@open-mercato/core 0.6.6-develop.6330.1.a261878aa8 → 0.6.6-develop.6332.1.6e73f0f55b

package/src/modules/customers/backend/customers/people-v2/[id]/page.tsx

@@ -2,7 +2,7 @@
 
 import * as React from 'react'
 import Link from 'next/link'
-import { useRouter, useSearchParams } from 'next/navigation'
+import { useRouter, useSearchParams, usePathname } from 'next/navigation'
 import { User, Hash, Users, Building2 } from 'lucide-react'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { CrudForm } from '@open-mercato/ui/backend/CrudForm'
@@ -24,6 +24,7 @@ import { AttachmentsSection, ErrorMessage, LoadingMessage, RecordNotFoundState,
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
 import { InjectionSpot, useInjectionWidgets } from '@open-mercato/ui/backend/injection/InjectionSpot'
 import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
+import { buildRecordInjectionContext, useSetCurrentRecordInjectionContext } from '@open-mercato/ui/backend/injection/recordContext'
 import { createTranslatorWithFallback } from '@open-mercato/shared/lib/i18n/translate'
 
 import { ActivitiesSection } from '../../../../components/detail/ActivitiesSection'
@@ -57,6 +58,7 @@ export default function PersonDetailV2Page({ params }: { params?: { id?: string
   const t = useT()
   const router = useRouter()
   const searchParams = useSearchParams()
+  const pathname = usePathname()
   const { organizationId } = useOrganizationScopeDetail()
   const isMobile = useIsMobile()
   const { confirm, ConfirmDialogElement } = useConfirmDialog()
@@ -219,6 +221,20 @@ export default function PersonDetailV2Page({ params }: { params?: { id?: string
     [injectionContext, runMutation],
   )
 
+  // Publish page-load record context to the AppShell-owned `backend:record:current`
+  // mount so the enterprise record_locks widget resolves `customers.person` + id
+  // explicitly (the hardcoded path allowlist misses the `people-v2` route).
+  // Presence/acquire/heartbeat run on load; the hook clears on unmount/record switch.
+  useSetCurrentRecordInjectionContext(
+    buildRecordInjectionContext({
+      resourceKind: 'customers.person',
+      resourceId: currentPersonId,
+      updatedAt: data?.person?.updatedAt ?? data?.person?.updated_at ?? null,
+      data: data as Record<string, unknown> | null,
+      path: pathname,
+    }),
+  )
+
   const handleAddActivity = React.useCallback((kind: ActivityKind) => {
     setScheduleEditData({
       id: '',
@@ -518,7 +534,7 @@ export default function PersonDetailV2Page({ params }: { params?: { id?: string
                 <CrudForm<PersonEditFormValues>
                   embedded
                   trackDirtyWhenEmbedded
-                  injectionSpotId="customers.person"
+                  injectionSpotId="crud-form:customers.person"
                   entityIds={[E.customers.customer_entity, E.customers.customer_person_profile]}
                   schema={formSchema}
                   fields={fields}

package/src/modules/customers/commands/interactions.ts

@@ -39,7 +39,7 @@ import {
   buildCustomFieldResetMap,
 } from '@open-mercato/shared/lib/commands/customFieldSnapshots'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
-import { enforceRecordGoneIsConflict, enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { enforceRecordGoneIsConflict, enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { CrudIndexerConfig, CrudEventsConfig } from '@open-mercato/shared/lib/crud/types'
 import { recomputeNextInteraction } from '../lib/interactionProjection'
@@ -644,7 +644,7 @@ const updateInteractionCommand: CommandHandler<InteractionUpdateInput, { interac
       // when the client opted into optimistic locking, a stale edit fails with the
       // unified 409 instead of silently overwriting (#2055). Strictly additive —
       // no-op when no expected-version header is present.
-      enforceCommandOptimisticLock({
+      await enforceCommandOptimisticLockWithGuards(ctx.container, {
         resourceKind: 'customers.interaction',
         resourceId: interaction.id,
         current: interaction.updatedAt,
@@ -912,7 +912,7 @@ const completeInteractionCommand: CommandHandler<InteractionCompleteInput, { int
       ensureTenantScope(ctx, interaction.tenantId)
       ensureOrganizationScope(ctx, interaction.organizationId)
 
-      enforceCommandOptimisticLock({
+      await enforceCommandOptimisticLockWithGuards(ctx.container, {
         resourceKind: 'customers.interaction',
         resourceId: interaction.id,
         current: interaction.updatedAt,
@@ -1052,7 +1052,7 @@ const cancelInteractionCommand: CommandHandler<InteractionCancelInput, { interac
       ensureTenantScope(ctx, interaction.tenantId)
       ensureOrganizationScope(ctx, interaction.organizationId)
 
-      enforceCommandOptimisticLock({
+      await enforceCommandOptimisticLockWithGuards(ctx.container, {
         resourceKind: 'customers.interaction',
         resourceId: interaction.id,
         current: interaction.updatedAt,
@@ -1190,7 +1190,7 @@ const deleteInteractionCommand: CommandHandler<{ body?: Record<string, unknown>;
         ensureTenantScope(ctx, interaction.tenantId)
         ensureOrganizationScope(ctx, interaction.organizationId)
 
-        enforceCommandOptimisticLock({
+        await enforceCommandOptimisticLockWithGuards(ctx.container, {
           resourceKind: 'customers.interaction',
           resourceId: interaction.id,
           current: interaction.updatedAt,

package/src/modules/customers/commands/pipeline-stages.ts

@@ -16,6 +16,10 @@ import {
 import { ensureOrganizationScope, ensureTenantScope, ensureDictionaryEntry } from './shared'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
+import {
+  enforceCommandOptimisticLockWithGuards,
+  enforceRecordGoneIsConflict,
+} from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 
 const createPipelineStageCommand: CommandHandler<PipelineStageCreateInput, { stageId: string }> = {
   id: 'customers.pipeline-stages.create',
@@ -106,11 +110,21 @@ const updatePipelineStageCommand: CommandHandler<PipelineStageUpdateInput, void>
       ...(callerTenantId ? { tenantId: callerTenantId } : {}),
       ...(callerOrganizationId ? { organizationId: callerOrganizationId } : {}),
     })
-    if (!stage) throw new CrudHttpError(404, { error: 'Pipeline stage not found' })
+    if (!stage) {
+      enforceRecordGoneIsConflict({ resourceKind: 'customers.pipelineStage', resourceId: parsed.id, request: ctx.request ?? null })
+      throw new CrudHttpError(404, { error: 'Pipeline stage not found' })
+    }
 
     ensureTenantScope(ctx, stage.tenantId)
     ensureOrganizationScope(ctx, stage.organizationId)
 
+    await enforceCommandOptimisticLockWithGuards(ctx.container, {
+      resourceKind: 'customers.pipelineStage',
+      resourceId: stage.id,
+      current: stage.updatedAt,
+      request: ctx.request ?? null,
+    })
+
     await withAtomicFlush(em, [
       () => {
         if (parsed.label !== undefined) stage.label = parsed.label
@@ -148,11 +162,21 @@ const deletePipelineStageCommand: CommandHandler<PipelineStageDeleteInput, void>
       ...(callerTenantId ? { tenantId: callerTenantId } : {}),
       ...(callerOrganizationId ? { organizationId: callerOrganizationId } : {}),
     })
-    if (!stage) throw new CrudHttpError(404, { error: 'Pipeline stage not found' })
+    if (!stage) {
+      enforceRecordGoneIsConflict({ resourceKind: 'customers.pipelineStage', resourceId: parsed.id, request: ctx.request ?? null })
+      throw new CrudHttpError(404, { error: 'Pipeline stage not found' })
+    }
 
     ensureTenantScope(ctx, stage.tenantId)
     ensureOrganizationScope(ctx, stage.organizationId)
 
+    await enforceCommandOptimisticLockWithGuards(ctx.container, {
+      resourceKind: 'customers.pipelineStage',
+      resourceId: stage.id,
+      current: stage.updatedAt,
+      request: ctx.request ?? null,
+    })
+
     const activeDealsCount = await em.count(CustomerDeal, {
       pipelineStageId: parsed.id,
       deletedAt: null,

package/src/modules/customers/commands/pipelines.ts

@@ -12,6 +12,10 @@ import {
 } from '../data/validators'
 import { ensureOrganizationScope, ensureTenantScope } from './shared'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import {
+  enforceCommandOptimisticLockWithGuards,
+  enforceRecordGoneIsConflict,
+} from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 
 const createPipelineCommand: CommandHandler<PipelineCreateInput, { pipelineId: string }> = {
@@ -56,11 +60,21 @@ const updatePipelineCommand: CommandHandler<PipelineUpdateInput, void> = {
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const pipeline = await em.findOne(CustomerPipeline, { id: parsed.id })
-    if (!pipeline) throw new CrudHttpError(404, { error: 'Pipeline not found' })
+    if (!pipeline) {
+      enforceRecordGoneIsConflict({ resourceKind: 'customers.pipeline', resourceId: parsed.id, request: ctx.request ?? null })
+      throw new CrudHttpError(404, { error: 'Pipeline not found' })
+    }
 
     ensureTenantScope(ctx, pipeline.tenantId)
     ensureOrganizationScope(ctx, pipeline.organizationId)
 
+    await enforceCommandOptimisticLockWithGuards(ctx.container, {
+      resourceKind: 'customers.pipeline',
+      resourceId: pipeline.id,
+      current: pipeline.updatedAt,
+      request: ctx.request ?? null,
+    })
+
     await withAtomicFlush(em, [
       async () => {
         if (parsed.isDefault && !pipeline.isDefault) {
@@ -86,11 +100,21 @@ const deletePipelineCommand: CommandHandler<PipelineDeleteInput, void> = {
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const pipeline = await em.findOne(CustomerPipeline, { id: parsed.id })
-    if (!pipeline) throw new CrudHttpError(404, { error: 'Pipeline not found' })
+    if (!pipeline) {
+      enforceRecordGoneIsConflict({ resourceKind: 'customers.pipeline', resourceId: parsed.id, request: ctx.request ?? null })
+      throw new CrudHttpError(404, { error: 'Pipeline not found' })
+    }
 
     ensureTenantScope(ctx, pipeline.tenantId)
     ensureOrganizationScope(ctx, pipeline.organizationId)
 
+    await enforceCommandOptimisticLockWithGuards(ctx.container, {
+      resourceKind: 'customers.pipeline',
+      resourceId: pipeline.id,
+      current: pipeline.updatedAt,
+      request: ctx.request ?? null,
+    })
+
     const activeDealsCount = await em.count(CustomerDeal, {
       pipelineId: parsed.id,
       deletedAt: null,

package/src/modules/customers/components/detail/AddressesSection.tsx

@@ -1,7 +1,9 @@
 "use client"
 
 import * as React from 'react'
-import { apiCall, apiCallOrThrow, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, apiCallOrThrow, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'
 import { AddressesSection as SharedAddressesSection } from '@open-mercato/ui/backend/detail'
 import type { AddressDataAdapter, AddressTypesAdapter, AddressFormatStrategy, SectionAction } from '@open-mercato/ui/backend/detail'
 import { createTranslatorWithFallback } from '@open-mercato/shared/lib/i18n/translate'
@@ -99,6 +101,12 @@ export function AddressesSection({
                 : typeof record.isPrimary === 'boolean'
                   ? record.isPrimary
                   : false,
+            updatedAt:
+              typeof record.updated_at === 'string'
+                ? record.updated_at
+                : typeof record.updatedAt === 'string'
+                  ? record.updatedAt
+                  : null,
           }
         })
         .filter((value): value is NonNullable<typeof value> => value !== null)
@@ -107,7 +115,7 @@ export function AddressesSection({
       const response = await apiCallOrThrow<Record<string, unknown>>(
         '/api/customers/addresses',
         {
-          // optimistic-lock-exempt: address link add/remove sub-resource
+          // optimistic-lock-exempt: address create-only (no prior version to compare)
           method: 'POST',
           headers: { 'content-type': 'application/json' },
           body: JSON.stringify({
@@ -120,33 +128,47 @@ export function AddressesSection({
       )
       return response.result ?? {}
     },
-    update: async ({ id, payload }) => {
-      await apiCallOrThrow(
-        '/api/customers/addresses',
-        {
-          // optimistic-lock-exempt: address link add/remove sub-resource
-          method: 'PUT',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({
-            id,
-            ...payload,
-            country: payload.country ? payload.country.toUpperCase() : undefined,
-          }),
-        },
-        { errorMessage: t('customers.people.detail.addresses.error') },
-      )
+    update: async ({ id, payload, updatedAt }) => {
+      try {
+        await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(updatedAt ?? null),
+          () => apiCallOrThrow(
+            '/api/customers/addresses',
+            {
+              method: 'PUT',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({
+                id,
+                ...payload,
+                country: payload.country ? payload.country.toUpperCase() : undefined,
+              }),
+            },
+            { errorMessage: t('customers.people.detail.addresses.error') },
+          ),
+        )
+      } catch (err) {
+        surfaceRecordConflict(err, t)
+        throw err
+      }
     },
-    delete: async ({ id }) => {
-      await apiCallOrThrow(
-        '/api/customers/addresses',
-        {
-          // optimistic-lock-exempt: address link add/remove sub-resource
-          method: 'DELETE',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({ id }),
-        },
-        { errorMessage: t('customers.people.detail.addresses.error') },
-      )
+    delete: async ({ id, updatedAt }) => {
+      try {
+        await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(updatedAt ?? null),
+          () => apiCallOrThrow(
+            '/api/customers/addresses',
+            {
+              method: 'DELETE',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ id }),
+            },
+            { errorMessage: t('customers.people.detail.addresses.error') },
+          ),
+        )
+      } catch (err) {
+        surfaceRecordConflict(err, t)
+        throw err
+      }
     },
   }), [t])
 

package/src/modules/customers/components/detail/DealForm.tsx

@@ -69,6 +69,14 @@ export type DealFormProps = {
   showCancelAction?: boolean
   initialPipelineOptions?: PipelineOption[]
   initialPipelineStageOptions?: PipelineStageOption[]
+  /**
+   * Injection spot id for the form-scoped record_locks widget (e.g.
+   * `customers.deal`). Mirrors how people-v2/companies-v2 mount their save-time
+   * `crud-form:*` widget so a deal save conflict surfaces the merge dialog.
+   */
+  injectionSpotId?: string
+  /** Optimistic-lock version (`deal.updatedAt`) for the embedded CrudForm. */
+  optimisticLockUpdatedAt?: string | null
 }
 
 type EntityOption = {
@@ -732,6 +740,8 @@ export function DealForm({
   showCancelAction = true,
   initialPipelineOptions,
   initialPipelineStageOptions,
+  injectionSpotId,
+  optimisticLockUpdatedAt,
 }: DealFormProps) {
   const t = useT()
   const [pending, setPending] = React.useState(false)
@@ -1168,6 +1178,8 @@ export function DealForm({
       backHref={backHref}
       hideFooterActions={hideFooterActions}
       onDirtyChange={onDirtyChange}
+      injectionSpotId={injectionSpotId}
+      optimisticLockUpdatedAt={optimisticLockUpdatedAt}
       collapsibleGroups={collapsibleGroups}
       sortableGroups={sortableGroups}
       versionHistory={showVersionHistory && mode === 'edit' && initialValues?.id

package/src/modules/customers/components/detail/notesAdapter.ts

@@ -1,6 +1,7 @@
 "use client"
 
-import { apiCallOrThrow, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCallOrThrow, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { mapCommentSummary, type NotesDataAdapter } from '@open-mercato/ui/backend/detail/NotesSection'
 
 type Translator = (key: string, fallback?: string, params?: Record<string, string | number>) => string
@@ -92,33 +93,43 @@ export function createCustomerNotesAdapter(
       )
       return response.result ?? {}
     },
-    update: async ({ id, patch }) => {
+    update: async ({ id, patch, updatedAt }) => {
       const payload: Record<string, unknown> = { id }
       if (patch.body !== undefined) payload.body = patch.body
       if (patch.appearanceIcon !== undefined) payload.appearanceIcon = patch.appearanceIcon
       if (patch.appearanceColor !== undefined) payload.appearanceColor = patch.appearanceColor
+      // Send the optimistic-lock header (note's loaded updatedAt) so a stale edit —
+      // or an edit after the note was deleted in another tab — surfaces the unified
+      // conflict bar (409) instead of silently overwriting. The guarded runner
+      // (useGuardedMutation) routes the 409 through surfaceRecordConflict.
       await runWrite(
-        () => apiCallOrThrow(
-          '/api/customers/comments',
-          {
-            method: 'PUT',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify(payload),
-          },
-          { errorMessage: translator('customers.people.detail.notes.updateError') },
+        () => withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(updatedAt ?? null),
+          () => apiCallOrThrow(
+            '/api/customers/comments',
+            {
+              method: 'PUT',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify(payload),
+            },
+            { errorMessage: translator('customers.people.detail.notes.updateError') },
+          ),
         ),
         { operation: 'updateNote', id },
       )
     },
-    delete: async ({ id }) => {
+    delete: async ({ id, updatedAt }) => {
       await runWrite(
-        () => apiCallOrThrow(
-          `/api/customers/comments?id=${encodeURIComponent(id)}`,
-          {
-            method: 'DELETE',
-            headers: { 'content-type': 'application/json' },
-          },
-          { errorMessage: translator('customers.people.detail.notes.deleteError', 'Failed to delete note') },
+        () => withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(updatedAt ?? null),
+          () => apiCallOrThrow(
+            `/api/customers/comments?id=${encodeURIComponent(id)}`,
+            {
+              method: 'DELETE',
+              headers: { 'content-type': 'application/json' },
+            },
+            { errorMessage: translator('customers.people.detail.notes.deleteError', 'Failed to delete note') },
+          ),
         ),
         { operation: 'deleteNote', id },
       )

package/src/modules/customers/i18n/de.json

@@ -923,6 +923,8 @@
   "customers.deals.detail.badge.deal": "Deal",
   "customers.deals.detail.badge.lost": "Lost",
   "customers.deals.detail.badge.won": "Won",
+  "customers.deals.detail.closeLostError": "Deal konnte nicht als verloren markiert werden.",
+  "customers.deals.detail.closeWonError": "Deal konnte nicht als gewonnen markiert werden.",
   "customers.deals.detail.closure.lost": "Lost",
   "customers.deals.detail.closure.prompt": "Close deal — choose outcome",
   "customers.deals.detail.closure.won": "Won",

package/src/modules/customers/i18n/en.json

@@ -923,6 +923,8 @@
   "customers.deals.detail.badge.deal": "Deal",
   "customers.deals.detail.badge.lost": "Lost",
   "customers.deals.detail.badge.won": "Won",
+  "customers.deals.detail.closeLostError": "Failed to mark deal as lost.",
+  "customers.deals.detail.closeWonError": "Failed to mark deal as won.",
   "customers.deals.detail.closure.lost": "Lost",
   "customers.deals.detail.closure.prompt": "Close deal — choose outcome",
   "customers.deals.detail.closure.won": "Won",

package/src/modules/customers/i18n/es.json

@@ -923,6 +923,8 @@
   "customers.deals.detail.badge.deal": "Deal",
   "customers.deals.detail.badge.lost": "Lost",
   "customers.deals.detail.badge.won": "Won",
+  "customers.deals.detail.closeLostError": "No se pudo marcar el deal como perdido.",
+  "customers.deals.detail.closeWonError": "No se pudo marcar el deal como ganado.",
   "customers.deals.detail.closure.lost": "Lost",
   "customers.deals.detail.closure.prompt": "Close deal — choose outcome",
   "customers.deals.detail.closure.won": "Won",

package/src/modules/customers/i18n/pl.json

@@ -923,6 +923,8 @@
   "customers.deals.detail.badge.deal": "Deal",
   "customers.deals.detail.badge.lost": "Lost",
   "customers.deals.detail.badge.won": "Won",
+  "customers.deals.detail.closeLostError": "Nie udało się oznaczyć deala jako przegranego.",
+  "customers.deals.detail.closeWonError": "Nie udało się oznaczyć deala jako wygranego.",
   "customers.deals.detail.closure.lost": "Lost",
   "customers.deals.detail.closure.prompt": "Close deal — choose outcome",
   "customers.deals.detail.closure.won": "Won",

package/src/modules/data_sync/api/schedules/[id]/route.ts

@@ -3,6 +3,8 @@ import { z } from 'zod'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { readOptimisticLockExpected } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { updateSyncScheduleSchema } from '../../../data/validators'
 import type { SyncScheduleService } from '../../../lib/sync-schedule-service'
 import { serializeSchedule } from '../serialize'
@@ -111,7 +113,8 @@ export async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }>
       timezone: parsed.data.timezone ?? current.timezone,
       fullSync: parsed.data.fullSync ?? current.fullSync,
       isEnabled: parsed.data.isEnabled ?? current.isEnabled,
-    }, scope)
+      expectedUpdatedAt: readOptimisticLockExpected(req),
+    }, scope, container)
 
     if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
       await runCrudMutationGuardAfterSuccess(container, {
@@ -126,9 +129,11 @@ export async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }>
         metadata: guardResult.metadata ?? null,
       })
     }
-
     return NextResponse.json(serializeSchedule(schedule))
   } catch (error) {
+    if (isCrudHttpError(error)) {
+      return NextResponse.json(error.body, { status: error.status })
+    }
     const message = error instanceof Error ? error.message : 'Failed to update sync schedule'
     return NextResponse.json({ error: message }, { status: 422 })
   }
@@ -168,25 +173,38 @@ export async function DELETE(req: Request, ctx: { params?: Promise<{ id?: string
     return NextResponse.json(guardResult.body, { status: guardResult.status })
   }
 
-  const deleted = await scheduleService.deleteSchedule(parsedParams.data.id, scope)
+  try {
+    const deleted = await scheduleService.deleteSchedule(
+      parsedParams.data.id,
+      scope,
+      container,
+      readOptimisticLockExpected(req),
+    )
+
+    if (!deleted) {
+      return NextResponse.json({ error: 'Schedule not found' }, { status: 404 })
+    }
 
-  if (!deleted) {
-    return NextResponse.json({ error: 'Schedule not found' }, { status: 404 })
-  }
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(container, {
+        tenantId: auth.tenantId,
+        organizationId: scope.organizationId,
+        userId: auth.sub,
+        resourceKind: 'data_sync.schedule',
+        resourceId: parsedParams.data.id,
+        operation: 'delete',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
 
-  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
-    await runCrudMutationGuardAfterSuccess(container, {
-      tenantId: auth.tenantId,
-      organizationId: scope.organizationId,
-      userId: auth.sub,
-      resourceKind: 'data_sync.schedule',
-      resourceId: parsedParams.data.id,
-      operation: 'delete',
-      requestMethod: req.method,
-      requestHeaders: req.headers,
-      metadata: guardResult.metadata ?? null,
-    })
+    return NextResponse.json({ deleted: true })
+  } catch (error) {
+    if (isCrudHttpError(error)) {
+      return NextResponse.json(error.body, { status: error.status })
+    }
+    const message = error instanceof Error ? error.message : 'Failed to delete sync schedule'
+    return NextResponse.json({ error: message }, { status: 422 })
   }
-
-  return NextResponse.json({ deleted: true })
 }

package/src/modules/data_sync/api/schedules/route.ts

@@ -90,7 +90,7 @@ export async function POST(req: Request) {
     const schedule = await scheduleService.saveSchedule({
       ...parsed.data,
       expectedUpdatedAt: readOptimisticLockExpected(req),
-    }, scope)
+    }, scope, container)
 
     if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
       await runCrudMutationGuardAfterSuccess(container, {

package/src/modules/data_sync/backend/data-sync/page.tsx

@@ -26,6 +26,7 @@ import { Switch } from '@open-mercato/ui/primitives/switch'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
 import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -402,21 +403,27 @@ export default function SyncRunsDashboardPage() {
     setIsSavingSchedule(true)
     try {
       const call = await runMutation({
-        // optimistic-lock-exempt: keyed upsert (POST, no record id/version in body) — guard targets id-addressed PUT/PATCH/DELETE
-        operation: () => apiCall<SyncScheduleRecord>('/api/data_sync/schedules', {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({
-            integrationId: selectedIntegration.integrationId,
-            entityType: selectedEntityType,
-            direction: selectedDirection,
-            scheduleType: scheduleEditor.scheduleType,
-            scheduleValue: scheduleEditor.scheduleValue.trim(),
-            timezone: scheduleEditor.timezone.trim() || DEFAULT_TIMEZONE,
-            fullSync: scheduleEditor.fullSync,
-            isEnabled: scheduleEditor.isEnabled,
-          }),
-        }, { fallback: null }),
+        // Keyed upsert (POST). When the editor holds an existing schedule's
+        // `updatedAt`, the lock header version-checks the resolved row on the
+        // server; a brand-new schedule has a null `updatedAt`, so the header is
+        // empty and the create path stays unaffected.
+        operation: () => withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(scheduleEditor.updatedAt),
+          () => apiCall<SyncScheduleRecord>('/api/data_sync/schedules', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              integrationId: selectedIntegration.integrationId,
+              entityType: selectedEntityType,
+              direction: selectedDirection,
+              scheduleType: scheduleEditor.scheduleType,
+              scheduleValue: scheduleEditor.scheduleValue.trim(),
+              timezone: scheduleEditor.timezone.trim() || DEFAULT_TIMEZONE,
+              fullSync: scheduleEditor.fullSync,
+              isEnabled: scheduleEditor.isEnabled,
+            }),
+          }, { fallback: null }),
+        ),
         mutationPayload: {
           integrationId: selectedIntegration.integrationId,
           entityType: selectedEntityType,
@@ -435,6 +442,16 @@ export default function SyncRunsDashboardPage() {
       })
 
       if (!call.ok || !call.result) {
+        const conflictError = Object.assign(
+          new Error((call.result as { error?: string } | null)?.error ?? t('data_sync.dashboard.schedule.error', 'Failed to save recurring schedule')),
+          {
+            status: call.status,
+            ...(call.result && typeof call.result === 'object' ? call.result : {}),
+          },
+        )
+        if (surfaceRecordConflict(conflictError, t)) {
+          return
+        }
         flash((call.result as { error?: string } | null)?.error ?? t('data_sync.dashboard.schedule.error', 'Failed to save recurring schedule'), 'error')
         return
       }