@open-mercato/core 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/src/modules/customers/lib/todoCompatibility.ts

@@ -78,17 +78,6 @@ export type CanonicalTodoListResult = {
   total: number
 }
 
-function emptyCanonicalTodoList(): CanonicalTodoListResult {
-  return { items: [], bridgeIds: new Set(), total: 0 }
-}
-
-function isCollapsedRestrictedOrganizationScope(
-  organizationIds: string[] | null | undefined,
-  isUnrestricted: boolean | undefined,
-): boolean {
-  return isUnrestricted !== true && (!organizationIds || organizationIds.length === 0)
-}
-
 export type ListTodosPagination = { page: number; pageSize: number }
 
 function resolveLegacyTodoSource(source: string | null | undefined): string {
@@ -388,11 +377,8 @@ export async function listLegacyTodoRows(
   tenantId: string,
   organizationIds: string[] | null,
   entityId: string | undefined,
-  options?: { limit?: number | null; isUnrestricted?: boolean },
+  options?: { limit?: number | null },
 ): Promise<CustomerTodoRow[]> {
-  if (isCollapsedRestrictedOrganizationScope(organizationIds, options?.isUnrestricted)) {
-    return []
-  }
   const where: Record<string, unknown> = { tenantId }
   if (organizationIds && organizationIds.length > 0) {
     where.organizationId = { $in: organizationIds }
@@ -439,12 +425,8 @@ export async function listCanonicalTodoRows(
     pagination?: ListTodosPagination | null
     searchText?: string | null
     limit?: number | null
-    isUnrestricted?: boolean
   },
 ): Promise<CanonicalTodoListResult> {
-  if (isCollapsedRestrictedOrganizationScope(organizationIds, options?.isUnrestricted)) {
-    return emptyCanonicalTodoList()
-  }
   const where: Record<string, unknown> = {
     tenantId: auth.tenantId,
     interactionType: 'task',

package/src/modules/dashboards/i18n/es.json

@@ -7,10 +7,10 @@
   "dashboards.analytics.comparison.vsLastWeek": "vs semana pasada",
   "dashboards.analytics.comparison.vsLastYear": "vs año pasado",
   "dashboards.analytics.comparison.vsMonthBefore": "vs mes anterior",
-  "dashboards.analytics.comparison.vsPrevious30Days": "vs 30 días anteriores",
-  "dashboards.analytics.comparison.vsPrevious7Days": "vs 7 días anteriores",
-  "dashboards.analytics.comparison.vsPrevious90Days": "vs 90 días anteriores",
-  "dashboards.analytics.comparison.vsPreviousPeriod": "vs período anterior",
+  "dashboards.analytics.comparison.vsPrevious30Days": "vs 30 dias anteriores",
+  "dashboards.analytics.comparison.vsPrevious7Days": "vs 7 dias anteriores",
+  "dashboards.analytics.comparison.vsPrevious90Days": "vs 90 dias anteriores",
+  "dashboards.analytics.comparison.vsPreviousPeriod": "vs periodo anterior",
   "dashboards.analytics.comparison.vsQuarterBefore": "vs trimestre anterior",
   "dashboards.analytics.comparison.vsWeekBefore": "vs semana anterior",
   "dashboards.analytics.comparison.vsYearBefore": "vs año anterior",

package/src/modules/dashboards/i18n/pl.json

@@ -2,18 +2,18 @@
   "dashboards.analytics.chartVariant.donut": "Pierścieniowy",
   "dashboards.analytics.chartVariant.pie": "Kołowy",
   "dashboards.analytics.comparison.vsDayBefore": "vs przedwczoraj",
-  "dashboards.analytics.comparison.vsLastMonth": "vs poprzedni miesiąc",
-  "dashboards.analytics.comparison.vsLastQuarter": "vs poprzedni kwartał",
-  "dashboards.analytics.comparison.vsLastWeek": "vs poprzedni tydzień",
+  "dashboards.analytics.comparison.vsLastMonth": "vs poprzedni miesiac",
+  "dashboards.analytics.comparison.vsLastQuarter": "vs poprzedni kwartal",
+  "dashboards.analytics.comparison.vsLastWeek": "vs poprzedni tydzien",
   "dashboards.analytics.comparison.vsLastYear": "vs poprzedni rok",
-  "dashboards.analytics.comparison.vsMonthBefore": "vs miesiąc wcześniej",
+  "dashboards.analytics.comparison.vsMonthBefore": "vs miesiac wczesniej",
   "dashboards.analytics.comparison.vsPrevious30Days": "vs poprzednie 30 dni",
   "dashboards.analytics.comparison.vsPrevious7Days": "vs poprzednie 7 dni",
   "dashboards.analytics.comparison.vsPrevious90Days": "vs poprzednie 90 dni",
   "dashboards.analytics.comparison.vsPreviousPeriod": "vs poprzedni okres",
-  "dashboards.analytics.comparison.vsQuarterBefore": "vs kwartał wcześniej",
-  "dashboards.analytics.comparison.vsWeekBefore": "vs tydzień wcześniej",
-  "dashboards.analytics.comparison.vsYearBefore": "vs rok wcześniej",
+  "dashboards.analytics.comparison.vsQuarterBefore": "vs kwartal wczesniej",
+  "dashboards.analytics.comparison.vsWeekBefore": "vs tydzien wczesniej",
+  "dashboards.analytics.comparison.vsYearBefore": "vs rok wczesniej",
   "dashboards.analytics.comparison.vsYesterday": "vs wczoraj",
   "dashboards.analytics.currency.unlabelled": "Kwoty pokazane bez waluty",
   "dashboards.analytics.currency.unlabelledHint": "Nie udało się wiarygodnie ustalić waluty, dlatego kwota jest wyświetlana bez jej oznaczenia.",

package/src/modules/dashboards/lib/widgetScope.ts

@@ -1,7 +1,6 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { createRequestContainer, type AppContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
-import { isUnrestrictedOrganizationScope } from '@open-mercato/shared/lib/auth/organizationAccess'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 
@@ -10,7 +9,6 @@ export type WidgetScopeContext = {
   em: EntityManager
   tenantId: string
   organizationIds: string[] | null
-  isUnrestrictedOrganizationScope?: boolean
 }
 
 function normalizeScopeId(value: string | null | undefined): string | null {
@@ -93,9 +91,5 @@ export async function resolveWidgetScope(
     em,
     tenantId,
     organizationIds,
-    isUnrestrictedOrganizationScope: isUnrestrictedOrganizationScope({
-      isSuperAdmin,
-      allowedOrganizationIds: scope?.allowedIds,
-    }),
   }
 }

package/src/modules/data_sync/AGENTS.md

@@ -206,7 +206,7 @@ If the sync provider needs bootstrap credentials, mappings, locales, channels, o
 - **Resetting an opt-out**: A reset flow that deletes the shared `SyncCursor` row MUST also call `syncRunService.resetResumePosition(integrationId, entityType, direction, scope)`. An opted-out entity type has no shared row to delete, so deleting only that leaves the resume position on the last interrupted run and the next incremental run re-imports just the tail of the walk it was reset against. The call is a no-op when nothing is interrupted, so make it unconditionally
 - **Resume**: Retry reads the last successful cursor, resumes from there
 - **Progress**: Linked to `ProgressJob` via `progressJobId` for `ProgressTopBar` display
-- **Cancellation**: The engine polls `progressService.isCancellationRequested()` in the batch handler AND on the heartbeat tick while a batch is still in flight, aborting `StreamImportInput.signal` / `StreamExportInput.signal`. Adapters SHOULD honour the signal wherever the work is divisible (per page, per record, around a long flush) and `return` — with the `return` ABOVE the `yield`, never below it, or the engine commits a cursor for a half-applied page. Adapters that ignore the signal keep the old between-batches behavior.
+- **Cancellation**: Via `progressService.isCancellationRequested()`
 - **Tracing**: The engine emits one **root** span per batch (`data_sync.import.batch` / `data_sync.export.batch`) linked back to the run, covering the adapter's read *and* the engine's bookkeeping. Adapters MUST NOT hand-roll their own batch span — they cannot root it, so a multi-day run would ride on the single sampling decision taken for the request that triggered it. Inner spans an adapter creates nest under the batch span normally. The final read — the one that finds the stream drained — is traced as `data_sync.import.drain` / `data_sync.export.drain`, so N batches emit exactly N `*.batch` spans plus one `*.drain`.
 - **Stream shape**: The engine drives the adapter's async iterator explicitly (`batch-stream.ts`) so the span wraps `next()`, where a generator does its real work before yielding. Closing follows the language's own `IteratorClose` rules, so `finally` blocks in an adapter generator behave exactly as under `for await`: no `return()` when the stream exhausts or `next()` throws (already closed), `return()` with its failure surfaced on an early stop, and `return()` with its failure swallowed when the engine's own handler threw (that error wins). Keep cleanup in `finally`.
 

package/src/modules/data_sync/backend/data-sync/page.tsx

@@ -74,7 +74,6 @@ type ResponsePayload = {
   total: number
   page: number
   totalPages: number
-  totalIsCapped?: boolean
 }
 
 type SyncOption = {
@@ -154,7 +153,6 @@ export default function SyncRunsDashboardPage() {
   const [page, setPage] = React.useState(1)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
-  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [search, setSearch] = React.useState('')
   const [filterValues, setFilterValues] = React.useState<FilterValues>({})
   const [isLoading, setIsLoading] = React.useState(true)
@@ -202,7 +200,6 @@ export default function SyncRunsDashboardPage() {
         setRows(Array.isArray(payload.items) ? payload.items : [])
         setTotal(payload.total || 0)
         setTotalPages(payload.totalPages || 1)
-        setTotalIsCapped(payload?.totalIsCapped === true)
         setIsLoading(false)
       }
     }
@@ -1068,7 +1065,7 @@ export default function SyncRunsDashboardPage() {
               }] : []),
             ]} />
           )}
-          pagination={{ page, pageSize: 20, total, totalPages, totalIsCapped, onPageChange: setPage }}
+          pagination={{ page, pageSize: 20, total, totalPages, onPageChange: setPage }}
           isLoading={isLoading}
         />
       </PageBody>

package/src/modules/data_sync/lib/adapter.ts

@@ -45,27 +45,6 @@ export interface StreamImportInput {
    * declares no parameters.
    */
   parameters?: Record<string, RunParameterValue>
-  /**
-   * Aborted when the run is cancelled, so an adapter can stop INSIDE a batch.
-   *
-   * The engine only gets to look at cancellation between batches — its check sits in the batch
-   * handler, which runs after the adapter has yielded. An adapter whose batch takes minutes (a
-   * whole-table walk over a slow link) therefore keeps working, keeps writing, and keeps its
-   * advisory lock for that whole time, however long ago the operator pressed Cancel.
-   *
-   * Honour it wherever the work is divisible — per page, per record, around a long flush — and just
-   * return: the generator's own `finally` runs, which is where a lock or a connection is released.
-   * Adapters that ignore it behave exactly as they do today.
-   *
-   * The `return` MUST sit ABOVE the `yield` for the page you abandoned, never below it. The engine
-   * commits `batch.cursor` for every batch it receives, so yielding a half-applied page advances the
-   * cursor past records that were never applied and no later run ever walks them again.
-   *
-   * The signal only reaches work running in THIS process. An adapter that hands part of a batch to
-   * other workers must give that work its own cancellation check against the same progress job —
-   * aborting here stops the generator, not anything already queued elsewhere.
-   */
-  signal?: AbortSignal
 }
 
 export interface ImportItem {
@@ -78,18 +57,6 @@ export interface ImportItem {
 export interface ImportBatch {
   items: ImportItem[]
   cursor: string
-  /**
-   * Whether the source has more to give after this batch. The final batch MUST report `false`.
-   *
-   * This is not advisory. The engine uses the last batch's value to tell a stream that DRAINED from
-   * one the adapter STOPPED EARLY on {@link StreamImportInput.signal}, because both end the same way
-   * — the generator simply returns. An adapter that reports `true` on its final batch will have a
-   * complete run misreported as `cancelled` whenever a cancel lands during the final read: the
-   * operator is told a finished sync was partial, and the run stays resumable with nothing left to
-   * resume.
-   *
-   * Derive it from the source rather than hardcoding it — `Boolean(nextPage)`, `offset < total`.
-   */
   hasMore: boolean
   totalEstimate?: number
   processedCount?: number
@@ -109,8 +76,6 @@ export interface StreamExportInput {
   runId?: string
   /** See {@link StreamImportInput.parameters}. */
   parameters?: Record<string, RunParameterValue>
-  /** Aborted when the run is cancelled — see {@link StreamImportInput.signal}. */
-  signal?: AbortSignal
 }
 
 export interface ExportItemResult {
@@ -123,7 +88,6 @@ export interface ExportItemResult {
 export interface ExportBatch {
   results: ExportItemResult[]
   cursor: string
-  /** Whether the source has more to give; the final batch MUST report `false`. See {@link ImportBatch.hasMore}. */
   hasMore: boolean
   batchIndex: number
 }

package/src/modules/data_sync/lib/sync-engine.ts

@@ -94,28 +94,12 @@ function applyExportCounters(batch: ExportBatch): SyncCounterDelta {
 }
 
 // Adapter batches can legitimately outlast the stale-job sweep window (slow upstream
-// APIs), so the engine must heartbeat while a batch is still being produced. The same
-// tick also polls cancellation, so a cancel lands within one interval instead of waiting
-// out the batch — sharing this timer rather than adding a second one that would double
-// the per-interval round-trips for the whole life of a run.
+// APIs), so the engine must heartbeat while a batch is still being produced.
 const HEARTBEAT_TICK_MS = (STALE_JOB_TIMEOUT_SECONDS * 1000) / 4
 
 // Runs `tick` on an interval only while the source iterator is pending, so heartbeats
 // stop the moment the producer dies and genuinely stale jobs still get swept. The outer
 // finally closes the adapter generator on early exits (cancellation, ownership conflict).
-// Our own abort, as opposed to a failure that merely coincided with one. Adapters are told to
-// return rather than throw, but `signal.throwIfAborted()` and an aborted `fetch` both surface as
-// this, and either is a cancellation rather than a fault.
-//
-// Matched structurally on `name` rather than with `instanceof Error`, because those two throw a
-// `DOMException`, and whether that inherits from `Error` depends on the runtime — it does under
-// bare Node 24 and does NOT under the jest environment this is tested in. An `instanceof` test
-// therefore passes or fails on where the code runs, which is not something cancellation should
-// depend on.
-function isAbortError(error: unknown): boolean {
-  return typeof error === 'object' && error !== null && (error as { name?: unknown }).name === 'AbortError'
-}
-
 async function* withHeartbeat<T>(source: AsyncIterable<T>, tick: () => void, intervalMs: number): AsyncGenerator<T, void, undefined> {
   const iterator = source[Symbol.asyncIterator]()
   try {
@@ -203,32 +187,6 @@ export function createSyncEngine(deps: EngineDeps) {
     }
   }
 
-  // Rides the heartbeat timer, which is the only thing that runs while the adapter is still
-  // producing a batch — the engine's own cancellation check sits in the batch handler and is
-  // reached only after a yield. Swallows its own errors because it runs on a timer, where an
-  // unhandled rejection is fatal, and stops polling once it has aborted.
-  function makeCancellationTick(progressJobId: string | null | undefined, scope: SyncScope, controller: AbortController): () => void {
-    if (!progressJobId) return () => {}
-    let inFlight = false
-    return () => {
-      if (inFlight || controller.signal.aborted) return
-      inFlight = true
-      progressService.isCancellationRequested(progressJobId, scope.tenantId, scope.organizationId)
-        .then((cancelled) => {
-          if (cancelled) controller.abort()
-        })
-        .catch((error) => {
-          logger.warn('Cancellation poll failed', {
-            progressJobId,
-            error: error instanceof Error ? error.message : String(error),
-          })
-        })
-        .finally(() => {
-          inFlight = false
-        })
-    }
-  }
-
   async function refreshCoverageSnapshots(entityTypes: string[] | undefined, scope: SyncScope): Promise<void> {
     if (!entityTypes || entityTypes.length === 0) return
 
@@ -601,17 +559,10 @@ export function createSyncEngine(deps: EngineDeps) {
       let processedCount = await seedProcessedCount(run.progressJobId, scope)
       let totalCount: number | null = null
       let committedBatches = activeRun.batchesCompleted ?? 0
-      // Whether the last committed batch said the source was exhausted. Distinguishes a stream that
-      // drained from one the adapter stopped early — see the post-stream finalize below.
-      let streamReportedDone = false
       // Captured while the triggering job's span is still the active one, so
       // every rooted batch trace can link back to it.
       const runTrace = captureTelemetryTrace()
       const spanAttributes = runSpanAttributes(run, providerKey, scope)
-      // Declared outside the try because both the catch and the completion path below read it.
-      const cancellation = new AbortController()
-      const heartbeat = makeHeartbeatTick(run.progressJobId, scope)
-      const pollCancellation = makeCancellationTick(run.progressJobId, scope, cancellation)
 
       try {
         const streamResult = await forEachBatch(
@@ -625,11 +576,8 @@ export function createSyncEngine(deps: EngineDeps) {
               scope: { organizationId: scope.organizationId, tenantId: scope.tenantId },
               runId: run.id,
               parameters: (run.parameters ?? {}) as RunParameters,
-              signal: cancellation.signal,
             }),
-            // `finally` so a synchronous throw from the heartbeat cannot also stop cancellation
-            // from being observed for the rest of the run.
-            () => { try { heartbeat() } finally { pollCancellation() } },
+            makeHeartbeatTick(run.progressJobId, scope),
             HEARTBEAT_TICK_MS,
           ),
           {
@@ -644,7 +592,7 @@ export function createSyncEngine(deps: EngineDeps) {
               'data_sync.batch_size': batch.items.length,
             })
 
-            if (cancellation.signal.aborted || (run.progressJobId && await progressService.isCancellationRequested(run.progressJobId, scope.tenantId, scope.organizationId))) {
+            if (run.progressJobId && await progressService.isCancellationRequested(run.progressJobId, scope.tenantId, scope.organizationId)) {
               await finalizeRun(run.id, 'cancelled', scope, undefined, operationalTelemetry)
               return 'stop'
             }
@@ -673,7 +621,6 @@ export function createSyncEngine(deps: EngineDeps) {
               { expectedBatchesCompleted: committedBatches, persistSharedCursor },
             )
             committedBatches += 1
-            streamReportedDone = batch.hasMore === false
 
             await updateProgress(run.progressJobId, processedCount, totalCount, scope)
             await refreshCoverageSnapshots(batch.refreshCoverageEntityTypes, scope)
@@ -710,15 +657,6 @@ export function createSyncEngine(deps: EngineDeps) {
           })
           return
         }
-        // An adapter that honours the signal may reject instead of returning, so our own abort is
-        // a cancellation rather than a fault — and must not leave an `error` entry in the
-        // integration log for a run the operator cancelled on purpose. Anything else that merely
-        // coincided with the cancel — a rejecting commit, an upstream 500 — is a genuine failure
-        // and keeps its log entry, its message, its `failed` status and its failed event.
-        if (cancellation.signal.aborted && isAbortError(error)) {
-          await finalizeRun(run.id, 'cancelled', scope, undefined, operationalTelemetry)
-          return
-        }
         const message = error instanceof Error ? error.message : 'Sync import failed'
         await integrationLogService.write(
           {
@@ -733,19 +671,6 @@ export function createSyncEngine(deps: EngineDeps) {
         return
       }
 
-      // An adapter that honours the signal stops mid-batch and returns WITHOUT yielding, so the
-      // batch handler — which owns the only other `cancelled` transition — never runs and the
-      // stream reports `completed`.
-      //
-      // `streamReportedDone` keeps that from swallowing a run that genuinely finished: an adapter
-      // that ignores the signal and drains after reporting `hasMore: false` delivered everything it
-      // had, even when the cancel landed during the final read. Calling that cancelled would tell
-      // the operator a complete sync was partial and leave a finished run resumable.
-      if (cancellation.signal.aborted && !streamReportedDone) {
-        await finalizeRun(run.id, 'cancelled', scope, undefined, operationalTelemetry)
-        return
-      }
-
       await finalizeRun(run.id, 'completed', scope, undefined, operationalTelemetry)
     },
 
@@ -828,17 +753,10 @@ export function createSyncEngine(deps: EngineDeps) {
       const mapping = await resolveMapping(adapter, run.entityType, scope)
       let processedCount = await seedProcessedCount(run.progressJobId, scope)
       let committedBatches = activeRun.batchesCompleted ?? 0
-      // Whether the last committed batch said the source was exhausted. Distinguishes a stream that
-      // drained from one the adapter stopped early — see the post-stream finalize below.
-      let streamReportedDone = false
       // Captured while the triggering job's span is still the active one, so
       // every rooted batch trace can link back to it.
       const runTrace = captureTelemetryTrace()
       const spanAttributes = runSpanAttributes(run, providerKey, scope)
-      // Declared outside the try because both the catch and the completion path below read it.
-      const cancellation = new AbortController()
-      const heartbeat = makeHeartbeatTick(run.progressJobId, scope)
-      const pollCancellation = makeCancellationTick(run.progressJobId, scope, cancellation)
 
       try {
         const streamResult = await forEachBatch(
@@ -852,11 +770,8 @@ export function createSyncEngine(deps: EngineDeps) {
               scope: { organizationId: scope.organizationId, tenantId: scope.tenantId },
               runId: run.id,
               parameters: (run.parameters ?? {}) as RunParameters,
-              signal: cancellation.signal,
             }),
-            // `finally` so a synchronous throw from the heartbeat cannot also stop cancellation
-            // from being observed for the rest of the run.
-            () => { try { heartbeat() } finally { pollCancellation() } },
+            makeHeartbeatTick(run.progressJobId, scope),
             HEARTBEAT_TICK_MS,
           ),
           {
@@ -871,7 +786,7 @@ export function createSyncEngine(deps: EngineDeps) {
               'data_sync.batch_size': batch.results.length,
             })
 
-            if (cancellation.signal.aborted || (run.progressJobId && await progressService.isCancellationRequested(run.progressJobId, scope.tenantId, scope.organizationId))) {
+            if (run.progressJobId && await progressService.isCancellationRequested(run.progressJobId, scope.tenantId, scope.organizationId)) {
               await finalizeRun(run.id, 'cancelled', scope, undefined, operationalTelemetry)
               return 'stop'
             }
@@ -900,7 +815,6 @@ export function createSyncEngine(deps: EngineDeps) {
               { expectedBatchesCompleted: committedBatches, persistSharedCursor },
             )
             committedBatches += 1
-            streamReportedDone = batch.hasMore === false
             await updateProgress(run.progressJobId, processedCount, null, scope)
             await logExportItemFailures(run.id, run.integrationId, batch.results, scope)
 
@@ -932,15 +846,6 @@ export function createSyncEngine(deps: EngineDeps) {
           })
           return
         }
-        // An adapter that honours the signal may reject instead of returning, so our own abort is
-        // a cancellation rather than a fault — and must not leave an `error` entry in the
-        // integration log for a run the operator cancelled on purpose. Anything else that merely
-        // coincided with the cancel — a rejecting commit, an upstream 500 — is a genuine failure
-        // and keeps its log entry, its message, its `failed` status and its failed event.
-        if (cancellation.signal.aborted && isAbortError(error)) {
-          await finalizeRun(run.id, 'cancelled', scope, undefined, operationalTelemetry)
-          return
-        }
         const message = error instanceof Error ? error.message : 'Sync export failed'
         await integrationLogService.write(
           {
@@ -955,19 +860,6 @@ export function createSyncEngine(deps: EngineDeps) {
         return
       }
 
-      // An adapter that honours the signal stops mid-batch and returns WITHOUT yielding, so the
-      // batch handler — which owns the only other `cancelled` transition — never runs and the
-      // stream reports `completed`.
-      //
-      // `streamReportedDone` keeps that from swallowing a run that genuinely finished: an adapter
-      // that ignores the signal and drains after reporting `hasMore: false` delivered everything it
-      // had, even when the cancel landed during the final read. Calling that cancelled would tell
-      // the operator a complete sync was partial and leave a finished run resumable.
-      if (cancellation.signal.aborted && !streamReportedDone) {
-        await finalizeRun(run.id, 'cancelled', scope, undefined, operationalTelemetry)
-        return
-      }
-
       await finalizeRun(run.id, 'completed', scope, undefined, operationalTelemetry)
     },
   }

package/src/modules/data_sync/workers/sync-export.ts

@@ -7,7 +7,6 @@ import {
   DATA_SYNC_LOCK_DURATION_MS,
   DATA_SYNC_MAX_STALLED_COUNT,
 } from '../lib/queue-policy'
-import { failAbandonedRun } from '../lib/abandoned-run'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('data_sync').child({ component: 'sync-export' })
@@ -28,9 +27,6 @@ export const metadata: WorkerMeta = {
   concurrency: 5,
   lockDuration: DATA_SYNC_LOCK_DURATION_MS,
   maxStalledCount: DATA_SYNC_MAX_STALLED_COUNT,
-  // Declared on the worker, not on the enqueueing queue: the abandonment this reports is a worker
-  // restart, and the process that restarts never constructs the producer's queue instance.
-  onJobAbandoned: failAbandonedRun,
 }
 
 type HandlerContext = JobContext & {

package/src/modules/data_sync/workers/sync-import.ts

@@ -7,7 +7,6 @@ import {
   DATA_SYNC_LOCK_DURATION_MS,
   DATA_SYNC_MAX_STALLED_COUNT,
 } from '../lib/queue-policy'
-import { failAbandonedRun } from '../lib/abandoned-run'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('data_sync').child({ component: 'sync-import' })
@@ -28,9 +27,6 @@ export const metadata: WorkerMeta = {
   concurrency: 5,
   lockDuration: DATA_SYNC_LOCK_DURATION_MS,
   maxStalledCount: DATA_SYNC_MAX_STALLED_COUNT,
-  // Declared on the worker, not on the enqueueing queue: the abandonment this reports is a worker
-  // restart, and the process that restarts never constructs the producer's queue instance.
-  onJobAbandoned: failAbandonedRun,
 }
 
 type HandlerContext = JobContext & {

package/src/modules/devices/AGENTS.md

@@ -23,14 +23,6 @@ delivery logic** (sender, providers, delivery rows, workers live in the `push_no
   — they carry undo snapshots, query-index side effects, and domain events.
 - Treat `push_token` as a secret: **never** include it in list/response field sets. Only
   `push_provider` and `push_token_updated_at` are exposed.
-- Serialize every GET response in **camelCase**, like every other module. The list routes run
-  `transformDeviceListItem` (`api/deviceList.ts`) over the query engine's raw projection and the admin
-  detail route uses `serializeDeviceDetail` (`api/deviceSerialization.ts`). Both also emit the legacy
-  snake_case keys as **deprecated aliases** via `toDeprecatedSnakeCaseAliases`, kept for one minor
-  version per `BACKWARD_COMPATIBILITY.md` § 7 and pinned by `TC-DEV-007`; when the bridge is dropped,
-  remove the alias spread from those two functions and the deprecated keys from `deviceListItemSchema`
-  / `deviceDetailItemSchema`. Adding a column means adding it to `deviceListFields`, the transform, and
-  the schemas. See `.ai/specs/2026-08-24-devices-api-camelcase-responses.md` (#5513).
 - Honor the `pushToken` tri-state on `PUT`: absent key = leave unchanged; explicit `null` = clear
   (revoked OS permission) and bump `push_token_updated_at`. The command uses own-property presence.
 - Keep the list route's CRUD cache tag aligned with the command's `resourceKind`. The list reads
@@ -97,20 +89,9 @@ write busts both caches (see cache-tag note above).
 ## ACL
 
 `devices.view`, `devices.manage` (self-serve), `devices.admin` (cross-user). Defaults in `setup.ts`:
-`superadmin`/`admin` get `devices.*` **plus `auth.users.list`**; `employee` gets `view` + `manage`. Run
+`superadmin`/`admin` get `devices.*`; `employee` gets `view` + `manage`. Run
 `yarn mercato auth sync-role-acls` after changing `acl.ts`/`setup.ts` to backfill existing tenants.
 
-`devices.admin` declares `dependsOn: ['auth.users.list']`: the admin screens name owners by person,
-and the register form's owner picker rejects values that do not resolve to a directory entry, so a
-role holding `devices.admin` without the dependency cannot complete that form. `dependsOn` only
-surfaces the gap in the ACL editor — it does not grant. Run the sync command above after deploying
-an ACL change here.
-
-The picker is `allowCustomValues: false`. That rejects free text and an id belonging to nobody; it
-does **not** reject a raw id that is already a known option, because `ComboboxInput` matches on
-`option.value` and `CrudForm` keeps the unfiltered first page as suggestions for the form's
-lifetime. Either way the submitted value is a real user in the caller's scope.
-
 ## Validation Commands
 
 ```bash

package/src/modules/devices/acl.ts

@@ -1,15 +1,7 @@
 export const features = [
   { id: 'devices.view', title: 'View own devices', module: 'devices' },
   { id: 'devices.manage', title: 'Manage own devices', module: 'devices' },
-  {
-    id: 'devices.admin',
-    title: 'Manage devices across users',
-    module: 'devices',
-    // Managing devices across users means naming the owner, and the admin screens name them by
-    // person rather than by UUID: the register form's owner picker and the owner column on both
-    // list and detail resolve through `GET /api/auth/users`, which `auth.users.list` gates.
-    dependsOn: ['auth.users.list'],
-  },
+  { id: 'devices.admin', title: 'Manage devices across users', module: 'devices' },
 ]
 
 export default features

package/src/modules/devices/api/admin/devices/[id]/route.ts

@@ -15,8 +15,6 @@ import { updateDeviceSchema } from '../../../../data/validators'
 import { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
 import { resolveDeviceActorUserId } from '../../../auth'
 import { executeUpdate, executeDeactivate, type DeviceMutationContext } from '../../../deviceOps'
-import { serializeDeviceDetail, deviceDetailItemSchema } from '../../../deviceSerialization'
-import { DEPRECATED_SNAKE_CASE_NOTICE } from '../../../openapi'
 
 const logger = createLogger('devices')
 
@@ -40,6 +38,23 @@ async function loadDevice(
   return findOneWithDecryption(em, UserDevice, { id, tenantId, deletedAt: null }, undefined, { tenantId })
 }
 
+// push_token is a secret and is never returned.
+function serializeDevice(device: UserDevice) {
+  return {
+    id: device.id,
+    user_id: device.userId,
+    device_id: device.deviceId,
+    platform: device.platform,
+    client_app_version: device.clientAppVersion ?? null,
+    os_version: device.osVersion ?? null,
+    push_provider: device.pushProvider ?? null,
+    push_token_updated_at: device.pushTokenUpdatedAt ? device.pushTokenUpdatedAt.toISOString() : null,
+    last_seen_at: device.lastSeenAt ? device.lastSeenAt.toISOString() : null,
+    created_at: device.createdAt ? device.createdAt.toISOString() : null,
+    updated_at: device.updatedAt ? device.updatedAt.toISOString() : null,
+  }
+}
+
 export async function GET(req: Request, { params }: { params: { id: string } }) {
   const { translate } = await resolveTranslations()
   try {
@@ -61,7 +76,7 @@ export async function GET(req: Request, { params }: { params: { id: string } })
     if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: device.organizationId ?? null })) {
       return NextResponse.json({ error: translate('devices.errors.forbidden', 'Access denied') }, { status: 403 })
     }
-    return NextResponse.json({ item: serializeDeviceDetail(device) })
+    return NextResponse.json({ item: serializeDevice(device) })
   } catch (err) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
@@ -162,7 +177,21 @@ export async function DELETE(req: Request, { params }: { params: { id: string }
 
 const okResponseSchema = z.object({ ok: z.literal(true), id: z.string().uuid().optional() })
 const errorResponseSchema = z.object({ error: z.string() })
-const detailResponseSchema = z.object({ item: deviceDetailItemSchema })
+const detailResponseSchema = z.object({
+  item: z.object({
+    id: z.string().uuid(),
+    user_id: z.string().uuid(),
+    device_id: z.string(),
+    platform: z.enum(['ios', 'android', 'web']),
+    client_app_version: z.string().nullable(),
+    os_version: z.string().nullable(),
+    push_provider: z.string().nullable(),
+    push_token_updated_at: z.string().nullable(),
+    last_seen_at: z.string().nullable(),
+    created_at: z.string().nullable(),
+    updated_at: z.string().nullable(),
+  }),
+})
 
 export const openApi: OpenApiRouteDoc = {
   tag: 'Devices (admin)',
@@ -170,7 +199,7 @@ export const openApi: OpenApiRouteDoc = {
   methods: {
     GET: {
       summary: 'Get any device',
-      description: `Admin: fetch a single device by id (push_token is never returned). ${DEPRECATED_SNAKE_CASE_NOTICE}`,
+      description: 'Admin: fetch a single device by id (push_token is never returned).',
       responses: [{ status: 200, description: 'Device', schema: detailResponseSchema }],
       errors: [
         { status: 400, description: 'Invalid id', schema: errorResponseSchema },

package/src/modules/devices/api/admin/devices/route.ts

@@ -2,7 +2,6 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
-import { toHeaderLabel } from '@open-mercato/shared/lib/crud/exporters'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
@@ -22,14 +21,7 @@ import {
 } from '../../../data/validators'
 import { resolveDeviceActorUserId } from '../../auth'
 import { createDevicesCrudOpenApi, createPagedListResponseSchema } from '../../openapi'
-import {
-  deviceListSchema,
-  deviceListFields,
-  deviceListSortFieldMap,
-  deviceListItemSchema,
-  deviceExportColumnFields,
-  transformDeviceListItem,
-} from '../../deviceList'
+import { deviceListSchema, deviceListFields, deviceListSortFieldMap, deviceListItemSchema } from '../../deviceList'
 import { executeRegister, type DeviceMutationContext } from '../../deviceOps'
 
 const logger = createLogger('devices')
@@ -63,11 +55,6 @@ const crud = makeCrudRoute({
     entityId: E.devices.user_device,
     fields: deviceListFields,
     sortFieldMap: deviceListSortFieldMap,
-    // The query engine projects raw column names; expose them in camelCase like every other module.
-    transformItem: transformDeviceListItem,
-    // Without an explicit column set the factory's default export spreads each item, so the deprecated
-    // snake_case aliases would double every column in the CSV/JSON/XML export.
-    export: { columns: deviceExportColumnFields.map((field) => ({ field, header: toHeaderLabel(field) })) },
     // Tenant + org scope is enforced by the factory (orm.tenantField + orm.orgField); only the optional
     // userId/platform narrowing is left to do here.
     buildFilters: async (query) => {