05/16 Fix bugs 3

app/utils/audit.py

@@ -44,6 +44,11 @@ def log_action(action: str,
     """
     Write a single AuditLog row.  Safe to call from any request context.
 
+    ⚠️  This function calls db.session.commit() internally.
+    Always call it AFTER the primary db.session.commit() for the business
+    transaction — never before.  Calling it mid-transaction will commit any
+    dirty ORM state accumulated in the session up to that point.
+
     Parameters
     ----------
     action       : One of the ACTION_* constants (or a custom string ≤ 50 chars).
@@ -90,4 +95,4 @@ def log_action(action: str,
         try:
             db.session.rollback()
         except Exception:
-            pass
+            pass