@open-mercato/core 0.6.7-develop.6652.1.3ab996caba → 0.6.7-develop.6660.1.90e1e2eef6

package/src/modules/dictionaries/api/[dictionaryId]/entries/reorder/route.ts

@@ -130,6 +130,9 @@ export async function POST(req: Request, ctx: { params?: { dictionaryId?: string
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Invalid input', details: err.issues }, { status: 400 })
+    }
     logger.error('Failed to reorder dictionary entries', { err })
     return NextResponse.json({ error: 'Failed to reorder dictionary entries' }, { status: 500 })
   }

package/src/modules/dictionaries/api/[dictionaryId]/entries/route.ts

@@ -160,6 +160,9 @@ export async function GET(req: Request, ctx: { params?: { dictionaryId?: string
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Invalid input', details: err.issues }, { status: 400 })
+    }
     logger.error('Failed to load dictionary entries', { err })
     return NextResponse.json({ error: 'Failed to load dictionary entries' }, { status: 500 })
   }
@@ -252,6 +255,9 @@ export async function POST(req: Request, ctx: { params?: { dictionaryId?: string
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Invalid input', details: err.issues }, { status: 400 })
+    }
     logger.error('Failed to create dictionary entry', { err })
     return NextResponse.json({ error: 'Failed to create dictionary entry' }, { status: 500 })
   }

package/src/modules/dictionaries/api/[dictionaryId]/entries/set-default/route.ts

@@ -130,6 +130,9 @@ export async function POST(req: Request, ctx: { params?: { dictionaryId?: string
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Invalid input', details: err.issues }, { status: 400 })
+    }
     logger.error('Failed to set default entry', { err })
     return NextResponse.json({ error: 'Failed to set default entry' }, { status: 500 })
   }

package/src/modules/dictionaries/components/DictionaryEntriesEditor.tsx

@@ -424,7 +424,15 @@ export function DictionaryEntriesEditor({ dictionaryId, dictionaryName, readOnly
       </div>
 
       <Dialog open={dialogOpen} onOpenChange={(open) => (!open ? closeDialog() : undefined)}>
-        <DialogContent>
+        <DialogContent
+          aria-modal="true"
+          onKeyDown={(event) => {
+            if ((event.metaKey || event.ctrlKey) && event.key === 'Enter' && !isSaving) {
+              event.preventDefault()
+              void handleSave()
+            }
+          }}
+        >
           <DialogHeader>
             <DialogTitle>
               {formState.id
@@ -434,11 +442,12 @@ export function DictionaryEntriesEditor({ dictionaryId, dictionaryName, readOnly
           </DialogHeader>
           <div className="space-y-4">
             <div className="space-y-2">
-              <label className="text-sm font-medium">
+              <label htmlFor="dictionary-entry-value" className="text-sm font-medium">
                 {t('dictionaries.config.entries.dialog.valueLabel', 'Value')}
                 <span className="ml-1 text-destructive">*</span>
               </label>
               <Input
+                id="dictionary-entry-value"
                 type="text"
                 value={formState.value}
                 onChange={(event) => {
@@ -448,8 +457,9 @@ export function DictionaryEntriesEditor({ dictionaryId, dictionaryName, readOnly
                     setErrors((prev) => ({ ...prev, value: undefined }))
                   }
                 }}
+                aria-required="true"
                 aria-invalid={errors.value ? 'true' : 'false'}
-                aria-describedby="dictionary-entry-value-error"
+                aria-describedby={errors.value ? 'dictionary-entry-value-error' : undefined}
               />
               {errors.value ? (
                 <p id="dictionary-entry-value-error" className="text-xs text-destructive">
@@ -458,10 +468,11 @@ export function DictionaryEntriesEditor({ dictionaryId, dictionaryName, readOnly
               ) : null}
             </div>
             <div className="space-y-2">
-              <label className="text-sm font-medium">
+              <label htmlFor="dictionary-entry-label" className="text-sm font-medium">
                 {t('dictionaries.config.entries.dialog.labelLabel', 'Label')}
               </label>
               <Input
+                id="dictionary-entry-label"
                 type="text"
                 value={formState.label}
                 onChange={(event) => setFormState((prev) => ({ ...prev, label: event.target.value }))}

package/src/modules/feature_toggles/api/global/route.ts

@@ -103,13 +103,19 @@ const crud = makeCrudRoute({
     entity: FeatureToggle,
     idField: 'id',
     orgField: null,
-    tenantField: "tenantId",
+    // The query engine requires the caller's tenant context even when the
+    // underlying entity is global; the list below explicitly disables its
+    // automatic tenant predicate.
+    tenantField: 'tenantId',
     softDeleteField: 'deletedAt'
   },
   indexer: { entityType: E.feature_toggles.feature_toggle },
   list: {
     schema: listQuerySchema,
     entityId: E.feature_toggles.feature_toggle,
+    // FeatureToggle rows and their query-index projections are global
+    // (null/null scope), so filtering them by the actor's tenant hides them.
+    omitAutomaticTenantOrgScope: true,
     fields: listFields,
     sortFieldMap: {
       id: 'id',

package/src/modules/feature_toggles/commands/global.ts

@@ -52,14 +52,11 @@ const featureToggleCrudIndexer = { entityType: E.feature_toggles.feature_toggle
 
 const FEATURE_TOGGLE_LOCK_RESOURCE_KIND = 'feature_toggles.feature_toggle'
 
-function featureToggleIdentifiers(
-  toggle: FeatureToggle | ToggleSnapshot,
-  ctx: { auth?: { tenantId?: string | null } | null },
-) {
+function featureToggleIdentifiers(toggle: FeatureToggle | ToggleSnapshot) {
   return {
     id: toggle.id,
     organizationId: null,
-    tenantId: ctx.auth?.tenantId ?? null,
+    tenantId: null,
   }
 }
 
@@ -113,7 +110,7 @@ const createToggleCommand: CommandHandler<ToggleCreateInput, { toggleId: string
       dataEngine,
       action: 'created',
       entity: toggle,
-      identifiers: featureToggleIdentifiers(toggle, ctx),
+      identifiers: featureToggleIdentifiers(toggle),
       syncOrigin: ctx.syncOrigin,
       indexer: featureToggleCrudIndexer,
     })
@@ -157,7 +154,7 @@ const createToggleCommand: CommandHandler<ToggleCreateInput, { toggleId: string
         dataEngine,
         action: 'deleted',
         entity: toggle,
-        identifiers: featureToggleIdentifiers(toggle, ctx),
+        identifiers: featureToggleIdentifiers(toggle),
         syncOrigin: ctx.syncOrigin,
         indexer: featureToggleCrudIndexer,
       })
@@ -196,7 +193,7 @@ const createToggleCommand: CommandHandler<ToggleCreateInput, { toggleId: string
       dataEngine,
       action: 'created',
       entity: toggle,
-      identifiers: featureToggleIdentifiers(toggle, ctx),
+      identifiers: featureToggleIdentifiers(toggle),
       syncOrigin: ctx.syncOrigin,
       indexer: featureToggleCrudIndexer,
     })
@@ -245,7 +242,7 @@ const updateToggleCommand: CommandHandler<ToggleUpdateInput, { toggleId: string
       dataEngine,
       action: 'updated',
       entity: toggle,
-      identifiers: featureToggleIdentifiers(toggle, ctx),
+      identifiers: featureToggleIdentifiers(toggle),
       syncOrigin: ctx.syncOrigin,
       indexer: featureToggleCrudIndexer,
     })
@@ -328,7 +325,7 @@ const updateToggleCommand: CommandHandler<ToggleUpdateInput, { toggleId: string
       dataEngine,
       action: 'updated',
       entity: toggle,
-      identifiers: featureToggleIdentifiers(toggle, ctx),
+      identifiers: featureToggleIdentifiers(toggle),
       syncOrigin: ctx.syncOrigin,
       indexer: featureToggleCrudIndexer,
     })
@@ -369,7 +366,7 @@ const deleteToggleCommand: CommandHandler<{ body?: Record<string, unknown>; quer
       dataEngine,
       action: 'deleted',
       entity: toggle,
-      identifiers: featureToggleIdentifiers(toggle, ctx),
+      identifiers: featureToggleIdentifiers(toggle),
       syncOrigin: ctx.syncOrigin,
       indexer: featureToggleCrudIndexer,
     })
@@ -443,7 +440,7 @@ const deleteToggleCommand: CommandHandler<{ body?: Record<string, unknown>; quer
       dataEngine,
       action: 'updated',
       entity: toggle,
-      identifiers: featureToggleIdentifiers(toggle, ctx),
+      identifiers: featureToggleIdentifiers(toggle),
       syncOrigin: ctx.syncOrigin,
       indexer: featureToggleCrudIndexer,
     })

package/src/modules/query_index/lib/subscriber-scope.ts

@@ -1,11 +1,28 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
-import { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'
+import { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'
+import { resolveRegisteredEntityTableName } from '@open-mercato/shared/lib/query/engine'
 
 export type QueryIndexScope = {
   tenantId: string | null
   organizationId: string | null
 }
 
+export type QueryIndexSourceMetadata = {
+  table: string
+  organizationColumn: string | null
+  tenantColumn: string | null
+}
+
+export type QueryIndexSourceScope =
+  | { kind: 'global' }
+  | { kind: 'missing' }
+  | { kind: 'row'; scope: QueryIndexScope }
+
+type QueryIndexEntityMetadata = {
+  tableName?: unknown
+  properties?: Record<string, { fieldNames?: unknown }>
+}
+
 export class QueryIndexScopeError extends Error {
   constructor(message: string) {
     super(message)
@@ -18,7 +35,7 @@ type ResolveRecordScopeInput = {
   payloadOrganizationId: string | null | undefined
   hasPayloadTenantId: boolean
   hasPayloadOrganizationId: boolean
-  rowScope: QueryIndexScope | null
+  sourceScope: QueryIndexSourceScope
 }
 
 type ResolveReindexScopeInput = {
@@ -27,26 +44,66 @@ type ResolveReindexScopeInput = {
   allowAllTenants?: boolean
 }
 
-export async function loadQueryIndexRowScope(
+export function resolveQueryIndexSourceMetadata(
   em: EntityManager,
   entityType: string,
-  recordId: string
-): Promise<QueryIndexScope | null> {
+): QueryIndexSourceMetadata {
+  const registeredEntityIds = Object.values(getEntityIds(false)).flatMap((moduleEntities) => Object.values(moduleEntities ?? {}))
+  if (!registeredEntityIds.includes(entityType)) {
+    throw new QueryIndexScopeError(`Query index entity type is not registered: ${entityType}`)
+  }
+
+  const table = resolveRegisteredEntityTableName(em, entityType as never)
+  if (!table) {
+    throw new QueryIndexScopeError(`Query index entity type has no registered ORM table: ${entityType}`)
+  }
+
+  const registry = em.getMetadata?.()
+  const allMetadataRaw = typeof registry?.getAll === 'function' ? registry.getAll() : null
+  const allMetadata: QueryIndexEntityMetadata[] = Array.isArray(allMetadataRaw)
+    ? allMetadataRaw as QueryIndexEntityMetadata[]
+    : allMetadataRaw instanceof Map
+      ? Array.from(allMetadataRaw.values()) as QueryIndexEntityMetadata[]
+      : Object.values(allMetadataRaw ?? {}) as QueryIndexEntityMetadata[]
+  const metadata = allMetadata.find((candidate) => String(candidate.tableName ?? '') === table)
+  if (!metadata) {
+    throw new QueryIndexScopeError(`Query index entity metadata was not found for table: ${table}`)
+  }
+
+  return {
+    table,
+    organizationColumn: resolveScopeColumn(metadata, 'organizationId', table),
+    tenantColumn: resolveScopeColumn(metadata, 'tenantId', table),
+  }
+}
+
+export async function loadQueryIndexRowScope(
+  em: EntityManager,
+  source: QueryIndexSourceMetadata,
+  recordId: string,
+): Promise<QueryIndexSourceScope> {
+  if (!source.organizationColumn && !source.tenantColumn) {
+    return { kind: 'global' }
+  }
+
   const db = em.getKysely<any>()
-  const table = resolveEntityTableName(em, entityType)
+  const columns = [source.organizationColumn, source.tenantColumn].filter((column): column is string => column !== null)
   const row = await db
-    .selectFrom(table as any)
-    .select(['organization_id' as any, 'tenant_id' as any])
+    .selectFrom(source.table as any)
+    .select(columns as any)
     .where('id' as any, '=', recordId)
-    .executeTakeFirst() as { organization_id: string | null; tenant_id: string | null } | undefined
+    .executeTakeFirst() as Record<string, string | null | undefined> | undefined
 
   if (!row) {
-    return null
+    return { kind: 'missing' }
   }
 
   return {
-    organizationId: row.organization_id ?? null,
-    tenantId: row.tenant_id ?? null,
+    kind: 'row',
+    scope: {
+      organizationId: source.organizationColumn ? row[source.organizationColumn] ?? null : null,
+      tenantId: source.tenantColumn ? row[source.tenantColumn] ?? null : null,
+    },
   }
 }
 
@@ -56,10 +113,23 @@ export function resolveQueryIndexRecordScope(input: ResolveRecordScopeInput): Qu
     payloadOrganizationId,
     hasPayloadTenantId,
     hasPayloadOrganizationId,
-    rowScope,
+    sourceScope,
   } = input
 
-  if (!rowScope) {
+  if (sourceScope.kind === 'global') {
+    if (!hasPayloadTenantId || !hasPayloadOrganizationId || payloadTenantId !== null || payloadOrganizationId !== null) {
+      throw new QueryIndexScopeError(
+        'Query index event for a global entity must explicitly provide tenantId and organizationId as null'
+      )
+    }
+
+    return {
+      tenantId: null,
+      organizationId: null,
+    }
+  }
+
+  if (sourceScope.kind === 'missing') {
     if (!hasPayloadTenantId || !hasPayloadOrganizationId) {
       throw new QueryIndexScopeError(
         'Query index event is missing tenantId/organizationId and source row scope could not be resolved'
@@ -72,6 +142,8 @@ export function resolveQueryIndexRecordScope(input: ResolveRecordScopeInput): Qu
     }
   }
 
+  const rowScope = sourceScope.scope
+
   if (hasPayloadTenantId && !isSameScopeValue(payloadTenantId, rowScope.tenantId)) {
     throw new QueryIndexScopeError(
       `Query index event tenantId does not match source row scope (payload=${String(payloadTenantId ?? null)}, row=${String(rowScope.tenantId)})`
@@ -109,3 +181,15 @@ export function resolveQueryIndexReindexScope(input: ResolveReindexScopeInput):
 function isSameScopeValue(left: string | null | undefined, right: string | null): boolean {
   return (left ?? null) === right
 }
+
+function resolveScopeColumn(metadata: QueryIndexEntityMetadata, property: string, table: string): string | null {
+  const scopeProperty = metadata.properties?.[property]
+  if (!scopeProperty) return null
+  const fieldNames = scopeProperty.fieldNames
+  if (!Array.isArray(fieldNames) || fieldNames.length !== 1 || typeof fieldNames[0] !== 'string' || !fieldNames[0]) {
+    throw new QueryIndexScopeError(
+      `Query index ${property} metadata must map exactly one physical column for table: ${table}`
+    )
+  }
+  return fieldNames[0]
+}

package/src/modules/query_index/subscribers/delete_one.ts

@@ -1,9 +1,12 @@
 import { recordIndexerError } from '@open-mercato/shared/lib/indexers/error-log'
-import { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'
 import { sql } from 'kysely'
 import { markDeleted } from '../lib/indexer'
 import { applyCoverageAdjustments, createCoverageAdjustments } from '../lib/coverage'
-import { loadQueryIndexRowScope, resolveQueryIndexRecordScope } from '../lib/subscriber-scope'
+import {
+  loadQueryIndexRowScope,
+  resolveQueryIndexRecordScope,
+  resolveQueryIndexSourceMetadata,
+} from '../lib/subscriber-scope'
 
 export const metadata = { event: 'query_index.delete_one', persistent: false }
 
@@ -40,13 +43,14 @@ export default async function handle(payload: any, ctx: { resolve: <T=any>(name:
   try {
     const hasPayloadOrganizationId = Object.prototype.hasOwnProperty.call(payload ?? {}, 'organizationId')
     const hasPayloadTenantId = Object.prototype.hasOwnProperty.call(payload ?? {}, 'tenantId')
-    const rowScope = await loadQueryIndexRowScope(em, entityType, recordId).catch(() => null)
+    const source = resolveQueryIndexSourceMetadata(em, entityType)
+    const sourceScope = await loadQueryIndexRowScope(em, source, recordId)
     const resolvedScope = resolveQueryIndexRecordScope({
       payloadOrganizationId: payload?.organizationId,
       payloadTenantId: payload?.tenantId,
       hasPayloadOrganizationId,
       hasPayloadTenantId,
-      rowScope,
+      sourceScope,
     })
     organizationId = resolvedScope.organizationId
     tenantId = resolvedScope.tenantId
@@ -57,14 +61,21 @@ export default async function handle(payload: any, ctx: { resolve: <T=any>(name:
     let baseCheckSucceeded = false
     try {
       const db = (em as any).getKysely()
-      const table = resolveEntityTableName(em, entityType)
-      const row = await db
-        .selectFrom(table as any)
+      let baseQuery = db
+        .selectFrom(source.table as any)
         .select(['deleted_at' as any])
         .where('id' as any, '=', recordId)
-        .where('organization_id' as any, organizationId === null ? 'is' : '=', organizationId as any)
-        .where(sql`tenant_id is not distinct from ${tenantId}`)
-        .executeTakeFirst() as { deleted_at: Date | null } | undefined
+      if (source.organizationColumn) {
+        baseQuery = baseQuery.where(
+          source.organizationColumn as any,
+          organizationId === null ? 'is' : '=',
+          organizationId as any,
+        )
+      }
+      if (source.tenantColumn) {
+        baseQuery = baseQuery.where(sql`${sql.ref(source.tenantColumn)} is not distinct from ${tenantId}`)
+      }
+      const row = await baseQuery.executeTakeFirst() as { deleted_at: Date | null } | undefined
       const baseMissing = !row
       const baseDeleted = baseMissing || (row && row.deleted_at != null)
       baseCheckSucceeded = true

package/src/modules/query_index/subscribers/upsert_one.ts

@@ -1,7 +1,11 @@
 import { recordIndexerError } from '@open-mercato/shared/lib/indexers/error-log'
 import { upsertIndexRow, reindexSearchTokensForRecord } from '../lib/indexer'
 import { applyCoverageAdjustments, createCoverageAdjustments } from '../lib/coverage'
-import { loadQueryIndexRowScope, resolveQueryIndexRecordScope } from '../lib/subscriber-scope'
+import {
+  loadQueryIndexRowScope,
+  resolveQueryIndexRecordScope,
+  resolveQueryIndexSourceMetadata,
+} from '../lib/subscriber-scope'
 
 export const metadata = { event: 'query_index.upsert_one', persistent: false }
 
@@ -25,13 +29,14 @@ export default async function handle(payload: any, ctx: { resolve: <T=any>(name:
   try {
     const hasPayloadOrganizationId = Object.prototype.hasOwnProperty.call(payload ?? {}, 'organizationId')
     const hasPayloadTenantId = Object.prototype.hasOwnProperty.call(payload ?? {}, 'tenantId')
-    const rowScope = await loadQueryIndexRowScope(em, entityType, recordId).catch(() => null)
+    const source = resolveQueryIndexSourceMetadata(em, entityType)
+    const sourceScope = await loadQueryIndexRowScope(em, source, recordId)
     const resolvedScope = resolveQueryIndexRecordScope({
       payloadOrganizationId: payload?.organizationId,
       payloadTenantId: payload?.tenantId,
       hasPayloadOrganizationId,
       hasPayloadTenantId,
-      rowScope,
+      sourceScope,
     })
     organizationId = resolvedScope.organizationId
     tenantId = resolvedScope.tenantId

package/src/modules/workflows/AGENTS.md

@@ -142,6 +142,28 @@ Configure automatic workflow starts from domain events:
 5. Configure `contextMapping` to extract event payload into workflow context
 6. Use `debounceMs` and `maxConcurrentInstances` to prevent trigger storms
 
+### Trigger Sources And Precedence
+
+`loadTriggersForTenant()` (`lib/event-trigger-service.ts`) merges three sources into `UnifiedTrigger`s, each tagged with a `source` discriminator:
+
+| `source` | Origin | Notes |
+|----------|--------|-------|
+| `legacy` | `workflow_event_triggers` rows | Backward compatibility with triggers created before triggers were embedded in definitions |
+| `embedded` | `triggers[]` inside a `workflow_definitions` row's `definition` JSONB | What the visual editor and the definitions API write |
+| `code` | `triggers[]` on a code-defined workflow in the in-memory registry (`defineWorkflow`) | Projected by `loadCodeTriggers()`; no DB row required (#4425) |
+
+Precedence: **a DB-backed definition wins over its code counterpart.** Any non-deleted `workflow_definitions` row shadows the code projection for the same `workflowId` — including a disabled row, and including a customization whose `triggers[]` was emptied. This preserves `customize` semantics: once an operator materializes a code workflow, the DB row alone decides which triggers are live.
+
+MUST invalidate the trigger cache after any write that changes which source owns a workflow's triggers — `loadTriggersForTenant()` caches per tenant/organization for `TRIGGER_CACHE_TTL` (5 min), so without invalidation the wildcard subscriber keeps matching a stale snapshot:
+
+```typescript
+import { invalidateTriggerCache } from '../lib/event-trigger-service'
+
+if (tenantId) invalidateTriggerCache(tenantId, organizationId ?? undefined)
+```
+
+This covers definition create/update/delete **and** `POST .../[id]/customize` (code projection → embedded row) and `POST .../[id]/reset-to-code` (embedded row → code projection). Invalidate for the **written row's own** tenant/organization rather than the caller's — `customize` looks an override up by `(workflowId, tenantId)`, so it can revive a row owned by a sibling organization. Omitting `organizationId` clears every organization under the tenant.
+
 ## Widget Injection
 
 The module injects an order-approval widget into the sales module:

package/src/modules/workflows/api/definitions/[id]/customize/route.ts

@@ -17,6 +17,7 @@ import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@op
 import { WorkflowDefinition } from '../../../../data/entities'
 import { serializeWorkflowDefinition } from '../../serialize'
 import { getCodeWorkflow } from '../../../../lib/code-registry'
+import { invalidateTriggerCache } from '../../../../lib/event-trigger-service'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('workflows')
@@ -115,6 +116,14 @@ export async function POST(request: NextRequest, context: RouteContext) {
       saved = override
     }
 
+    // Materializing the override moves trigger ownership from the code registry
+    // to the new `workflow_definitions` row, so the cached snapshot the wildcard
+    // subscriber reads is stale until TRIGGER_CACHE_TTL expires (#4425). Scope
+    // the invalidation to the saved row's own organization: reviving an existing
+    // override belonging to a sibling organization changes triggers for THAT
+    // organization, not for the caller's.
+    if (saved.tenantId) invalidateTriggerCache(saved.tenantId, saved.organizationId ?? undefined)
+
     if (guardResult?.shouldRunAfterSuccess) {
       await runCrudMutationGuardAfterSuccess(container, {
         tenantId: tenantId ?? '',

package/src/modules/workflows/api/definitions/[id]/reset-to-code/route.ts

@@ -16,6 +16,7 @@ import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@op
 import { WorkflowDefinition, WorkflowInstance } from '../../../../data/entities'
 import { serializeCodeWorkflowDefinition } from '../../serialize'
 import { getCodeWorkflow } from '../../../../lib/code-registry'
+import { invalidateTriggerCache } from '../../../../lib/event-trigger-service'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('workflows')
@@ -140,6 +141,12 @@ export async function POST(
     em.remove(definition)
     await em.flush()
 
+    // Trigger ownership falls back to the code registry, so the cached snapshot
+    // still holds the embedded triggers of a row that no longer exists (#4425).
+    if (removedSnapshot.tenantId) {
+      invalidateTriggerCache(removedSnapshot.tenantId, removedSnapshot.organizationId ?? undefined)
+    }
+
     if (guardResult?.shouldRunAfterSuccess) {
       await runCrudMutationGuardAfterSuccess(container, {
         tenantId: tenantId ?? '',