@memberjunction/server 6.1.3 → 6.2.0-edge.0

package/src/generic/ResolverBase.ts

@@ -10,6 +10,7 @@ import {
   EntitySaveOptions,
   IMetadataProvider,
   IRunViewProvider,
+  KeyValuePair,
   LogDebug,
   LogError,
   LogStatus,
@@ -1521,6 +1522,62 @@ export class ResolverBase {
     }
   }
 
+  /**
+   * IS-A PROMOTION over the wire: an EXISTING parent record gaining a subtype — an Animal that is
+   * now also a Dog. It arrives as the CHILD's create mutation carrying the existing parent's
+   * primary key, because in IS-A the shared key is the relationship and the child has no key of
+   * its own to mint. `NewRecord()` has just reset the whole chain to "new", so left alone the
+   * parent would save as a CREATE: a second copy of a row that already exists (a unique-constraint
+   * violation at best, a silently duplicated parent at worst).
+   *
+   * When a child create carries a complete primary key, bind the new child to the existing parent
+   * row with `AttachToParent` (#3825): it loads the parent chain, so the parent saves as an UPDATE
+   * and only the child is INSERTed. A key that matches no row leaves the fresh chain exactly as
+   * `NewRecord()` built it — the ordinary whole-chain create. A non-IS-A entity, or a create with
+   * no key, never gets past the guards.
+   *
+   * @returns true when the child was attached to an existing parent row.
+   */
+  protected async attachToExistingParentIfPromotion(entityObject: BaseEntity, input: Record<string, unknown>): Promise<boolean> {
+    if (!entityObject.EntityInfo.IsChildType) {
+      return false;
+    }
+    const key = this.primaryKeyFromInput(entityObject.EntityInfo, input);
+    if (!key) {
+      return false;
+    }
+    const attached = await entityObject.AttachToParent(key);
+    if (!attached) {
+      // No parent row under that key: this is a whole-chain create on the CALLER's key (the
+      // client mints the shared key at the root and sends it, so honoring it keeps the client's
+      // in-memory chain and the stored rows on one key). AttachToParent restored the fresh chain,
+      // but the root's ReadOnly key slot is no longer writable — a later SetMany would silently
+      // keep the server-minted value — so re-seed the chain with the supplied key explicitly.
+      entityObject.NewRecord(key);
+    }
+    return attached;
+  }
+
+  /**
+   * The entity's primary key as supplied on a mutation input, or null when any part of it is
+   * missing. Composite keys are all-or-nothing: a half-specified key identifies nothing. An empty
+   * string counts as missing, the same as null — it is never a valid key value, and a GUID or
+   * string key that is "" identifies no row, so the create proceeds as a whole-chain create rather
+   * than failing the lookup. A malformed non-empty key (e.g. a non-GUID for a uniqueidentifier)
+   * is NOT swallowed: the load throws and the mutation fails loudly.
+   */
+  protected primaryKeyFromInput(entityInfo: EntityInfo, input: Record<string, unknown>): CompositeKey | null {
+    const pairs: KeyValuePair[] = [];
+    for (const pk of entityInfo.PrimaryKeys) {
+      const value = input[pk.Name] ?? input[pk.CodeName];
+      if (value === null || value === undefined || value === '') {
+        return null;
+      }
+      pairs.push(new KeyValuePair(pk.Name, value));
+    }
+    return pairs.length > 0 ? CompositeKey.FromKeyValuePairs(pairs) : null;
+  }
+
   protected async CreateRecord(entityName: string, input: any, provider: DatabaseProviderBase, userPayload: UserPayload, pubSub: PubSubEngine) {
     // Check API key scope authorization for entity create operations
     await this.CheckAPIKeyScopeAuthorization('entity:create', entityName, userPayload);
@@ -1538,6 +1595,10 @@ export class ResolverBase {
       for (const key of Object.keys(input)) {
         if (key !== 'RestoreContext___') fieldsForSet[key] = input[key];
       }
+      // IS-A promotion: bind the new child to its EXISTING parent row BEFORE the field
+      // assignments, so values the client sent for parent fields land on the loaded parent
+      // (as an update) instead of being wiped by the load.
+      await this.attachToExistingParentIfPromotion(entityObject, fieldsForSet);
       entityObject.SetMany(fieldsForSet);
 
       // Reconstruct the client-side restore context, if any, on this server

package/src/index.ts

@@ -67,6 +67,8 @@ import { RegisterRSUProgressBridge } from './integration/RSUProgressBridge.js';
 import { ClientToolRequestManager, AgentRunWatchdog } from '@memberjunction/ai-agents';
 import { SessionJanitor } from './agentSessions/index.js';
 import { StartTaskGraphDispatcher } from './services/StartTaskGraphDispatcher.js';
+import { GetAttachmentService } from '@memberjunction/aiengine';
+import { MJStorageBlobStore } from './services/MJStorageBlobStore.js';
 import { CACHE_INVALIDATION_TOPIC } from './generic/CacheInvalidationResolver.js';
 import { ConnectorFactory, IntegrationEngine, IntegrationSyncOptions } from '@memberjunction/integration-engine';
 import { CronExpressionHelper } from '@memberjunction/scheduling-engine';
@@ -281,6 +283,17 @@ function resolveServerVersion(): string | undefined {
   }
 }
 
+// Bind MJStorage as the conversation-attachment blob store. The attachment service itself no longer
+// imports `@memberjunction/storage` — that dependency made it unusable from any browser or React
+// Native client, which is why the same attachment rules had been reimplemented three times.
+//
+// This runs at module load, not inside `serve()`, so that merely importing MJServer is enough: any
+// entry point that reaches the attachment service — a resolver under test, a script, a worker that
+// never calls `serve()` — finds storage already bound rather than degrading to "storage is not
+// available on this host". The store is stateless and configures `FileStorageEngine` on use, so
+// there is no ordering hazard in binding this early.
+GetAttachmentService().BlobStore = new MJStorageBlobStore();
+
 export const serve = async (resolverPaths: Array<string>, app: Application = createApp(), options?: MJServerOptions): Promise<void> => {
   const t0 = performance.now();
   // Level-gated startup logger. Resolves verbosity from telemetry.level (single
@@ -307,7 +320,7 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
     console.log({ combinedResolverPaths, paths, cwd: process.cwd() });
   }
 
-  const setupComplete$ = new ReplaySubject(1);
+const setupComplete$ = new ReplaySubject(1);
   const dbType = getDbType();
   const dataSources: DataSourceInfo[] = [];
 

package/src/resolvers/FetchEntityVectorsResolver.ts

@@ -5,7 +5,7 @@ import { MJEntityDocumentEntity, MJVectorIndexEntity, MJVectorDatabaseEntity } f
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { GetAIAPIKey } from '@memberjunction/ai';
 import { VectorDBBase } from '@memberjunction/ai-vectordb';
-import { MJGlobal, UUIDsEqual } from '@memberjunction/global';
+import { EscapeSQLString, MJGlobal, UUIDsEqual } from '@memberjunction/global';
 
 /* ───── GraphQL types ───── */
 
@@ -144,7 +144,7 @@ export class FetchEntityVectorsResolver extends ResolverBase {
         const rv = new RunView();
         const result = await rv.RunView<MJEntityDocumentEntity>({
             EntityName: 'MJ: Entity Documents',
-            ExtraFilter: `ID='${entityDocumentID}'`,
+            ExtraFilter: `ID='${EscapeSQLString(entityDocumentID)}'`,
             ResultType: 'entity_object',
         }, contextUser);
 

package/src/resolvers/QuerySystemUserResolver.ts

@@ -6,6 +6,7 @@ import { MJQueryResolver, MJQuery_, MJQueryField_, MJQueryParameter_, MJQueryEnt
 import { GetReadWriteProvider } from '../util.js';
 import { DeleteOptionsInput } from '../generic/DeleteOptionsInput.js';
 import { MJQueryEntityServer } from '@memberjunction/core-entities-server';
+import { EscapeSQLString } from '@memberjunction/global';
 
 /**
  * Minimal shape of a query row returned by RunView lookups (plain object, not entity instance).
@@ -493,7 +494,7 @@ export class MJQueryResolverExtended extends MJQueryResolver {
             // now make sure there is NO existing query by the same name in the specified category
             const existingQueryResult = await provider.RunView({
                 EntityName: 'MJ: Queries',
-                ExtraFilter: `Name='${input.Name}' AND CategoryID='${finalCategoryID}'` 
+                ExtraFilter: `Name='${EscapeSQLString(input.Name)}' AND CategoryID='${EscapeSQLString(finalCategoryID)}'`
             }, context.userPayload.userRecord);
             if (existingQueryResult.Success && existingQueryResult.Results?.length > 0) {
                 // we have a match! Let's return an error

package/src/resolvers/RealtimeClientSessionResolver.ts

@@ -57,7 +57,7 @@ import {
     deleteRealtimeRecordingSegments,
 } from '@memberjunction/ai-agents';
 import { AgentExecutionProgressCallback, MJAIAgentEntityExtended, AppContextSnapshot } from '@memberjunction/ai-core-plus';
-import { RealtimeToolDefinition } from '@memberjunction/ai';
+import { ChatMessage, RealtimeToolDefinition } from '@memberjunction/ai';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { PUSH_STATUS_UPDATES_TOPIC } from '../generic/PushStatusResolver.js';
 import { GetReadWriteProvider } from '../util.js';
@@ -136,6 +136,11 @@ const MAX_PRIOR_TRANSCRIPT_CHARS = 8_000;
 /** Maximum prior-session chain legs walked when hydrating a resumed session's transcript. */
 const MAX_PRIOR_TRANSCRIPT_LEGS = 5;
 
+/** Maximum TEXT-conversation turns hydrated into a voice session's companion prompt (newest kept). */
+const MAX_CONVERSATION_HISTORY_TURNS = 30;
+/** Maximum TEXT-conversation CHARS hydrated into a voice session's companion prompt (oldest dropped). */
+const MAX_CONVERSATION_HISTORY_CHARS = 8_000;
+
 /**
  * Authoritative shape persisted in `AIAgentSession.Config_` for a client-direct voice session.
  * The target agent id is stored here at start and read back on every relay — the browser never
@@ -486,10 +491,17 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         // Best-effort model-context hydration: the PRIOR session chain's transcript (ownership-
         // checked, capped) is framed into the system prompt so the model REMEMBERS the last leg.
         // Strictly tolerant — any problem yields no hydration, never a failed start.
-        const priorTranscript = await this.loadPriorTranscript(lastSessionId, contextUser, provider);
+        const prior = await this.loadPriorTranscript(lastSessionId, contextUser, provider);
+        // ...and the TEXT conversation the call is being started from, so a voice session opened
+        // mid-thread knows what was already typed. The legs above are excluded: they are already
+        // framed as the resumed transcript, and injecting the same turns twice puts two accounts of
+        // the same exchange in one prompt.
+        const conversationMessages = await this.loadConversationHistory(
+            conversationId, prior?.LegIDs ?? [], contextUser, provider,
+        );
         const result = await this.prepareClientSessionOrClose(
-            session, coAgentID, effectiveTargetId, contextUser, provider, preferredModelId, clientTools, priorTranscript,
-            configOverridesJson, maxSessionSeconds, applicationId, this.parseAppContext(appContextJson),
+            session, coAgentID, effectiveTargetId, contextUser, provider, preferredModelId, clientTools, prior?.Text,
+            configOverridesJson, maxSessionSeconds, applicationId, this.parseAppContext(appContextJson), conversationMessages,
         );
         // Best-effort restore of the PRIOR session's persisted channel states (e.g. the whiteboard
         // board). Strictly tolerant — any problem yields a null field, never a failed start.
@@ -1684,6 +1696,8 @@ export class RealtimeClientSessionResolver extends ResolverBase {
      * @param priorTranscript Optional capped, role-tagged transcript of the PRIOR session chain
      *   (from {@link loadPriorTranscript}) — the service frames it into the system prompt so a
      *   resumed session remembers the previous leg(s).
+     * @param conversationMessages Optional capped history of the TEXT conversation this session is
+     *   starting from (from {@link loadConversationHistory}) — framed as "Conversation so far".
      */
     private async prepareClientSessionOrClose(
         session: MJAIAgentSessionEntity,
@@ -1698,6 +1712,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         maxSessionSeconds?: number,
         applicationId?: string,
         appContext?: AppContextSnapshot,
+        conversationMessages?: ChatMessage[],
     ): Promise<StartRealtimeClientSessionResult> {
         const prep = await this.clientSessionService.PrepareClientSession(
             {
@@ -1708,10 +1723,10 @@ export class RealtimeClientSessionResolver extends ResolverBase {
                 // Server-authoritative voice duration cap (widget guests) — bounds the driver session
                 // where supported; the janitor enforces the session deadline regardless.
                 MaxSessionSeconds: maxSessionSeconds,
-                // MVP: conversation history is not yet hydrated into ChatMessage[]; the co-agent
-                // companion prompt runs without prior turns. A later phase loads the session's
-                // Conversation into ChatMessage[] for richer context.
-                ConversationMessages: [],
+                // The TEXT conversation this call was started from, so the co-agent opens knowing
+                // what the user already typed rather than asking them to say it again. Hydrated by
+                // `loadConversationHistory`; empty when there is no conversation or the read failed.
+                ConversationMessages: conversationMessages ?? [],
                 UserID: contextUser.ID,
                 PreferredModelID: preferredModelId,
                 // Client-declared, CLIENT-EXECUTED UI tools (see the mutation's SECURITY NOTE) —
@@ -2005,7 +2020,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         lastSessionId: string | undefined,
         contextUser: UserInfo,
         provider: IMetadataProvider,
-    ): Promise<string | undefined> {
+    ): Promise<{ Text: string; LegIDs: string[] } | undefined> {
         if (!lastSessionId) {
             return undefined;
         }
@@ -2016,7 +2031,10 @@ export class RealtimeClientSessionResolver extends ResolverBase {
             }
             const turns = await this.loadChainTranscriptTurns(legIDs, contextUser, provider);
             const lines = this.capTranscriptLines(turns);
-            return lines.length > 0 ? lines.join('\n') : undefined;
+            // The leg ids travel with the text because the CONVERSATION history hydrated alongside
+            // this would otherwise re-inject the same turns: a voice turn is persisted as an
+            // ordinary Conversation Detail, so these legs are part of the conversation too.
+            return lines.length > 0 ? { Text: lines.join('\n'), LegIDs: legIDs } : undefined;
         } catch (error) {
             LogError(
                 `StartRealtimeClientSession: prior-transcript hydration failed for session ${lastSessionId}: ${(error as Error).message}`,
@@ -2025,6 +2043,101 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         }
     }
 
+    /**
+     * Loads the conversation this voice session is starting from, as `ChatMessage[]` for the
+     * co-agent's companion prompt.
+     *
+     * This is the half of the context flow that was missing. Voice turns have always been
+     * persisted as `MJ: Conversation Details`, so anything SAID reaches a later text turn — but
+     * nothing TYPED reached a voice session, which opened with no idea what the thread was about.
+     * The symptom is not an error; it is the agent asking the user to repeat something they just
+     * wrote, which is exactly when voice is least forgivable.
+     *
+     * Caps mirror the resume path (newest {@link MAX_CONVERSATION_HISTORY_TURNS} turns, then a
+     * {@link MAX_CONVERSATION_HISTORY_CHARS} budget with the oldest dropped first) so the freshest
+     * context always survives.
+     *
+     * Session-stamped rows are KEPT unless `coveredSessionIDs` names them: a call the user had last
+     * week is part of this conversation and the model should know it. Only the legs already framed
+     * as the resumed transcript are removed, so the prompt never carries two accounts of one
+     * exchange.
+     *
+     * Strictly tolerant — no conversation, a failed read, or any throw yields `[]`, never a failed
+     * session start. The call still works; it just starts cold.
+     *
+     * @param conversationId The conversation the session is bound to, when there is one.
+     * @param coveredSessionIDs Session ids already framed via `PriorTranscript`.
+     * @param contextUser The calling user (RunView scope — the read is row-level-secured).
+     * @param provider The request-scoped metadata provider.
+     * @returns The capped history, oldest first.
+     */
+    private async loadConversationHistory(
+        conversationId: string | undefined,
+        coveredSessionIDs: string[],
+        contextUser: UserInfo,
+        provider: IMetadataProvider,
+    ): Promise<ChatMessage[]> {
+        if (!conversationId) {
+            return [];
+        }
+        try {
+            const rv = RunView.FromMetadataProvider(provider);
+            const result = await rv.RunView<{
+                Role: string;
+                Message: string | null;
+                HiddenToUser: boolean;
+                AgentSessionID: string | null;
+            }>(
+                {
+                    EntityName: CONVERSATION_DETAIL_ENTITY,
+                    ExtraFilter: `ConversationID='${conversationId.replace(/'/g, "''")}'`,
+                    Fields: ['ID', 'Role', 'Message', 'HiddenToUser', 'AgentSessionID', '__mj_CreatedAt'],
+                    OrderBy: '__mj_CreatedAt ASC',
+                    ResultType: 'simple',
+                },
+                contextUser,
+            );
+            if (!result.Success) {
+                LogError(`StartRealtimeClientSession: conversation-history query failed: ${result.ErrorMessage}`);
+                return [];
+            }
+            const covered = new Set(coveredSessionIDs.map((id) => id.trim().toLowerCase()));
+            const turns = (result.Results ?? []).filter(
+                (row) =>
+                    !row.HiddenToUser &&
+                    (row.Role === 'User' || row.Role === 'AI') &&
+                    typeof row.Message === 'string' &&
+                    row.Message.trim().length > 0 &&
+                    !covered.has((row.AgentSessionID ?? '').trim().toLowerCase()),
+            );
+            return this.capConversationHistory(turns);
+        } catch (error) {
+            LogError(
+                `StartRealtimeClientSession: conversation-history hydration failed for conversation ${conversationId}: ${(error as Error).message}`,
+            );
+            return [];
+        }
+    }
+
+    /**
+     * Applies the history caps and maps to `ChatMessage[]`: the newest
+     * {@link MAX_CONVERSATION_HISTORY_TURNS} turns, then a total budget of
+     * {@link MAX_CONVERSATION_HISTORY_CHARS} characters with the oldest dropped first.
+     */
+    private capConversationHistory(turns: Array<{ Role: string; Message: string | null }>): ChatMessage[] {
+        const newest = turns.slice(-MAX_CONVERSATION_HISTORY_TURNS);
+        const messages: ChatMessage[] = newest.map((t) => ({
+            role: t.Role === 'AI' ? 'assistant' : 'user',
+            content: (t.Message ?? '').trim(),
+        }));
+        let total = messages.reduce((sum, m) => sum + String(m.content).length + 1, 0);
+        while (messages.length > 0 && total > MAX_CONVERSATION_HISTORY_CHARS) {
+            const dropped = messages.shift() as ChatMessage;
+            total -= String(dropped.content).length + 1;
+        }
+        return messages;
+    }
+
     /**
      * Walks the prior-session chain backwards from `lastSessionId`, returning the OWNED leg ids
      * (newest first). The first leg must exist and be owned by the caller, else `[]` (logged);

package/src/resolvers/RunAIAgentResolver.ts

@@ -1631,12 +1631,13 @@ export class RunAIAgentResolver extends ResolverBase {
         if (!artifactVersion.FileID) return null;
 
         try {
-            // Use the attachment service's downloadFileContent which uses GetObject directly
+            // The attachment service returns base64 rather than a Buffer — `Buffer` is Node-only,
+            // and removing it from that signature is what let the service stop depending on the
+            // storage SDKs and become usable from browser and React Native hosts.
             const attachmentService = GetAttachmentService();
-            const buffer = await attachmentService.DownloadFileContent(artifactVersion.FileID, contextUser, provider);
-            if (!buffer) return null;
+            const base64 = await attachmentService.DownloadFileContent(artifactVersion.FileID, contextUser, provider);
+            if (!base64) return null;
 
-            const base64 = buffer.toString('base64');
             const mimeType = artifactVersion.MimeType || 'application/octet-stream';
             return `data:${mimeType};base64,${base64}`;
         } catch (err) {

package/src/resolvers/SearchEntitiesResolver.ts

@@ -114,7 +114,9 @@ export class SearchEntitiesResolver {
                     Groups: params.map(p => ({ EntityName: p.EntityName, Results: [] })),
                 };
             }
-            const md = GetReadOnlyProvider(providers);
+            // Search is a pure read, so the read-write pool is a valid fallback. Without it, a server
+            // with no read-only login configured gets `null` here and every search silently returns empty.
+            const md = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
             const user = UserCache.Instance.Users.find(
                 (u) => u.Email.trim().toLowerCase() === userPayload.email.trim().toLowerCase()
             );

package/src/resolvers/SearchKnowledgeResolver.ts

@@ -32,6 +32,9 @@ export class SearchKnowledgeResultItem {
     @Field()
     EntityName: string;
 
+    @Field({ nullable: true })
+    EntityDisplayName?: string;
+
     @Field()
     RecordID: string;
 
@@ -461,6 +464,7 @@ export class SearchKnowledgeResolver extends ResolverBase {
             Results: result.Results.map((r: SearchEngineResultItem) => ({
                 ID: r.ID,
                 EntityName: r.EntityName,
+                EntityDisplayName: r.EntityDisplayName,
                 RecordID: r.RecordID,
                 SourceType: r.SourceType,
                 ResultType: r.ResultType,

package/src/resolvers/SearchKnowledgeSystemUserResolver.ts

@@ -88,6 +88,7 @@ export class SearchKnowledgeSystemUserResolver extends ResolverBase {
             Results: result.Results.map((r: SearchEngineResultItem) => ({
                 ID: r.ID,
                 EntityName: r.EntityName,
+                EntityDisplayName: r.EntityDisplayName,
                 RecordID: r.RecordID,
                 SourceType: r.SourceType,
                 ResultType: r.ResultType,

package/src/resolvers/TransactionGroupResolver.ts

@@ -78,6 +78,19 @@ export class TransactionOutputType {
 
 
 
+/**
+ * Renders one refused transaction-group item for the server log, naming the position, entity and
+ * operation so an operator can tie the refusal back to the row the client sent.
+ *
+ * `CompleteMessage` rather than `Message` because a refusal can report itself through any of
+ * `Message`, `Error` or the `Errors` array — a validation failure populates only the last of the
+ * three, so reading `Message` alone logs an empty reason for exactly the case that matters most.
+ */
+function describeRefusedItem(index: number, item: TransactionItemInputType, entity: BaseEntity): string {
+    const reason = entity.LatestResult?.CompleteMessage?.trim();
+    return `  [${index}] ${item.OperationType} '${item.EntityName}': ${reason || 'refused without a reported reason'}`;
+}
+
 export class TransactionResolver extends ResolverBase {
     /**
      * Maps a TransactionGroup item's operation type onto the SAME API-key scope path the singular
@@ -123,8 +136,14 @@ export class TransactionResolver extends ResolverBase {
             const tg = await md.CreateTransactionGroup();
             const entityObjects: BaseEntity[] = [];
             const objectValues: any[] = [];
+            // #4309: Save()/Delete() report a LOGICAL refusal by returning false — they do not throw —
+            // and a refused row is never enrolled, because TransactionGroup.AddTransaction() is reached
+            // only from inside ProviderToUse.Save()/Delete(). Discarding that boolean let a group whose
+            // rows were all refused arrive at Submit() empty, take its legitimate "nothing to do"
+            // branch, and report success for writes that never happened.
+            const refusals: string[] = [];
 
-            for (const item of group.Items) {
+            for (const [index, item] of group.Items.entries()) {
                 // instantiate a new entity object for the item
                 const entity = await md.GetEntityObject(item.EntityName, context.userPayload.userRecord);
                 entityObjects.push(entity); // save for later for mapping variables if needed
@@ -147,17 +166,51 @@ export class TransactionResolver extends ResolverBase {
                         objectValues.push(itemValues);
                         entity.SetMany(itemValues, true);
                         entity.TransactionGroup = tg;
-                        await entity.Save();
+                        if (!await entity.Save()) {
+                            refusals.push(describeRefusedItem(index, item, entity));
+                        }
                         break;
                     case "Delete":
                         await entity.InnerLoad(pkey);
-                        objectValues.push(entity.GetDataObject());
+                        // AWAITED: GetDataObject() is async, and pushing the un-awaited Promise put
+                        // one into `objectValues` — which is `any[]`, so neither tsc nor a
+                        // floating-promise lint could see it. PrepareReturnValue's Delete branch
+                        // then stringified that Promise, and JSON.stringify(Promise) is "{}", so
+                        // EVERY Delete in a transaction group reported an empty payload, successful
+                        // ones included. Worse than losing the payload: GraphQLDataProvider's Delete
+                        // transaction callback validates the commit with
+                        // `pk.Value !== results[pk.FieldName]`, so "{}" made every key mismatch and
+                        // reported 'Transaction failed to commit' for a delete that DID commit.
+                        // Awaiting costs nothing here — DataObjectParams defaults
+                        // includeRelatedEntityData to false, which guards the method's only awaited
+                        // work, so with no params this is GetAll() plus a filter loop.
+                        objectValues.push(await entity.GetDataObject());
                         entity.TransactionGroup = tg;
-                        await entity.Delete();
+                        if (!await entity.Delete()) {
+                            refusals.push(describeRefusedItem(index, item, entity));
+                        }
                         break;
                 }
             }
 
+            // A refused row never enrolled, so submitting now would commit only the SURVIVORS and
+            // still report unqualified success. Nothing has been written at this point — enrolment
+            // is deferral, and the provider does not touch the database until Submit() — so
+            // returning here leaves the database exactly as we found it.
+            //
+            // The predicate is the RETURN VALUE, not whether the group ended up empty: a row that
+            // is not dirty also fails to enrol and correctly returns true, and an empty group
+            // legitimately means "nothing to do" for a caller that enrolled nothing. That is also
+            // why this belongs here rather than in TransactionGroupBase.Submit() — this is the only
+            // layer that still knows which row was refused and why.
+            if (refusals.length > 0) {
+                LogError(
+                    `TransactionResolver::ExecuteTransactionGroup --- ${refusals.length} of ${group.Items.length} ` +
+                    `item(s) were refused, so the group was not submitted:\n${refusals.join('\n')}`
+                );
+                return await this.PrepareReturnValue(false, entityObjects, objectValues, group);
+            }
+
             // now, we need to set the variables
             if (group.Variables && group.Variables.length > 0) {
                 for (const networkVar of group.Variables) {