@memberjunction/core 6.2.0-edge.5 → 6.2.0-edge.7

package/dist/generic/providerBase.js

@@ -1,15 +1,17 @@
 import { BaseEntity } from "./baseEntity.js";
+import { IsTransportError } from './transportError.js';
 import { EntityDocumentTypeInfo, EntityFieldTSType, EntityInfo, EntityPermissionType, FieldSecurityDenialMessage, FieldSecurityError } from "./entityInfo.js";
-import { AllMetadata } from "./interfaces.js";
+import { GetEffectiveAlternateBaseViewName, IsExplicitBaseViewOverride } from "./alternateBaseViews.js";
+import { ProviderType, AllMetadata } from "./interfaces.js";
 import { RecordChangeFieldSecurityProjector } from "./recordChangeFieldSecurity.js";
 import { ComputeRRF } from "./scoring/ReciprocalRankFusion.js";
 import { LocalCacheManager, CacheCategory } from "./localCacheManager.js";
 import { ApplicationInfo } from "../generic/applicationInfo.js";
 import { AuditLogTypeInfo, AuthorizationInfo, AuthorizationRoleInfo, RoleInfo, RowLevelSecurityFilterInfo, UserInfo } from "./securityInfo.js";
-import { MJGlobal, MJEventType, NormalizeUUID, UUIDsEqual, EscapeSQLString, ordinalCompare } from "@memberjunction/global";
-import { FindReferencedIdentifiers } from "@memberjunction/sql-dialect";
+import { MJGlobal, MJEventType, NormalizeUUID, UUIDsEqual, IndexByUUID, EscapeSQLString, ordinalCompare } from "@memberjunction/global";
+import { FieldSecuritySQLGate } from "./fieldSecuritySQLGate.js";
 import { TelemetryManager } from "./telemetryManager.js";
-import { LogDebug, LogError, LogStatus, LogStatusEx } from "./logging.js";
+import { LogDebug, LogError, LogStatus, LogStatusEx, LogWarning } from "./logging.js";
 import { QueryCategoryInfo, QueryFieldInfo, QueryInfo, QueryPermissionInfo, QueryEntityInfo, QueryParameterInfo, QueryDependencyInfo, SQLDialectInfo, QuerySQLInfo } from "./queryInfo.js";
 import { LibraryInfo } from "./libraryInfo.js";
 import { CompositeKey } from "./compositeKey.js";
@@ -20,6 +22,8 @@ import { IsPlatformSQL } from "./platformSQL.js";
 import { GetDataHooks } from "./dataHooks.js";
 import { TransformSimpleObjectToEntityObject } from "./util.js";
 import { LoadRelatedRecordsBatched } from "./relatedRecordBatchLoader.js";
+import { GetLocalTimeZone } from "./contextTokens.js";
+import { FindQueryContextTokens, QueryContextCacheValues } from "./queryTemplateContext.js";
 /**
  * Creates a new instance of AllMetadata from a simple object.
  * Handles deserialization and proper instantiation of all metadata classes.
@@ -249,10 +253,11 @@ export class ProviderBase {
          */
         this._metadataReadsJoinTransaction = false;
         /**
-         * The MJ_Metadata dataset items (code + entity name) as of the last full load. The remote
+         * The MJ_Metadata dataset items (code + entity name + row count) as of the last load. The remote
          * timestamps ({@link GetLatestMetadataUpdates}) are keyed by entity name while a dataset
          * read is scoped by item code, so this is the bridge that lets a staleness check be turned
-         * into a scoped reload (see {@link PartialRefreshItemCodes}).
+         * into a scoped reload (see {@link PartialRefreshItemCodes}) and lets {@link adoptServerMetadata}
+         * verify that the received dataset items' row counts match `_latestRemoteMetadataTimestamps`.
          */
         this._metadataDatasetItems = null;
         /** Debounce timer for {@link scheduleMetadataMemberRefresh}. */
@@ -266,7 +271,16 @@ export class ProviderBase {
         this._peerMetadataNoticeTimer = null;
         this._metadataMemberRefreshWaits = 0;
         this._clientFingerprintMemo = new WeakMap();
+        this._requestDeniedReadFields = new WeakMap();
         this._cachedVisibleExplorerNavigationItems = null;
+        /**
+         * Whether the most recent {@link RefreshRemoteMetadataTimestamps} actually REACHED the
+         * server, regardless of whether it came back with usable timestamps.
+         *
+         * Starts `true` so that nothing reads "unreachable" before a read has been attempted.
+         * See {@link ReadRemoteMetadataTimestamps} for why the distinction exists.
+         */
+        this._lastRemoteTimestampReadReached = true;
         /** Guard for {@link logMetadataSnapshotDisabledOnce}. */
         this._metadataSnapshotSkipLogged = false;
     }
@@ -556,7 +570,13 @@ export class ProviderBase {
         this._metadataDatasetEntityNames = names;
         this._metadataDatasetItems = (dataset.Results ?? [])
             .filter(item => item.Code && item.EntityName)
-            .map(item => ({ Code: item.Code, EntityName: item.EntityName }));
+            .map(item => ({
+            Code: item.Code,
+            EntityName: item.EntityName,
+            EntityID: item.EntityID,
+            RowCount: Array.isArray(item.Results) ? item.Results.length : undefined,
+            LatestUpdateDate: item.LatestUpdateDate
+        }));
         this.ensureInflightViewInvalidation();
     }
     /**
@@ -1076,6 +1096,7 @@ export class ProviderBase {
                 if (params.OnDataChanged && preResult.fingerprint) {
                     preResult.cachedResult.Unsubscribe = LocalCacheManager.Instance.RegisterChangeCallback(preResult.fingerprint, params.OnDataChanged);
                 }
+                ProviderBase.clearSkippedTotalRowCount(params, preResult.cachedResult);
                 return preResult.cachedResult;
             }
             // Cache miss — execute query, then post-process (stores in cache)
@@ -1084,6 +1105,7 @@ export class ProviderBase {
             // PostRunView copies any hook-supplied replacement onto `result` in place, so this
             // reference reflects the hook chain's output.
             await this.PostRunView(result, params, preResult, contextUser);
+            ProviderBase.clearSkippedTotalRowCount(params, result);
             return result;
         }
         // Delegate to RunViews, which uses the smart cache check (lightweight maxUpdatedAt +
@@ -1119,7 +1141,10 @@ export class ProviderBase {
             return this.executeRunViewsPipeline(params, contextUser);
         }
         // ── Coalescing: merge concurrent RunViews into one mega-batch ──
-        if (ProviderBase.CoalesceWindowMs > 0 && !this.TrustLocalCacheCompletely) {
+        // A run carrying view properties is never merged: a merged batch with any CacheLocal member
+        // goes through the cache-check transport, which carries dynamic runs only and would drop the
+        // view and its properties.
+        if (ProviderBase.CoalesceWindowMs > 0 && !this.TrustLocalCacheCompletely && !params.some(ProviderBase.carriesViewProperties)) {
             // Only coalesce on the client side where cache validation round-trips are expensive.
             // Server-side trusts its cache (no network calls), so coalescing adds no benefit.
             return this.enqueueCoalescedRunViews(params, contextUser);
@@ -1153,27 +1178,7 @@ export class ProviderBase {
         // ── Fresh execution ──
         const promise = this.executeRunViewsPipeline(params, contextUser)
             .then(results => {
-            // Stash resolved results for the linger window. Safety cap: under
-            // extreme churn (hundreds of distinct keys resolving within one linger
-            // window) skip lingering rather than hold more result arrays in memory —
-            // the linger is a latency optimization, never a correctness requirement.
-            const entry = this._inflightViews.get(key);
-            if (entry && entry.promise === promise) {
-                if (ProviderBase.DedupLingerMs > 0 && this._inflightViews.size <= ProviderBase.MaxLingerEntries) {
-                    entry.resolvedResults = results;
-                    entry.resolvedAt = Date.now();
-                    // Schedule cleanup after linger expires
-                    setTimeout(() => {
-                        const current = this._inflightViews.get(key);
-                        if (current && current.promise === promise) {
-                            this._inflightViews.delete(key);
-                        }
-                    }, ProviderBase.DedupLingerMs);
-                }
-                else {
-                    this._inflightViews.delete(key);
-                }
-            }
+            this.stashInflightLingerResult(key, promise, results, true);
             return results;
         })
             .catch(err => {
@@ -1190,6 +1195,36 @@ export class ProviderBase {
         return results.map(r => this.shallowCopyResult(r));
     }
     // ── Dedup helpers ──────────────────────────────────────────────────
+    /**
+     * Stashes resolved RunViews results on `_inflightViews` for `DedupLingerMs` and schedules
+     * cleanup via an isolated static `WeakRef` timer helper so the timer closure's V8 lexical
+     * context never retains `this`, `promise`, or `results` on short-lived per-request providers.
+     */
+    stashInflightLingerResult(key, promise, results, enforceMaxEntries) {
+        const entry = this._inflightViews.get(key);
+        if (!entry || entry.promise !== promise) {
+            return;
+        }
+        if (ProviderBase.DedupLingerMs > 0 && (!enforceMaxEntries || this._inflightViews.size <= ProviderBase.MaxLingerEntries)) {
+            const resolvedAt = Date.now();
+            entry.resolvedResults = results;
+            entry.resolvedAt = resolvedAt;
+            ProviderBase.scheduleInflightLingerExpiry(new WeakRef(this), key, resolvedAt);
+        }
+        else {
+            this._inflightViews.delete(key);
+        }
+    }
+    static scheduleInflightLingerExpiry(selfRef, key, resolvedAt) {
+        const timer = setTimeout(() => {
+            const self = selfRef.deref();
+            const current = self?._inflightViews.get(key);
+            if (current && current.resolvedAt === resolvedAt) {
+                self?._inflightViews.delete(key);
+            }
+        }, ProviderBase.DedupLingerMs);
+        timer?.unref?.();
+    }
     /**
      * The original RunViews execution pipeline (pre-processing, cache,
      * internal execution, post-processing).
@@ -1197,6 +1232,55 @@ export class ProviderBase {
     async executeRunViewsPipeline(params, contextUser) {
         // Pre-processing for batch
         const preResult = await this.PreRunViews(params, contextUser);
+        const refused = preResult.refusedResults;
+        if (!refused) {
+            return this.runAdmittedViews(params, preResult, contextUser);
+        }
+        // Every later stage works on the admitted views only — the same subset, in the same
+        // order, that PreRunViews built its cache maps and smart-cache-check params from.
+        const admitted = params.filter((_, i) => !refused.has(i));
+        const admittedResults = await this.runAdmittedViews(admitted, preResult, contextUser);
+        return ProviderBase.interleaveRefusedResults(admittedResults, refused, params.length);
+    }
+    /**
+     * Puts each refused view's result back at its own index of the caller's batch, with the
+     * admitted views' results filling the remaining indexes in order.
+     */
+    static interleaveRefusedResults(admittedResults, refused, batchSize) {
+        const merged = [];
+        let next = 0;
+        for (let i = 0; i < batchSize; i++) {
+            const refusal = refused.get(i);
+            merged.push(refusal ? refusal : admittedResults[next++]);
+        }
+        return merged;
+    }
+    /**
+     * Keeps the `TotalRowCount` contract on every way out of the pipeline: a caller that passed
+     * `SkipTotalRowCount` gets `undefined`, never a number. Cache hits, the smart-cache check and
+     * the GraphQL wire each rebuild a result and each have a reason to fill in a row count, so the
+     * contract is applied once here rather than at each of those sites.
+     */
+    static clearSkippedTotalRowCount(params, result) {
+        if (result && params.SkipTotalRowCount === true && params.ResultType !== 'count_only') {
+            result.TotalRowCount = undefined;
+        }
+    }
+    /**
+     * Runs a RunViews batch of the views the field-security predicate gate admitted, and applies
+     * the `TotalRowCount` contract to whichever stage produced each result.
+     */
+    async runAdmittedViews(params, preResult, contextUser) {
+        const results = await this.runAdmittedViewStages(params, preResult, contextUser);
+        params.forEach((param, i) => ProviderBase.clearSkippedTotalRowCount(param, results[i]));
+        return results;
+    }
+    /**
+     * The cache, database and post-processing stages of a RunViews batch, for the views the
+     * field-security predicate gate admitted. `params` and every index map in `preResult`
+     * describe the same admitted views.
+     */
+    async runAdmittedViewStages(params, preResult, contextUser) {
         // Check for smart cache check mode
         if (preResult.useSmartCacheCheck && preResult.smartCacheCheckParams) {
             return this.executeSmartCacheCheck(params, preResult, contextUser);
@@ -1466,22 +1550,7 @@ export class ProviderBase {
         // ── Fresh execution ──
         const promise = this.executeRunViewsPipeline(params, contextUser)
             .then(results => {
-            const entry = this._inflightViews.get(key);
-            if (entry && entry.promise === promise) {
-                entry.resolvedResults = results;
-                entry.resolvedAt = Date.now();
-                if (ProviderBase.DedupLingerMs > 0) {
-                    setTimeout(() => {
-                        const current = this._inflightViews.get(key);
-                        if (current && current.promise === promise) {
-                            this._inflightViews.delete(key);
-                        }
-                    }, ProviderBase.DedupLingerMs);
-                }
-                else {
-                    this._inflightViews.delete(key);
-                }
-            }
+            this.stashInflightLingerResult(key, promise, results, false);
             return results;
         })
             .catch(err => {
@@ -1534,14 +1603,80 @@ export class ProviderBase {
      * - entities where server caching is disallowed
      */
     runViewCacheEligible(param) {
+        // In the browser a run carrying view properties is never cached: the server works out values
+        // the browser cannot see (token defaults, server-set values), so a browser slot could go stale
+        // without any row changing. The server caches it, keyed on the resolved values.
+        if (!this.TrustLocalCacheCompletely && ProviderBase.carriesViewProperties(param)) {
+            return false;
+        }
         return !param.BypassCache &&
+            param.CacheLocal !== false &&
             !param.AfterKey &&
             !IsMaterializedDataSource(param.DataSource) &&
+            !this.isAlternateBaseViewCacheBypassed(param) &&
             param.ResultType !== 'count_only' &&
             (param.CacheLocal === true || this.TrustLocalCacheCompletely) &&
             this.IsServerCacheAllowedForEntity(param);
-        // Deliberately not user-dependent: server slots are full-width and shared, so field
-        // security never changes whether a query is cacheable, only what is projected out of it.
+        // Deliberately not user-dependent: field security changes which slot a request uses
+        // (the fls: segment), never whether it is cacheable.
+    }
+    /**
+     * True when the caller explicitly requested a non-empty `Fields` projection on a plain-object
+     * (`ResultType !== 'entity_object'`) read.
+     */
+    hasNarrowFieldsOverride(param) {
+        return Boolean(param.Fields && param.Fields.length > 0 && param.ResultType !== 'entity_object');
+    }
+    /**
+     * True when a cache-miss read should widen `Fields` to the full entity superset AND populate
+     * `LocalCacheManager` with that superset.
+     *
+     * On the server (`TrustLocalCacheCompletely === true`), cache-allowed entities (`AllowCaching === true`)
+     * widen on miss by default so the Fields-agnostic superset slot serves any future `Fields` subset
+     * (`server-cache` S1 -> S2 -> S3), UNLESS the caller explicitly opts out via `CacheLocal: false` or
+     * `BypassCache: true` (in which case narrow SQL `SELECT` pushdown is preserved end-to-end without
+     * polluting the cache). On the client (`TrustLocalCacheCompletely === false`), only `CacheLocal: true`
+     * widens and caches.
+     */
+    shouldWidenAndPopulateCache(param) {
+        return this.runViewCacheEligible(param);
+    }
+    /**
+     * True when the request targets an `AlternateBaseView` (explicitly on `param.AlternateBaseView`
+     * or pinned on `param.ViewEntity`) whose `CachePolicy` (or an ancestor's `CachePolicy` in its
+     * `ParentID` chain) is `'Bypass'` (`IsBypassCache === true`), when the requested alternate
+     * base view does not resolve to a usable view on the entity, or when a saved User View is
+     * referenced only by `ViewID`/`ViewName` without a loaded `ViewEntity` (fail-closed: we cannot
+     * synchronously inspect `DisplayState.alternateBaseView` until the view is loaded).
+     */
+    isAlternateBaseViewCacheBypassed(param) {
+        if (IsExplicitBaseViewOverride(param)) {
+            return false;
+        }
+        const effectiveAbv = GetEffectiveAlternateBaseViewName(param);
+        if (!effectiveAbv) {
+            if (!param.ViewEntity && Boolean(param.ViewID || param.ViewName)) {
+                const knownEntity = this.ResolveRunViewEntitySync(param);
+                if (knownEntity) {
+                    return knownEntity.AlternateBaseViews.some(v => v.IsBypassCache || !v.IsUsable);
+                }
+                return this.Entities.some(e => e.AlternateBaseViews.some(v => v.IsBypassCache || !v.IsUsable));
+            }
+            return false;
+        }
+        const entity = this.ResolveRunViewEntitySync(param);
+        if (!entity) {
+            return true; // Fail closed when entity cannot be resolved synchronously
+        }
+        const abv = entity.GetAlternateBaseView(effectiveAbv);
+        if (!abv || !abv.IsUsable) {
+            return true;
+        }
+        return abv.IsBypassCache;
+    }
+    /** True when a run carries view properties (even an empty map): the browser sends it to the server as it is. */
+    static carriesViewProperties(param) {
+        return param.Properties !== undefined || param.ServerProperties !== undefined;
     }
     /** True when the entity is a CodeGen materialized-query wrapper (materialized_vw*) whose snapshot is
      * refreshed out-of-band — the same one IsServerCacheAllowedForEntity excludes from the server cache. */
@@ -1569,6 +1704,7 @@ export class ProviderBase {
         return !param.BypassCache &&
             !param.AfterKey &&
             !IsMaterializedDataSource(param.DataSource) &&
+            !this.isAlternateBaseViewCacheBypassed(param) &&
             param.ResultType !== 'count_only' &&
             param.CacheLocal === true &&
             !this.isMaterializedWrapperEntity(param);
@@ -1637,6 +1773,8 @@ export class ProviderBase {
                 p.UserSearchString ?? '',
                 p.ViewID ?? '',
                 p.ViewName ?? '',
+                IsExplicitBaseViewOverride(p) ? 'abv_override:base' : '',
+                p.TimeZone ?? '',
                 contextUser?.ID ?? ''
             ].join('|');
             return `${base}|${extras}`;
@@ -1698,15 +1836,15 @@ export class ProviderBase {
         if (memoized) {
             return memoized;
         }
-        // The signed-in user's row filter (rls:) and allowed field list (fls:, see
-        // ComputeClientFLSAllowedKey) are part of client slot identity, as they are on the server.
+        // The signed-in user's row filter (rls:) and field-security key (fls:, see
+        // ComputeRunViewFLSFingerprintKey) are part of client slot identity, as they are on the server.
         // The browser cache outlives a session — one IndexedDB store per server URL — and the
         // currency check compares only maxUpdatedAt and rowCount, which cannot tell one user's
         // rows from another's, nor notice a column. Without these segments, a different user on
         // the same browser could be served the previous user's rows, and a user whose field
         // access is tightened would keep seeing a column just taken away. Both are empty for an
         // unrestricted user, whose fingerprints are unchanged.
-        const base = LocalCacheManager.Instance.GenerateRunViewFingerprint(param, this.InstanceConnectionString, this.ComputeRunViewRLSWhereClause(param), undefined, this.ComputeClientFLSAllowedKey(param));
+        const base = LocalCacheManager.Instance.GenerateRunViewFingerprint(param, this.InstanceConnectionString, this.ComputeRunViewRLSWhereClause(param), undefined, this.ComputeRunViewFLSFingerprintKey(param));
         // Normalize a FULL-COVERAGE field list to '*' — in the FINGERPRINT only (B44).
         //
         // entity_object params get widened to an explicit list of every entity field
@@ -1894,6 +2032,7 @@ export class ProviderBase {
             ExtraFilter: filter,
             ResultType: 'simple',
             MaxRows: 1,
+            SkipTotalRowCount: true,
         }, contextUser);
         if (!r.Success || (r.Results?.length ?? 0) === 0)
             return null;
@@ -2002,6 +2141,7 @@ export class ProviderBase {
             Fields: entity.PrimaryKeys.map(pk => pk.Name),
             ResultType: 'simple',
             MaxRows: ids.length,
+            SkipTotalRowCount: true,
         }, contextUser);
         if (!r.Success)
             return new Set();
@@ -2022,7 +2162,10 @@ export class ProviderBase {
         // revoked grants stay visible through the linger window.
         // SaveViewResults bypasses for the original reason: it creates DB
         // records and must not be deduplicated.
-        return params.some(p => p.SaveViewResults === true || p.BypassCache === true);
+        // CacheLocal:false is the server-side opt-out from the RunView cache (read AND write). A
+        // linger hit would hand back rows that were themselves served from that cache, so the
+        // opt-out has to cover the dedup window as well.
+        return params.some(p => p.SaveViewResults === true || p.BypassCache === true || p.CacheLocal === false);
     }
     /**
      * Returns a shallow copy of a RunViewResult: the Results array is a
@@ -2095,9 +2238,36 @@ export class ProviderBase {
             authorized: !user || qInfo.UserCanRun(user),
             categoryPath: qInfo.CategoryPath,
             queryName: qInfo.Name,
+            contextTokens: FindQueryContextTokens(qInfo.ID, id => [this.Queries.find(q => UUIDsEqual(q.ID, id))?.SQL, ...this.QuerySQLs.filter(s => UUIDsEqual(s.QueryID, id)).map(s => s.SQL)], id => this.QueryDependencies.filter(d => UUIDsEqual(d.QueryID, id)).map(d => d.DependsOnQueryID)),
             queryId: qInfo.ID
         };
     }
+    /**
+     * The fingerprint segment for what the server sets on a run: `ServerParameters`, and the
+     * `Context.*` values the query reads, worked out for this user, zone and day. Empty when the
+     * run has neither, so the fingerprint is exactly what it was before either existed.
+     * @returns null when the query reads `Context.Now`: such a result is never reused
+     */
+    queryCacheServerSegment(params, contextUser, auth) {
+        const segment = {};
+        if (params.ServerParameters && Object.keys(params.ServerParameters).length > 0) {
+            segment.__serverParameters = params.ServerParameters;
+        }
+        // ponytail: an unresolvable query (not in metadata) adds no Context segment. The TTL gate then
+        // serves only the slot's warmer, so users stay apart, but a date value can be stale for up to
+        // the slot's TTL across midnight. Resolve the SQL here too if that ever matters.
+        const tokens = auth.resolvable ? auth.contextTokens ?? [] : [];
+        if (tokens.length > 0) {
+            // A browser's server works out dates in the zone the browser sends; a server run uses its own TimeZone or UTC.
+            const timeZone = params.TimeZone ?? (this.ProviderType === ProviderType.Network ? GetLocalTimeZone() : undefined);
+            const values = QueryContextCacheValues(tokens, { User: contextUser ?? this.CurrentUser, TimeZone: timeZone });
+            if (values === null) {
+                return null;
+            }
+            segment.__context = values;
+        }
+        return segment;
+    }
     async RunQuery(params, contextUser) {
         // Shallow-clone for symmetry with RunView — pipeline must never mutate caller objects
         params = { ...params };
@@ -2126,6 +2296,8 @@ export class ProviderBase {
             // (the fingerprint carries no DataSource segment). Keeping materialized out of this layer
             // means the only staleness is the refresh cadence the snapshot already advertises.
             && !IsMaterializedDataSource(params.DataSource)
+            // A RequireApproved run must check the approval on every run; a cached slot would skip it.
+            && !params.RequireApproved
             && LocalCacheManager.Instance.IsInitialized;
         let queryFingerprint;
         let queryDefinition;
@@ -2137,25 +2309,32 @@ export class ProviderBase {
             const queryAuth = this.ResolveQueryCacheAuthorization(params, contextUser);
             // MaxRows/StartRow shape the result set — they MUST distinguish cache slots,
             // so fold them into the parameters portion of the fingerprint.
+            // Server-set values (ServerParameters, the Context.* values the query reads) shape the
+            // result too, so one user's slot never answers another user or another day.
+            const serverSegment = this.queryCacheServerSegment(params, contextUser, queryAuth);
             const fingerprintParams = {
                 ...(params.Parameters ?? {}),
                 __maxRows: params.MaxRows ?? -1,
-                __startRow: params.StartRow ?? 0
+                __startRow: params.StartRow ?? 0,
+                ...serverSegment,
+                ...(queryAuth.fieldSecurityKey ? { __fieldSecurity: queryAuth.fieldSecurityKey } : {})
             };
-            queryFingerprint = LocalCacheManager.Instance.GenerateRunQueryFingerprint(
-            // The RESOLVED identity when metadata resolves, so a request by ID, by name, or by
-            // both shares one slot (and a query's slots can be found by its ID). The caller's
-            // identity otherwise.
-            queryAuth.resolvable ? queryAuth.queryId : params.QueryID, queryAuth.resolvable ? queryAuth.queryName : params.QueryName, fingerprintParams, this.InstanceConnectionString, 
-            // B46: the full category path is a DISTINGUISHING element. Canonical resolved
-            // path when metadata resolves; the caller-stated path otherwise (runtime-created
-            // queries) — either way, same-named queries in different categories get
-            // different slots.
-            queryAuth.resolvable ? queryAuth.categoryPath : params.CategoryPath);
+            if (serverSegment !== null) {
+                queryFingerprint = LocalCacheManager.Instance.GenerateRunQueryFingerprint(
+                // The RESOLVED identity when metadata resolves, so a request by ID, by name, or by
+                // both shares one slot (and a query's slots can be found by its ID). The caller's
+                // identity otherwise.
+                queryAuth.resolvable ? queryAuth.queryId : params.QueryID, queryAuth.resolvable ? queryAuth.queryName : params.QueryName, fingerprintParams, this.InstanceConnectionString, 
+                // B46: the full category path is a DISTINGUISHING element. Canonical resolved
+                // path when metadata resolves; the caller-stated path otherwise (runtime-created
+                // queries) — either way, same-named queries in different categories get
+                // different slots.
+                queryAuth.resolvable ? queryAuth.categoryPath : params.CategoryPath);
+            }
             queryDefinition = queryAuth.definition;
             // TTL-enforced, and a miss when the slot was written under another query definition.
-            const cached = await LocalCacheManager.Instance.GetRunQueryResult(queryFingerprint, queryDefinition);
-            if (cached) {
+            const cached = queryFingerprint ? await LocalCacheManager.Instance.GetRunQueryResult(queryFingerprint, queryDefinition) : null;
+            if (cached && queryFingerprint) {
                 const serveFromSlot = () => ({
                     QueryID: cached.queryId ?? params.QueryID ?? '',
                     QueryName: params.QueryName ?? '',
@@ -2349,6 +2528,25 @@ export class ProviderBase {
         }
         EntityInfo.AssertEntityActiveStatus(entity, callerName);
     }
+    /**
+     * Emits a `[Deprecated]` warning when a cache-hit RunView served rows for a deprecated
+     * `AlternateBaseView` (or an alternate view whose ancestor in `ParentID` is deprecated).
+     * Cache misses log deprecation once inside `ResolveAlternateBaseView` during execution.
+     */
+    logDeprecatedAlternateBaseViewIfAny(params, callerName) {
+        const effectiveAbv = GetEffectiveAlternateBaseViewName(params);
+        if (!effectiveAbv) {
+            return;
+        }
+        const entity = this.ResolveRunViewEntitySync(params);
+        const abv = entity?.GetAlternateBaseView(effectiveAbv);
+        if (entity && abv?.IsDeprecated) {
+            LogStatusEx({
+                message: `[Deprecated] AlternateBaseView '${abv.Name}' on entity '${entity.Name}' is deprecated (called from ${callerName}).`,
+                verboseOnly: false,
+            });
+        }
+    }
     // Type aliases for cleaner code
     get PreRunViewResult() { return this._preRunViewResultType; }
     get PreRunViewsResult() { return this._preRunViewsResultType; }
@@ -2420,7 +2618,7 @@ export class ProviderBase {
         return entity.GetEffectiveRowFilterWhereClause(user, EntityPermissionType.Read, '');
     }
     /**
-     * The CLIENT's field-security cache key: a canonical list of the fields this user MAY read.
+     * The field-security cache key for one entity: a canonical list of the fields the user MAY read.
      *
      * Keyed on the ALLOWED set rather than the denied set for two reasons. Once metadata ships
      * to browsers filtered to what a user may see ([#3485](https://github.com/MemberJunction/MJ/issues/3485)),
@@ -2432,18 +2630,20 @@ export class ProviderBase {
      * Returns '' when the entity has field security off or the user is denied nothing, so
      * unrestricted users keep byte-identical fingerprints and shared slots.
      *
-     * Only takes effect once the client's metadata refreshes. A client on stale metadata
-     * computes a stale key; the backstop is that the server strips denied columns from every
-     * fresh fetch regardless.
+     * Reads the denied set through {@link ResolveRequestDeniedReadFields}, so the key and the
+     * SELECT list a database provider builds for the same request describe the same columns.
+     *
+     * @param params - The request; also the memo the denied set is shared through
+     * @param contextUser - The request's user; defaults to {@link CurrentUser}
      */
-    ComputeClientFLSAllowedKey(params) {
-        const user = this.CurrentUser;
-        if (!user || !params.EntityName)
+    ComputeClientFLSAllowedKey(params, contextUser) {
+        const user = contextUser ?? this.CurrentUser;
+        if (!user)
             return '';
-        const entity = this.EntityByName(params.EntityName);
-        if (!entity?.EnableFieldLevelSecurity)
+        const entity = this.ResolveRunViewEntitySync(params);
+        if (!entity)
             return '';
-        const denied = entity.GetDeniedReadFields(user);
+        const denied = this.ResolveRequestDeniedReadFields(params, entity, user);
         if (denied.size === 0)
             return '';
         return entity.Fields
@@ -2453,32 +2653,107 @@ export class ProviderBase {
             .join(',');
     }
     /**
-     * The field-security segment for a {@link LocalCacheManager} RunView fingerprint — the one
-     * place the client/server asymmetry is decided, so the two tiers cannot drift.
+     * The field-security segment for a {@link LocalCacheManager} RunView fingerprint, on both
+     * tiers: the slot a request reads and fills belongs to the user's permission class.
+     *
+     * - **The entity's allowed columns** ({@link ComputeClientFLSAllowedKey}). A database
+     *   provider selects only the columns the reader may see, so a restricted reader's fill is
+     *   narrower than an unrestricted one's, and the two must never share a slot. A browser
+     *   stores rows exactly as the server returned them and never projects on read, so its
+     *   slots need the same identity. It also keeps user searches apart: which rows match a
+     *   search depends on which columns the reader may search.
+     * - **For a saved view, the user's denials on every entity.** A view's stored clause can
+     *   reach other entities (nested view filters), and those clauses are only screened when the
+     *   database runs them, on a miss. Keying the slot on the whole denial profile means a hit
+     *   is only ever served from a fill by a user whose clauses screen identically.
+     *
+     * Empty for a user denied nothing, so unrestricted users keep byte-identical fingerprints
+     * and share slots. Read-time projection ({@link ApplyFieldSecurityProjection}) still runs on
+     * every hit and miss, as a backstop.
+     *
+     * @param params - The request
+     * @param contextUser - The request's user; defaults to {@link CurrentUser}. On a server
+     *   this must be the request's user, never the process user.
+     */
+    ComputeRunViewFLSFingerprintKey(params, contextUser) {
+        const user = contextUser ?? this.CurrentUser;
+        const allowed = this.ComputeClientFLSAllowedKey(params, user);
+        const namesView = !!(params.ViewID || params.ViewName || params.ViewEntity);
+        const profile = namesView && user ? this.ComputeFieldSecurityProfileKey(user) : '';
+        return profile ? `${allowed}#view:${profile}` : allowed;
+    }
+    /**
+     * Every field `user` may not read, across all entities: one `entityID:field,field` entry per
+     * entity on which the user is denied something, sorted. '' for a user denied nothing.
+     *
+     * @param user - The user whose denials to describe
+     */
+    ComputeFieldSecurityProfileKey(user) {
+        // Memoized per (catalog, user) and recomputed whenever field-security configuration or the
+        // user's roles change, so a saved-view RunView does not walk the catalog each time.
+        return FieldSecuritySQLGate.CatalogDenialProfileKey(this.Entities, user);
+    }
+    /**
+     * The fingerprint of the server-cache slot a RunView reads and fills for `contextUser`:
+     * the request, this provider's connection, the user's row-level-security clause and the
+     * user's field-security key. Every server path that reads or writes a RunView slot builds
+     * its fingerprint here, so none of them can leave a segment out — a path that omitted the
+     * user's segments would read or fill another permission class's slot.
+     *
+     * @param params - The request
+     * @param contextUser - The request's user; defaults to {@link CurrentUser}
+     */
+    ComputeRunViewCacheFingerprint(params, contextUser) {
+        return LocalCacheManager.Instance.GenerateRunViewFingerprint(params, this.InstanceConnectionString, this.ComputeRunViewRLSWhereClause(params, contextUser), undefined, this.ComputeRunViewFLSFingerprintKey(params, contextUser));
+    }
+    /**
+     * The field-security key a browser sends with a cached slot's status, and the one a server
+     * compares it with: a hash of {@link ComputeRunViewFLSFingerprintKey}, or '' for a user
+     * denied nothing.
      *
-     * **SERVER → no segment.** Its slots are full-width and shared by every user; per-request
-     * narrowing happens at read time in {@link ApplyFieldSecurityProjection}, which runs on
-     * every hit and every miss. A segment here would fragment one shared slot into one per
-     * permission class and protect nothing the projection does not already handle.
+     * The currency check otherwise compares only `maxUpdatedAt` and `rowCount`, and neither
+     * changes when a user loses a column. A browser whose metadata has not refreshed yet keeps
+     * its old slot (same fingerprint) and would be told "current" while still showing the
+     * column; with this key the server sees the mismatch and answers "stale" with fresh rows.
      *
-     * **CLIENT → the allowed-list key.** Its slots are stored exactly as the server returned
-     * them (already narrowed on the wire) and are not projected on read, so slot identity has to
-     * carry the field set. Without it, a user whose access is tightened keeps being served their
-     * persisted IndexedDB slot: the currency check compares `maxUpdatedAt` and `rowCount` only,
-     * neither of which notices a column, so the server answers "current" and the browser keeps
-     * showing a column that was just taken away.
+     * @param params - The request
+     * @param contextUser - The request's user; defaults to {@link CurrentUser}
+     */
+    ComputeFieldSecurityCacheStatusKey(params, contextUser) {
+        const key = this.ComputeRunViewFLSFingerprintKey(params, contextUser);
+        return key ? LocalCacheManager.Instance.HashSecuritySegment(key) : '';
+    }
+    /**
+     * The fields `user` may not read on `entity` for this one request, resolved once and reused by
+     * everything that asks again for the same request (`params` object), user object and entity.
      *
-     * Empty/undefined for unrestricted users on both tiers, so their fingerprints stay
-     * byte-identical and keep sharing slots.
+     * The cache key and the SELECT list are built at different moments of a request. Read
+     * independently, a metadata refresh landing between the two would key a slot for one
+     * permission class and fill it with another's columns. Sharing one answer per request rules
+     * that out. Empty when field security does not apply.
+     *
+     * @param params - The request; the memo is keyed on this object
+     * @param entity - The entity being read
+     * @param user - The request's user
      */
-    ComputeRunViewFLSFingerprintKey(params) {
-        return this.TrustLocalCacheCompletely ? undefined : this.ComputeClientFLSAllowedKey(params);
+    ResolveRequestDeniedReadFields(params, entity, user) {
+        if (!user) {
+            return new Set();
+        }
+        const memo = this._requestDeniedReadFields.get(params);
+        if (memo && memo.User === user && UUIDsEqual(memo.EntityID, entity.ID)) {
+            return memo.Denied;
+        }
+        const denied = entity.FieldLevelSecurityApplies ? entity.GetDeniedReadFields(user) : new Set();
+        this._requestDeniedReadFields.set(params, { User: user, EntityID: entity.ID, Denied: denied });
+        return denied;
     }
     /**
      * The fetch-widening field list for a cache-eligible request: always every entity field.
-     * One slot per (entity, filter, order) serves every caller regardless of the field subset
-     * they asked for, and field security narrows per request at read time via
-     * {@link ApplyFieldSecurityProjection}.
+     * One slot per (entity, filter, order, permission class) serves every caller regardless of
+     * the field subset they asked for. Field security is not applied here: a database provider
+     * leaves the user's denied columns out of the SELECT it builds from this list, and the slot
+     * key carries the user's class ({@link ComputeRunViewFLSFingerprintKey}).
      */
     ComputeRunViewFetchFields(entity, params) {
         const includeBinary = params?.IncludeBinaryFields === true;
@@ -2533,69 +2808,78 @@ export class ProviderBase {
     // FIELD-LEVEL SECURITY
     // ========================================================================
     /**
-     * Rejects a RunView whose `ExtraFilter`, `OrderBy`, or `Aggregates` expressions reference a
-     * field the user cannot read.
+     * Rejects a RunView whose caller-authored SQL reads a field the user cannot read: `ExtraFilter`,
+     * `OrderBy`, `OverrideExcludeFilter`, every `Aggregates[].expression`, and — when the request
+     * carries a loaded `ViewEntity` — that view's stored `WhereClause` and `OrderByClause`.
      *
      * Output projection alone is security theater. A user denied `Salary` can send
      * `ExtraFilter: "Salary > 200000"` or `OrderBy: "Salary DESC"` and reconstruct the values
      * from which rows come back and in what order — the column never appears in a result, so
      * every output-stripping point reports "secure." Aggregates are the same channel in a purer
      * form: `Aggregates: [{expression: 'MIN(Salary)'}]` under a narrow filter returns a denied
-     * field's exact values directly. Predicate validation is a first-class enforcement point,
-     * not a belt-and-braces afterthought. Together these cover every caller-authored expression
-     * surface (`UserSearchString` is handled by excluding denied fields from the searched set,
-     * not by rejection — see below).
+     * field's exact values directly. `UserSearchString` is handled by excluding denied fields from
+     * the searched set, not by rejection.
      *
-     * Lives at the provider layer rather than in the GraphQL resolver (where the plan first
-     * placed it) because every RunView funnels through here — the batch path, server-internal
-     * agents and actions running under a restricted `contextUser`, and the resolver alike. One
-     * gate, no path left uncovered.
+     * Lives at the provider layer because every RunView funnels through here — the batch path,
+     * server-internal agents and actions running under a restricted `contextUser`, and the
+     * resolver alike. A database provider checks the clauses it actually runs a second time, once
+     * a saved view is resolved, so a request that names only a `ViewID` is covered too.
      *
-     * The error deliberately does not say whether the field is missing or merely forbidden —
-     * see {@link ProviderBase.FieldSecurityDenialMessage}.
+     * The reading of each clause, and the error it raises, is {@link FieldSecuritySQLGate}'s.
      */
     AssertPredicatesRespectFieldSecurity(params, contextUser) {
-        if (!contextUser || !params.EntityName) {
+        if (!contextUser) {
             return;
         }
-        const entity = this.EntityByName(params.EntityName);
-        if (!entity?.EnableFieldLevelSecurity) {
-            return; // the overwhelmingly common case — one boolean, no allocation
-        }
-        const denied = entity.GetDeniedReadFields(contextUser);
-        if (denied.size === 0) {
+        const entity = this.ResolveRunViewEntitySync(params);
+        if (!entity) {
             return;
         }
-        // Map lowercased denied names back to their real casing for the message.
-        const deniedByName = new Map();
-        for (const field of entity.Fields) {
-            if (denied.has(field.Name.trim().toLowerCase())) {
-                deniedByName.set(field.Name.trim().toLowerCase(), field.Name);
-            }
-        }
-        // Aliases are deliberately not scanned — an alias names the output column, no data
-        // flows through it.
-        const clauses = [
+        const view = params.ViewEntity;
+        this.AssertClausesRespectFieldSecurityForEntity(entity, [
             params.ExtraFilter,
-            params.OrderBy,
+            params.OverrideExcludeFilter,
             ...(params.Aggregates ?? []).map(a => a?.expression),
-        ];
-        for (const clause of clauses) {
-            if (typeof clause !== 'string' || clause.length === 0) {
+            view ? view.Get('WhereClause') : undefined,
+        ], contextUser);
+        this.AssertSortRespectsFieldSecurityForEntity(entity, [
+            params.OrderBy,
+            view?.OrderByClause,
+        ], contextUser);
+    }
+    /**
+     * Throws a {@link FieldSecurityError} when any of `clauses` — SQL fragments that run against
+     * `entity`'s view — reads a field `user` cannot read, reads whole rows of an entity the user is
+     * denied fields on, or cannot be read well enough to tell. Non-string and blank entries are
+     * skipped. A no-op, with nothing scanned, for a user denied nothing on any entity.
+     *
+     * The shared entry point for every clause slot a provider runs: RunView parameters, a saved
+     * view's stored clauses, dataset item filters, user-search text spliced as SQL.
+     */
+    AssertClausesRespectFieldSecurityForEntity(entity, clauses, user) {
+        this.assertFragmentsAllowed(entity, clauses, user, (sql, context) => FieldSecuritySQLGate.FindViolation(sql, context));
+    }
+    /**
+     * {@link AssertClausesRespectFieldSecurityForEntity} for ORDER BY fragments, which also refuses
+     * a sort by column position for a user denied a field on `entity`
+     * ({@link FieldSecuritySQLGate.FindSortViolation}).
+     */
+    AssertSortRespectsFieldSecurityForEntity(entity, orderBys, user) {
+        this.assertFragmentsAllowed(entity, orderBys, user, (sql, context) => FieldSecuritySQLGate.FindSortViolation(sql, context));
+    }
+    /** Throws the field-security error for the first of `fragments` that `find` refuses. */
+    assertFragmentsAllowed(entity, fragments, user, find) {
+        const context = { User: user, Dialect: this.PlatformKey, Catalog: this.Entities, TargetEntity: entity };
+        for (const clause of fragments) {
+            if (typeof clause !== 'string' || clause.trim().length === 0) {
                 continue;
             }
-            const hits = FindReferencedIdentifiers(clause, deniedByName.values());
-            if (hits.length > 0) {
-                LogDebug(`[FieldSecurity] Rejected RunView on '${entity.Name}' for user ${contextUser.Email}: ` +
-                    `predicate references denied field(s) ${hits.join(', ')}`);
-                throw new FieldSecurityError(hits[0], entity.Name);
+            const violation = find(clause, context);
+            if (violation) {
+                LogDebug(`[FieldSecurity] Rejected SQL on '${entity.Name}' for user ${user.Email}: ${violation.Kind} ${violation.Reference}`);
+                throw FieldSecuritySQLGate.ErrorForViolation(violation, entity.Name);
             }
         }
-        // UserSearchString is not a predicate the caller authored — it is a search term the
-        // platform expands across IncludeInUserSearchAPI fields. There is nothing to reject;
-        // the correct handling is to not search the denied fields, which the SQL builder does
-        // by consulting the same denied set. Rejecting here would make the search box fail
-        // for a term that merely happens to match a restricted field's name.
     }
     /**
      * The single wording for "you cannot use this field," modeled on SQL Server's posture of
@@ -2615,15 +2899,13 @@ export class ProviderBase {
     /**
      * Strips fields the user cannot read from plain-object result rows.
      *
-     * This is the primary read-time control for list results, and it runs on BOTH cache hits
-     * and cache misses — the property the rest of the cache design is arranged around. Because
-     * it reads live metadata, a permission change takes effect on the next metadata refresh
-     * with no result-cache invalidation: the cached full-width superset stays valid and only
-     * the projection changes.
-     *
-     * It composes with two per-request, never-cached narrowings that avoid pulling columns a
-     * restricted service account has no business holding: the `simple`-path SELECT-list
-     * intersection, and `Load()`'s allowed-column SELECT.
+     * The backstop behind slot segmentation: cache slots are keyed by the reader's permission
+     * class ({@link ComputeRunViewFLSFingerprintKey}) and filled with only that class's columns,
+     * and this still runs on BOTH cache hits and cache misses, checking every row. A slot can hold
+     * more than its class may read (an `entity_object` fill selects every column, and a slot keyed
+     * just before a permission change keeps its old width), and this is what keeps such a slot
+     * from reaching a reader. It reads live metadata, so a tightened permission applies here from
+     * the next metadata refresh.
      *
      * NEVER applied to `entity_object` results. Those become `BaseEntity` instances whose
      * fields round-trip through `GenerateSaveSQL`, which iterates ALL `IsSPParameter` fields
@@ -2633,11 +2915,11 @@ export class ProviderBase {
      * output, which the GraphQL layer enforces separately.
      */
     ApplyFieldSecurityProjection(rows, params, contextUser) {
-        if (!rows?.length || !contextUser || !params.EntityName || params.ResultType === 'entity_object') {
+        if (!rows?.length || !contextUser || params.ResultType === 'entity_object') {
             return rows;
         }
-        const entity = this.EntityByName(params.EntityName);
-        if (!entity?.EnableFieldLevelSecurity) {
+        const entity = this.ResolveRunViewEntitySync(params);
+        if (!entity?.FieldLevelSecurityApplies) {
             return rows;
         }
         const denied = entity.GetDeniedReadFields(contextUser);
@@ -2648,32 +2930,78 @@ export class ProviderBase {
     }
     /**
      * Row-loop half of {@link ApplyFieldSecurityProjection}, split out so the policy above reads
-     * as policy. Mirrors {@link ProjectRowsToFields}' matching semantics (trim + lowercase) and
-     * its no-op probe: when the first row carries none of the denied keys, the whole result is
-     * returned untouched rather than rebuilt row by row.
+     * as policy. Mirrors {@link ProjectRowsToFields}' matching semantics (trim + lowercase).
+     *
+     * Every row is checked on its own: rows in one result need not share a shape (a slot can mix
+     * rows written by different paths), so no row stands in for the others. A row carrying no
+     * denied key is kept as is, and when none do the input array itself is returned.
+     *
+     * The per-key work (trim, lowercase, set lookup) is done once per key SHAPE rather than once
+     * per row: rows with the same keys in the same order share one {@link RowProjectionPlan}. A
+     * result is almost always a single shape, so a restricted user's 10k-row result pays for one
+     * row's worth of key matching plus a copy per row.
      *
      * @param deniedLowercase field names to omit, already lowercased
      */
     static omitFieldsFromRows(rows, deniedLowercase) {
-        const probe = rows[0];
-        if (!probe || typeof probe !== 'object') {
-            return rows;
+        const plans = { Last: null, BySignature: new Map() };
+        let changed = false;
+        const projected = rows.map((row) => {
+            const narrowed = ProviderBase.omitFieldsFromRow(row, deniedLowercase, plans);
+            changed = changed || narrowed !== row;
+            return narrowed;
+        });
+        return changed ? projected : rows;
+    }
+    /** One row of {@link omitFieldsFromRows}: the row itself when it carries no denied key, else a copy without them. */
+    static omitFieldsFromRow(row, deniedLowercase, plans) {
+        if (!row || typeof row !== 'object') {
+            return row;
         }
-        const keysToOmit = Object.keys(probe).filter(k => deniedLowercase.has(k.trim().toLowerCase()));
-        if (keysToOmit.length === 0) {
-            return rows;
+        const source = row;
+        const keys = Object.keys(source);
+        const plan = ProviderBase.rowProjectionPlanFor(keys, deniedLowercase, plans);
+        if (!plan.Keep) {
+            return row;
         }
-        const omit = new Set(keysToOmit);
-        return rows.map((row) => {
-            const source = row;
-            const filtered = {};
-            for (const key of Object.keys(source)) {
-                if (!omit.has(key)) {
-                    filtered[key] = source[key];
-                }
+        const filtered = {};
+        for (const key of plan.Keep) {
+            filtered[key] = source[key];
+        }
+        return filtered;
+    }
+    /**
+     * The plan for a row with exactly these keys, built on first sight of the shape. The last plan
+     * used is tried first; otherwise plans are found by the joined key list. Either way the plan's
+     * own key list is compared with the row's before it is used, so two different shapes can
+     * never share a plan.
+     */
+    static rowProjectionPlanFor(keys, deniedLowercase, plans) {
+        if (plans.Last && ProviderBase.sameKeys(plans.Last.Keys, keys)) {
+            return plans.Last; // consecutive rows nearly always share a shape: no signature to build
+        }
+        const signature = keys.join('\u0000');
+        let plan = plans.BySignature.get(signature);
+        if (!plan || !ProviderBase.sameKeys(plan.Keys, keys)) {
+            const keep = keys.some(k => deniedLowercase.has(k.trim().toLowerCase()))
+                ? keys.filter(k => !deniedLowercase.has(k.trim().toLowerCase()))
+                : null;
+            plan = { Keys: keys, Keep: keep };
+            plans.BySignature.set(signature, plan);
+        }
+        plans.Last = plan;
+        return plan;
+    }
+    static sameKeys(a, b) {
+        if (a.length !== b.length) {
+            return false;
+        }
+        for (let i = 0; i < a.length; i++) {
+            if (a[i] !== b[i]) {
+                return false;
             }
-            return filtered;
-        });
+        }
+        return true;
     }
     /**
      * Strips or narrows the `MJ: Record Changes` payload columns a user may not read, using the
@@ -2685,6 +3013,9 @@ export class ProviderBase {
      * Everything about the per-row denied set, the payload treatment, and the fail-closed decision
      * lives in {@link RecordChangeFieldSecurityProjector}; this is only the RunView wiring.
      *
+     * A request whose entity cannot be resolved without I/O (only a `ViewID` or `ViewName`) is
+     * projected too, so a saved view over Record Changes is not a way around it.
+     *
      * Runs at all four RunView projection points, matching the main projection: both cache-hit
      * paths and both cache-miss paths. The cache-hit path is not optional — it is the exact path
      * the original cross-user leak runs through, an unrestricted user warming a full-width slot
@@ -2707,9 +3038,13 @@ export class ProviderBase {
         if (!rows?.length || !contextUser || params.ResultType === 'entity_object') {
             return rows;
         }
-        if (!RecordChangeFieldSecurityProjector.IsRecordChangesEntity(this.ResolveRunViewEntitySync(params))) {
+        const entity = this.ResolveRunViewEntitySync(params);
+        if (entity && !RecordChangeFieldSecurityProjector.IsRecordChangesEntity(entity)) {
             return rows;
         }
+        // An entity that does not resolve here (a ViewID/ViewName-only request) may be Record
+        // Changes. The projector decides per row from the row's own EntityID and fails closed on a
+        // row without one; rows that carry no payload column come back untouched.
         return new RecordChangeFieldSecurityProjector(this, contextUser).ProjectRows(rows);
     }
     /**
@@ -2741,6 +3076,9 @@ export class ProviderBase {
         // Hooks run after PlatformSQL resolution so they see plain-string filters,
         // and before cache fingerprinting so injected filters affect the cache key.
         params = await this.RunPreRunViewHooks(params, contextUser);
+        // A stored view's property values are worked out before the cache lookup, so the
+        // fingerprint keys on them. After hooks, so a hook can set ServerProperties.
+        await this.PrepareRunViewProperties(params, contextUser);
         // Field-level security: reject predicates referencing unreadable fields. Runs AFTER
         // hooks so injected filters are scanned too, and BEFORE the cache lookup so a rejected
         // request never consults (or warms) a cache slot.
@@ -2752,6 +3090,7 @@ export class ProviderBase {
             EntityName: params.EntityName,
             ViewID: params.ViewID,
             ViewName: params.ViewName,
+            AlternateBaseView: GetEffectiveAlternateBaseViewName(params),
             ExtraFilter: params.ExtraFilter,
             OrderBy: params.OrderBy,
             ResultType: params.ResultType,
@@ -2771,39 +3110,29 @@ export class ProviderBase {
         await this.EntityStatusCheck(params, 'PreRunView', contextUser);
         const entityCheckTime = performance.now() - entityCheckStart;
         // Save the caller's original Fields request for post-cache filtering.
-        // We always fetch ALL fields from the DB so the cache entry is a universal superset
-        // that satisfies any future query for the same entity+filter regardless of field subset.
+        // When widening happens (full-row read, a cache-eligible read on the server, explicit
+        // CacheLocal: true, or entity_object), we fetch every field this user's permission class
+        // may read so the cache entry is a superset for that class, and project the result back to
+        // the caller's Fields. A narrow Fields read first checks any already-warm superset slot
+        // (0-SQL hit). Only CacheLocal: false or BypassCache: true keep the caller's narrow SQL
+        // projection on a miss, and then nothing is written to the cache.
         const entityLookupStart = performance.now();
-        let callerRequestedFields = params.Fields && params.Fields.length > 0
+        const rawCallerRequestedFields = params.Fields && params.Fields.length > 0
             ? params.Fields.map(f => f.trim().toLowerCase())
             : null; // null = caller wants all fields
-        // Only override Fields to the widened fetch set when caching will actually happen
-        // for this call. For non-cached calls we respect the caller's narrow Fields
-        // end-to-end — there's no cache-coherence concern to preserve. The widened set is
-        // ALL entity fields, for every user: the server cache holds full-width slots and
-        // narrows per request at read time (ApplyFieldSecurityProjection).
         const entity = params.EntityName ? this.EntityByName(params.EntityName) : null;
-        const willCache = this.runViewCacheEligible(params);
-        // entity_object ALWAYS widens, cache-eligible or not: a BaseEntity must hydrate from
-        // every column it is entitled to, or it round-trips partial state into a save. This
-        // must happen here rather than only in the server's PreProcessRunView, which is not on
-        // the client's path — a client entity_object request without CacheLocal would otherwise
-        // ship the caller's narrow Fields over the wire and materialize partial entities. What a
-        // field-restricted user RECEIVES is still their allowed set: the server strips denied
-        // columns on the wire, and the missing keys mark those fields not-loaded.
-        const widenForEntityObject = params.ResultType === 'entity_object';
         if (entity)
             this.ResolveIncludeBinaryFields(params, entity);
-        if (entity && (willCache || widenForEntityObject)) {
-            params.Fields = this.ComputeRunViewFetchFields(entity, params);
-            // Platform contract: explicit Fields always include the primary key(s) —
-            // project back down to requested ∪ PK, matching the direct SQL path.
-            if (callerRequestedFields) {
-                callerRequestedFields = ProviderBase.UnionFieldsWithPrimaryKeys(callerRequestedFields, entity);
-            }
-        }
+        const projectedCallerFields = (rawCallerRequestedFields && entity)
+            ? ProviderBase.UnionFieldsWithPrimaryKeys(rawCallerRequestedFields, entity)
+            : rawCallerRequestedFields;
+        const canReadFromCache = this.runViewCacheEligible(params);
+        const willPopulateCache = this.shouldWidenAndPopulateCache(params) && (!this.hasNarrowFieldsOverride(params) || Boolean(entity));
+        // entity_object ALWAYS widens, cache-eligible or not: a BaseEntity must hydrate from
+        // every column it is entitled to, or it round-trips partial state into a save.
+        const widenForEntityObject = params.ResultType === 'entity_object';
         const entityLookupTime = performance.now() - entityLookupStart;
-        // Check local cache if enabled
+        // Check local cache FIRST if enabled (before any cache-miss Fields widening)
         const cacheCheckStart = performance.now();
         let cacheStatus = 'disabled';
         let cachedResult;
@@ -2819,29 +3148,26 @@ export class ProviderBase {
         // fails closed (or resolves ViewEntity synchronously) to plug that hole.
         const cacheReadDenied = (!!entity && !!contextUser && !(entity.GetUserPermisions(contextUser)?.CanRead ?? false)) ||
             this.cacheDeniedForViewOnlyRequest(params, contextUser);
-        if (willCache && !cacheReadDenied && LocalCacheManager.Instance.IsInitialized) {
-            const rlsWhereClause = this.ComputeRunViewRLSWhereClause(params, contextUser);
-            const flsFieldsKey = this.ComputeRunViewFLSFingerprintKey(params);
-            fingerprint = LocalCacheManager.Instance.GenerateRunViewFingerprint(params, this.InstanceConnectionString, rlsWhereClause, undefined, flsFieldsKey);
+        if (canReadFromCache && !cacheReadDenied && LocalCacheManager.Instance.IsInitialized) {
+            fingerprint = this.ComputeRunViewCacheFingerprint(params, contextUser);
             const cached = await LocalCacheManager.Instance.GetRunViewResult(fingerprint);
             if (cached) {
                 // These rows are the cache's shared, deep-frozen objects — the runtime freeze is
                 // what stops a consumer from corrupting the cache. Anything that needs to
                 // transform them must map onto copies.
-                let results = cached.results;
-                if (callerRequestedFields && params.ResultType !== 'entity_object') {
-                    results = ProjectRowsToFields(results, callerRequestedFields);
+                // Materialize any encrypted fields stored as ciphertext at rest before projection.
+                let results = await this.MaterializeCachedRowsForCaller(cached.results, entity, contextUser, Boolean(params.PreserveRestrictedApiCiphertext));
+                if (projectedCallerFields && params.ResultType !== 'entity_object') {
+                    results = ProjectRowsToFields(results, projectedCallerFields);
                 }
                 // Field-level security MUST be applied here, not only in PostRunView: this path
                 // RETURNS (see RunView) without ever calling PostRunView, and it is the exact
-                // path the cross-user leak runs through — an unrestricted user warms the cache
-                // with every column, then a restricted user hits that same slot. The cache is
-                // column-agnostic by design (one entry serves every field subset), so the
-                // caller's Fields list is unrelated to security and cannot be relied on.
+                // path a cross-user leak would run through. Slots are keyed by permission class,
+                // but a slot can still be wider than its class (an entity_object fill selects
+                // every column), and the caller's Fields list is unrelated to security.
                 results = this.ApplyFieldSecurityProjection(results, params, contextUser);
-                // Record Changes payload security, on the same cache-hit path and for the same
-                // reason: the slot is shared and full-width, so whoever warmed it decides nothing
-                // about who may read what out of it.
+                // Record Changes payload security, on the same cache-hit path: its denials belong
+                // to the entity each row is about, which the Record Changes slot key cannot carry.
                 results = this.ApplyRecordChangeFieldSecurityProjection(results, params, contextUser);
                 // Reconstruct RunViewResult from cached data
                 cachedResult = {
@@ -2857,6 +3183,7 @@ export class ProviderBase {
                     AggregateResults: LocalCacheManager.Instance.ReorderAggregateResultsToRequest(cached.aggregateResults, params.Aggregates)
                 };
                 cacheStatus = 'hit';
+                this.logDeprecatedAlternateBaseViewIfAny(params, 'PreRunView');
                 if (!params.CacheLocal && this.TrustLocalCacheCompletely) {
                     LogStatusEx({ message: `  ✅ [Server Cache HIT] RunView "${params.EntityName || params.ViewName || 'unknown'}" — ${results.length} rows served from server cache (no DB query)`, verboseOnly: true });
                 }
@@ -2865,41 +3192,48 @@ export class ProviderBase {
                 cacheStatus = 'miss';
             }
         }
+        // On cache MISS (or uninitialized cache), widen Fields ONLY when populating a superset
+        // cache slot or materializing full BaseEntity objects.
+        let callerRequestedFieldsForPost = null;
+        if (cacheStatus !== 'hit' && entity && (willPopulateCache || widenForEntityObject)) {
+            params.Fields = this.ComputeRunViewFetchFields(entity, params);
+            if (willPopulateCache && projectedCallerFields) {
+                callerRequestedFieldsForPost = projectedCallerFields;
+            }
+        }
         const cacheCheckTime = performance.now() - cacheCheckStart;
         const totalPreTime = performance.now() - preViewStart;
         if (totalPreTime > 50) {
-            LogStatus(`[PERF-PRE] PreRunView ${params.EntityName}: ${totalPreTime.toFixed(1)}ms (telemetry=${telemetryTime.toFixed(1)}ms, entityCheck=${entityCheckTime.toFixed(1)}ms, entityLookup=${entityLookupTime.toFixed(1)}ms, cache=${cacheCheckTime.toFixed(1)}ms)`);
+            LogStatusEx({ message: `[PERF-PRE] PreRunView ${params.EntityName}: ${totalPreTime.toFixed(1)}ms (telemetry=${telemetryTime.toFixed(1)}ms, entityCheck=${entityCheckTime.toFixed(1)}ms, entityLookup=${entityLookupTime.toFixed(1)}ms, cache=${cacheCheckTime.toFixed(1)}ms)`, verboseOnly: true });
         }
         return {
             telemetryEventId,
             cacheStatus,
             cachedResult,
             fingerprint,
-            // Only non-null when params.Fields was actually widened above — tells
+            // Only non-null when params.Fields was actually widened for cache population — tells
             // PostRunView to project cache-miss DB results back to the caller's shape
-            callerRequestedFields: (entity && willCache) ? callerRequestedFields : null
+            callerRequestedFields: callerRequestedFieldsForPost,
+            populateCache: willPopulateCache,
         };
     }
     /**
      * Pre-processing hook for RunViews (batch).
      * Handles telemetry, validation, and cache lookup for multiple views.
+     * A view the field-security predicate gate refuses is left out of every later stage and
+     * reported in `refusedResults`; the cache status describes the admitted views only.
      * @param params - Array of view parameters
      * @param contextUser - Optional user context
-     * @returns Pre-processing result with cache status for each view
+     * @returns Pre-processing result with cache status for each admitted view
      */
     async PreRunViews(params, contextUser) {
         // Resolve any PlatformSQL values to plain strings for the active platform
         for (const p of params) {
             this.ResolvePlatformSQLInParams(p);
         }
-        // Run registered PreRunView hooks on each param in the batch
-        for (let i = 0; i < params.length; i++) {
-            params[i] = await this.RunPreRunViewHooks(params[i], contextUser);
-            // Field-level security predicate gate, same contract as the single-view path.
-            // One bad view rejects the whole batch — a batch is one caller request, and
-            // silently returning partial results would hide the denial.
-            this.AssertPredicatesRespectFieldSecurity(params[i], contextUser);
-        }
+        // Run registered PreRunView hooks on each param in the batch, then the field-security
+        // predicate gate (after the hooks, so injected filters are scanned too).
+        const refusedResults = await this.runBatchHooksAndPredicateGate(params, contextUser);
         // Start telemetry tracking for batch operation
         const fromEngine = params.some(p => p._fromEngine);
         const telemetryEventId = TelemetryManager.Instance.StartEvent('RunView', 'ProviderBase.RunViews', {
@@ -2921,6 +3255,7 @@ export class ProviderBase {
             // client), which is exactly what a keyset sweep does on every page.
             StartRows: params.map(p => p.StartRow),
             AfterKeys: params.map(p => p.AfterKey?.ToConcatenatedString()),
+            AlternateBaseViews: params.map(p => GetEffectiveAlternateBaseViewName(p)),
             // Exemption was threaded through the DEPRECATED batch twin but not this one, so
             // RunViewParams.Telemetry.Exempt was silently ineffective for every batch RunView —
             // and, because RunView() delegates here whenever BypassCache or AfterKey is set,
@@ -2934,21 +3269,74 @@ export class ProviderBase {
             ExemptReason: params.find(p => p.Telemetry?.Reason)?.Telemetry?.Reason,
             _fromEngine: fromEngine
         }, contextUser?.ID);
+        // A refused view never reaches a cache lookup, the smart cache check or the database.
+        const admitted = refusedResults ? params.filter((_, i) => !refusedResults.has(i)) : params;
+        const preResult = await this.lookUpAdmittedViews(admitted, telemetryEventId, contextUser);
+        return refusedResults ? { ...preResult, refusedResults } : preResult;
+    }
+    /**
+     * Runs each view's PreRunView hooks, replacing `params[i]` with the hooked params, then the
+     * field-security predicate gate — the same contract as the single-view path, except that a
+     * refusal fails only its own view: it becomes that view's `Success: false` result, carrying
+     * the refusal's ambiguous message, so the views batched with it still run. A batch is often
+     * several independent reads (a dashboard's panels), and one unreadable column in one of them
+     * must not blank the rest; the refusal is still reported, at the refused view's index. Any
+     * other error from the gate is thrown and fails the batch.
+     * @returns The refused views' results keyed by batch index, or `undefined` when none was refused.
+     */
+    async runBatchHooksAndPredicateGate(params, contextUser) {
+        let refused;
+        for (let i = 0; i < params.length; i++) {
+            params[i] = await this.RunPreRunViewHooks(params[i], contextUser);
+            await this.PrepareRunViewProperties(params[i], contextUser);
+            try {
+                this.AssertPredicatesRespectFieldSecurity(params[i], contextUser);
+            }
+            catch (error) {
+                refused ??= new Map();
+                refused.set(i, ProviderBase.fieldSecurityRefusalAsResult(error));
+            }
+        }
+        return refused;
+    }
+    /** `error` as a failed view result when it is a field-security refusal; otherwise rethrows it. */
+    static fieldSecurityRefusalAsResult(error) {
+        if (!(error instanceof Error) || (!(error instanceof FieldSecurityError) && error.name !== FieldSecurityError.ErrorName)) {
+            throw error;
+        }
+        return { Success: false, Results: [], RowCount: 0, TotalRowCount: 0, ExecutionTime: 0, UserViewRunID: '', ErrorMessage: error.message };
+    }
+    /**
+     * The cache stage of PreRunViews for the views the predicate gate admitted. An empty batch
+     * (every view refused) is reported as fully cached, so the pipeline returns without a
+     * database call and still ends the batch's telemetry event.
+     */
+    async lookUpAdmittedViews(params, telemetryEventId, contextUser) {
+        if (params.length === 0) {
+            return { telemetryEventId, allCached: true, cachedResults: [] };
+        }
         // Client-side providers route any CacheLocal params through smart-cache-check:
         // a single batched GraphQL call sends fingerprints (hashes + counts) per view,
         // the server confirms current vs stale, and only stale views return data.
         // Server-side providers trust the cache completely and fall through to the
         // traditional flow which returns cached data immediately on hit.
         if (!this.TrustLocalCacheCompletely) {
-            const useSmartCacheCheck = params.some(p => p.CacheLocal);
+            // The cache-check transport carries dynamic runs only, so a batch holding a run with view
+            // properties takes the ordinary path, where the view and its properties reach the server.
+            const useSmartCacheCheck = params.some(p => p.CacheLocal) && !params.some(ProviderBase.carriesViewProperties);
             if (useSmartCacheCheck && LocalCacheManager.Instance.IsInitialized) {
                 return this.prepareSmartCacheCheckParams(params, telemetryEventId, contextUser);
             }
         }
+        return this.lookUpBatchCache(params, telemetryEventId, contextUser);
+    }
+    /** The server's trusted-cache lookup for a batch: serves hits, and lists the misses to run. */
+    async lookUpBatchCache(params, telemetryEventId, contextUser) {
         // Traditional caching flow
         const cacheStatusMap = new Map();
         const callerFieldsMap = new Map();
         const fingerprintMap = new Map();
+        const populateCacheSet = new Set();
         const uncachedParams = [];
         const cachedResults = [];
         let allCached = true;
@@ -2956,31 +3344,22 @@ export class ProviderBase {
             const param = params[i];
             // Entity status check
             await this.EntityStatusCheck(param, 'PreRunViews', contextUser);
-            // Save caller's original Fields, then always fetch all fields from DB.
-            // One cache entry per entity+filter satisfies all field subsets.
-            let callerFields = param.Fields && param.Fields.length > 0
+            // Save caller's original Fields. Consult warm superset cache slots first (0-SQL hit),
+            // and on cache miss widen Fields ONLY when populating a superset cache slot or
+            // materializing BaseEntity instances.
+            const rawCallerFields = param.Fields && param.Fields.length > 0
                 ? param.Fields.map(f => f.trim().toLowerCase())
                 : null;
-            // Only override Fields to the widened fetch set when caching will actually happen
-            // for this call. For non-cached calls we respect the caller's narrow Fields
-            // end-to-end — there's no cache-coherence concern to preserve. Widened = ALL
-            // fields, for every user (see PreRunView).
             const batchEntity = param.EntityName ? this.EntityByName(param.EntityName) : null;
-            const batchWillCache = this.runViewCacheEligible(param);
-            // Same entity_object-always-widens rule as the single-view path above.
-            const batchWidenForEntityObject = param.ResultType === 'entity_object';
             if (batchEntity)
                 this.ResolveIncludeBinaryFields(param, batchEntity);
-            if (batchEntity && (batchWillCache || batchWidenForEntityObject)) {
-                param.Fields = this.ComputeRunViewFetchFields(batchEntity, param);
-                // Platform contract: explicit Fields always include the primary key(s)
-                if (callerFields) {
-                    callerFields = ProviderBase.UnionFieldsWithPrimaryKeys(callerFields, batchEntity);
-                    // Remember the caller's original shape so PostRunViews can project
-                    // cache-miss DB results back down to it
-                    callerFieldsMap.set(i, callerFields);
-                }
-            }
+            const projectedCallerFields = (rawCallerFields && batchEntity)
+                ? ProviderBase.UnionFieldsWithPrimaryKeys(rawCallerFields, batchEntity)
+                : rawCallerFields;
+            const batchCanReadCache = this.runViewCacheEligible(param);
+            const batchWillPopulateCache = this.shouldWidenAndPopulateCache(param) && (!this.hasNarrowFieldsOverride(param) || Boolean(batchEntity));
+            // Same entity_object-always-widens rule as the single-view path above.
+            const batchWidenForEntityObject = param.ResultType === 'entity_object';
             // Check local cache if enabled or if server trusts its cache completely
             // BypassCache skips cache entirely — used by maintenance actions querying for
             // records that were inserted via direct SQL (bypassing BaseEntity.Save())
@@ -2990,21 +3369,19 @@ export class ProviderBase {
             // view-only fail-closed gate for ViewID/ViewName-only requests (no resolvable entity).
             const batchCacheReadDenied = (!!batchEntity && !!contextUser && !(batchEntity.GetUserPermisions(contextUser)?.CanRead ?? false)) ||
                 this.cacheDeniedForViewOnlyRequest(param, contextUser);
-            if (batchWillCache && !batchCacheReadDenied && LocalCacheManager.Instance.IsInitialized) {
-                const rlsWhereClause = this.ComputeRunViewRLSWhereClause(param, contextUser);
-                const flsFieldsKey = this.ComputeRunViewFLSFingerprintKey(param);
-                const fingerprint = LocalCacheManager.Instance.GenerateRunViewFingerprint(param, this.InstanceConnectionString, rlsWhereClause, undefined, flsFieldsKey);
+            if (batchCanReadCache && !batchCacheReadDenied && LocalCacheManager.Instance.IsInitialized) {
+                const fingerprint = this.ComputeRunViewCacheFingerprint(param, contextUser);
                 fingerprintMap.set(i, fingerprint);
                 const cached = await LocalCacheManager.Instance.GetRunViewResult(fingerprint);
                 if (cached) {
                     // Shared, deep-frozen cache rows — same contract as the single-view hit path.
-                    let results = cached.results;
-                    if (callerFields && param.ResultType !== 'entity_object') {
-                        results = ProjectRowsToFields(results, callerFields);
+                    let results = await this.MaterializeCachedRowsForCaller(cached.results, batchEntity, contextUser, Boolean(param.PreserveRestrictedApiCiphertext));
+                    if (projectedCallerFields && param.ResultType !== 'entity_object') {
+                        results = ProjectRowsToFields(results, projectedCallerFields);
                     }
                     // Field-level security on the batch cache-hit path — same reasoning as the
                     // single-view path in PreRunView: this result is returned without
-                    // PostRunViews projecting it, and the cached superset is column-agnostic.
+                    // PostRunViews projecting it, and a slot can be wider than its class.
                     results = this.ApplyFieldSecurityProjection(results, param, contextUser);
                     results = this.ApplyRecordChangeFieldSecurityProjection(results, param, contextUser);
                     const cachedViewResult = {
@@ -3021,6 +3398,7 @@ export class ProviderBase {
                     };
                     // if needed this will transform each result into an entity object
                     await this.TransformSimpleObjectToEntityObject(param, cachedViewResult, contextUser);
+                    this.logDeprecatedAlternateBaseViewIfAny(param, 'PreRunViews');
                     if (!param.CacheLocal && this.TrustLocalCacheCompletely) {
                         LogStatusEx({ message: `    ✅ [Server Cache HIT] RunViews "${param.EntityName || param.ViewName || 'unknown'}" — ${cached.results.length} rows served from server cache (no DB query)`, verboseOnly: true });
                     }
@@ -3035,6 +3413,15 @@ export class ProviderBase {
             else {
                 cacheStatusMap.set(i, { status: 'disabled' });
             }
+            if (batchWillPopulateCache) {
+                populateCacheSet.add(i);
+            }
+            if (batchEntity && (batchWillPopulateCache || batchWidenForEntityObject)) {
+                param.Fields = this.ComputeRunViewFetchFields(batchEntity, param);
+                if (batchWillPopulateCache && projectedCallerFields) {
+                    callerFieldsMap.set(i, projectedCallerFields);
+                }
+            }
             allCached = false;
             uncachedParams.push(param);
             cachedResults.push(null); // Placeholder for uncached
@@ -3049,7 +3436,8 @@ export class ProviderBase {
             uncachedParams: allCached ? undefined : uncachedParams,
             cacheStatusMap,
             callerFieldsMap: callerFieldsMap.size > 0 ? callerFieldsMap : undefined,
-            fingerprintMap: fingerprintMap.size > 0 ? fingerprintMap : undefined
+            fingerprintMap: fingerprintMap.size > 0 ? fingerprintMap : undefined,
+            populateCacheSet,
         };
     }
     /**
@@ -3105,6 +3493,8 @@ export class ProviderBase {
                 smartCacheCheckParams[paramIndex].cacheStatus = {
                     maxUpdatedAt: cached.maxUpdatedAt,
                     rowCount: cached.rowCount,
+                    // Lets the server answer "stale" when this user's columns changed but no row did.
+                    fieldSecurityKey: this.ComputeFieldSecurityCacheStatusKey(params[paramIndex], contextUser),
                 };
             }
         }
@@ -3427,31 +3817,53 @@ export class ProviderBase {
      * @param preResult - The pre-processing result
      * @param contextUser - Optional user context
      */
+    /**
+     * Hook allowing server database providers to substitute pre-decryption (ciphertext-preserving)
+     * rows before storing view results in {@link LocalCacheManager} / Redis, ensuring decrypted
+     * plaintext secrets are never persisted in local or shared caches.
+     *
+     * Client-side providers inherit this default identity implementation.
+     */
+    PrepareRowsForCacheStorage(rows, _entityInfo) {
+        return rows;
+    }
+    /**
+     * Hook allowing server database providers to decrypt ciphertext-at-rest rows retrieved from
+     * {@link LocalCacheManager} for in-process callers (or selectively preserve restricted
+     * ciphertext when `preserveRestrictedApiCiphertext` is `true`).
+     *
+     * Client-side providers inherit this default identity implementation.
+     */
+    async MaterializeCachedRowsForCaller(rows, _entityInfo, _contextUser, _preserveRestrictedApiCiphertext) {
+        return rows;
+    }
     async PostRunView(result, params, preResult, contextUser) {
         // Store in local cache BEFORE entity transformation — the cache needs
         // plain JSON-serializable objects. BaseEntity objects contain RxJS Subjects
         // with circular subscriber references that break JSON.stringify.
         // On cache read, TransformSimpleObjectToEntityObject is called to restore
         // entity objects when ResultType === 'entity_object'.
-        // runViewCacheEligible is the same predicate PreRunView used to decide whether to
-        // widen Fields — only widened (superset) results may be written to the cache.
-        // preResult.fingerprint doubles as a guard (only computed when eligible).
-        if (this.runViewCacheEligible(params) && result.Success && preResult.fingerprint && LocalCacheManager.Instance.IsInitialized) {
+        // preResult.populateCache records PreRunView's widening decision so narrow Fields
+        // queries (without CacheLocal: true) never poison the Fields-agnostic superset slot.
+        const resolvedEntity = this.resolveEntityForRunViewParams(params);
+        const shouldPopulateSlot = preResult.populateCache ?? this.shouldWidenAndPopulateCache(params);
+        if (shouldPopulateSlot && result.Success && preResult.fingerprint && LocalCacheManager.Instance.IsInitialized) {
             const maxUpdatedAt = this.extractMaxUpdatedAt(result.Results);
-            await LocalCacheManager.Instance.SetRunViewResult(preResult.fingerprint, params, result.Results, maxUpdatedAt, result.AggregateResults, result.TotalRowCount, this);
+            await LocalCacheManager.Instance.SetRunViewResult(preResult.fingerprint, params, this.PrepareRowsForCacheStorage(result.Results, resolvedEntity), maxUpdatedAt, result.AggregateResults, result.TotalRowCount, this);
         }
         else if (this.shouldAutoCache(params, result, contextUser)) {
             // Server-side auto-cache: small, unfiltered, unsorted results are
             // automatically cached even without explicit CacheLocal. These are
             // safe for in-place upsert on entity changes (no filter to evaluate).
-            const fingerprint = preResult.fingerprint || LocalCacheManager.Instance.GenerateRunViewFingerprint(params, this.InstanceConnectionString, this.ComputeRunViewRLSWhereClause(params, contextUser), undefined, this.ComputeRunViewFLSFingerprintKey(params));
+            const fingerprint = preResult.fingerprint || this.ComputeRunViewCacheFingerprint(params, contextUser);
             const maxUpdatedAt = this.extractMaxUpdatedAt(result.Results);
-            await LocalCacheManager.Instance.SetRunViewResult(fingerprint, params, result.Results, maxUpdatedAt, result.AggregateResults, result.TotalRowCount, this);
+            await LocalCacheManager.Instance.SetRunViewResult(fingerprint, params, this.PrepareRowsForCacheStorage(result.Results, resolvedEntity), maxUpdatedAt, result.AggregateResults, result.TotalRowCount, this);
             LogStatusEx({ message: `  📦 [Auto-Cache] RunView "${params.EntityName || params.ViewName || 'unknown'}" — ${result.Results.length} rows auto-cached (small + unfiltered)`, verboseOnly: true });
         }
         // Project cache-miss DB results back down to the caller's originally requested
-        // fields. PreRunView widened params.Fields to ALL entity fields so the cache
-        // entry (written above) is a universal superset — but the caller must receive
+        // fields. PreRunView widened params.Fields to ALL entity fields (less the columns this
+        // user's permission class may not read) so the cache entry written above is a superset
+        // for that class — but the caller must receive
         // the same shape on a miss as they do on a hit (which projects from cache).
         // Must run AFTER the cache writes (cache keeps the superset) and only for
         // plain-object results (entity objects need all fields).
@@ -3459,10 +3871,9 @@ export class ProviderBase {
             result.Results = ProjectRowsToFields(result.Results, preResult.callerRequestedFields);
         }
         // Field-level security on the cache-MISS path (the hit path is enforced in PreRunView,
-        // which returns before this hook ever runs). Must come AFTER the cache write above so
-        // the cache keeps the universal superset — permission changes then take effect on the
-        // next metadata refresh with no result-cache invalidation, because visibility is a pure
-        // read-time projection rather than something baked into the cached rows.
+        // which returns before this hook ever runs). Runs AFTER the cache write above, as on the
+        // hit path: the slot keeps what the database returned for this permission class, and
+        // every reader is projected against live metadata.
         if (result.Success) {
             result.Results = this.ApplyFieldSecurityProjection(result.Results, params, contextUser);
             result.Results = this.ApplyRecordChangeFieldSecurityProjection(result.Results, params, contextUser);
@@ -3521,18 +3932,21 @@ export class ProviderBase {
             // per item. Compute lazily only for indexes PreRunViews skipped (cache
             // was disabled for them but auto-cache/OnDataChanged may still need it).
             const fingerprint = preResult.fingerprintMap?.get(i)
-                ?? LocalCacheManager.Instance.GenerateRunViewFingerprint(params[i], this.InstanceConnectionString, this.ComputeRunViewRLSWhereClause(params[i], contextUser), undefined, this.ComputeRunViewFLSFingerprintKey(params[i]));
-            // CRITICAL: must be the SAME eligibility predicate PreRunViews used to decide
+                ?? this.ComputeRunViewCacheFingerprint(params[i], contextUser);
+            // CRITICAL: must reflect the SAME widening predicate PreRunViews used to decide
             // whether to widen Fields. Writing a non-widened (narrow or keyset-paged)
-            // result here poisons the Fields-agnostic superset slot — this exact gate
-            // previously omitted BypassCache/AfterKey and cached narrow BypassCache rows.
-            if (this.runViewCacheEligible(params[i]) && results[i].Success && LocalCacheManager.Instance.IsInitialized) {
+            // result here poisons the Fields-agnostic superset slot.
+            const itemEntity = this.resolveEntityForRunViewParams(params[i]);
+            const shouldPopulateBatchSlot = preResult.populateCacheSet
+                ? preResult.populateCacheSet.has(i)
+                : this.shouldWidenAndPopulateCache(params[i]);
+            if (shouldPopulateBatchSlot && results[i].Success && LocalCacheManager.Instance.IsInitialized) {
                 const maxUpdatedAt = this.extractMaxUpdatedAt(results[i].Results);
-                cachePromises.push(LocalCacheManager.Instance.SetRunViewResult(fingerprint, params[i], results[i].Results, maxUpdatedAt, results[i].AggregateResults, results[i].TotalRowCount, this));
+                cachePromises.push(LocalCacheManager.Instance.SetRunViewResult(fingerprint, params[i], this.PrepareRowsForCacheStorage(results[i].Results, itemEntity), maxUpdatedAt, results[i].AggregateResults, results[i].TotalRowCount, this));
             }
             else if (this.shouldAutoCache(params[i], results[i], contextUser)) {
                 const maxUpdatedAt = this.extractMaxUpdatedAt(results[i].Results);
-                cachePromises.push(LocalCacheManager.Instance.SetRunViewResult(fingerprint, params[i], results[i].Results, maxUpdatedAt, results[i].AggregateResults, results[i].TotalRowCount, this));
+                cachePromises.push(LocalCacheManager.Instance.SetRunViewResult(fingerprint, params[i], this.PrepareRowsForCacheStorage(results[i].Results, itemEntity), maxUpdatedAt, results[i].AggregateResults, results[i].TotalRowCount, this));
                 LogStatusEx({ message: `    📦 [Auto-Cache] RunViews "${params[i].EntityName || params[i].ViewName || 'unknown'}" — ${results[i].Results.length} rows auto-cached (small + unfiltered)`, verboseOnly: true });
             }
             // Register OnDataChanged callback if provided
@@ -3543,7 +3957,8 @@ export class ProviderBase {
         await Promise.all(cachePromises);
         // Project cache-miss DB results back down to each caller's originally
         // requested fields. PreRunViews widened those params' Fields to ALL entity
-        // fields so the cache entries (written above) are universal supersets — but
+        // fields (less what each user's permission class may not read) so the cache entries
+        // written above are supersets for that class — but
         // callers must receive the same shape on a miss as on a hit (which projects
         // from cache). Skip hits (already projected) and entity_object results
         // (need all fields).
@@ -3602,6 +4017,18 @@ export class ProviderBase {
             });
         }
     }
+    /**
+     * Works out a stored view's property values ({@link RunViewParams.Properties},
+     * {@link RunViewParams.ServerProperties}, and each property's default) before the run's cache
+     * lookup, so the result-cache fingerprint keys on the values the run will actually use. Called
+     * on the run's own params copy, after the PreRunView hooks. Must never throw: a run whose
+     * properties would be refused is left for the provider's run path to refuse with its message.
+     *
+     * Does nothing here. A database provider, which resolves token defaults on the server, overrides it.
+     */
+    async PrepareRunViewProperties(_params, _contextUser) {
+        // The client sends Properties as they are; the server resolves them.
+    }
     /**
      * Runs all registered PreRunView hooks against a single RunViewParams,
      * returning the (possibly mutated) params.
@@ -3790,6 +4217,8 @@ export class ProviderBase {
         // main-path variants of those bugs.
         if (!this.runViewCacheEligible(params))
             return false;
+        if (this.hasNarrowFieldsOverride(params))
+            return false;
         if (!LocalCacheManager.Instance.IsInitialized)
             return false;
         if (!result.Success)
@@ -3800,11 +4229,16 @@ export class ProviderBase {
             return false;
         // Only auto-cache unfiltered, unsorted queries — these are safe for
         // in-place upsert because LocalCacheManager doesn't need to evaluate
-        // SQL predicates or sort expressions.
+        // SQL predicates or sort expressions. AlternateBaseView queries apply
+        // a canonical SQL WHERE/JOIN and must not be auto-cached as unfiltered.
         const filter = typeof params.ExtraFilter === 'string' ? params.ExtraFilter.trim() : '';
         const orderBy = typeof params.OrderBy === 'string' ? params.OrderBy.trim() : '';
         if (filter.length > 0 || orderBy.length > 0)
             return false;
+        if (GetEffectiveAlternateBaseViewName(params))
+            return false;
+        if (Boolean(params.ViewID || params.ViewName || params.ViewEntity))
+            return false;
         return true;
     }
     extractMaxUpdatedAt(results) {
@@ -4100,6 +4534,9 @@ export class ProviderBase {
      * Resolves the {@link EntityInfo} normalization should read field types from, using only
      * synchronously available information on the params.
      */
+    resolveEntityForRunViewParams(param) {
+        return this.resolveEntityForNormalization(param);
+    }
     resolveEntityForNormalization(param) {
         if (param.EntityName) {
             return this.EntityByName(param.EntityName);
@@ -4237,7 +4674,7 @@ export class ProviderBase {
         if (!this.TrustLocalCacheCompletely && !hardRefresh && !this._localMetadata?.AllEntities?.length) {
             await Promise.all([localCacheInitPromise, this.LoadLocalMetadataFromStorage()]);
             if (this._localMetadata?.AllEntities?.length) {
-                LogStatusEx({ message: `⚡ [Metadata Cache] Loaded ${this._localMetadata.AllEntities.length} entities from local cache — pre-validating before engine startup`, verboseOnly: false });
+                LogStatus(`⚡ [Metadata Cache] Loaded ${this._localMetadata.AllEntities.length} entities from local cache — pre-validating before engine startup`);
                 // Do NOT kick off background validation here — it writes to IndexedDB
                 // which contends with engine RunView cache reads during StartupManager.
                 // Instead, the caller (setupGraphQLClient) should call
@@ -4325,7 +4762,7 @@ export class ProviderBase {
                     const start = new Date().getTime();
                     const res = await this.GetAllMetadata(providerToUse, effectiveHardRefresh);
                     const end = new Date().getTime();
-                    LogStatusEx({ message: `GetAllMetadata() took ${end - start} ms`, verboseOnly: true });
+                    LogStatus(`GetAllMetadata() took ${end - start} ms`);
                     if (res) {
                         await this.adoptServerMetadata(res);
                         this._configLoadedFromServer = true;
@@ -4353,7 +4790,8 @@ export class ProviderBase {
     }
     /**
      * Adopts a metadata snapshot just loaded from the server: swaps it in, records that the
-     * local copy now matches the server's timestamps, and persists it to local storage.
+     * local copy now matches the server's timestamps (verified per item against the received
+     * dataset row counts), and persists it to local storage.
      *
      * The swap goes through UpdateLocalMetadata — a single property assignment, atomic in
      * JavaScript, so readers see the old snapshot until the new one is complete — which keeps
@@ -4361,9 +4799,116 @@ export class ProviderBase {
      */
     async adoptServerMetadata(res) {
         this.UpdateLocalMetadata(res);
-        this._latestLocalMetadataTimestamps = this._latestRemoteMetadataTimestamps; // we just used the server to get all the stuff
+        this._latestLocalMetadataTimestamps = this.reconcileAdoptedMetadataTimestamps(res);
         await this.SaveLocalMetadataToStorage();
     }
+    /**
+     * Verifies that each item in `_latestRemoteMetadataTimestamps` matches the row count actually
+     * received in the loaded `MJ_Metadata` dataset (or `AllMetadata` collections) before advancing
+     * `_latestLocalMetadataTimestamps`. If any item has a mismatched row count (e.g., because a
+     * server cache slot returned stale rows while the SQL status probe reported newer counts),
+     * logs a warning and preserves the unadvanced local timestamp for that item so the next
+     * staleness check (`LocalMetadataObsolete`) detects the discrepancy and self-heals.
+     */
+    reconcileAdoptedMetadataTimestamps(res) {
+        const remote = this._latestRemoteMetadataTimestamps;
+        if (!remote || remote.length === 0) {
+            return remote;
+        }
+        const norm = (v) => (v ?? '').trim().toLowerCase();
+        const rollup = norm(ProviderBase._allMetadataTypeName);
+        const prevLocal = this._latestLocalMetadataTimestamps ?? [];
+        const datasetItems = this._metadataDatasetItems;
+        const resRecord = res;
+        let hasMismatch = false;
+        const reconciled = [];
+        const datasetItemsByEntityID = datasetItems && datasetItems.length > 0
+            ? IndexByUUID(datasetItems.filter(item => Boolean(item.EntityID)), item => item.EntityID)
+            : null;
+        const datasetItemsByNameOrCode = new Map();
+        if (datasetItems && datasetItems.length > 0) {
+            for (const item of datasetItems) {
+                if (item.EntityName)
+                    datasetItemsByNameOrCode.set(norm(item.EntityName), item);
+                if (item.Code)
+                    datasetItemsByNameOrCode.set(norm(item.Code), item);
+            }
+        }
+        for (const remoteEntry of remote) {
+            if (norm(remoteEntry.Type) === rollup) {
+                continue;
+            }
+            let receivedRowCount;
+            let receivedUpdateDate;
+            if (datasetItems && datasetItems.length > 0) {
+                const match = (remoteEntry.ID ? datasetItemsByEntityID?.Get(remoteEntry.ID) : undefined)
+                    ?? datasetItemsByNameOrCode.get(norm(remoteEntry.Type));
+                if (match && match.RowCount !== undefined) {
+                    receivedRowCount = match.RowCount;
+                    receivedUpdateDate = match.LatestUpdateDate;
+                }
+            }
+            else if (resRecord) {
+                // Fallback when adoptServerMetadata is invoked without a preceding dataset load
+                const arrayMatch = AllMetadataArrays.find(m => {
+                    const code = m.key.substring(3);
+                    return norm(code) === norm(remoteEntry.Type) ||
+                        norm(m.key) === norm(remoteEntry.Type) ||
+                        norm(`MJ: ${code}`) === norm(remoteEntry.Type);
+                });
+                if (arrayMatch) {
+                    const arr = resRecord[arrayMatch.key];
+                    if (Array.isArray(arr)) {
+                        receivedRowCount = arr.length;
+                    }
+                }
+            }
+            if (receivedRowCount !== undefined &&
+                remoteEntry.RowCount !== undefined &&
+                receivedRowCount !== remoteEntry.RowCount) {
+                hasMismatch = true;
+                LogWarning(`[Metadata Cache] Row count mismatch when adopting server metadata for "${remoteEntry.Type}": ` +
+                    `received ${receivedRowCount} rows but remote status reported ${remoteEntry.RowCount} rows. ` +
+                    `Not advancing local timestamp for "${remoteEntry.Type}" so the next check self-heals.`, 'Metadata');
+                const priorEntry = prevLocal.find(m => norm(m.Type) === norm(remoteEntry.Type));
+                if (priorEntry) {
+                    reconciled.push({
+                        ...priorEntry,
+                        RowCount: receivedRowCount
+                    });
+                }
+                else {
+                    const fallbackDate = receivedUpdateDate &&
+                        remoteEntry.UpdatedAt &&
+                        new Date(receivedUpdateDate).getTime() !== new Date(remoteEntry.UpdatedAt).getTime()
+                        ? receivedUpdateDate
+                        : new Date(0);
+                    reconciled.push({
+                        ...remoteEntry,
+                        UpdatedAt: fallbackDate,
+                        RowCount: receivedRowCount
+                    });
+                }
+            }
+            else {
+                reconciled.push(remoteEntry);
+            }
+        }
+        if (!hasMismatch) {
+            return remote;
+        }
+        const remoteRollup = remote.find(r => norm(r.Type) === rollup);
+        if (remoteRollup) {
+            const priorRollup = prevLocal.find(m => norm(m.Type) === rollup);
+            const totalReconciledRows = reconciled.reduce((sum, item) => sum + (item.RowCount ?? 0), 0);
+            reconciled.push({
+                ...remoteRollup,
+                UpdatedAt: priorRollup?.UpdatedAt ?? new Date(0),
+                RowCount: totalReconciledRows
+            });
+        }
+        return reconciled;
+    }
     /**
      * Decides whether the current staleness can be served by a scoped reload of the saved-query
      * family. Compares local and remote timestamps item by item (the same test as
@@ -4439,14 +4984,14 @@ export class ProviderBase {
             const start = Date.now();
             const d = await this.GetDatasetByName(ProviderBase._mjMetadataDatasetName, skipOthers, this.CurrentUser, providerToUse, true);
             if (!d?.Success) {
-                LogStatusEx({ message: `[Metadata] Scoped reload of ${codes.join(', ')} failed (${d?.Status ?? 'no result'}); running the full reload`, verboseOnly: false });
+                LogStatusEx({ message: `[Metadata] Scoped reload of ${codes.join(', ')} failed (${d?.Status ?? 'no result'}); running the full reload`, verboseOnly: true });
                 return false;
             }
             const simple = {};
             for (const code of codes) {
                 const item = d.Results?.find(r => r.Code === code);
                 if (!item || item.Success === false || !Array.isArray(item.Results)) {
-                    LogStatusEx({ message: `[Metadata] Scoped reload: item ${code} ${item ? `failed (${item.Status ?? 'no rows'})` : 'missing'}; running the full reload`, verboseOnly: false });
+                    LogStatusEx({ message: `[Metadata] Scoped reload: item ${code} ${item ? `failed (${item.Status ?? 'no rows'})` : 'missing'}; running the full reload`, verboseOnly: true });
                     return false;
                 }
                 simple[code] = item.Results;
@@ -4463,6 +5008,19 @@ export class ProviderBase {
             for (const m of AllMetadataArrays) {
                 target[m.key] = keep.has(m.key.substring(3)) ? fresh[m.key] : kept[m.key];
             }
+            this._metadataDatasetItems = items.map(existing => {
+                if (!keep.has(existing.Code)) {
+                    return existing;
+                }
+                const updated = d.Results?.find(r => r.Code === existing.Code);
+                return updated && Array.isArray(updated.Results)
+                    ? {
+                        ...existing,
+                        RowCount: updated.Results.length,
+                        LatestUpdateDate: updated.LatestUpdateDate ?? existing.LatestUpdateDate
+                    }
+                    : existing;
+            });
             // Adopted like every other server snapshot. _configLoadedFromServer is NOT set: this read
             // fetched no current user (the existing one is carried over), so the next pre-validation
             // must still run its check.
@@ -4485,17 +5043,17 @@ export class ProviderBase {
         try {
             const needsRefresh = await this.CheckToSeeIfRefreshNeeded(providerToUse);
             if (needsRefresh) {
-                LogStatusEx({ message: `⚡ [Metadata Cache] Background check: metadata is stale — refreshing...`, verboseOnly: false });
+                LogStatusEx({ message: `⚡ [Metadata Cache] Background check: metadata is stale — refreshing...`, verboseOnly: true });
                 const start = Date.now();
                 const res = await this.GetAllMetadata(providerToUse, false);
                 const elapsed = Date.now() - start;
                 if (res) {
                     await this.adoptServerMetadata(res);
-                    LogStatusEx({ message: `⚡ [Metadata Cache] Background refresh complete (${elapsed}ms) — metadata updated in place`, verboseOnly: false });
+                    LogStatusEx({ message: `⚡ [Metadata Cache] Background refresh complete (${elapsed}ms) — metadata updated in place`, verboseOnly: true });
                 }
             }
             else {
-                LogStatusEx({ message: `⚡ [Metadata Cache] Background check: metadata is current — no refresh needed`, verboseOnly: false });
+                LogStatusEx({ message: `⚡ [Metadata Cache] Background check: metadata is current — no refresh needed`, verboseOnly: true });
                 await this.RefreshCurrentUser();
             }
         }
@@ -4545,17 +5103,17 @@ export class ProviderBase {
                 this.RefreshCurrentUser(),
             ]);
             if (needsRefresh) {
-                LogStatusEx({ message: `⚡ [Metadata Cache] Pre-validation: metadata is stale — refreshing before engine startup`, verboseOnly: false });
+                LogStatus(`⚡ [Metadata Cache] Pre-validation: metadata is stale — refreshing before engine startup`);
                 const start = Date.now();
                 const res = await this.GetAllMetadata(providerToUse, false);
                 const elapsed = Date.now() - start;
                 if (res) {
                     await this.adoptServerMetadata(res);
-                    LogStatusEx({ message: `⚡ [Metadata Cache] Pre-validation refresh complete (${elapsed}ms)`, verboseOnly: false });
+                    LogStatus(`⚡ [Metadata Cache] Pre-validation refresh complete (${elapsed}ms)`);
                 }
             }
             else {
-                LogStatusEx({ message: `⚡ [Metadata Cache] Pre-validation: metadata is current`, verboseOnly: false });
+                LogStatus(`⚡ [Metadata Cache] Pre-validation: metadata is current`);
             }
         }
         catch (e) {
@@ -4622,18 +5180,26 @@ export class ProviderBase {
      * customized adoption through CloneAllMetadata. Remove the CloneAllMetadata
      * override to activate a CreateSharedMetadataShell override.
      */
+    /**
+     * Builds this instance's AllMetadata as a zero-copy prototype-delegated shell over
+     * another provider's already-loaded metadata (`Object.create(shared)`), keeping
+     * `CurrentUser` as an own property on the shell instance.
+     *
+     * Why zero-copy prototype delegation is safe: the metadata graph (`AllMetadata` and its
+     * arrays) is treated as immutable after `Config`. Refreshes swap the entire `AllMetadata`
+     * reference via `UpdateLocalMetadata` rather than mutating the previous `AllMetadata`
+     * instance in place, so in-flight shells continue reading a consistent snapshot while
+     * avoiding 19 array shallow-copies on every per-request provider creation.
+     */
     CreateSharedMetadataShell(shared) {
-        const shell = new AllMetadata();
-        for (const m of AllMetadataArrays) {
-            shell[m.key] = [...(shared[m.key] ?? [])];
-        }
+        const shell = Object.create(shared);
         shell.CurrentUser = this.CurrentUser; // same semantics the deep clone had — per-instance, not shared
         return shell;
     }
     /**
      * Adopts the global provider's metadata for this instance without reloading it
      * from the server: shares the (immutable post-Config) metadata arrays by
-     * reference via {@link CreateSharedMetadataShell} and builds this instance's
+     * reference via {@link CreateSharedMetadataShell} and shares or builds this instance's
      * entity lookup maps.
      */
     CopyMetadataFromGlobalProvider() {
@@ -4642,7 +5208,8 @@ export class ProviderBase {
             // registered-but-not-yet-configured global would otherwise donate an empty graph
             // and this Config would "succeed" with zero entities. Falling through to the
             // normal load path is the correct behavior in that case.
-            const globalMetadata = Metadata.Provider !== this ? Metadata.Provider?.AllMetadata : undefined; // global-provider-ok: this method adopts metadata FROM the global provider on bootstrap
+            const globalProvider = Metadata.Provider !== this ? Metadata.Provider : undefined; // global-provider-ok: this method adopts metadata FROM the global provider on bootstrap
+            const globalMetadata = globalProvider?.AllMetadata;
             if ((globalMetadata?.AllEntities?.length ?? 0) > 0) {
                 // Back-compat: before #3083 this path called the overridable CloneAllMetadata,
                 // so external subclasses could customize adoption (e.g. tenant-filtered deep
@@ -4652,7 +5219,17 @@ export class ProviderBase {
                 const adopted = subclassOverridesClone
                     ? this.CloneAllMetadata(globalMetadata)
                     : this.CreateSharedMetadataShell(globalMetadata);
-                this.UpdateLocalMetadata(adopted);
+                if (!subclassOverridesClone &&
+                    globalProvider instanceof ProviderBase &&
+                    adopted.AllEntities === globalMetadata.AllEntities &&
+                    globalProvider._entityMapByName.size > 0) {
+                    this._localMetadata = adopted;
+                    this._entityMapByName = globalProvider._entityMapByName;
+                    this._entityMapByID = globalProvider._entityMapByID;
+                }
+                else {
+                    this.UpdateLocalMetadata(adopted);
+                }
                 return true;
             }
             return false;
@@ -4662,6 +5239,13 @@ export class ProviderBase {
             return false; // if we fail to copy the metadata, we will return false
         }
     }
+    /**
+     * Re-adopts the immutable read-only metadata catalog shell and lookup maps from
+     * `Metadata.Provider` after the global provider completes a metadata refresh.
+     */
+    SyncMetadataFromGlobalProvider() {
+        return this.CopyMetadataFromGlobalProvider();
+    }
     /**
      * Builds dataset filters based on the provider configuration.
      * Ensures MJ Core schema is always included and never excluded.
@@ -4734,7 +5318,7 @@ export class ProviderBase {
                     simpleMetadata[r.Code] = r.Results;
                 }
                 // Post Process Entities because there's some special handling of the sub-objects
-                simpleMetadata.AllEntities = this.PostProcessEntityMetadata(simpleMetadata.Entities, simpleMetadata.EntityFields, simpleMetadata.EntityFieldValues, simpleMetadata.EntityPermissions, simpleMetadata.EntityRelationships, simpleMetadata.EntitySettings, simpleMetadata.EntityOrganicKeys, simpleMetadata.EntityOrganicKeyRelatedEntities, simpleMetadata.EntityFieldPermissions);
+                simpleMetadata.AllEntities = this.PostProcessEntityMetadata(simpleMetadata.Entities, simpleMetadata.EntityFields, simpleMetadata.EntityFieldValues, simpleMetadata.EntityPermissions, simpleMetadata.EntityRelationships, simpleMetadata.EntitySettings, simpleMetadata.EntityOrganicKeys, simpleMetadata.EntityOrganicKeyRelatedEntities, simpleMetadata.EntityFieldPermissions, simpleMetadata.EntityAlternateBaseViews);
                 // Post Process the Applications, because we want to handle the sub-objects properly.
                 simpleMetadata.AllApplications = simpleMetadata.Applications.map((a) => {
                     a.ApplicationEntities = simpleMetadata.ApplicationEntities.filter((ae) => UUIDsEqual(ae.ApplicationID, a.ID));
@@ -4821,7 +5405,7 @@ export class ProviderBase {
         }
         return map;
     }
-    PostProcessEntityMetadata(entities, fields, fieldValues, permissions, relationships, settings, organicKeys, organicKeyRelatedEntities, fieldPermissions) {
+    PostProcessEntityMetadata(entities, fields, fieldValues, permissions, relationships, settings, organicKeys, organicKeyRelatedEntities, fieldPermissions, alternateBaseViews) {
         const result = [];
         // Sort entities alphabetically by name to ensure deterministic ordering
         // This prevents non-deterministic output in CodeGen and other metadata consumers
@@ -4859,6 +5443,9 @@ export class ProviderBase {
         const activeOrganicKeysByEntityId = organicKeys
             ? this.groupByNormalizedUUID(organicKeys.filter(ok => ok.Status === 'Active'), ok => ok.EntityID)
             : new Map();
+        const alternateBaseViewsByEntityId = alternateBaseViews && alternateBaseViews.length > 0
+            ? this.groupByNormalizedUUID(alternateBaseViews, abv => abv.EntityID)
+            : new Map();
         for (const e of sortedEntities) {
             const entityIdKey = NormalizeUUID(e.ID);
             const entityFields = fieldsByEntityId.get(entityIdKey) || [];
@@ -4870,6 +5457,9 @@ export class ProviderBase {
             if (organicKeys) {
                 e.EntityOrganicKeys = activeOrganicKeysByEntityId.get(entityIdKey) || [];
             }
+            if (alternateBaseViews) {
+                e.EntityAlternateBaseViews = alternateBaseViewsByEntityId.get(entityIdKey) || [];
+            }
             result.push(new EntityInfo(e, this));
         }
         // Check for schema name collision: if both 'MJ' and 'MJCustom' schemas exist,
@@ -5085,6 +5675,27 @@ export class ProviderBase {
      * RefreshIfNeeded load outside Config's reload single-flight). For the same reason it gets
      * `false`, not the owner's rejection, when the owner's check throws.
      * @returns True if refresh is needed, false otherwise
+     *
+     * @remarks
+     * This is a **freshness question, not a load**, so it never throws on an unreachable
+     * server. {@link ReadRemoteMetadataTimestamps} reports whether the server was reached at
+     * all, and when it was NOT the honest answer here depends on whether we hold anything to
+     * serve:
+     *
+     * - **We hold local metadata** → answer `false` ("do not tear this down"). The cached
+     *   snapshot may be a few seconds stale; a rejected status query is no reason to throw
+     *   it away, and every caller of this method treats `false` as "carry on with what you
+     *   have".
+     * - **We hold nothing** → answer `true`, so the caller attempts a real load against the
+     *   actual metadata fetch. That load logs its own failure and leaves the graph empty;
+     *   `SetupGraphQLClient` turns an empty graph into an error carrying it, while a caller
+     *   that only checks {@link Config}'s return value sees `true`.
+     *
+     * Before this, an unreachable status query propagated an exception out of
+     * {@link Config} and the Explorer's single boot catch turned it into a non-retryable
+     * "System Error" — the whole app dead over a freshness check it did not need an answer
+     * to. The two warm callers ({@link backgroundValidateAndRefresh},
+     * {@link preValidateAndRefresh}) already caught it; {@link Config} did not.
      */
     async CheckToSeeIfRefreshNeeded(providerToUse, bypassMinCheckInterval) {
         if (!this.AllowRefresh)
@@ -5123,10 +5734,29 @@ export class ProviderBase {
      */
     async runRefreshCheck(providerToUse) {
         const gotTimestamps = await this.RefreshRemoteMetadataTimestamps(providerToUse);
+        // Read the reachability flag in the SAME synchronous turn the await above resumed in —
+        // before the next await can let a concurrent check overwrite it.
+        const serverReached = this._lastRemoteTimestampReadReached;
         if (gotTimestamps) {
             this._lastRefreshCheckAt = Date.now();
         }
         await this.syncLocalMetadataFromStorage();
+        if (!gotTimestamps && !serverReached) {
+            // Could not ask the server. `LocalMetadataObsolete()` would answer `true` here
+            // purely because the remote timestamp list is empty — a "yes, reload everything"
+            // derived from the absence of an answer rather than from any comparison.
+            const haveLocal = (this._localMetadata?.AllEntities?.length ?? 0) > 0;
+            if (haveLocal) {
+                LogError(`[RefreshCheck] Could not read metadata timestamps from the server — serving the ` +
+                    `cached metadata snapshot (${this._localMetadata.AllEntities.length} entities) and ` +
+                    `deferring the staleness check to the next call.`);
+                return false;
+            }
+            LogError(`[RefreshCheck] Could not read metadata timestamps from the server and there is no ` +
+                `cached snapshot to fall back on — reporting a refresh as needed so the caller loads ` +
+                `metadata; that load reports its own failure.`);
+            return true;
+        }
         return this.LocalMetadataObsolete();
     }
     /**
@@ -5318,8 +5948,30 @@ export class ProviderBase {
         if (cachedDataset && cachedDateStr) {
             // We have a candidate cache entry — confirm freshness with the server.
             const localDate = new Date(cachedDateStr);
-            const status = await this.GetDatasetStatusByName(datasetName, itemFilters);
-            if (status && localDate.getTime() >= status.LatestUpdateDate.getTime()) {
+            let status;
+            try {
+                status = await this.GetDatasetStatusByName(datasetName, itemFilters);
+            }
+            catch (e) {
+                // Only the TRANSPORT failing earns the fallback. A server that answered "no"
+                // (an identity without the scope, a validation rejection) gave a definite
+                // answer that waiting will not change, and the cache would hand the caller
+                // exactly what the server just declined to — so that propagates as it always did.
+                if (!IsTransportError(e)) {
+                    throw e;
+                }
+                // We are HOLDING a complete cached dataset and only asked whether it is still
+                // current. A failed freshness question is not grounds for throwing the answer
+                // away and propagating: the line below re-fetches the whole dataset from the
+                // same unreachable server, so the alternative to serving this cache is an
+                // exception, not fresher data. Serve it and say so.
+                LogError(`GetAndCacheDatasetByName('${datasetName}'): the freshness check failed — ` +
+                    `${e instanceof Error ? e.message : String(e)}. Serving the cached dataset ` +
+                    `(cached ${cachedDateStr}), which may be stale.`);
+                return cachedDataset;
+            }
+            const serverDate = this.validDatasetDate(status?.LatestUpdateDate);
+            if (status?.Success && serverDate && localDate.getTime() >= serverDate.getTime()) {
                 // Timestamps suggest cache is fresh; verify per-entity row counts to
                 // catch deleted rows (timestamp comparison alone misses pure deletes).
                 // Shared with IsDatasetCacheUpToDate so the two cannot drift again.
@@ -5328,9 +5980,11 @@ export class ProviderBase {
                 }
             }
         }
-        // Cold path or stale: fetch from server and cache.
+        // Cold path or stale: fetch from server and cache only when the load succeeded.
         const dataset = await this.GetDatasetByName(datasetName, itemFilters, contextUser, providerToUse);
-        await this.CacheDataset(datasetName, itemFilters, dataset);
+        if (dataset?.Success) {
+            await this.CacheDataset(datasetName, itemFilters, dataset);
+        }
         return dataset;
     }
     /**
@@ -5361,8 +6015,9 @@ export class ProviderBase {
         if (localDate) {
             // we have a local cached timestamp, so compare it to the server timestamp
             const status = await this.GetDatasetStatusByName(datasetName, itemFilters);
-            if (status) {
-                const serverTimestamp = status.LatestUpdateDate.getTime();
+            const serverDate = this.validDatasetDate(status?.LatestUpdateDate);
+            if (status?.Success && serverDate) {
+                const serverTimestamp = serverDate.getTime();
                 if (localDate.getTime() >= serverTimestamp) {
                     // this situation means our local cache timestamp is >= the server timestamp, so we're most likely up to date
                     // in this situation, the last thing we check is for each entity, if the rowcount is the same as the server, if it is, we're good
@@ -5385,6 +6040,17 @@ export class ProviderBase {
             return false;
         }
     }
+    /**
+     * Normalizes a dataset `LatestUpdateDate` to a valid `Date`, or `null` when absent or invalid
+     * (for example, when a dataset or dataset-status call fails and returns `LatestUpdateDate: null`).
+     */
+    validDatasetDate(value) {
+        if (value == null) {
+            return null;
+        }
+        const date = value instanceof Date ? value : new Date(value);
+        return Number.isNaN(date.getTime()) ? null : date;
+    }
     /**
      * Compares the per-entity row counts of a cached dataset against the server's status.
      *
@@ -5443,6 +6109,12 @@ export class ProviderBase {
      * @param dataset
      */
     async CacheDataset(datasetName, itemFilters, dataset) {
+        const latestUpdateDate = this.validDatasetDate(dataset?.LatestUpdateDate);
+        if (!dataset?.Success || !latestUpdateDate) {
+            LogError(`CacheDataset("${datasetName}"): refusing to cache failed or undated dataset result ` +
+                `(Success=${dataset?.Success}, Status=${dataset?.Status ?? 'unknown'})`);
+            return;
+        }
         const ls = this.LocalStorageProvider;
         if (ls) {
             const key = this.GetDatasetCacheKey(datasetName, itemFilters);
@@ -5450,7 +6122,7 @@ export class ProviderBase {
             await ls.SetItem(key, dataset, ProviderBase.DatasetCacheCategory, { TTLSeconds: ProviderBase.DatasetCacheTTLSeconds });
             // Date is stored as ISO string for forward-compatibility across providers
             // (Redis can't natively round-trip Date; localStorage requires string).
-            await ls.SetItem(key + '_date', dataset.LatestUpdateDate.toISOString(), ProviderBase.DatasetCacheCategory, { TTLSeconds: ProviderBase.DatasetDateCacheTTLSeconds });
+            await ls.SetItem(key + '_date', latestUpdateDate.toISOString(), ProviderBase.DatasetCacheCategory, { TTLSeconds: ProviderBase.DatasetDateCacheTTLSeconds });
         }
     }
     /**
@@ -5557,11 +6229,70 @@ export class ProviderBase {
     }
     /**
      * Retrieves the latest metadata update timestamps from the server.
-     * @returns Array of metadata update information
+     * @returns Array of metadata update information, or `undefined` when the server could not
+     * be asked (transport failure, timeout, gateway error) or answered unsuccessfully.
+     *
+     * @remarks
+     * This is the ONE network call behind every staleness check, and it is a question about
+     * freshness — never the metadata itself. A rejected status query therefore returns
+     * `undefined` (an absent answer) rather than propagating: its callers already treat a
+     * falsy result as "could not tell", while an exception out of here travelled unguarded
+     * through {@link RefreshRemoteMetadataTimestamps} → {@link CheckToSeeIfRefreshNeeded} →
+     * {@link Config} and killed the caller's whole bootstrap.
+     *
+     * The failure is logged at error level, not swallowed quietly: "we are running on a
+     * cached snapshot because the server did not answer" is something an operator needs to
+     * see in the console.
      */
     async GetLatestMetadataUpdates(providerToUse) {
-        // No schema filters for metadata — see comment in GetAllMetadata
-        const d = await this.GetDatasetStatusByName(ProviderBase._mjMetadataDatasetName, null, this.CurrentUser, providerToUse);
+        return (await this.ReadRemoteMetadataTimestamps(providerToUse)).Timestamps;
+    }
+    /**
+     * The metadata-status read, with **why** it failed preserved.
+     *
+     * Two failures look the same to {@link GetLatestMetadataUpdates} — both give `undefined` —
+     * but they call for opposite responses, so callers that can act on the difference read it
+     * here instead:
+     *
+     * - `Reached: false` — the request never got an answer (transport failure, timeout, 504).
+     *   Transient. Nothing can be concluded about freshness, and a full metadata load would hit
+     *   the same wall, so the right move is to keep serving what we have.
+     * - `Reached: true` with no `Timestamps` — the server answered `Success: false`. A
+     *   *permanent* condition (the dataset is missing or misconfigured), not a network blip.
+     *   Degrading here would serve a stale cache forever; the historical behaviour of treating
+     *   it as "obsolete" and attempting the real load is correct, because `GetDatasetByName`
+     *   may well still work.
+     * - A rejection that is NOT a transport failure — an authorization denial ("this API key
+     *   requires the dataset:read scope"), a validation rejection, a programming error — is
+     *   the server (or our own code) answering, not the wire failing. It propagates exactly
+     *   as it did before this method existed. {@link IsTransportError} draws the line. The
+     *   integration tier's FLS fixture depends on this: it builds a reader whose scope rule
+     *   has not propagated yet and retries `Config()` until the denial stops — a denial
+     *   swallowed into `Reached: false` left that reader with an empty snapshot for good.
+     *
+     * Conflating these is how a broken status endpoint — or a refused identity — would become
+     * permanently invisible.
+     */
+    async ReadRemoteMetadataTimestamps(providerToUse) {
+        let d;
+        try {
+            // No schema filters for metadata — see comment in GetAllMetadata
+            d = await this.GetDatasetStatusByName(ProviderBase._mjMetadataDatasetName, null, this.CurrentUser, providerToUse);
+        }
+        catch (e) {
+            if (!IsTransportError(e)) {
+                // The server answered — with a refusal. Not ours to soften.
+                throw e;
+            }
+            LogError(`ReadRemoteMetadataTimestamps: the metadata status query failed — ` +
+                `${e instanceof Error ? e.message : String(e)}. Reporting the server as unreachable; ` +
+                `callers fall back to the cached metadata snapshot.`);
+            return { Reached: false, Timestamps: undefined };
+        }
+        return { Reached: true, Timestamps: this.mapDatasetStatusToTimestamps(d) };
+    }
+    /** Shape a dataset-status answer into the timestamp list, or `undefined` if it failed. */
+    mapDatasetStatusToTimestamps(d) {
         if (d && d.Success) {
             const ret = d.EntityUpdateDates.map(e => {
                 return {
@@ -5580,6 +6311,7 @@ export class ProviderBase {
             });
             return ret;
         }
+        return undefined;
     }
     /**
      * Refreshes the remote metadata timestamps from the server.
@@ -5587,9 +6319,14 @@ export class ProviderBase {
      * @returns True if timestamps were successfully refreshed
      */
     async RefreshRemoteMetadataTimestamps(providerToUse) {
-        const mdTimeStamps = await this.GetLatestMetadataUpdates(providerToUse);
-        if (mdTimeStamps) {
-            this._latestRemoteMetadataTimestamps = mdTimeStamps;
+        const read = await this.ReadRemoteMetadataTimestamps(providerToUse);
+        // Recorded rather than returned: this method's `boolean` contract is "did the timestamps
+        // refresh", and widening it would change a public signature that callers outside this
+        // class already consume. {@link CheckToSeeIfRefreshNeeded} reads the flag in the same
+        // synchronous turn this call resolves in, so no interleaving call can overwrite it first.
+        this._lastRemoteTimestampReadReached = read.Reached;
+        if (read.Timestamps) {
+            this._latestRemoteMetadataTimestamps = read.Timestamps;
             return true;
         }
         else
@@ -5655,18 +6392,22 @@ export class ProviderBase {
     }
     /**
      * Rebuilds the O(1) entity lookup Maps from the current AllEntities array.
+     * Allocates fresh Map instances so any per-request provider sharing a previous
+     * snapshot's maps is unaffected by a subsequent refresh.
      * Called automatically from UpdateLocalMetadata().
      */
     RebuildEntityMaps() {
         const entities = this._localMetadata?.AllEntities;
-        this._entityMapByName.clear();
-        this._entityMapByID.clear();
+        const byName = new Map();
+        const byID = new Map();
         if (entities) {
             for (const e of entities) {
-                this._entityMapByName.set(e.Name.trim().toLowerCase(), e);
-                this._entityMapByID.set(NormalizeUUID(e.ID), e);
+                byName.set(e.Name.trim().toLowerCase(), e);
+                byID.set(NormalizeUUID(e.ID), e);
             }
         }
+        this._entityMapByName = byName;
+        this._entityMapByID = byID;
     }
     /**
      * Returns the filesystem provider for the current environment.