@open-mercato/core 0.6.7-develop.6726.1.983ae8a07e → 0.6.7-develop.6749.1.6b54c56dfe

package/src/modules/dashboards/widgets/dashboard/pipeline-summary/config.ts

@@ -1,11 +1,58 @@
 import { type DateRangePreset, isValidDateRangePreset } from '@open-mercato/ui/backend/date-range'
+import type { WidgetDataRequest } from '../../../services/widgetDataService'
+
+// Deal statuses that mean the deal is closed and must stop counting as current pipeline.
+//
+// This is a denylist, not an allowlist: `customer_deals.status` is a lenient `text` column
+// fed by the per-tenant `deal_status` dictionary, so a status unknown to code counts as OPEN
+// and keeps contributing to the chart. That keeps tenant-specific stages visible and mirrors
+// `customers/lib/interactionStatus.ts`, which treats an unknown interaction status as open.
+//
+// Every vocabulary that reaches the column has to be listed here:
+//   - `win` / `loose` are written by the deal closure UI and the kanban board.
+//   - `won` / `lost` are written verbatim by the `customers.update_deal_stage` AI tool, whose
+//     free-form `toStage` is passed straight through to `status`.
+//   - `closed` is a seeded `deal_status` dictionary value, persisted by the dashboards
+//     analytics seed and treated as terminal by the demo-data generator.
+export const CLOSED_DEAL_STATUSES = ['win', 'loose', 'won', 'lost', 'closed'] as const
+
+// A deal is also closed when `closure_outcome` records the outcome, which the deals-summary
+// KPI already treats as terminal: `api/deals/summary/route.ts` counts a deal as won or lost
+// when EITHER `status` OR `closure_outcome` says so. The two columns can disagree — the CRUD
+// API accepts `closureOutcome` on its own, and the AI tool writes `status` without ever setting
+// it — so the chart has to test both signals to agree with those KPI cards (#4668).
+//
+// The `closure_outcome` side is expressed as `IS NULL` rather than as a `neq` denylist for two
+// reasons, and swapping it for `neq` would be a silent regression:
+//   - `closure_outcome` is nullable, and every OPEN deal holds NULL there. `neq` renders as
+//     `column != ?`, and in SQL `NULL != 'won'` is NULL, not true — a `neq` filter would drop
+//     every open deal and empty the chart. `status` has no such problem: it is `text not null
+//     default 'open'`, which is why the status side stays a denylist.
+//   - Unlike `status`, this column is not fed by a per-tenant dictionary. Every write path
+//     validates it against the same closed `z.enum(['won', 'lost'])` (`data/validators.ts`,
+//     `api/deals/[id]/route.ts`, `api/deals/[id]/stats/route.ts`), so a non-null value always
+//     means closed and there is no tenant-specific vocabulary to keep visible.
+export const OPEN_DEAL_CLOSURE_OUTCOME_FILTER = {
+  field: 'closureOutcome',
+  operator: 'is_null',
+} as const
+
+export const PIPELINE_STATUS_SCOPES = ['open', 'all'] as const
+
+export type PipelineStatusScope = typeof PIPELINE_STATUS_SCOPES[number]
 
 export type PipelineSummarySettings = {
   dateRange: DateRangePreset
+  statusScope: PipelineStatusScope
 }
 
 export const DEFAULT_SETTINGS: PipelineSummarySettings = {
   dateRange: 'this_month',
+  statusScope: 'open',
+}
+
+function isValidStatusScope(value: unknown): value is PipelineStatusScope {
+  return typeof value === 'string' && (PIPELINE_STATUS_SCOPES as readonly string[]).includes(value)
 }
 
 export function hydrateSettings(raw: unknown): PipelineSummarySettings {
@@ -13,5 +60,44 @@ export function hydrateSettings(raw: unknown): PipelineSummarySettings {
   const obj = raw as Record<string, unknown>
   return {
     dateRange: isValidDateRangePreset(obj.dateRange) ? obj.dateRange : DEFAULT_SETTINGS.dateRange,
+    statusScope: isValidStatusScope(obj.statusScope) ? obj.statusScope : DEFAULT_SETTINGS.statusScope,
+  }
+}
+
+export function dehydrateSettings(settings: PipelineSummarySettings): Record<string, unknown> {
+  return {
+    dateRange: settings.dateRange,
+    statusScope: settings.statusScope,
+  }
+}
+
+export function buildPipelineDataRequest(settings: PipelineSummarySettings): WidgetDataRequest {
+  const request: WidgetDataRequest = {
+    entityType: 'customers:deals',
+    metric: {
+      field: 'valueAmount',
+      aggregate: 'sum',
+    },
+    groupBy: {
+      field: 'pipelineStage',
+      resolveLabels: true,
+    },
+    dateRange: {
+      field: 'createdAt',
+      preset: settings.dateRange,
+    },
+  }
+
+  if (settings.statusScope === 'open') {
+    request.filters = [
+      ...CLOSED_DEAL_STATUSES.map((status) => ({
+        field: 'status',
+        operator: 'neq' as const,
+        value: status,
+      })),
+      { ...OPEN_DEAL_CLOSURE_OUTCOME_FILTER },
+    ]
   }
+
+  return request
 }

package/src/modules/dashboards/widgets/dashboard/pipeline-summary/widget.client.tsx

@@ -10,7 +10,14 @@ import {
   InlineDateRangeSelect,
   type DateRangePreset,
 } from '@open-mercato/ui/backend/date-range'
-import { DEFAULT_SETTINGS, hydrateSettings, type PipelineSummarySettings } from './config'
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@open-mercato/ui/primitives/select'
+import {
+  DEFAULT_SETTINGS,
+  buildPipelineDataRequest,
+  hydrateSettings,
+  type PipelineStatusScope,
+  type PipelineSummarySettings,
+} from './config'
 import type { WidgetDataResponse } from '../../../services/widgetDataService'
 import { formatCurrencyCompact } from '../../../lib/formatters'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -18,23 +25,7 @@ import { createLogger } from '@open-mercato/shared/lib/logger'
 const logger = createLogger('dashboards').child({ component: 'pipeline-summary' })
 
 async function fetchPipelineData(settings: PipelineSummarySettings, fetchWidgetData: WidgetDataFetcher): Promise<WidgetDataResponse> {
-  const body = {
-    entityType: 'customers:deals',
-    metric: {
-      field: 'valueAmount',
-      aggregate: 'sum',
-    },
-    groupBy: {
-      field: 'pipelineStage',
-      resolveLabels: true,
-    },
-    dateRange: {
-      field: 'createdAt',
-      preset: settings.dateRange,
-    },
-  }
-
-  return fetchWidgetData<WidgetDataResponse>(body)
+  return fetchWidgetData<WidgetDataResponse>(buildPipelineDataRequest(settings))
 }
 
 function formatStageLabel(stage: unknown, t: (key: string, fallback: string) => string): string {
@@ -97,6 +88,30 @@ const PipelineSummaryWidget: React.FC<DashboardWidgetComponentProps<PipelineSumm
           value={hydrated.dateRange}
           onChange={(dateRange: DateRangePreset) => onSettingsChange({ ...hydrated, dateRange })}
         />
+        <div className="space-y-1.5">
+          <label
+            htmlFor="pipeline-summary-status-scope"
+            className="text-xs font-semibold uppercase text-muted-foreground"
+          >
+            {t('dashboards.analytics.settings.dealStatusScope', 'Deals included')}
+          </label>
+          <Select
+            value={hydrated.statusScope}
+            onValueChange={(value) => onSettingsChange({ ...hydrated, statusScope: value as PipelineStatusScope })}
+          >
+            <SelectTrigger id="pipeline-summary-status-scope" size="sm">
+              <SelectValue />
+            </SelectTrigger>
+            <SelectContent>
+              <SelectItem value="open">
+                {t('dashboards.analytics.settings.dealStatusScopeOpen', 'Open deals only')}
+              </SelectItem>
+              <SelectItem value="all">
+                {t('dashboards.analytics.settings.dealStatusScopeAll', 'All deals, including won and lost')}
+              </SelectItem>
+            </SelectContent>
+          </Select>
+        </div>
       </div>
     )
   }

package/src/modules/dashboards/widgets/dashboard/pipeline-summary/widget.ts

@@ -1,5 +1,5 @@
 import { lazyDashboardWidget, type DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
-import { DEFAULT_SETTINGS, hydrateSettings, type PipelineSummarySettings } from './config'
+import { DEFAULT_SETTINGS, dehydrateSettings, hydrateSettings, type PipelineSummarySettings } from './config'
 const PipelineSummaryWidget = lazyDashboardWidget(() => import('./widget.client'))
 
 const widget: DashboardWidgetModule<PipelineSummarySettings> = {
@@ -18,7 +18,7 @@ const widget: DashboardWidgetModule<PipelineSummarySettings> = {
   },
   Widget: PipelineSummaryWidget,
   hydrateSettings,
-  dehydrateSettings: (s) => ({ dateRange: s.dateRange }),
+  dehydrateSettings,
 }
 
 export default widget

package/src/modules/data_sync/lib/adapter.ts

@@ -104,6 +104,24 @@ export interface DataSyncAdapter {
   readonly runMode?: 'generic' | 'provider'
   readonly operationalTelemetry?: boolean
 
+  /**
+   * Batch work MUST be replay-safe.
+   *
+   * Sync jobs are delivered at least once: BullMQ redelivers a job whose lock
+   * was not renewed, and the engine resumes the run from its last committed
+   * cursor. A batch the generator already yielded can therefore be produced and
+   * executed again, and the engine only fences its own commit — anything the
+   * generator itself did before yielding has already happened.
+   *
+   * Upserts keyed by `externalId` satisfy this. Per-record side effects that are
+   * not idempotent (sending mail, posting to a third party, incrementing a
+   * remote counter) do not, and will run twice on a resume. Make them
+   * conditional on state the adapter can re-read, or move them behind an event
+   * the engine emits after the commit.
+   *
+   * `cursor` is a resume position, not an identity: repeating it between batches
+   * is allowed.
+   */
   streamImport?(input: StreamImportInput): AsyncIterable<ImportBatch>
   streamExport?(input: StreamExportInput): AsyncIterable<ExportBatch>
   getInitialCursor?(input: { entityType: string; scope: TenantScope }): Promise<string | null>

package/src/modules/data_sync/lib/queue-policy.ts

@@ -0,0 +1,30 @@
+/**
+ * Queue names whose jobs resume an existing SyncRun instead of starting a fresh
+ * one. The workers import these to declare their `metadata.queue`, so a rename
+ * cannot silently drop the retry policy.
+ */
+export const DATA_SYNC_IMPORT_QUEUE = 'data-sync-import'
+export const DATA_SYNC_EXPORT_QUEUE = 'data-sync-export'
+
+export const DATA_SYNC_RESUMABLE_QUEUES: readonly string[] = [DATA_SYNC_IMPORT_QUEUE, DATA_SYNC_EXPORT_QUEUE]
+
+export const DATA_SYNC_QUEUE_ATTEMPTS = 3
+
+/**
+ * A backfill batch can hold the processor well past BullMQ's 30s default lock,
+ * so these jobs stall on slow upstreams even when the worker is perfectly
+ * healthy. `DATA_SYNC_LOCK_DURATION_MS` is the primary defence — it stops most
+ * of those false stalls at the source rather than reacting to them.
+ *
+ * `DATA_SYNC_MAX_STALLED_COUNT` covers what is left. BullMQ fails a job once it
+ * stalls more than this many times, and at the default of 1 a single stall
+ * during a long backfill discards the run permanently. 10 buys enough
+ * redeliveries to survive a rolling restart. Raising it is only safe because a
+ * duplicate delivery can no longer corrupt the run: the ownership
+ * compare-and-swap in `commitBatchProgress` lets exactly one worker advance a
+ * run, and every other delivery aborts on its first commit. A job that poisons its
+ * worker still dies — after 10 stalls, with the run left `running` and its
+ * cursor unmoved, which is the state the admin runs list surfaces.
+ */
+export const DATA_SYNC_LOCK_DURATION_MS = 120_000
+export const DATA_SYNC_MAX_STALLED_COUNT = 10

package/src/modules/data_sync/lib/queue.ts

@@ -1,13 +1,31 @@
 import { createModuleQueue, type Queue } from '@open-mercato/queue'
+import {
+  DATA_SYNC_LOCK_DURATION_MS,
+  DATA_SYNC_MAX_STALLED_COUNT,
+  DATA_SYNC_QUEUE_ATTEMPTS,
+  DATA_SYNC_RESUMABLE_QUEUES,
+} from './queue-policy'
 
 const queues = new Map<string, Queue<Record<string, unknown>>>()
 
+const resumableQueueNames = new Set<string>(DATA_SYNC_RESUMABLE_QUEUES)
+
 export function getSyncQueue(queueName: string): Queue<Record<string, unknown>> {
   const existing = queues.get(queueName)
   if (existing) return existing
 
   const concurrency = Math.max(1, Number.parseInt(process.env.DATA_SYNC_QUEUE_CONCURRENCY ?? '5', 10) || 5)
-  const created = createModuleQueue<Record<string, unknown>>(queueName, { concurrency })
+  const created = createModuleQueue<Record<string, unknown>>(
+    queueName,
+    resumableQueueNames.has(queueName)
+      ? {
+        concurrency,
+        attempts: DATA_SYNC_QUEUE_ATTEMPTS,
+        lockDuration: DATA_SYNC_LOCK_DURATION_MS,
+        maxStalledCount: DATA_SYNC_MAX_STALLED_COUNT,
+      }
+      : { concurrency },
+  )
 
   queues.set(queueName, created)
   return created

package/src/modules/data_sync/lib/start-run.ts

@@ -1,6 +1,7 @@
 import type { ProgressService } from '../../progress/lib/progressService'
 import type { SyncRunService } from './sync-run-service'
 import { getSyncQueue } from './queue'
+import { DATA_SYNC_EXPORT_QUEUE, DATA_SYNC_IMPORT_QUEUE } from './queue-policy'
 
 export type DataSyncStartScope = {
   organizationId: string
@@ -71,7 +72,7 @@ export async function startDataSyncRun(params: {
     },
   )
 
-  const queueName = input.direction === 'import' ? 'data-sync-import' : 'data-sync-export'
+  const queueName = input.direction === 'import' ? DATA_SYNC_IMPORT_QUEUE : DATA_SYNC_EXPORT_QUEUE
   const queue = getSyncQueue(queueName)
   await queue.enqueue({
     runId: run.id,

package/src/modules/data_sync/lib/sync-engine.ts

@@ -9,6 +9,7 @@ import { emitDataSyncEvent } from '../events'
 import type { DataSyncAdapter, DataMapping, ExportBatch, ImportBatch } from './adapter'
 import { getDataSyncAdapter } from './adapter-registry'
 import type { SyncRunService } from './sync-run-service'
+import { SyncRunOwnershipConflictError } from './sync-run-service'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('data_sync').child({ component: 'sync-engine' })
@@ -236,6 +237,21 @@ export function createSyncEngine(deps: EngineDeps) {
       return
     }
 
+    if (run.status !== status) {
+      // `markStatus` refuses a terminal -> different-terminal transition and
+      // returns the row unchanged, so the run is already finished under another
+      // delivery of this job. Everything below — the progress job, the
+      // operational log and the lifecycle event — would describe the wrong
+      // outcome, and `data_sync.run.failed` is dispatched to tenant webhooks.
+      // A displaced worker stays silent instead.
+      logger.warn('Skipping finalization of a sync run another worker already finalized', {
+        runId,
+        requestedStatus: status,
+        actualStatus: run.status,
+      })
+      return
+    }
+
     if (run.progressJobId) {
       if (status === 'completed') {
         await progressService.completeJob(
@@ -408,6 +424,10 @@ export function createSyncEngine(deps: EngineDeps) {
         throw new Error(`Integration ${run.integrationId} is missing credentials`)
       }
 
+      // A run already `running` means a stalled job was redelivered, so this is
+      // a resume rather than a first start. Consumers see one `started` event per
+      // delivery either way; the flag is what lets them tell the two apart.
+      const resumed = run.status === 'running'
       const activeRun = await syncRunService.markStatus(run.id, 'running', scope)
       if (!activeRun || activeRun.status !== 'running') {
         return
@@ -417,6 +437,7 @@ export function createSyncEngine(deps: EngineDeps) {
         integrationId: run.integrationId,
         entityType: run.entityType,
         direction: run.direction,
+        resumed,
         tenantId: scope.tenantId,
         organizationId: scope.organizationId,
       })
@@ -452,6 +473,7 @@ export function createSyncEngine(deps: EngineDeps) {
       const mapping = await resolveMapping(adapter, run.entityType, scope)
       let processedCount = 0
       let totalCount: number | null = null
+      let committedBatches = activeRun.batchesCompleted ?? 0
 
       try {
         for await (const batch of adapter.streamImport({
@@ -481,7 +503,9 @@ export function createSyncEngine(deps: EngineDeps) {
             },
             batch.cursor,
             scope,
+            committedBatches,
           )
+          committedBatches += 1
 
           await updateProgress(run.progressJobId, processedCount, totalCount, scope)
           await refreshCoverageSnapshots(batch.refreshCoverageEntityTypes, scope)
@@ -507,6 +531,13 @@ export function createSyncEngine(deps: EngineDeps) {
           })
         }
       } catch (error) {
+        if (error instanceof SyncRunOwnershipConflictError) {
+          logger.warn('Yielding import run to a concurrent worker that already advanced it', {
+            runId: run.id,
+            expectedBatchesCompleted: error.expectedBatchesCompleted,
+          })
+          return
+        }
         const message = error instanceof Error ? error.message : 'Sync import failed'
         await integrationLogService.write(
           {
@@ -553,6 +584,10 @@ export function createSyncEngine(deps: EngineDeps) {
         throw new Error(`Integration ${run.integrationId} is missing credentials`)
       }
 
+      // A run already `running` means a stalled job was redelivered, so this is
+      // a resume rather than a first start. Consumers see one `started` event per
+      // delivery either way; the flag is what lets them tell the two apart.
+      const resumed = run.status === 'running'
       const activeRun = await syncRunService.markStatus(run.id, 'running', scope)
       if (!activeRun || activeRun.status !== 'running') {
         return
@@ -562,6 +597,7 @@ export function createSyncEngine(deps: EngineDeps) {
         integrationId: run.integrationId,
         entityType: run.entityType,
         direction: run.direction,
+        resumed,
         tenantId: scope.tenantId,
         organizationId: scope.organizationId,
       })
@@ -596,6 +632,7 @@ export function createSyncEngine(deps: EngineDeps) {
 
       const mapping = await resolveMapping(adapter, run.entityType, scope)
       let processedCount = 0
+      let committedBatches = activeRun.batchesCompleted ?? 0
 
       try {
         for await (const batch of adapter.streamExport({
@@ -626,7 +663,9 @@ export function createSyncEngine(deps: EngineDeps) {
             },
             batch.cursor,
             scope,
+            committedBatches,
           )
+          committedBatches += 1
           await updateProgress(run.progressJobId, processedCount, null, scope)
           await logExportItemFailures(run.id, run.integrationId, batch.results, scope)
 
@@ -647,6 +686,13 @@ export function createSyncEngine(deps: EngineDeps) {
           })
         }
       } catch (error) {
+        if (error instanceof SyncRunOwnershipConflictError) {
+          logger.warn('Yielding export run to a concurrent worker that already advanced it', {
+            runId: run.id,
+            expectedBatchesCompleted: error.expectedBatchesCompleted,
+          })
+          return
+        }
         const message = error instanceof Error ? error.message : 'Sync export failed'
         await integrationLogService.write(
           {

package/src/modules/data_sync/lib/sync-run-service.ts

@@ -26,6 +26,27 @@ type SyncScope = {
   tenantId: string
 }
 
+/**
+ * Raised when a batch commit loses the ownership compare-and-swap, meaning
+ * another delivery of the same job advanced the run while this worker was
+ * streaming.
+ *
+ * BullMQ guarantees at-least-once delivery: a job whose lock is not renewed is
+ * redelivered under the SAME job id, whether the previous worker died or is only
+ * blocked. No identity token can tell those apart, so ownership is enforced here
+ * — on the write that matters — instead of at claim time. The loser aborts and
+ * leaves the run to the worker that is still making progress.
+ */
+export class SyncRunOwnershipConflictError extends Error {
+  constructor(
+    readonly runId: string,
+    readonly expectedBatchesCompleted: number,
+  ) {
+    super(`[internal] Sync run ${runId} advanced past batch ${expectedBatchesCompleted} under a concurrent worker`)
+    this.name = 'SyncRunOwnershipConflictError'
+  }
+}
+
 export function createSyncRunService(em: EntityManager) {
   async function resolveCursorRow(run: SyncRun, scope: SyncScope): Promise<SyncCursor | null> {
     return findOneWithDecryption(
@@ -150,7 +171,11 @@ export function createSyncRunService(em: EntityManager) {
             organizationId: scope.organizationId,
             tenantId: scope.tenantId,
             deletedAt: null,
-            status: 'pending',
+            // A BullMQ stalled-job redelivery finds the run in `running` after
+            // the previous worker was hard-killed. Treat that transition as an
+            // idempotent claim while still excluding terminal states so a
+            // cancelled or completed run cannot be revived.
+            status: { $in: ['pending', 'running'] },
           },
           {
             status,
@@ -178,6 +203,12 @@ export function createSyncRunService(em: EntityManager) {
       return row
     },
 
+    /**
+     * @deprecated Use {@link commitBatchProgress}, which writes counters and
+     * cursor in one transaction behind the ownership fence. This method updates
+     * counters unfenced, so two deliveries of the same job can lose each other's
+     * increments. Kept for external callers only.
+     */
     async updateCounts(
       runId: string,
       delta: Partial<Pick<SyncRun, 'createdCount' | 'updatedCount' | 'skippedCount' | 'failedCount' | 'batchesCompleted'>>,
@@ -195,6 +226,11 @@ export function createSyncRunService(em: EntityManager) {
       return row
     },
 
+    /**
+     * @deprecated Use {@link commitBatchProgress}. This method advances the
+     * cursor without the ownership fence, so a stale delivery can move the
+     * cursor of a run another worker owns. Kept for external callers only.
+     */
     async updateCursor(runId: string, cursor: string, scope: SyncScope): Promise<void> {
       const run = await this.getRun(runId, scope)
       if (!run) return
@@ -204,16 +240,61 @@ export function createSyncRunService(em: EntityManager) {
       ], { transaction: true })
     },
 
+    /**
+     * Commits one batch's counters and cursor in a single transaction.
+     *
+     * Passing `expectedBatchesCompleted` fences the write: the run must still be
+     * `running` and still sit on that batch count, or another delivery of the
+     * same BullMQ job owns the run and this commit throws
+     * `SyncRunOwnershipConflictError` and rolls back. Omitting it keeps the
+     * legacy unguarded write for callers outside the engine.
+     *
+     * The fence token is `batchesCompleted` rather than `cursor` because it
+     * advances by construction on every commit. A cursor is a free-form adapter
+     * string that an adapter may legitimately repeat between batches — the
+     * Akeneo products adapter does, between its final page and the
+     * reconciliation batch that follows it — and a repeated token fences
+     * nothing.
+     *
+     * The guard's `UPDATE` also holds the row lock for the rest of the
+     * transaction, so a competing commit blocks here and then re-reads the
+     * advanced count instead of interleaving with this one. That is what lets
+     * the counters below stay a plain read-modify-write against the snapshot
+     * read above: a commit that wins the fence has proven that nothing else
+     * landed since it read.
+     */
     async commitBatchProgress(
       runId: string,
       delta: Partial<Pick<SyncRun, 'createdCount' | 'updatedCount' | 'skippedCount' | 'failedCount' | 'batchesCompleted'>>,
       cursor: string,
       scope: SyncScope,
+      expectedBatchesCompleted?: number,
     ): Promise<SyncRun | null> {
       const run = await this.getRun(runId, scope)
       if (!run) return null
       const cursorRow = await resolveCursorRow(run, scope)
+      const claimRunOwnership = async () => {
+        if ((delta.batchesCompleted ?? 0) < 1) {
+          throw new Error(`[internal] A fenced commit for sync run ${runId} must advance batchesCompleted`)
+        }
+        const owned = await em.nativeUpdate(
+          SyncRun,
+          {
+            id: runId,
+            organizationId: scope.organizationId,
+            tenantId: scope.tenantId,
+            deletedAt: null,
+            status: 'running',
+            batchesCompleted: expectedBatchesCompleted,
+          },
+          { updatedAt: new Date() },
+        )
+        if (owned === 0) {
+          throw new SyncRunOwnershipConflictError(runId, expectedBatchesCompleted ?? 0)
+        }
+      }
       await withAtomicFlush(em, [
+        ...(expectedBatchesCompleted === undefined ? [] : [claimRunOwnership]),
         () => {
           run.createdCount += delta.createdCount ?? 0
           run.updatedCount += delta.updatedCount ?? 0

package/src/modules/data_sync/workers/sync-export.ts

@@ -2,6 +2,11 @@ import type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'
 import type { ProgressService } from '../../progress/lib/progressService'
 import type { SyncEngine } from '../lib/sync-engine'
 import type { SyncRunService } from '../lib/sync-run-service'
+import {
+  DATA_SYNC_EXPORT_QUEUE,
+  DATA_SYNC_LOCK_DURATION_MS,
+  DATA_SYNC_MAX_STALLED_COUNT,
+} from '../lib/queue-policy'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('data_sync').child({ component: 'sync-export' })
@@ -17,9 +22,11 @@ type SyncJobPayload = {
 }
 
 export const metadata: WorkerMeta = {
-  queue: 'data-sync-export',
+  queue: DATA_SYNC_EXPORT_QUEUE,
   id: 'data-sync:export',
   concurrency: 5,
+  lockDuration: DATA_SYNC_LOCK_DURATION_MS,
+  maxStalledCount: DATA_SYNC_MAX_STALLED_COUNT,
 }
 
 type HandlerContext = JobContext & {

package/src/modules/data_sync/workers/sync-import.ts

@@ -2,6 +2,11 @@ import type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'
 import type { ProgressService } from '../../progress/lib/progressService'
 import type { SyncEngine } from '../lib/sync-engine'
 import type { SyncRunService } from '../lib/sync-run-service'
+import {
+  DATA_SYNC_IMPORT_QUEUE,
+  DATA_SYNC_LOCK_DURATION_MS,
+  DATA_SYNC_MAX_STALLED_COUNT,
+} from '../lib/queue-policy'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('data_sync').child({ component: 'sync-import' })
@@ -17,9 +22,11 @@ type SyncJobPayload = {
 }
 
 export const metadata: WorkerMeta = {
-  queue: 'data-sync-import',
+  queue: DATA_SYNC_IMPORT_QUEUE,
   id: 'data-sync:import',
   concurrency: 5,
+  lockDuration: DATA_SYNC_LOCK_DURATION_MS,
+  maxStalledCount: DATA_SYNC_MAX_STALLED_COUNT,
 }
 
 type HandlerContext = JobContext & {