }
 
@@ -96,6 +99,20 @@ export async function PATCH(req: Request) {
       return NextResponse.json({ error: 'Settings not found' }, { status: 404 })
     }
 
+    // Optimistic lock: refuse a stale overwrite when two tabs edit the same inbox
+    // settings record. Strictly additive — a no-op without the expected-version header.
+    try {
+      enforceCommandOptimisticLock({
+        resourceKind: 'inbox_ops.settings',
+        resourceId: settings.id,
+        current: settings.updatedAt ?? null,
+        request: req,
+      })
+    } catch (err) {
+      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+      throw err
+    }
+
     if (parsed.data.workingLanguage !== undefined) {
       settings.workingLanguage = parsed.data.workingLanguage
     }
@@ -115,6 +132,7 @@ export async function PATCH(req: Request) {
         inboxAddress: settings.inboxAddress,
         isActive: settings.isActive,
         workingLanguage: settings.workingLanguage,
+        updatedAt: settings.updatedAt instanceof Date ? settings.updatedAt.toISOString() : (settings.updatedAt ?? null),
       },
     })
   } catch (err) {