@open-mercato/core 0.6.7 → 0.6.8-develop.6875.1.871a4afc94

package/src/modules/feature_toggles/components/FeatureGuard.tsx

@@ -8,23 +8,30 @@ export type FeatureGuardProps = {
   children: React.ReactNode
   fallback?: React.ReactNode
   loadingFallback?: React.ReactNode
+  defaultValue?: boolean
 }
 
 /**
  * FeatureGuard component that conditionally renders children based on feature toggle state.
- * 
+ *
  * @param id - The feature toggle identifier
  * @param children - Content to render when the feature is enabled
  * @param fallback - Optional content to render when the feature is disabled
  * @param loadingFallback - Optional content to render while loading the feature state
+ * @param defaultValue - Toggle value assumed when the check cannot be resolved
+ *   (undefined toggle, type mismatch, network or permission failure). Defaults
+ *   to `false`; pass `true` to keep guarded UI visible when the check fails.
+ *   Distinct from `fallback`, which is what gets rendered once the feature is
+ *   known to be disabled.
  */
 export function FeatureGuard({
   id,
   children,
   fallback = null,
   loadingFallback = null,
+  defaultValue = false,
 }: FeatureGuardProps) {
-  const { enabled, isLoading } = useFeatureFlagBoolean({ id })
+  const { enabled, isLoading } = useFeatureFlagBoolean({ id, defaultValue })
 
   if (isLoading) {
     return <>{loadingFallback}</>

package/src/modules/feature_toggles/components/FeatureToggleOverrideCard.tsx

@@ -69,7 +69,7 @@ export function FeatureToggleOverrideCard({ toggleId }: { toggleId: string }) {
                     <CardTitle>{t('feature_toggles.override.title', 'Override')}</CardTitle>
                 </CardHeader>
                 <CardContent>
-                    <Alert variant="destructive">
+                    <Alert status="error">
                         <AlertTitle>{t('ui.errors.defaultTitle', 'Something went wrong')}</AlertTitle>
                         <AlertDescription>{error.message}</AlertDescription>
                     </Alert>

package/src/modules/feature_toggles/components/hooks/staleTime.ts

@@ -0,0 +1,5 @@
+// Mirrors the server-side toggle resolution cache TTL in
+// `lib/feature-flag-check.ts`, so several components reading the same toggle
+// share one request instead of refetching a value the server would not have
+// re-resolved anyway.
+export const FEATURE_FLAG_STALE_TIME_MS = 60_000

package/src/modules/feature_toggles/components/hooks/useFeatureFlagBoolean.ts

@@ -2,9 +2,19 @@
 
 import { useQuery } from '@tanstack/react-query'
 import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { FEATURE_FLAG_STALE_TIME_MS } from './staleTime'
 
 export type UseFeatureFlagOptions = {
   id: string
+  /**
+   * Value used while the check is in flight and whenever the toggle cannot be
+   * resolved (undefined toggle, type mismatch, network or permission failure).
+   *
+   * Defaults to `false` so an unresolved toggle keeps a feature switched off.
+   * Pass `true` for toggles that hide existing UI — there a failed check must
+   * not make the feature disappear.
+   */
+  defaultValue?: boolean
 }
 
 export type UseFeatureFlagResult = {
@@ -21,6 +31,7 @@ type Result<T> = {
 }
 
 export function useFeatureFlagBoolean(options: UseFeatureFlagOptions): UseFeatureFlagResult {
+  const defaultValue = options.defaultValue ?? false
   const query = useQuery({
     queryKey: ['featureToggles', 'check', options?.id],
     queryFn: async () => {
@@ -37,9 +48,10 @@ export function useFeatureFlagBoolean(options: UseFeatureFlagOptions): UseFeatur
       return result
     },
     enabled: !!options.id,
+    staleTime: FEATURE_FLAG_STALE_TIME_MS,
   })
 
-  const enabled = query.data?.ok ? query.data.value : false
+  const enabled = query.data?.ok ? query.data.value : defaultValue
   const isLoading = query.isLoading
 
   return {

package/src/modules/feature_toggles/components/hooks/useFeatureFlagJson.ts

@@ -2,9 +2,16 @@
 
 import { useQuery } from '@tanstack/react-query'
 import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { FEATURE_FLAG_STALE_TIME_MS } from './staleTime'
 
-export type UseFeatureFlagJsonOptions = {
+export type UseFeatureFlagJsonOptions<T = unknown> = {
     id: string
+    /**
+     * Value used while the check is in flight and whenever the toggle cannot be
+     * resolved (undefined toggle, type mismatch, network or permission failure).
+     * Defaults to `null`.
+     */
+    defaultValue?: T | null
 }
 
 export type UseFeatureFlagJsonResult<T = unknown> = {
@@ -20,7 +27,8 @@ type Result<T> = {
     error: unknown
 }
 
-export function useFeatureFlagJson<T = unknown>(options: UseFeatureFlagJsonOptions): UseFeatureFlagJsonResult<T> {
+export function useFeatureFlagJson<T = unknown>(options: UseFeatureFlagJsonOptions<T>): UseFeatureFlagJsonResult<T> {
+    const defaultValue = options.defaultValue ?? null
     const query = useQuery({
         queryKey: ['featureToggles', 'check', 'json', options?.id],
         queryFn: async () => {
@@ -37,9 +45,10 @@ export function useFeatureFlagJson<T = unknown>(options: UseFeatureFlagJsonOptio
             return result
         },
         enabled: !!options.id,
+        staleTime: FEATURE_FLAG_STALE_TIME_MS,
     })
 
-    const value = query.data?.ok ? query.data.value : null
+    const value = query.data?.ok ? query.data.value : defaultValue
     const isLoading = query.isLoading
 
     return {

package/src/modules/feature_toggles/components/hooks/useFeatureFlagNumber.ts

@@ -2,9 +2,16 @@
 
 import { useQuery } from '@tanstack/react-query'
 import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { FEATURE_FLAG_STALE_TIME_MS } from './staleTime'
 
 export type UseFeatureFlagNumberOptions = {
     id: string
+    /**
+     * Value used while the check is in flight and whenever the toggle cannot be
+     * resolved (undefined toggle, type mismatch, network or permission failure).
+     * Defaults to `null`.
+     */
+    defaultValue?: number | null
 }
 
 export type UseFeatureFlagNumberResult = {
@@ -21,6 +28,7 @@ type Result<T> = {
 }
 
 export function useFeatureFlagNumber(options: UseFeatureFlagNumberOptions): UseFeatureFlagNumberResult {
+    const defaultValue = options.defaultValue ?? null
     const query = useQuery({
         queryKey: ['featureToggles', 'check', 'number', options?.id],
         queryFn: async () => {
@@ -37,9 +45,10 @@ export function useFeatureFlagNumber(options: UseFeatureFlagNumberOptions): UseF
             return result
         },
         enabled: !!options.id,
+        staleTime: FEATURE_FLAG_STALE_TIME_MS,
     })
 
-    const value = query.data?.ok ? query.data.value : null
+    const value = query.data?.ok ? query.data.value : defaultValue
     const isLoading = query.isLoading
 
     return {

package/src/modules/feature_toggles/components/hooks/useFeatureFlagString.ts

@@ -2,9 +2,16 @@
 
 import { useQuery } from '@tanstack/react-query'
 import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { FEATURE_FLAG_STALE_TIME_MS } from './staleTime'
 
 export type UseFeatureFlagStringOptions = {
     id: string
+    /**
+     * Value used while the check is in flight and whenever the toggle cannot be
+     * resolved (undefined toggle, type mismatch, network or permission failure).
+     * Defaults to `null`.
+     */
+    defaultValue?: string | null
 }
 
 export type UseFeatureFlagStringResult = {
@@ -21,6 +28,7 @@ type Result<T> = {
 }
 
 export function useFeatureFlagString(options: UseFeatureFlagStringOptions): UseFeatureFlagStringResult {
+    const defaultValue = options.defaultValue ?? null
     const query = useQuery({
         queryKey: ['featureToggles', 'check', 'string', options?.id],
         queryFn: async () => {
@@ -37,9 +45,10 @@ export function useFeatureFlagString(options: UseFeatureFlagStringOptions): UseF
             return result
         },
         enabled: !!options.id,
+        staleTime: FEATURE_FLAG_STALE_TIME_MS,
     })
 
-    const value = query.data?.ok ? query.data.value : null
+    const value = query.data?.ok ? query.data.value : defaultValue
     const isLoading = query.isLoading
 
     return {

package/src/modules/feature_toggles/i18n/ko.json

@@ -0,0 +1,96 @@
+{
+  "feature_toggles.audit.overrides.changeState": "재정의 상태 변경됨",
+  "feature_toggles.audit.toggles.create": "토글 생성됨",
+  "feature_toggles.audit.toggles.delete": "토글 삭제됨",
+  "feature_toggles.audit.toggles.update": "토글 수정됨",
+  "feature_toggles.detail.defaultValue": "기본값",
+  "feature_toggles.detail.description": "설명",
+  "feature_toggles.detail.details": "상세 정보",
+  "feature_toggles.detail.fields.category": "카테고리",
+  "feature_toggles.detail.fields.defaultState": "기본 상태",
+  "feature_toggles.detail.fields.failMode": "실패 모드",
+  "feature_toggles.detail.fields.identifier": "식별자",
+  "feature_toggles.detail.fields.name": "이름",
+  "feature_toggles.form.action.save": "저장",
+  "feature_toggles.form.errors.load": "기능 토글 재정의를 불러오지 못했습니다",
+  "feature_toggles.form.fields.category.label": "카테고리",
+  "feature_toggles.form.fields.defaultState.disabled": "비활성화됨",
+  "feature_toggles.form.fields.defaultState.enabled": "활성화됨",
+  "feature_toggles.form.fields.defaultState.label": "기본 상태",
+  "feature_toggles.form.fields.defaultValue.boolean.label": "기본값 (불리언)",
+  "feature_toggles.form.fields.defaultValue.description": "이 토글의 기본값을 설정하세요.",
+  "feature_toggles.form.fields.defaultValue.json.label": "기본값 (JSON)",
+  "feature_toggles.form.fields.defaultValue.number.label": "기본값 (숫자)",
+  "feature_toggles.form.fields.defaultValue.selectType": "기본값을 구성하려면 위에서 유형을 선택하세요",
+  "feature_toggles.form.fields.defaultValue.string.label": "기본값 (문자열)",
+  "feature_toggles.form.fields.defaultValue.string.placeholder": "기본 문자열 값 입력",
+  "feature_toggles.form.fields.description.label": "설명",
+  "feature_toggles.form.fields.identifier.label": "식별자",
+  "feature_toggles.form.fields.name.label": "이름",
+  "feature_toggles.form.fields.type.label": "유형",
+  "feature_toggles.form.groups.basic": "기본 정보",
+  "feature_toggles.form.groups.defaultValue": "기본값",
+  "feature_toggles.form.groups.type": "유형 구성",
+  "feature_toggles.form.loading": "불러오는 중…",
+  "feature_toggles.form.title.edit": "기능 토글 편집",
+  "feature_toggles.global.help.title": "기능 토글",
+  "feature_toggles.list.confirmDelete": "기능 토글 \"{identifier}\"을(를) 삭제하시겠습니까?",
+  "feature_toggles.list.error.load": "기능 토글을 불러오지 못했습니다",
+  "feature_toggles.list.filters.category": "카테고리",
+  "feature_toggles.list.filters.defaultState": "기본 상태",
+  "feature_toggles.list.filters.defaultState.disabled": "비활성화됨",
+  "feature_toggles.list.filters.defaultState.enabled": "활성화됨",
+  "feature_toggles.list.filters.identifier": "식별자",
+  "feature_toggles.list.filters.name": "이름",
+  "feature_toggles.list.filters.type": "유형",
+  "feature_toggles.list.headers.category": "카테고리",
+  "feature_toggles.list.headers.defaultState": "기본 상태",
+  "feature_toggles.list.headers.disabled": "비활성화됨",
+  "feature_toggles.list.headers.enabled": "활성화됨",
+  "feature_toggles.list.headers.identifier": "식별자",
+  "feature_toggles.list.headers.name": "이름",
+  "feature_toggles.list.headers.type": "유형",
+  "feature_toggles.list.table.refresh": "새로고침",
+  "feature_toggles.nav.global": "전역",
+  "feature_toggles.nav.group": "기능 토글",
+  "feature_toggles.nav.overrides": "재정의",
+  "feature_toggles.override.disabled": "재정의가 비활성화되어 있습니다. 값은 기본 구성에서 상속됩니다.",
+  "feature_toggles.override.error.load": "재정의를 불러오지 못했습니다",
+  "feature_toggles.override.fields.isOverride.description": "활성화하면 이 테넌트는 기본 구성을 상속하는 대신 커스텀 값을 사용합니다.",
+  "feature_toggles.override.fields.isOverride.label": "재정의 활성화",
+  "feature_toggles.override.fields.overrideValue.description": "이 테넌트의 재정의 값을 설정하세요.",
+  "feature_toggles.override.fields.value.boolean.label": "재정의 값 (불리언)",
+  "feature_toggles.override.fields.value.json.label": "재정의 값 (JSON)",
+  "feature_toggles.override.fields.value.number.label": "재정의 값 (숫자)",
+  "feature_toggles.override.fields.value.string.label": "재정의 값 (문자열)",
+  "feature_toggles.override.fields.value.string.placeholder": "재정의 문자열 값 입력",
+  "feature_toggles.override.groups.mode": "재정의 모드",
+  "feature_toggles.override.groups.value": "재정의 값",
+  "feature_toggles.override.save": "재정의 저장",
+  "feature_toggles.override.tenant": "테넌트: {{name}}",
+  "feature_toggles.override.title": "재정의",
+  "feature_toggles.override.unknownType": "알 수 없는 토글 유형입니다. 재정의 값을 구성할 수 없습니다.",
+  "feature_toggles.overrides.error.update": "재정의 업데이트에 실패했습니다",
+  "feature_toggles.overrides.filters.overrideState": "재정의 상태",
+  "feature_toggles.overrides.filters.overrideState.disabled": "비활성화됨",
+  "feature_toggles.overrides.filters.overrideState.enabled": "활성화됨",
+  "feature_toggles.overrides.filters.overrideState.inherit": "상속",
+  "feature_toggles.overrides.headers.category": "카테고리",
+  "feature_toggles.overrides.headers.defaultState": "기본 상태",
+  "feature_toggles.overrides.headers.identifier": "식별자",
+  "feature_toggles.overrides.headers.isOverride.false": "아니오",
+  "feature_toggles.overrides.headers.isOverride.true": "예",
+  "feature_toggles.overrides.headers.name": "이름",
+  "feature_toggles.overrides.headers.organization": "조직",
+  "feature_toggles.overrides.headers.overrideState": "재정의 상태",
+  "feature_toggles.overrides.headers.tenant": "테넌트",
+  "feature_toggles.overrides.help.title": "기능 토글 재정의",
+  "feature_toggles.types.boolean": "불리언",
+  "feature_toggles.types.json": "JSON",
+  "feature_toggles.types.number": "숫자",
+  "feature_toggles.types.string": "문자열",
+  "feature_toggles.values.false": "거짓",
+  "feature_toggles.values.no": "아니오",
+  "feature_toggles.values.true": "참",
+  "feature_toggles.values.yes": "예"
+}

package/src/modules/inbox_ops/ai-tools.ts

@@ -3,7 +3,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import type { AwilixContainer } from 'awilix'
 import { runWithCacheTenant } from '@open-mercato/cache'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { hasFeature } from '@open-mercato/shared/security/features'
+import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
 import { InboxProposal, InboxProposalAction, InboxDiscrepancy } from './data/entities'
 import { inboxProposalCategoryEnum } from './data/validators'
 import { executeAction } from './lib/executionEngine'
@@ -311,8 +311,10 @@ Returns on error: error message with appropriate detail.`,
 
     // Check target module permission
     if (action.requiredFeature) {
-      const featureGranted =
-        ctx.isSuperAdmin || hasFeature(ctx.userFeatures, action.requiredFeature)
+      const featureGranted = authorizeFeatures([action.requiredFeature], {
+        grantedFeatures: ctx.userFeatures,
+        unrestricted: ctx.isSuperAdmin,
+      })
       if (!featureGranted) {
         return {
           error: 'Insufficient permissions',

package/src/modules/inbox_ops/api/proposals/[id]/actions/[actionId]/route.ts

@@ -1,6 +1,8 @@
 import { NextResponse } from 'next/server'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { runWithCacheTenant } from '@open-mercato/cache'
+import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import {
   runCrudMutationGuardAfterSuccess,
   validateCrudMutationGuard,
@@ -40,6 +42,20 @@ export async function PATCH(req: Request) {
       return NextResponse.json({ error: 'Action already processed' }, { status: 409 })
     }
 
+    // Optimistic lock: refuse a stale overwrite when two tabs edit the same action
+    // payload. Strictly additive — a no-op without the expected-version header.
+    try {
+      await enforceCommandOptimisticLockWithGuards(ctx.container, {
+        resourceKind: 'inbox_ops.action',
+        resourceId: action.id,
+        current: action.updatedAt ?? null,
+        request: req,
+      })
+    } catch (err) {
+      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+      throw err
+    }
+
     const mergedPayload = { ...action.payload as Record<string, unknown>, ...parsed.data.payload }
     const payloadValidation = validateActionPayloadForType(action.actionType, mergedPayload)
     if (!payloadValidation.success) {
@@ -108,7 +124,7 @@ export const openApi: OpenApiRouteDoc = {
       responses: [
         { status: 200, description: 'Action updated' },
         { status: 404, description: 'Action not found' },
-        { status: 409, description: 'Action already processed' },
+        { status: 409, description: 'Action already processed or stale (optimistic-lock conflict)' },
       ],
     },
   },

package/src/modules/inbox_ops/api/proposals/route.ts

@@ -4,6 +4,8 @@ import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import type { FilterQuery } from '@mikro-orm/postgresql'
 import { findAndCountWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
+import { findEntityIdsBySearchTokens, type SearchTokenDatabase } from '@open-mercato/shared/lib/search/tokenLookup'
+import { E } from '#generated/entities.ids.generated'
 import { InboxProposal, InboxEmail, InboxProposalAction, InboxDiscrepancy, type InboxProposalCategory } from '../../data/entities'
 import { proposalListQuerySchema } from '../../data/validators'
 import { resolveRequestContext, UnauthorizedError } from '../routeHelpers'
@@ -47,7 +49,24 @@ export async function GET(req: Request) {
       }
     }
     if (query.search) {
-      where.summary = { $ilike: `%${escapeLikePattern(query.search)}%` }
+      // `summary` is covered by the inbox_ops encryption map, so an ILIKE alone
+      // compares the pattern against ciphertext and matches nothing once
+      // encryption is on. Union it with the token index, which stores hashes of
+      // the plaintext. Issue #2990.
+      const searchOr: FilterQuery<InboxProposal>[] = [
+        { summary: { $ilike: `%${escapeLikePattern(query.search)}%` } },
+      ]
+      const tokenMatch = await findEntityIdsBySearchTokens({
+        db: ctx.em.getKysely<SearchTokenDatabase>(),
+        entityType: E.inbox_ops.inbox_proposal,
+        query: query.search,
+        fields: ['summary'],
+        scope: { tenantId: ctx.tenantId, organizationId: ctx.organizationId },
+      })
+      if (tokenMatch.matched && tokenMatch.ids.length) {
+        searchOr.push({ id: { $in: tokenMatch.ids } })
+      }
+      where.$or = searchOr
     }
 
     const offset = (query.page - 1) * query.pageSize

package/src/modules/inbox_ops/api/webhook/inbound.ts

@@ -13,6 +13,11 @@ import { parseInboundEmail } from '../../lib/emailParser'
 import { checkRateLimit } from '../../lib/rateLimiter'
 import { emitInboxOpsEvent } from '../../events'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import {
+  readBoundedRequestBody,
+  resolveWebhookBodyLimitBytes,
+  WebhookBodyTooLargeError,
+} from '@open-mercato/shared/lib/webhooks'
 
 const logger = createLogger('inbox_ops').child({ component: 'webhook' })
 
@@ -20,7 +25,10 @@ export const metadata = {
   POST: { requireAuth: false },
 }
 
-const MAX_PAYLOAD_SIZE = 2 * 1024 * 1024 // 2MB
+const MAX_PAYLOAD_SIZE = resolveWebhookBodyLimitBytes(
+  process.env.INBOX_OPS_WEBHOOK_MAX_BODY_BYTES ?? process.env.OM_WEBHOOK_MAX_BODY_BYTES,
+  2 * 1024 * 1024,
+)
 const REPLAY_WINDOW_MS = 5 * 60 * 1000 // 5 minutes
 
 function isTimestampFresh(timestamp: string): boolean {
@@ -211,22 +219,16 @@ export async function POST(req: Request) {
     return NextResponse.json({ error: 'Service unavailable' }, { status: 503 })
   }
 
-  const contentLength = parseInt(req.headers.get('content-length') || '0', 10)
-  if (contentLength > MAX_PAYLOAD_SIZE) {
-    return NextResponse.json({ error: 'Payload too large' }, { status: 413 })
-  }
-
   let rawBody: string
   try {
-    rawBody = await req.text()
-  } catch {
+    rawBody = await readBoundedRequestBody(req, { maxBytes: MAX_PAYLOAD_SIZE })
+  } catch (error) {
+    if (error instanceof WebhookBodyTooLargeError) {
+      return NextResponse.json({ error: 'Payload too large' }, { status: 413 })
+    }
     return NextResponse.json({ error: 'Bad request' }, { status: 400 })
   }
 
-  if (rawBody.length > MAX_PAYLOAD_SIZE) {
-    return NextResponse.json({ error: 'Payload too large' }, { status: 413 })
-  }
-
   const verified = await verifyAndParse(req, rawBody)
   if (!verified.ok) {
     return verified.response

package/src/modules/inbox_ops/backend/inbox-ops/log/page.tsx

@@ -31,11 +31,11 @@ type EmailListResponse = {
 }
 
 const STATUS_COLORS: Record<string, string> = {
-  received: 'bg-blue-100 text-blue-800',
-  processing: 'bg-purple-100 text-purple-800',
-  processed: 'bg-green-100 text-green-800',
-  needs_review: 'bg-amber-100 text-amber-800',
-  failed: 'bg-red-100 text-red-800',
+  received: 'bg-status-info-bg text-status-info-text',
+  processing: 'bg-status-neutral-bg text-status-neutral-text',
+  processed: 'bg-status-success-bg text-status-success-text',
+  needs_review: 'bg-status-warning-bg text-status-warning-text',
+  failed: 'bg-status-error-bg text-status-error-text',
 }
 
 export default function ProcessingLogPage() {
@@ -141,7 +141,7 @@ export default function ProcessingLogPage() {
       accessorKey: 'processingError',
       header: t('inbox_ops.extraction_failed', 'Error'),
       cell: ({ row }) => (
-        <span className="text-xs text-red-600 truncate max-w-[280px] block">
+        <span className="text-xs text-status-error-text truncate max-w-[280px] block">
           {row.original.processingError || '-'}
         </span>
       ),

package/src/modules/inbox_ops/components/proposals/EditActionDialog.tsx

@@ -9,8 +9,8 @@ import {
   SelectTrigger,
   SelectValue,
 } from '@open-mercato/ui/primitives/select'
-import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
-import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { apiCallOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader, extractOptimisticLockConflict } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -123,10 +123,10 @@ function ContactPayloadEditor({
                   setLastName(event.target.value)
                   updatePersonName(firstName, event.target.value)
                 }}
-                className={lastNameMissing ? 'border-red-500' : ''}
+                className={lastNameMissing ? 'border-status-error-border' : ''}
               />
               {lastNameMissing && (
-                <p className="text-xs text-red-600 mt-1">{t('inbox_ops.contact.last_name_required', 'Last name is required')}</p>
+                <p className="text-xs text-status-error-text mt-1">{t('inbox_ops.contact.last_name_required', 'Last name is required')}</p>
               )}
             </div>
           </>
@@ -461,25 +461,30 @@ export function EditActionDialog({
     }
 
     setIsSaving(true)
-    const result = await runMutation({
-      // TODO(#2373-D): thread updatedAt — ActionDetail type lives outside this file's edit scope
-      operation: () => withScopedApiRequestHeaders(
-        buildOptimisticLockHeader(undefined),
-        () => apiCall<{ ok: boolean; error?: string }>(
-          `/api/inbox_ops/proposals/${action.proposalId}/actions/${action.id}`,
-          { method: 'PATCH', body: JSON.stringify({ payload: finalPayload }) },
+    try {
+      await runMutation({
+        operation: () => withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(action.updatedAt),
+          () => apiCallOrThrow<{ ok: boolean; error?: string }>(
+            `/api/inbox_ops/proposals/${action.proposalId}/actions/${action.id}`,
+            { method: 'PATCH', body: JSON.stringify({ payload: finalPayload }) },
+          ),
         ),
-      ),
-      context: {},
-    })
-    if (result?.ok && result.result?.ok) {
+        context: {},
+      })
       flash(t('inbox_ops.edit_dialog.saved', 'Action updated successfully'), 'success')
       onSaved()
       onClose()
-    } else {
-      flash(result?.result?.error || t('inbox_ops.flash.save_failed', 'Failed to save'), 'error')
+    } catch (error) {
+      if (extractOptimisticLockConflict(error)) {
+        onClose()
+        return
+      }
+      const message = error instanceof Error ? error.message.trim() : ''
+      flash(message || t('inbox_ops.flash.save_failed', 'Failed to save'), 'error')
+    } finally {
+      setIsSaving(false)
     }
-    setIsSaving(false)
   }, [action, payload, jsonMode, jsonText, t, onSaved, onClose, runMutation])
 
   React.useEffect(() => {
@@ -546,7 +551,7 @@ export function EditActionDialog({
                   setJsonError(null)
                 }}
               />
-              {jsonError && <p className="text-xs text-red-600">{t('inbox_ops.edit_dialog.invalid_json', 'Invalid JSON')}</p>}
+              {jsonError && <p className="text-xs text-status-error-text">{t('inbox_ops.edit_dialog.invalid_json', 'Invalid JSON')}</p>}
             </div>
           )}
 

package/src/modules/inbox_ops/components/proposals/types.ts

@@ -27,6 +27,7 @@ export type ActionDetail = {
   createdEntityType?: string
   executionError?: string
   executedAt?: string
+  updatedAt?: string
 }
 
 export type DiscrepancyDetail = {

package/src/modules/inbox_ops/i18n/de.json

@@ -162,6 +162,9 @@
   "inbox_ops.reply.send": "Antwort senden",
   "inbox_ops.reply.sending": "Wird gesendet...",
   "inbox_ops.reply.sent_success": "Antwort erfolgreich gesendet",
+  "inbox_ops.search.fallback.title": "Posteingang-Vorschlag",
+  "inbox_ops.search.subtitle.template": "Konfidenz: {{confidence}} · Status: {{status}}",
+  "inbox_ops.search.subtitle.templateWithCategory": "Konfidenz: {{confidence}} · Status: {{status}} · Kategorie: {{category}}",
   "inbox_ops.sender_unknown": "Unbekannt",
   "inbox_ops.settings.active": "Aktiv",
   "inbox_ops.settings.copied": "Kopiert",

package/src/modules/inbox_ops/i18n/en.json

@@ -162,6 +162,9 @@
   "inbox_ops.reply.send": "Send Reply",
   "inbox_ops.reply.sending": "Sending...",
   "inbox_ops.reply.sent_success": "Reply sent successfully",
+  "inbox_ops.search.fallback.title": "Inbox Proposal",
+  "inbox_ops.search.subtitle.template": "Confidence: {{confidence}} · Status: {{status}}",
+  "inbox_ops.search.subtitle.templateWithCategory": "Confidence: {{confidence}} · Status: {{status}} · Category: {{category}}",
   "inbox_ops.sender_unknown": "Unknown",
   "inbox_ops.settings.active": "Active",
   "inbox_ops.settings.copied": "Copied",

package/src/modules/inbox_ops/i18n/es.json

@@ -162,6 +162,9 @@
   "inbox_ops.reply.send": "Enviar respuesta",
   "inbox_ops.reply.sending": "Enviando...",
   "inbox_ops.reply.sent_success": "Respuesta enviada correctamente",
+  "inbox_ops.search.fallback.title": "Propuesta de bandeja",
+  "inbox_ops.search.subtitle.template": "Confianza: {{confidence}} · Estado: {{status}}",
+  "inbox_ops.search.subtitle.templateWithCategory": "Confianza: {{confidence}} · Estado: {{status}} · Categoría: {{category}}",
   "inbox_ops.sender_unknown": "Desconocido",
   "inbox_ops.settings.active": "Activo",
   "inbox_ops.settings.copied": "Copiado",