@open-mercato/core 0.7.1-develop.7153.1.7145d295e6 → 0.7.1-develop.7170.1.d95074d7ba

package/src/modules/entities/lib/validation.ts

@@ -1,6 +1,6 @@
 import type { EntityManager } from '@mikro-orm/core'
-import { CustomFieldDef } from '../data/entities'
 import { validateValuesAgainstDefs } from '@open-mercato/shared/modules/entities/validation'
+import { loadScopedCustomFieldDefs } from './scoped-field-defs'
 
 export async function validateCustomFieldValuesServer(
   em: EntityManager,
@@ -12,51 +12,11 @@ export async function validateCustomFieldValuesServer(
     rejectUndeclaredKeys?: boolean
   },
 ): Promise<{ ok: boolean; fieldErrors: Record<string, string> }> {
-  const organizationId = opts.organizationId ?? null
-  const tenantId = opts.tenantId ?? null
-  const defs = await em.find(CustomFieldDef, {
+  const byKey = await loadScopedCustomFieldDefs(em, {
     entityId: opts.entityId,
-    isActive: true,
-    deletedAt: null,
-    $and: [
-      {
-        $or: organizationId === null
-          ? [{ organizationId: null }]
-          : [{ organizationId }, { organizationId: null }],
-      },
-      {
-        $or: tenantId === null
-          ? [{ tenantId: null }]
-          : [{ tenantId }, { tenantId: null }],
-      },
-    ],
-  } as any)
-
-  // Prefer the most specific scope and newest definition for duplicate keys.
-  const scopeScore = (def: CustomFieldDef) => (def.tenantId ? 2 : 0) + (def.organizationId ? 1 : 0)
-  const byKey = new Map<string, CustomFieldDef>()
-  for (const d of defs) {
-    const existing = byKey.get(d.key)
-    if (!existing) {
-      byKey.set(d.key, d)
-      continue
-    }
-    const nextScore = scopeScore(d)
-    const existingScore = scopeScore(existing)
-    if (nextScore > existingScore) {
-      byKey.set(d.key, d)
-      continue
-    }
-    if (nextScore < existingScore) continue
-
-    const nextUpdatedAt = d.updatedAt instanceof Date ? d.updatedAt.getTime() : new Date(d.updatedAt).getTime()
-    const existingUpdatedAt = existing.updatedAt instanceof Date
-      ? existing.updatedAt.getTime()
-      : new Date(existing.updatedAt).getTime()
-    if (nextUpdatedAt >= existingUpdatedAt) {
-      byKey.set(d.key, d)
-    }
-  }
+    organizationId: opts.organizationId,
+    tenantId: opts.tenantId,
+  })
   return validateValuesAgainstDefs(opts.values, Array.from(byKey.values()) as any, {
     rejectUndeclaredKeys: opts.rejectUndeclaredKeys === true,
   })

package/src/modules/integrations/backend/integrations/[id]/page.tsx

@@ -1,7 +1,7 @@
 "use client"
 import * as React from 'react'
 import { extensionPoints } from '@open-mercato/core/modules/integrations/extension-points'
-import { usePathname, useRouter, useSearchParams } from 'next/navigation'
+import { useRouter, useSearchParams } from 'next/navigation'
 import { z } from 'zod'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { CrudForm, type CrudField } from '@open-mercato/ui/backend/CrudForm'
@@ -139,7 +139,7 @@ type LogEntry = {
 
 type IntegrationDetailPageProps = {
   params?: {
-    id?: string | string[]
+    id?: string
   }
 }
 
@@ -289,18 +289,6 @@ const CATEGORY_ICONS: Record<string, React.ElementType> = {
   webhook: Webhook,
 }
 
-function resolveRouteId(value: string | string[] | undefined): string | undefined {
-  if (Array.isArray(value)) return value[0]
-  return value
-}
-
-function resolvePathnameId(pathname: string): string | undefined {
-  const parts = pathname.split('/').filter(Boolean)
-  const integrationId = parts.at(-1)
-  if (!integrationId || integrationId === 'integrations' || integrationId === 'bundle') return undefined
-  return decodeURIComponent(integrationId)
-}
-
 function buildCredentialFields(
   credFields: CredentialField[],
   secretFieldsConfigured: SecretFieldsConfigured,
@@ -439,10 +427,9 @@ function splitLogPayload(payload: Record<string, unknown> | null | undefined) {
 }
 
 export default function IntegrationDetailPage({ params }: IntegrationDetailPageProps) {
-  const pathname = usePathname()
   const router = useRouter()
   const searchParams = useSearchParams()
-  const integrationId = resolveRouteId(params?.id) ?? resolvePathnameId(pathname)
+  const integrationId = params?.id
   const t = useT()
 
   const [detail, setDetail] = React.useState<IntegrationDetail | null>(null)
@@ -474,18 +461,9 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
     canManageCredentials,
   } = useIntegrationCredentialsFeatureAccess()
 
-  const resolveCurrentIntegrationId = React.useCallback(() => {
-    return integrationId ?? (
-      typeof window !== 'undefined'
-        ? resolvePathnameId(window.location.pathname)
-        : undefined
-    )
-  }, [integrationId])
-
   const loadDetail = React.useCallback(async (options?: { showLoading?: boolean }) => {
     const showLoading = options?.showLoading ?? true
-    const currentIntegrationId = resolveCurrentIntegrationId()
-    if (!currentIntegrationId) {
+    if (!integrationId) {
       if (showLoading) setIsLoading(false)
       if (showLoading) setError(t('integrations.detail.loadError', 'Failed to load integration'))
       return
@@ -495,7 +473,7 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
     if (showLoading) setIsLoading(true)
     try {
       const call = await apiCall<IntegrationDetail>(
-        `/api/integrations/${encodeURIComponent(currentIntegrationId)}`,
+        `/api/integrations/${encodeURIComponent(integrationId)}`,
         undefined,
         { fallback: null },
       )
@@ -515,17 +493,16 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
       if (showLoading) setError(t('integrations.detail.loadError', 'Failed to load integration'))
       if (showLoading) setIsLoading(false)
     }
-  }, [resolveCurrentIntegrationId, t])
+  }, [integrationId, t])
 
   const loadCredentials = React.useCallback(async () => {
-    const currentIntegrationId = resolveCurrentIntegrationId()
-    if (!currentIntegrationId) return
+    if (!integrationId) return
     const call = await apiCall<{
       credentials: Record<string, unknown>
       secretFieldsConfigured?: SecretFieldsConfigured
       updatedAt?: string | null
     }>(
-      `/api/integrations/${encodeURIComponent(currentIntegrationId)}/credentials`,
+      `/api/integrations/${encodeURIComponent(integrationId)}/credentials`,
       { headers: credentialsRequestHeaders },
       { fallback: null },
     )
@@ -535,7 +512,7 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
     }
     if (call.ok && call.result?.credentials) {
       const next = { ...call.result.credentials }
-      if (currentIntegrationId === 'storage_s3') {
+      if (integrationId === 'storage_s3') {
         const authMode = next.authMode
         if (authMode !== 'access_keys' && authMode !== 'ambient') {
           const hasKeys = Boolean(next.accessKeyId || next.secretAccessKey)
@@ -545,13 +522,12 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
       setCredValues(next)
       setCredentialsFormKey((current) => current + 1)
     }
-  }, [resolveCurrentIntegrationId])
+  }, [integrationId])
 
   const loadLogs = React.useCallback(async () => {
-    const currentIntegrationId = resolveCurrentIntegrationId()
-    if (!currentIntegrationId) return
+    if (!integrationId) return
     setIsLoadingLogs(true)
-    const params = new URLSearchParams({ integrationId: currentIntegrationId, pageSize: '50' })
+    const params = new URLSearchParams({ integrationId, pageSize: '50' })
     if (logLevel) params.set('level', logLevel)
     const call = await apiCall<{ items: LogEntry[] }>(
       `/api/integrations/logs?${params.toString()}`,
@@ -562,7 +538,7 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
       setLogs(call.result.items)
     }
     setIsLoadingLogs(false)
-  }, [logLevel, resolveCurrentIntegrationId])
+  }, [logLevel, integrationId])
 
   const detailWidgetSpotId = React.useMemo(
     () => resolveIntegrationDetailWidgetSpotId(detail?.integration ?? null, extensionPoints.hosts.legacyDetailTabs.spotId),
@@ -706,16 +682,15 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
   React.useEffect(() => { void loadLogs() }, [loadLogs])
 
   const handleToggleState = React.useCallback(async (enabled: boolean) => {
-    const currentIntegrationId = resolveCurrentIntegrationId()
-    if (!currentIntegrationId) return
+    if (!integrationId) return
     setIsTogglingState(true)
     try {
       const call = await runMutationWithContext({
         actionId: 'toggle-state',
-        mutationPayload: { integrationId: currentIntegrationId, isEnabled: enabled },
+        mutationPayload: { integrationId, isEnabled: enabled },
         operation: () => withScopedApiRequestHeaders(
           buildOptimisticLockHeader(detail?.state.updatedAt),
-          () => apiCall(`/api/integrations/${encodeURIComponent(currentIntegrationId)}/state`, {
+          () => apiCall(`/api/integrations/${encodeURIComponent(integrationId)}/state`, {
             method: 'PUT',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ isEnabled: enabled }),
@@ -741,11 +716,10 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
     } finally {
       setIsTogglingState(false)
     }
-  }, [detail?.state.updatedAt, refreshDetail, resolveCurrentIntegrationId, runMutationWithContext, t])
+  }, [detail?.state.updatedAt, refreshDetail, integrationId, runMutationWithContext, t])
 
   const handleSaveCredentials = React.useCallback(async (values: Record<string, unknown>) => {
-    const currentIntegrationId = resolveCurrentIntegrationId()
-    if (!currentIntegrationId) return
+    if (!integrationId) return
     setIsSavingCredentials(true)
     try {
       const credentialFields = (
@@ -754,7 +728,7 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
         ?? []
       )
       const savePayload = buildIntegrationCredentialSavePayload(
-        currentIntegrationId,
+        integrationId,
         values,
         credentialFields,
         secretFieldsConfigured,
@@ -762,10 +736,10 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
       const call = await runMutationWithContext({
         actionId: 'save-credentials',
         tabId: 'credentials',
-        mutationPayload: { integrationId: currentIntegrationId, ...savePayload },
+        mutationPayload: { integrationId, ...savePayload },
         operation: () => withScopedApiRequestHeaders(
           buildOptimisticLockHeader(credentialsUpdatedAt),
-          () => apiCall(`/api/integrations/${encodeURIComponent(currentIntegrationId)}/credentials`, {
+          () => apiCall(`/api/integrations/${encodeURIComponent(integrationId)}/credentials`, {
             method: 'PUT',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(savePayload),
@@ -791,19 +765,18 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
     } finally {
       setIsSavingCredentials(false)
     }
-  }, [credentialsUpdatedAt, detail, loadCredentials, resolveCurrentIntegrationId, runMutationWithContext, secretFieldsConfigured, t])
+  }, [credentialsUpdatedAt, detail, loadCredentials, integrationId, runMutationWithContext, secretFieldsConfigured, t])
 
   const handleVersionChange = React.useCallback(async (version: string) => {
-    const currentIntegrationId = resolveCurrentIntegrationId()
-    if (!currentIntegrationId) return
+    if (!integrationId) return
     try {
       const call = await runMutationWithContext({
         actionId: 'change-version',
         tabId: 'version',
-        mutationPayload: { integrationId: currentIntegrationId, apiVersion: version },
+        mutationPayload: { integrationId, apiVersion: version },
         operation: () => withScopedApiRequestHeaders(
           buildOptimisticLockHeader(detail?.state.updatedAt),
-          () => apiCall(`/api/integrations/${encodeURIComponent(currentIntegrationId)}/version`, {
+          () => apiCall(`/api/integrations/${encodeURIComponent(integrationId)}/version`, {
             method: 'PUT',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ apiVersion: version }),
@@ -820,19 +793,18 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
     } catch {
       flash(t('integrations.detail.version.saveError'), 'error')
     }
-  }, [detail?.state.updatedAt, refreshDetail, resolveCurrentIntegrationId, runMutationWithContext, t])
+  }, [detail?.state.updatedAt, refreshDetail, integrationId, runMutationWithContext, t])
 
   const handleHealthCheck = React.useCallback(async () => {
-    const currentIntegrationId = resolveCurrentIntegrationId()
-    if (!currentIntegrationId) return
+    if (!integrationId) return
     setIsCheckingHealth(true)
     try {
       const call = await runMutationWithContext({
         actionId: 'run-health-check',
         tabId: 'health',
-        mutationPayload: { integrationId: currentIntegrationId },
+        mutationPayload: { integrationId },
         operation: () => apiCall<HealthCheckResponse>(
-          `/api/integrations/${encodeURIComponent(currentIntegrationId)}/health`,
+          `/api/integrations/${encodeURIComponent(integrationId)}/health`,
           { method: 'POST' },
           { fallback: null },
         ),
@@ -859,7 +831,7 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
     } finally {
       setIsCheckingHealth(false)
     }
-  }, [refreshLogs, resolveCurrentIntegrationId, runMutationWithContext, t])
+  }, [refreshLogs, integrationId, runMutationWithContext, t])
 
   const hasVersions = Boolean(detail?.integration.apiVersions?.length)
   const integration = detail?.integration ?? null
@@ -1052,17 +1024,16 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
   }, [searchParams, visibleTabIds])
 
   const handleTabChange = React.useCallback((nextValue: string) => {
-    const currentIntegrationId = resolveCurrentIntegrationId()
     const nextTab = resolveRequestedIntegrationDetailTab(nextValue, visibleTabIds)
     setActiveTab(nextTab)
-    if (!currentIntegrationId) return
-    const basePath = `/backend/integrations/${encodeURIComponent(currentIntegrationId)}`
+    if (!integrationId) return
+    const basePath = `/backend/integrations/${encodeURIComponent(integrationId)}`
     const params = new URLSearchParams(searchParams?.toString() ?? '')
     if (nextTab === 'credentials') params.delete('tab')
     else params.set('tab', nextTab)
     const query = params.toString()
     router.replace(query ? `${basePath}?${query}` : basePath)
-  }, [resolveCurrentIntegrationId, router, searchParams, visibleTabIds])
+  }, [integrationId, router, searchParams, visibleTabIds])
 
   React.useEffect(() => {
     if (!runIdFromUrl) {

package/src/modules/integrations/backend/integrations/bundle/[id]/page.tsx

@@ -1,7 +1,6 @@
 "use client"
 import * as React from 'react'
 import Link from 'next/link'
-import { usePathname } from 'next/navigation'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { Card, CardHeader, CardTitle, CardContent } from '@open-mercato/ui/primitives/card'
 import { Badge } from '@open-mercato/ui/primitives/badge'
@@ -68,25 +67,12 @@ type BundleDetail = {
 
 type BundleConfigPageProps = {
   params?: {
-    id?: string | string[]
+    id?: string
   }
 }
 
-function resolveRouteId(value: string | string[] | undefined): string | undefined {
-  if (Array.isArray(value)) return value[0]
-  return value
-}
-
-function resolvePathnameId(pathname: string): string | undefined {
-  const parts = pathname.split('/').filter(Boolean)
-  const bundleId = parts.at(-1)
-  if (!bundleId || bundleId === 'bundle' || bundleId === 'integrations') return undefined
-  return decodeURIComponent(bundleId)
-}
-
 export default function BundleConfigPage({ params }: BundleConfigPageProps) {
-  const pathname = usePathname()
-  const bundleId = resolveRouteId(params?.id) ?? resolvePathnameId(pathname)
+  const bundleId = params?.id
   const t = useT()
 
   const [detail, setDetail] = React.useState<BundleDetail | null>(null)
@@ -107,17 +93,8 @@ export default function BundleConfigPage({ params }: BundleConfigPageProps) {
     contextId: mutationContextId,
   })
 
-  const resolveCurrentBundleId = React.useCallback(() => {
-    return bundleId ?? (
-      typeof window !== 'undefined'
-        ? resolvePathnameId(window.location.pathname)
-        : undefined
-    )
-  }, [bundleId])
-
   const load = React.useCallback(async () => {
-    const currentBundleId = resolveCurrentBundleId()
-    if (!currentBundleId) {
+    if (!bundleId) {
       setError(t('integrations.detail.loadError'))
       setIsLoading(false)
       return
@@ -126,7 +103,7 @@ export default function BundleConfigPage({ params }: BundleConfigPageProps) {
     setError(null)
     setIsNotFound(false)
     const call = await apiCall<BundleDetail>(
-      `/api/integrations/${encodeURIComponent(currentBundleId)}`,
+      `/api/integrations/${encodeURIComponent(bundleId)}`,
       undefined,
       { fallback: null },
     )
@@ -146,7 +123,7 @@ export default function BundleConfigPage({ params }: BundleConfigPageProps) {
       secretFieldsConfigured?: SecretFieldsConfigured
       updatedAt?: string | null
     }>(
-      `/api/integrations/${encodeURIComponent(currentBundleId)}/credentials`,
+      `/api/integrations/${encodeURIComponent(bundleId)}/credentials`,
       undefined,
       { fallback: null },
     )
@@ -156,7 +133,7 @@ export default function BundleConfigPage({ params }: BundleConfigPageProps) {
     }
     if (credCall.ok && credCall.result?.credentials) {
       const next = { ...credCall.result.credentials }
-      if (currentBundleId === 'storage_s3') {
+      if (bundleId === 'storage_s3') {
         const authMode = next.authMode
         if (authMode !== 'access_keys' && authMode !== 'ambient') {
           const hasKeys = Boolean(next.accessKeyId || next.secretAccessKey)
@@ -169,13 +146,12 @@ export default function BundleConfigPage({ params }: BundleConfigPageProps) {
       ))
     }
     setIsLoading(false)
-  }, [resolveCurrentBundleId, t])
+  }, [bundleId, t])
 
   React.useEffect(() => { void load() }, [load])
 
   const handleSaveCredentials = React.useCallback(async () => {
-    const currentBundleId = resolveCurrentBundleId()
-    if (!currentBundleId) return
+    if (!bundleId) return
     setIsSavingCreds(true)
     try {
       const savePayload = buildCredentialSavePayload(
@@ -184,19 +160,19 @@ export default function BundleConfigPage({ params }: BundleConfigPageProps) {
         secretFieldsConfigured,
       )
       const call = await runMutation({
-        mutationPayload: { bundleId: currentBundleId, ...savePayload },
+        mutationPayload: { bundleId, ...savePayload },
         context: {
           formId: mutationContextId,
           operation: 'update',
           actionId: 'save-credentials',
           resourceKind: 'integrations.bundle',
-          resourceId: currentBundleId,
-          bundleId: currentBundleId,
+          resourceId: bundleId,
+          bundleId,
           retryLastMutation,
         },
         operation: () => withScopedApiRequestHeaders(
           buildOptimisticLockHeader(credentialsUpdatedAt),
-          () => apiCall(`/api/integrations/${encodeURIComponent(currentBundleId)}/credentials`, {
+          () => apiCall(`/api/integrations/${encodeURIComponent(bundleId)}/credentials`, {
             method: 'PUT',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(savePayload),
@@ -214,7 +190,7 @@ export default function BundleConfigPage({ params }: BundleConfigPageProps) {
     } finally {
       setIsSavingCreds(false)
     }
-  }, [resolveCurrentBundleId, runMutation, mutationContextId, retryLastMutation, credValues, credentialsUpdatedAt, detail?.bundle?.credentials?.fields, load, secretFieldsConfigured, t])
+  }, [bundleId, runMutation, mutationContextId, retryLastMutation, credValues, credentialsUpdatedAt, detail?.bundle?.credentials?.fields, load, secretFieldsConfigured, t])
 
   const handleToggle = React.useCallback(async (integrationId: string, enabled: boolean, updatedAt?: string | null) => {
     setTogglingIds((prev) => new Set(prev).add(integrationId))

package/src/modules/notifications/backend/profile/notification-preferences/page.meta.ts

@@ -19,8 +19,8 @@ export const metadata = {
   requireFeatures: ['notifications.manage_preferences'],
   pageTitle: 'Notification Preferences',
   pageTitleKey: 'notifications.preferences.pageTitle',
-  pageGroup: 'Profile',
-  pageGroupKey: 'notifications.preferences.profileGroup',
+  pageGroup: 'Account',
+  pageGroupKey: 'profile.sections.account',
   pageOrder: 30,
   icon: slidersIcon,
   pageContext: 'profile' as const,

package/src/modules/progress/AGENTS.md

@@ -93,7 +93,7 @@ Use stable, grep-friendly ids:
 `progressService` is safe to run across many app/worker instances. Do not reintroduce read-modify-write transitions:
 
 - **Every status transition is a status-guarded `nativeUpdate` (CAS).** An update that matches zero rows lost the race — it MUST NOT emit events or overwrite the row. Allowed transitions: start from `pending|failed` (an already-running start is an idempotent no-op; `failed` allows queue retries and recovery from a wrong stale sweep), complete from `pending|running|failed`, fail from `pending|running`, cancel from `pending|running|failed`.
-- **Progress writes are guarded on `status IN ('pending','running')`** — once another process finishes/cancels a job, buffered updaters stop writing to it. Exception: when a write path finds the job `failed`, it attempts exactly one revival through the start CAS (a live producer writing progress proves a stale sweep false-positived) before giving up. That revive CAS is narrowed to rows whose `errorMessage` starts with `STALE_SWEEP_ERROR_PREFIX`, so a job that failed for a real reason keeps its message and stack instead of being resurrected by a racing buffered writer; `completed`/`cancelled` are never revived, and genuinely dead producers never write again, so real sweeps stick. Only `startJob` uses the unrestricted CAS, because a queue retry restarts the whole unit of work. A revive never resets `startedAt` — progress counts are absolute across deliveries, so the elapsed window `calculateEta` divides them by must be too.
+- **Progress writes are guarded on `status IN ('pending','running')`** — once another process finishes/cancels a job, buffered updaters stop writing to it. Exception: when a write path finds the job `failed`, it attempts exactly one revival through the start CAS (a live producer writing progress proves a stale sweep false-positived) before giving up. That revive CAS is narrowed to rows whose `errorMessage` starts with `STALE_SWEEP_ERROR_PREFIX`, so a job that failed for a real reason keeps its message and stack instead of being resurrected by a racing buffered writer; `completed`/`cancelled` are never revived, and genuinely dead producers never write again, so real sweeps stick. Only `startJob` uses the unrestricted CAS, because a queue retry restarts the whole unit of work. A revive never resets `startedAt` — progress counts are absolute across deliveries, so the elapsed window `calculateEta` divides them by must be too. A **zero-row revive CAS is not automatically the end of the write**: when the cached status is `failed` and the CAS misses, `incrementProgress` re-reads the row once, and adopts it as the throttle entry's snapshot if it came back writable — the miss usually means another writer (typically `touchJobHeartbeat`'s forked revive) already flipped the row to `running`, and a relative increment dropped there is unrecoverable.
 - **Long single units of work MUST call `touchJobHeartbeat`** — when one batch/step can outlast `STALE_JOB_TIMEOUT_SECONDS` (60s), run a keepalive that calls the optional `touchJobHeartbeat(jobId, ctx)` while awaiting it (see `withHeartbeat` in `data_sync/lib/sync-engine.ts`). It writes only `heartbeat_at`/`updated_at` on a **forked** EntityManager, so it is safe while the producer's own EM is mid-transaction, and it self-heals a falsely-swept job via the start CAS. Always optional-chain it (`progressService.touchJobHeartbeat?.(...)`) — third-party implementations may not provide it. The "no timers for durable work" rule below bans replacing queue delivery with timers, not an in-process keepalive around a pending await.
 - **`incrementProgress` deltas persist as atomic SQL increments** (`processed_count + n`), and the service reloads the database winner before returning or emitting, so concurrent writers never lose or report stale counts.
 - **Update-path reads use `disableIdentityMap: true`** — `isCancellationRequested` and lifecycle reads must always see fresh cross-process state, never a stale managed entity.

package/src/modules/progress/lib/progressServiceImpl.ts

@@ -363,10 +363,33 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
 
     async incrementProgress(jobId, delta, ctx) {
       const entry = await ensureThrottleEntry(jobId, ctx)
-      const job = entry.job
+      let job = entry.job
       if (TERMINAL_STATUSES.includes(job.status)) {
-        const revived = job.status === 'failed' && (await startJobViaCas(em, job, ctx, { staleSweptOnly: true }))
-        if (!revived) {
+        let writable = false
+        if (job.status === 'failed') {
+          writable = (await startJobViaCas(em, job, ctx, { staleSweptOnly: true })) != null
+          if (!writable) {
+            // The cached snapshot's status lags the row whenever another writer — typically
+            // the forked heartbeat in touchJobHeartbeat — already revived this job: the start
+            // CAS then misses because the row is `running`, not `failed`. Increments are
+            // relative, so returning here would lose the caller's delta for good (unlike
+            // updateProgress, whose next absolute write self-corrects). Unlike
+            // persistAndMaybeBroadcast, the re-read happens after the CAS rather than before
+            // it: startJobViaCas filters on database state, so retrying it against the fresh
+            // row could not change whether it matches.
+            const fresh = await loadFreshJob(jobId, ctx)
+            if (fresh) {
+              job = fresh
+              writable = PROGRESS_WRITABLE_STATUSES.includes(fresh.status)
+              // Adopting the fresh row cannot desync entry.pendingDelta, which is provably 0
+              // here: this guard is only reachable on a cached terminal status, and the only
+              // writers that cache one — ensureThrottleEntry's initial load and
+              // persistAndMaybeBroadcast's post-persist assignment — both leave the buffer empty.
+              if (writable) entry.job = fresh
+            }
+          }
+        }
+        if (!writable) {
           forgetJobThrottle(jobId)
           return job
         }

package/src/modules/sales/backend/sales/documents/[id]/page.tsx

@@ -24,6 +24,7 @@ import { Badge } from '@open-mercato/ui/primitives/badge'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
 import { Input } from '@open-mercato/ui/primitives/input'
 import { EmailInput } from '@open-mercato/ui/primitives/email-input'
+import { formatDisplayDate, formatDisplayDateTime, toDateInputValue, toUtcDateInputValue } from '@open-mercato/ui/primitives/date-format'
 import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '@open-mercato/ui/primitives/dialog'
 import { ArrowRightLeft, Building2, CreditCard, Mail, Pencil, Plus, Send, Store, Truck, UserRound, Wand2, X } from 'lucide-react'
 import { FormHeader, type ActionItem } from '@open-mercato/ui/backend/forms'
@@ -3864,17 +3865,16 @@ export default function SalesDocumentDetailPage({
         label: t('sales.documents.detail.expectedDeliveryAt.label', 'Expected delivery'),
         emptyLabel: t('sales.documents.detail.empty', 'Not set'),
         placeholder: t('sales.documents.detail.expectedDeliveryAt.placeholder', 'Add expected delivery date'),
-        value: record?.expectedDeliveryAt
-          ? new Date(record.expectedDeliveryAt).toISOString().slice(0, 10)
-          : null,
+        // UTC, not local: this editor submits a bare `yyyy-MM-dd`, which `z.coerce.date()`
+        // stores as UTC midnight. Reading it back locally names the previous day west of UTC.
+        value: toUtcDateInputValue(record?.expectedDeliveryAt),
         onSave: handleUpdateExpectedDeliveryAt,
         inputType: 'date',
         renderDisplay: (params) => {
           const { value, emptyLabel } = params
-          if (value && value.length) {
-            return <span className="text-sm text-muted-foreground">{new Date(value).toLocaleDateString(locale)}</span>
-          }
-          return <span className="text-sm text-muted-foreground">{emptyLabel}</span>
+          return (
+            <span className="text-sm text-muted-foreground">{formatDisplayDate(value, locale) ?? emptyLabel}</span>
+          )
         },
       })
     }
@@ -3915,10 +3915,10 @@ export default function SalesDocumentDetailPage({
         render: () => (
           <SectionCard title={t('sales.documents.detail.timestamps', 'Timestamps')} muted>
             <p className="text-sm text-muted-foreground">
-              {t('sales.documents.detail.created', 'Created')}: {record?.createdAt ?? '—'}
+              {t('sales.documents.detail.created', 'Created')}: {formatDisplayDateTime(record?.createdAt, locale) ?? '—'}
             </p>
             <p className="text-sm text-muted-foreground">
-              {t('sales.documents.detail.updated', 'Updated')}: {record?.updatedAt ?? '—'}
+              {t('sales.documents.detail.updated', 'Updated')}: {formatDisplayDateTime(record?.updatedAt, locale) ?? '—'}
             </p>
           </SectionCard>
         ),
@@ -4707,28 +4707,22 @@ export default function SalesDocumentDetailPage({
           <InlineTextEditor
             key="date"
             label={t('sales.documents.detail.date', 'Date')}
-            value={
-              record?.placedAt
-                ? new Date(record.placedAt).toISOString().slice(0, 10)
-                : record?.createdAt
-                  ? new Date(record.createdAt).toISOString().slice(0, 10)
-                  : null
-            }
+            // Two readings on purpose. `placedAt` is settable from this date input, so it is
+            // stored as UTC midnight and must be read back in UTC or the field flips a day west
+            // of UTC. `createdAt` is only ever stamped from a clock — a real instant, whose local
+            // day is the one to show.
+            value={toUtcDateInputValue(record?.placedAt) ?? toDateInputValue(record?.createdAt)}
             emptyLabel={t('sales.documents.detail.empty', 'Not set')}
             onSave={handleUpdatePlacedAt}
             inputType="date"
             activateOnClick
             containerClassName="h-full"
             saveLabel={t('customers.people.detail.inline.saveShortcut')}
-            renderDisplay={({ value, emptyLabel }) =>
-              value && value.length ? (
-                <span className="text-sm text-muted-foreground">
-                  {new Date(value).toLocaleDateString(locale)}
-                </span>
-              ) : (
-                <span className="text-sm text-muted-foreground">{emptyLabel}</span>
-              )
-            }
+            renderDisplay={({ value, emptyLabel }) => (
+              <span className="text-sm text-muted-foreground">
+                {formatDisplayDate(value, locale) ?? emptyLabel}
+              </span>
+            )}
           />
         </div>