@open-mercato/core 0.9.1-develop.7499.1.fcec456e4e → 0.9.1-develop.7515.1.e2712c8b00

package/src/modules/ecommerce/i18n/en.json

@@ -337,5 +337,6 @@
   "ecommerce.validation.pathPrefixInvalid": "Path prefix may contain only lowercase letters, digits, dashes and slashes, for example /shop.",
   "ecommerce.validation.slugInvalid": "Slug may contain only lowercase letters, digits and single dashes between them.",
   "ecommerce.validation.urlInvalid": "Enter a valid http(s) URL or a path starting with /.",
-  "notifications.categories.ecommerce": "Ecommerce"
+  "notifications.categories.ecommerce": "Ecommerce",
+  "search.entityType.ecommerce.ecommerce_store": "Store"
 }

package/src/modules/ecommerce/i18n/es.json

@@ -337,5 +337,6 @@
   "ecommerce.validation.pathPrefixInvalid": "El prefijo de ruta solo puede contener letras minúsculas, dígitos, guiones y barras, por ejemplo /shop.",
   "ecommerce.validation.slugInvalid": "El slug solo puede contener letras minúsculas, dígitos y guiones simples entre ellos.",
   "ecommerce.validation.urlInvalid": "Introduce una URL http(s) válida o una ruta que empiece por /.",
-  "notifications.categories.ecommerce": "Comercio electrónico"
+  "notifications.categories.ecommerce": "Comercio electrónico",
+  "search.entityType.ecommerce.ecommerce_store": "Tienda"
 }

package/src/modules/ecommerce/i18n/ko.json

@@ -337,5 +337,6 @@
   "ecommerce.validation.pathPrefixInvalid": "경로 접두사에는 영문 소문자, 숫자, 하이픈, 슬래시만 사용할 수 있습니다(예: /shop).",
   "ecommerce.validation.slugInvalid": "슬러그에는 영문 소문자, 숫자와 그 사이의 단일 하이픈만 사용할 수 있습니다.",
   "ecommerce.validation.urlInvalid": "유효한 http(s) URL 또는 /로 시작하는 경로를 입력하세요.",
-  "notifications.categories.ecommerce": "이커머스"
+  "notifications.categories.ecommerce": "이커머스",
+  "search.entityType.ecommerce.ecommerce_store": "스토어"
 }

package/src/modules/ecommerce/i18n/pl.json

@@ -337,5 +337,6 @@
   "ecommerce.validation.pathPrefixInvalid": "Prefiks ścieżki może zawierać tylko małe litery, cyfry, myślniki i ukośniki, np. /shop.",
   "ecommerce.validation.slugInvalid": "Slug może zawierać tylko małe litery, cyfry i pojedyncze myślniki między nimi.",
   "ecommerce.validation.urlInvalid": "Podaj prawidłowy adres URL http(s) lub ścieżkę zaczynającą się od /.",
-  "notifications.categories.ecommerce": "E-commerce"
+  "notifications.categories.ecommerce": "E-commerce",
+  "search.entityType.ecommerce.ecommerce_store": "Sklep"
 }

package/src/modules/ecommerce/search.ts

@@ -39,7 +39,6 @@ function buildStorePresenter(
     title,
     subtitle: subtitleParts.length ? subtitleParts.join(' · ') : undefined,
     icon: 'store',
-    badge,
   }
 }
 

package/src/modules/shipping_carriers/api/webhook/[provider]/route.ts

@@ -115,13 +115,10 @@ export async function POST(req: Request, { params }: { params: Promise<{ provide
     }
 
     await queue.enqueue({
-      name: 'shipping-carrier-webhook',
-      payload: {
-        providerKey,
-        event,
-        shipmentId: shipment.id,
-        scope: matchedScope,
-      },
+      providerKey,
+      event,
+      shipmentId: shipment.id,
+      scope: matchedScope,
     })
 
     return NextResponse.json({ received: true, queued: true }, { status: 202 })

package/src/modules/shipping_carriers/lib/shipping-service.ts

@@ -1,3 +1,4 @@
+import { LockMode } from '@mikro-orm/core'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { CredentialsService } from '../../integrations/lib/credentials-service'
@@ -200,7 +201,7 @@ export function createShippingCarrierService(deps: {
           trackingNumber: created.trackingNumber,
           organizationId: input.organizationId,
           tenantId: input.tenantId,
-        })
+        }, { tenantId: input.tenantId, organizationId: input.organizationId })
         return shipment
       } catch (error: unknown) {
         // Release the claim only when the carrier was NOT successfully called, so a retry can
@@ -256,24 +257,41 @@ export function createShippingCarrierService(deps: {
         trackingNumber: shipment.trackingNumber,
         credentials,
       })
-      const previousStatus = shipment.unifiedStatus
-      shipment.trackingEvents = tracking.events
-      shipment.lastPolledAt = new Date()
-      const transitionApplied = syncShipmentStatus(shipment, tracking.status)
-      await em.flush()
-      if (transitionApplied) {
+      const outcome = await em.transactional(async (tx) => {
+        const locked = await findOneWithDecryption(
+          tx,
+          CarrierShipment,
+          {
+            id: shipment.id,
+            organizationId: scope.organizationId,
+            tenantId: scope.tenantId,
+            deletedAt: null,
+          },
+          { lockMode: LockMode.PESSIMISTIC_WRITE, refresh: true },
+          scope,
+        )
+        if (!locked) return null
+        const previousStatus = locked.unifiedStatus
+        locked.trackingEvents = tracking.events
+        locked.lastPolledAt = new Date()
+        const applied = syncShipmentStatus(locked, tracking.status)
+        await tx.flush()
+        return { applied, previousStatus }
+      }, { clear: true })
+      if (outcome?.applied) {
         const eventPayload = {
           shipmentId: shipment.id,
           providerKey: input.providerKey,
-          previousStatus,
+          previousStatus: outcome.previousStatus,
           newStatus: tracking.status,
           organizationId: input.organizationId,
           tenantId: input.tenantId,
         }
-        await emitShippingEvent('shipping_carriers.shipment.status_changed', eventPayload)
+        const eventScope = { tenantId: input.tenantId, organizationId: input.organizationId }
+        await emitShippingEvent('shipping_carriers.shipment.status_changed', eventPayload, eventScope)
         if (TERMINAL_SHIPPING_STATUSES.has(tracking.status)) {
           const terminalEvent = getTerminalShippingEvent(tracking.status)
-          if (terminalEvent) await emitShippingEvent(terminalEvent, eventPayload)
+          if (terminalEvent) await emitShippingEvent(terminalEvent, eventPayload, eventScope)
         }
       }
       return tracking
@@ -307,7 +325,7 @@ export function createShippingCarrierService(deps: {
         providerKey: input.providerKey,
         organizationId: input.organizationId,
         tenantId: input.tenantId,
-      })
+      }, { tenantId: input.tenantId, organizationId: input.organizationId })
       return result
     },
 

package/src/modules/shipping_carriers/lib/status-sync.ts

@@ -29,8 +29,8 @@ export function isShipmentCancelNotAllowedError(error: unknown): error is Shipme
 }
 
 const VALID_SHIPPING_TRANSITIONS: Record<string, UnifiedShipmentStatus[]> = {
-  label_created: ['picked_up', 'in_transit', 'cancelled'],
-  picked_up: ['in_transit', 'cancelled'],
+  label_created: ['picked_up', 'in_transit', 'out_for_delivery', 'delivered', 'failed_delivery', 'returned', 'cancelled'],
+  picked_up: ['in_transit', 'out_for_delivery', 'delivered', 'failed_delivery', 'returned', 'cancelled'],
   in_transit: ['out_for_delivery', 'delivered', 'returned', 'failed_delivery'],
   out_for_delivery: ['delivered', 'returned', 'failed_delivery'],
   failed_delivery: ['in_transit', 'out_for_delivery', 'delivered', 'returned', 'cancelled'],

package/src/modules/shipping_carriers/workers/webhook-processor.ts

@@ -1,9 +1,10 @@
+import { LockMode } from '@mikro-orm/core'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { CarrierShipment } from '../data/entities'
 import { emitShippingEvent } from '../events'
-import type { ShippingWebhookEvent } from '../lib/adapter'
+import type { ShippingWebhookEvent, UnifiedShipmentStatus } from '../lib/adapter'
 import { getShippingAdapter } from '../lib/adapter-registry'
 import { getTerminalShippingEvent, syncShipmentStatus, TERMINAL_SHIPPING_STATUSES } from '../lib/status-sync'
 import { claimWebhookProcessing, releaseWebhookClaim } from '../lib/webhook-utils'
@@ -21,6 +22,16 @@ type WebhookJobPayload = {
   } | null
 }
 
+type LegacyWebhookJobEnvelope = {
+  name?: string
+  payload: WebhookJobPayload
+}
+
+function readWebhookJobPayload(data: WebhookJobPayload | LegacyWebhookJobEnvelope): WebhookJobPayload {
+  if ('providerKey' in data) return data
+  return data.payload
+}
+
 type HandlerContext = JobContext & {
   resolve: <T = unknown>(name: string) => T
 }
@@ -31,24 +42,25 @@ export const metadata: WorkerMeta = {
   concurrency: 5,
 }
 
-export default async function handle(job: QueuedJob<WebhookJobPayload>, ctx: HandlerContext): Promise<void> {
+export default async function handle(job: QueuedJob<WebhookJobPayload | LegacyWebhookJobEnvelope>, ctx: HandlerContext): Promise<void> {
+  const payload = readWebhookJobPayload(job.payload)
   try {
     const em = ctx.resolve<EntityManager>('em')
-    const adapter = getShippingAdapter(job.payload.providerKey)
+    const adapter = getShippingAdapter(payload.providerKey)
     if (!adapter) return
 
-    const shipment = job.payload.shipmentId && job.payload.scope
+    const shipment = payload.shipmentId && payload.scope
       ? await findOneWithDecryption(
         em,
         CarrierShipment,
         {
-          id: job.payload.shipmentId,
-          organizationId: job.payload.scope.organizationId,
-          tenantId: job.payload.scope.tenantId,
+          id: payload.shipmentId,
+          organizationId: payload.scope.organizationId,
+          tenantId: payload.scope.tenantId,
           deletedAt: null,
         },
         undefined,
-        job.payload.scope,
+        payload.scope,
       )
       : null
     if (!shipment) return
@@ -56,53 +68,73 @@ export default async function handle(job: QueuedJob<WebhookJobPayload>, ctx: Han
     const scope = { organizationId: shipment.organizationId, tenantId: shipment.tenantId }
     const claimed = await claimWebhookProcessing(
       em,
-      job.payload.event.idempotencyKey,
-      job.payload.providerKey,
+      payload.event.idempotencyKey,
+      payload.providerKey,
       scope,
-      job.payload.event.eventType,
+      payload.event.eventType,
     )
     if (!claimed) {
       return
     }
 
+    const carrierStatus = typeof payload.event.data.status === 'string'
+      ? payload.event.data.status
+      : payload.event.eventType
+
+    let transition: { previousStatus: string; newStatus: UnifiedShipmentStatus } | null = null
     try {
-      const carrierStatus = typeof job.payload.event.data.status === 'string'
-        ? job.payload.event.data.status
-        : job.payload.event.eventType
       const unifiedStatus = adapter.mapStatus(carrierStatus)
-      shipment.carrierStatus = carrierStatus
-      shipment.lastWebhookAt = new Date()
-
-      const transitionApplied = syncShipmentStatus(shipment, unifiedStatus)
-      if (!transitionApplied) return
-
-      await em.flush()
-
-      const eventPayload = {
-        shipmentId: shipment.id,
-        providerKey: job.payload.providerKey,
-        previousStatus: carrierStatus,
-        newStatus: unifiedStatus,
-        organizationId: shipment.organizationId,
-        tenantId: shipment.tenantId,
-      }
-      await emitShippingEvent('shipping_carriers.shipment.status_changed', eventPayload)
-      if (TERMINAL_SHIPPING_STATUSES.has(unifiedStatus)) {
-        const terminalEvent = getTerminalShippingEvent(unifiedStatus)
-        if (!terminalEvent) return
-        await emitShippingEvent(terminalEvent, eventPayload)
-      }
+      transition = await em.transactional(async (tx) => {
+        const locked = await findOneWithDecryption(
+          tx,
+          CarrierShipment,
+          {
+            id: shipment.id,
+            organizationId: scope.organizationId,
+            tenantId: scope.tenantId,
+            deletedAt: null,
+          },
+          { lockMode: LockMode.PESSIMISTIC_WRITE, refresh: true },
+          scope,
+        )
+        if (!locked) return null
+        const previousStatus = locked.unifiedStatus
+        if (!syncShipmentStatus(locked, unifiedStatus)) return null
+        locked.carrierStatus = carrierStatus
+        locked.lastWebhookAt = new Date()
+        await tx.flush()
+        return { previousStatus, newStatus: unifiedStatus }
+      }, { clear: true })
     } catch (error) {
       await releaseWebhookClaim(
         em,
-        job.payload.event.idempotencyKey,
-        job.payload.providerKey,
+        payload.event.idempotencyKey,
+        payload.providerKey,
         scope,
       )
       throw error
     }
+    if (!transition) return
+
+    const unifiedStatus = transition.newStatus
+    const eventPayload = {
+      shipmentId: shipment.id,
+      providerKey: payload.providerKey,
+      previousStatus: transition.previousStatus,
+      newStatus: unifiedStatus,
+      carrierStatus,
+      organizationId: shipment.organizationId,
+      tenantId: shipment.tenantId,
+    }
+    const eventScope = { tenantId: shipment.tenantId, organizationId: shipment.organizationId }
+    await emitShippingEvent('shipping_carriers.shipment.status_changed', eventPayload, eventScope)
+    if (TERMINAL_SHIPPING_STATUSES.has(unifiedStatus)) {
+      const terminalEvent = getTerminalShippingEvent(unifiedStatus)
+      if (!terminalEvent) return
+      await emitShippingEvent(terminalEvent, eventPayload, eventScope)
+    }
   } catch (error) {
-    logger.error('Job processing failed', { providerKey: job.payload.providerKey, shipmentId: job.payload.shipmentId, err: error })
+    logger.error('Job processing failed', { providerKey: payload.providerKey, shipmentId: payload.shipmentId, err: error })
     throw error
   }
 }

package/src/modules/staff/backend/staff/time-tracking/entries/page.tsx

@@ -353,7 +353,7 @@ export default function TimeTrackingEntriesPage() {
         }
       }
       const [selfRes, projectsRes, tagsRes, peopleRes] = await Promise.all([
-        safeCall<{ member?: { id?: string } | null }>('/api/staff/team-members/self'),
+        safeCall<{ member?: { id?: string; displayName?: string } | null }>('/api/staff/team-members/self'),
         safeCall<{ items?: Array<Record<string, unknown>> }>('/api/staff/timesheets/time-projects?page=1&pageSize=100'),
         safeCall<{ items?: Array<Record<string, unknown>> }>('/api/staff/timesheets/tags?page=1&pageSize=100'),
         safeCall<{ items?: Array<Record<string, unknown>> }>('/api/staff/team-members?page=1&pageSize=100'),
@@ -399,19 +399,25 @@ export default function TimeTrackingEntriesPage() {
       )
 
       const people = peopleRes?.ok && Array.isArray(peopleRes.result?.items) ? peopleRes.result.items : []
-      setPeopleOptions(
-        people
-          .map((row: Record<string, unknown>) => {
-            const id = typeof row.id === 'string' ? row.id : null
-            const label = typeof row.display_name === 'string'
-              ? row.display_name
-              : typeof row.displayName === 'string'
-                ? row.displayName
-                : null
-            return id && label ? { value: id, label } : null
-          })
-          .filter((option): option is { value: string; label: string } => option !== null),
-      )
+      const personOptions = people
+        .map((row: Record<string, unknown>) => {
+          const id = typeof row.id === 'string' ? row.id : null
+          const label = typeof row.display_name === 'string'
+            ? row.display_name
+            : typeof row.displayName === 'string'
+              ? row.displayName
+              : null
+          return id && label ? { value: id, label } : null
+        })
+        .filter((option): option is { value: string; label: string } => option !== null)
+      // The team list is closed to a caller without team-member access, yet the
+      // self filter is seeded for everyone — name it from the self lookup so its
+      // chip never falls back to the raw member id.
+      const selfName = selfRes?.ok ? selfRes.result?.member?.displayName : undefined
+      if (selfId && selfName && !personOptions.some((option) => option.value === selfId)) {
+        personOptions.push({ value: selfId, label: selfName })
+      }
+      setPeopleOptions(personOptions)
     })()
     return () => { cancelled = true }
   }, [scopeVersion])

package/src/modules/warranty_claims/commands/claim-lines.ts

@@ -43,6 +43,7 @@ import {
   ensureTenantScope,
   extractUndoPayload,
   requireScopedClaim,
+  throwUndoRefusal,
   type WarrantyClaimScope,
 } from './shared'
 import { assertPendingClaimQuantitiesWithinSold, validateClaimReferences } from './claims'
@@ -135,6 +136,31 @@ const mutableParentStatuses = new Set([
   'inspecting',
 ])
 
+const receivingParentStatuses = new Set(['received', 'inspecting'])
+
+type LineUndoParentRule = {
+  allowedParentStatuses: ReadonlySet<string>
+  lockedKey: string
+  lockedFallback: string
+}
+
+type LineUndoState = {
+  claim: WarrantyClaim
+  line: WarrantyClaimLine
+}
+
+const mutableParentUndoRule: LineUndoParentRule = {
+  allowedParentStatuses: mutableParentStatuses,
+  lockedKey: 'warranty_claims.errors.lineLocked',
+  lockedFallback: 'This line is locked in the current claim status.',
+}
+
+const receivingParentUndoRule: LineUndoParentRule = {
+  allowedParentStatuses: receivingParentStatuses,
+  lockedKey: 'warranty_claims.errors.receivingStatusInvalid',
+  lockedFallback: 'Receiving details can only be saved when the claim is received or under inspection.',
+}
+
 function parseCommandInput<T>(schema: z.ZodType<T>, rawInput: unknown): T {
   const result = schema.safeParse(rawInput ?? {})
   if (!result.success) {
@@ -482,6 +508,37 @@ async function recomputeClaimRollups(em: EntityManager, claim: WarrantyClaim): P
   claim.updatedAt = new Date()
 }
 
+function refuseLineUndoConflict(): Promise<never> {
+  return throwUndoRefusal('warranty_claims.errors.conflict', 'This claim changed while you were editing it.')
+}
+
+async function requireCurrentLineUndoState(
+  em: EntityManager,
+  after: LineSnapshot | null | undefined,
+  rule: LineUndoParentRule,
+): Promise<LineUndoState> {
+  if (!after) return refuseLineUndoConflict()
+  const scope: WarrantyClaimScope = { tenantId: after.tenantId, organizationId: after.organizationId }
+  const claim = await findOneWithDecryption(
+    em,
+    WarrantyClaim,
+    { id: after.claimId, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },
+    { lockMode: LockMode.PESSIMISTIC_WRITE },
+    scope,
+  )
+  if (!claim) return refuseLineUndoConflict()
+  if (!rule.allowedParentStatuses.has(claim.status)) return throwUndoRefusal(rule.lockedKey, rule.lockedFallback)
+  const line = await findOneWithDecryption(
+    em,
+    WarrantyClaimLine,
+    { id: after.id, tenantId: scope.tenantId, organizationId: scope.organizationId },
+    { lockMode: LockMode.PESSIMISTIC_WRITE },
+    scope,
+  )
+  if (!line || !after.updatedAt || toIso(line.updatedAt) !== after.updatedAt) return refuseLineUndoConflict()
+  return { claim, line }
+}
+
 async function requireScopedLine(
   em: EntityManager,
   lineId: string,
@@ -654,22 +711,20 @@ const createClaimLineCommand: CommandHandler<ClaimLineCreateInput, { lineId: str
   buildLog: async ({ result, snapshots }) => buildLineLog('warranty_claims.audit.claim_line.create', result.lineId, snapshots),
   undo: async ({ logEntry, ctx }) => {
     const payload = extractUndoPayload<LineUndoPayload>(logEntry)
-    const after = payload?.after
-    if (!after) return
-    const scope = { tenantId: after.tenantId, organizationId: after.organizationId }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const line = await findOneWithDecryption(em, WarrantyClaimLine, { id: after.id, tenantId: scope.tenantId, organizationId: scope.organizationId }, { populate: ['claim'] }, scope)
-    const claim = line ? claimOf(line) : null
-    if (!line || !claim) return
+    let state!: LineUndoState
     await withAtomicFlush(em, [
+      async () => {
+        state = await requireCurrentLineUndoState(em, payload?.after, mutableParentUndoRule)
+      },
       () => {
-        line.deletedAt = new Date()
-        line.updatedAt = new Date()
+        state.line.deletedAt = new Date()
+        state.line.updatedAt = new Date()
       },
-      () => recomputeClaimRollups(em, claim),
+      () => recomputeClaimRollups(em, state.claim),
     ], { transaction: true, label: 'warranty_claims.claim_line.create.undo' })
-    await emitClaimUpdated(ctx, claim)
-    await emitLineUndoCrud(ctx, 'deleted', line)
+    await emitClaimUpdated(ctx, state.claim)
+    await emitLineUndoCrud(ctx, 'deleted', state.line)
   },
 }
 
@@ -744,17 +799,17 @@ const updateClaimLineCommand: CommandHandler<ClaimLineUpdateInput, { lineId: str
     const payload = extractUndoPayload<LineUndoPayload>(logEntry)
     const before = payload?.before
     if (!before) return
-    const scope = { tenantId: before.tenantId, organizationId: before.organizationId }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const line = await findOneWithDecryption(em, WarrantyClaimLine, { id: before.id, tenantId: scope.tenantId, organizationId: scope.organizationId }, { populate: ['claim'] }, scope)
-    if (!line) return
-    const claim = claimOf(line) ?? await requireScopedClaim(em, before.claimId, scope)
+    let state!: LineUndoState
     await withAtomicFlush(em, [
-      () => restoreLineFromSnapshot(line, before),
-      () => recomputeClaimRollups(em, claim),
+      async () => {
+        state = await requireCurrentLineUndoState(em, payload?.after, mutableParentUndoRule)
+      },
+      () => restoreLineFromSnapshot(state.line, before),
+      () => recomputeClaimRollups(em, state.claim),
     ], { transaction: true, label: 'warranty_claims.claim_line.update.undo' })
-    await emitClaimUpdated(ctx, claim)
-    await emitLineUndoCrud(ctx, 'updated', line)
+    await emitClaimUpdated(ctx, state.claim)
+    await emitLineUndoCrud(ctx, 'updated', state.line)
   },
 }
 
@@ -800,35 +855,20 @@ const deleteClaimLineCommand: CommandHandler<LineDeleteInput, { lineId: string;
     const payload = extractUndoPayload<LineUndoPayload>(logEntry)
     const before = payload?.before
     if (!before) return
-    const scope = { tenantId: before.tenantId, organizationId: before.organizationId }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    let line = await findOneWithDecryption(em, WarrantyClaimLine, { id: before.id, tenantId: scope.tenantId, organizationId: scope.organizationId }, { populate: ['claim'] }, scope)
-    const claim = (line ? claimOf(line) : null) ?? await requireScopedClaim(em, before.claimId, scope)
+    let state!: LineUndoState
     await withAtomicFlush(em, [
+      async () => {
+        state = await requireCurrentLineUndoState(em, payload?.after, mutableParentUndoRule)
+      },
       () => {
-        if (!line) {
-          line = em.create(WarrantyClaimLine, {
-            id: before.id,
-            claim,
-            organizationId: before.organizationId,
-            tenantId: before.tenantId,
-            lineNo: before.lineNo,
-            qtyClaimed: before.qtyClaimed,
-            lineStatus: before.lineStatus,
-            warrantyStatus: before.warrantyStatus,
-            createdAt: new Date(),
-            updatedAt: new Date(),
-          })
-          em.persist(line)
-        }
-        restoreLineFromSnapshot(line, before)
-        line.deletedAt = null
+        restoreLineFromSnapshot(state.line, before)
+        state.line.deletedAt = null
       },
-      () => recomputeClaimRollups(em, claim),
+      () => recomputeClaimRollups(em, state.claim),
     ], { transaction: true, label: 'warranty_claims.claim_line.delete.undo' })
-    if (!line) return
-    await emitClaimUpdated(ctx, claim)
-    await emitLineUndoCrud(ctx, 'created', line)
+    await emitClaimUpdated(ctx, state.claim)
+    await emitLineUndoCrud(ctx, 'created', state.line)
   },
 }
 
@@ -916,17 +956,17 @@ const receiveClaimLineCommand: CommandHandler<ClaimLineReceiveInput, { lineId: s
     const payload = extractUndoPayload<LineUndoPayload>(logEntry)
     const before = payload?.before
     if (!before) return
-    const scope = { tenantId: before.tenantId, organizationId: before.organizationId }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const line = await findOneWithDecryption(em, WarrantyClaimLine, { id: before.id, tenantId: scope.tenantId, organizationId: scope.organizationId }, { populate: ['claim'] }, scope)
-    if (!line) return
-    const claim = await requireScopedClaim(em, before.claimId, scope)
+    let state!: LineUndoState
     await withAtomicFlush(em, [
-      () => restoreLineFromSnapshot(line, before),
-      () => recomputeClaimRollups(em, claim),
+      async () => {
+        state = await requireCurrentLineUndoState(em, payload?.after, receivingParentUndoRule)
+      },
+      () => restoreLineFromSnapshot(state.line, before),
+      () => recomputeClaimRollups(em, state.claim),
     ], { transaction: true, label: 'warranty_claims.claim_line.receive.undo' })
-    await emitClaimUpdated(ctx, claim)
-    await emitLineUndoCrud(ctx, 'updated', line)
+    await emitClaimUpdated(ctx, state.claim)
+    await emitLineUndoCrud(ctx, 'updated', state.line)
   },
 }
 
@@ -980,17 +1020,17 @@ const releaseClaimLineQuarantineCommand: CommandHandler<ClaimLineReleaseQuaranti
     const payload = extractUndoPayload<LineUndoPayload>(logEntry)
     const before = payload?.before
     if (!before) return
-    const scope = { tenantId: before.tenantId, organizationId: before.organizationId }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const line = await findOneWithDecryption(em, WarrantyClaimLine, { id: before.id, tenantId: scope.tenantId, organizationId: scope.organizationId }, { populate: ['claim'] }, scope)
-    if (!line) return
-    const claim = await requireScopedClaim(em, before.claimId, scope)
+    let state!: LineUndoState
     await withAtomicFlush(em, [
-      () => restoreLineFromSnapshot(line, before),
-      () => recomputeClaimRollups(em, claim),
+      async () => {
+        state = await requireCurrentLineUndoState(em, payload?.after, receivingParentUndoRule)
+      },
+      () => restoreLineFromSnapshot(state.line, before),
+      () => recomputeClaimRollups(em, state.claim),
     ], { transaction: true, label: 'warranty_claims.claim_line.release_quarantine.undo' })
-    await emitClaimUpdated(ctx, claim)
-    await emitLineUndoCrud(ctx, 'updated', line)
+    await emitClaimUpdated(ctx, state.claim)
+    await emitLineUndoCrud(ctx, 'updated', state.line)
   },
 }
 
@@ -1043,16 +1083,17 @@ const setClaimLineAssessmentCommand: CommandHandler<LineSetAssessmentInput, { li
     const payload = extractUndoPayload<LineUndoPayload>(logEntry)
     const before = payload?.before
     if (!before) return
-    const scope = { tenantId: before.tenantId, organizationId: before.organizationId }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const line = await findOneWithDecryption(em, WarrantyClaimLine, { id: before.id, tenantId: scope.tenantId, organizationId: scope.organizationId }, { populate: ['claim'] }, scope)
-    if (!line) return
-    const claim = claimOf(line) ?? await requireScopedClaim(em, before.claimId, scope)
+    let state!: LineUndoState
     await withAtomicFlush(em, [
-      () => restoreLineFromSnapshot(line, before),
+      async () => {
+        state = await requireCurrentLineUndoState(em, payload?.after, mutableParentUndoRule)
+      },
+      () => restoreLineFromSnapshot(state.line, before),
+      () => recomputeClaimRollups(em, state.claim),
     ], { transaction: true, label: 'warranty_claims.claim_line.set_assessment.undo' })
-    await emitClaimUpdated(ctx, claim)
-    await emitLineUndoCrud(ctx, 'updated', line)
+    await emitClaimUpdated(ctx, state.claim)
+    await emitLineUndoCrud(ctx, 'updated', state.line)
   },
 }