@memberjunction/server 6.1.4 → 6.1.6

package/dist/resolvers/RealtimeClientSessionResolver.js

@@ -23,9 +23,9 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
  * and **executes** every tool call the browser relays back. The three mutations here cover the MVP:
  *
  * 1. {@link RealtimeClientSessionResolver.StartRealtimeClientSession} — authorize, create the
- *    session (storing the target agent id server-side, authoritatively), mint the ephemeral config.
- * 2. {@link RealtimeClientSessionResolver.ExecuteRealtimeSessionTool} — execute a relayed tool call,
- *    reading the target agent id from the session (NOT the client) so the browser can't swap targets.
+ *    session (storing the target agent id on it), mint the ephemeral config.
+ * 2. {@link RealtimeClientSessionResolver.ExecuteRealtimeSessionTool} — execute a relayed tool call
+ *    for the target agent stored on the session, re-authorized for the caller on every call.
  * 3. {@link RealtimeClientSessionResolver.RelayRealtimeTranscript} — persist a transcript turn as a
  *    `Conversation Detail`.
  *
@@ -33,6 +33,13 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
  * - **Start**: the caller must have `CanRun` on the *target* agent (the Realtime Co-Agent is an internal
  *   orchestration agent, so the meaningful gate is the agent doing the real work).
  * - **Execute / Relay**: inbound ownership — the session's `UserID` must equal `contextUser.ID`.
+ * - **Session `Config`**: the owner can edit it through the generic entity API, so nothing in it is
+ *   trusted. Execute re-checks `CanRun` on its target, direct actions never come from it, and its
+ *   run ids are used only when {@link SessionRunIDVerifier} finds them to be records of the session.
+ * - **Scope-limited callers** (anonymous and resource-scoped magic-link sessions, including public
+ *   web-widget guests): no direct actions. Their scope exists only as row-level filters, which an
+ *   action can read around, and a scoped anonymous caller's relay runs as the system user. They
+ *   reach the target agent only through `invoke-target-agent`.
  *
  * @module @memberjunction/server
  */
@@ -41,10 +48,12 @@ import { AuthorizationEvaluator, LogError, LogStatus, RunView } from '@memberjun
 import { UUIDsEqual, IsValidUUID } from '@memberjunction/global';
 import { AIEngine } from '@memberjunction/aiengine';
 import { AIAgentPermissionHelper, AIEngineBase } from '@memberjunction/ai-engine-base';
-import { RealtimeClientSessionService, RealtimeChannelServerHost, EvaluateRuntimeOverrideAuthorization, FindIgnoredRealtimeConfigKeys, ParseRealtimeTypeConfiguration, ResolveEffectiveRealtimeConfig, REALTIME_ADVANCED_SESSION_CONTROLS_AUTHORIZATION, resolveRecordingStorageAccountID, storeRealtimeRecording, writeRealtimeRecordingSegment, deleteRealtimeRecordingSegments, } from '@memberjunction/ai-agents';
+import { RealtimeClientSessionService, RealtimeChannelServerHost, EvaluateRuntimeOverrideAuthorization, FindIgnoredRealtimeConfigKeys, ParseRealtimeTypeConfiguration, ResolveEffectiveRealtimeConfig, INVOKE_TARGET_AGENT_TOOL_NAME, REALTIME_ADVANCED_SESSION_CONTROLS_AUTHORIZATION, resolveRecordingStorageAccountID, storeRealtimeRecording, writeRealtimeRecordingSegment, deleteRealtimeRecordingSegments, } from '@memberjunction/ai-agents';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { GetReadWriteProvider } from '../util.js';
 import { SessionManager } from '../agentSessions/index.js';
+import { SessionRunIDVerifier } from '../agentSessions/SessionRunIDVerifier.js';
+import { IsScopeLimitedPrincipal } from '../auth/scopeLimitedPrincipal.js';
 import { resolveWidgetGuestRunContext, ResolveScopedAnonymousRunUser } from '../realtimeWidget/widgetGuestElevation.js';
 /**
  * Progress steps worth narrating to the realtime model — mirrors the normal agent-run path's filter
@@ -265,6 +274,31 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         // state on — otherwise that cleanup silently no-ops on a freshly-constructed instance.
         this.clientSessionService = new RealtimeClientSessionService();
         this.sessionManager = new SessionManager(this.clientSessionService);
+        this.runIDVerifier = new SessionRunIDVerifier();
+    }
+    /**
+     * The reason a `Save()`/`Delete()` returned false, for a log line. `CompleteMessage` renders
+     * `Message`, `Error` and every `Errors[]` entry (validation errors included, since `Save()`
+     * runs `Validate()` and records its errors there), so there is no separate `Validate()` call.
+     * When a subclass refused the write without recording anything, say so explicitly instead of
+     * "unknown error", which is what hid MJ#4791.
+     *
+     * Only a NULL `LatestResult` proves the refusal happened before the provider (nothing was
+     * registered at all). A SUCCESS `LatestResult` is an earlier save on the same instance — the
+     * refusal registered nothing — so its text must never be reported as this failure's reason.
+     */
+    describeSaveFailure(entity) {
+        const latest = entity.LatestResult;
+        if (!latest) {
+            return `no failure detail recorded (LatestResult null; ResultHistory length ${entity.ResultHistory.length}) ` +
+                '— the write was refused before reaching the provider';
+        }
+        if (latest.Success) {
+            return 'no failure detail recorded (latest result entry is a prior success; ' +
+                `ResultHistory length ${entity.ResultHistory.length})`;
+        }
+        const detail = latest.CompleteMessage?.trim();
+        return detail || `no failure detail recorded (LatestResult empty; ResultHistory length ${entity.ResultHistory.length})`;
     }
     /**
      * Start a client-direct realtime voice session targeting `targetAgentId`.
@@ -276,7 +310,7 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
      *    agent's `DefaultCoAgentID` → type-level `AIAgentCoAgent` default row → global Realtime Co-Agent) —
      *    see {@link RealtimeClientSessionResolver.resolveCoAgentID} for the full contract.
      * 3. Create the durable `AIAgentSession` (run by the co-agent), storing `targetAgentID` in its
-     *    config server-side — this is the authoritative target for all later relays.
+     *    config — the target later relays use, re-authorized for the caller on each relay.
      * 4. Mint the {@link import('@memberjunction/ai').ClientRealtimeSessionConfig} via the service.
      *    On failure the just-created session is closed so no half-open session leaks.
      *
@@ -363,8 +397,10 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
      * Execute a single tool call the browser relayed from its provider socket and return the
      * serialized result for the browser to relay back to the model.
      *
-     * Ownership-gated; the target agent id is read from the **session config** (authoritative), never
-     * from the client. Heartbeats the session on success.
+     * Ownership-gated. The target agent id is read from the session config and `CanRun` on it is
+     * checked for the caller on every call, because the owner can edit the config. A direct-action
+     * call from a scope-limited caller is refused before any elevation. Heartbeats the session on
+     * success.
      *
      * @returns The serialized tool result JSON.
      */
@@ -372,12 +408,17 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
         const session = await this.loadOwnedActiveSession(agentSessionId, contextUser, provider);
         const config = this.readSessionConfig(session);
+        await this.assertCanRunTarget(config.targetAgentID, contextUser, provider);
+        if (toolName !== INVOKE_TARGET_AGENT_TOOL_NAME && IsScopeLimitedPrincipal(contextUser)) {
+            return this.refuseDirectAction(agentSessionId, toolName);
+        }
         // SCOPED-ANONYMOUS ELEVATION (issue #3371): once ownership is proven above, the delegated
         // run + its AI-run-entity writes execute as the system user for a scoped anonymous caller
         // (the caller's role deliberately holds no grants on the run entities). The lead
-        // targetAgentID comes from the session config and was CanRun-gated at start; the colleague
-        // union is gated just below, against the CALLER, so elevation never widens agent authority.
+        // targetAgentID is CanRun-gated against the CALLER just above, and the colleague union
+        // just below, so elevation never widens agent authority.
         const runUser = ResolveScopedAnonymousRunUser(contextUser);
+        const runIDs = await this.runIDVerifier.Verify(session.ID, { CoAgentRunID: config.coAgentRunID, PendingFeedbackRunID: config.pendingFeedbackRunID }, runUser, provider);
         if (runUser !== contextUser) {
             LogStatus(`ExecuteRealtimeSessionTool: dispatching relayed tool '${toolName}' for session ${agentSessionId} ` +
                 'under the system user (scoped-anonymous caller).');
@@ -390,20 +431,21 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
             // Multi-target (Move 4): the session's persisted allowed-agent union — a model-named
             // colleague in the call is validated against this; absent ⇒ single-target behavior.
             AllowedAgents: await this.filterAllowedAgentsByCanRun(config.allowedAgents, contextUser),
-            DirectActions: config.directActions,
+            // No DirectActions: the service takes them from the session's start-time projection
+            // or the target agent's metadata, never from the owner-editable config.
             // Attribution follows the VISITOR even when `runUser` is elevated: the delegated run
             // row and its context-memory scope must stay the person's, not the system user's.
             AttributionUserID: contextUser.ID,
             // Nest the delegated target-agent run under the co-agent observability run (when present).
-            ParentRunID: config.coAgentRunID,
+            ParentRunID: runIDs.CoAgentRunID,
             Call: { CallID: callId, ToolName: toolName, Arguments: argsJson },
             OnProgress: this.buildDelegationProgressCallback(pubSub, userPayload, agentSessionId, callId),
             // Resume a previously-paused delegated run (if any) with the user's answer.
-            ResumeRunID: config.pendingFeedbackRunID,
+            ResumeRunID: runIDs.PendingFeedbackRunID,
         }, runUser, provider);
         const durationMs = Date.now() - startTime;
         LogStatus(`ExecuteRealtimeSessionTool: completed relayed tool '${toolName}' (callId: ${callId}) in ${durationMs}ms`);
-        if (toolName !== 'invoke-target-agent') {
+        if (toolName !== INVOKE_TARGET_AGENT_TOOL_NAME) {
             await this.persistDirectActionTurn(session, callId, toolName, argsJson, ResultJson, durationMs, contextUser, provider);
         }
         // Roll the paused-run id forward in the session config: clear the one we just consumed, and
@@ -412,7 +454,9 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         // Junction-link any artifacts the delegated run produced into the session's conversation
         // history (best-effort) — so chat, session review, and resume carryover can all see them.
         // Runs as `runUser`: the junction entity is not among an anonymous caller's relay grants.
-        await this.linkDelegatedArtifactsToConversation(session, Artifacts, runUser, provider);
+        // The hidden anchor detail it may need to create, though, is written by the CALLER (#4791)
+        // — same reason `persistDirectActionTurn` is: the System user is not the conversation owner.
+        await this.linkDelegatedArtifactsToConversation(session, Artifacts, runUser, contextUser, provider);
         await this.sessionManager.Heartbeat(agentSessionId, contextUser, provider);
         return ResultJson;
     }
@@ -439,6 +483,18 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
             }), userPayload);
         };
     }
+    /**
+     * The tool result for a direct-action call from a scope-limited caller (see the authorization
+     * model above). It has the broker's result shape, so the model hears that the tool is not
+     * available and can ask the target agent through `invoke-target-agent` instead.
+     */
+    refuseDirectAction(agentSessionId, toolName) {
+        LogStatus(`ExecuteRealtimeSessionTool: refused direct action '${toolName}' for a scope-limited caller on session ${agentSessionId}.`);
+        return JSON.stringify({
+            success: false,
+            output: `The tool '${toolName}' is not available in this session. Ask the agent to do it with ${INVOKE_TARGET_AGENT_TOOL_NAME}.`,
+        });
+    }
     /**
      * Rolls the session's `pendingFeedbackRunID` forward after a relayed tool call. The id we just
      * consumed (resumed or none) is dropped; a new paused run id is stored only when the run paused
@@ -463,7 +519,7 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         };
         session.Config_ = JSON.stringify(next);
         if (!(await session.Save())) {
-            LogError(`RealtimeClientSessionResolver.updatePendingFeedbackRunID save failed: ${session.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+            LogError(`RealtimeClientSessionResolver.updatePendingFeedbackRunID save failed for session ${session.ID}: ${this.describeSaveFailure(session)}`);
         }
     }
     /**
@@ -492,9 +548,10 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         // conversation (run-viewer observability parity). Best-effort — never fails the transcript relay.
         // The prompt-run write runs as the scoped-anonymous elevated user (issue #3371) — the visible
         // Conversation Detail above deliberately stays on the caller.
-        const promptRunID = this.readPromptRunID(session);
+        const runUser = ResolveScopedAnonymousRunUser(contextUser);
+        const promptRunID = await this.readPromptRunID(session, runUser, provider);
         if (promptRunID) {
-            await this.clientSessionService.AppendPromptRunMessage(promptRunID, this.mapTranscriptRoleToChatRole(role), text, replacesPrevious ?? false, ResolveScopedAnonymousRunUser(contextUser), provider);
+            await this.clientSessionService.AppendPromptRunMessage(promptRunID, this.mapTranscriptRoleToChatRole(role), text, replacesPrevious ?? false, runUser, provider);
         }
         await this.sessionManager.Heartbeat(agentSessionId, contextUser, provider);
         return true;
@@ -647,11 +704,12 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         // Persist the tool turn facts into a hidden ConversationDetail turn so session review
         // can reconstruct the tool card dynamically on load (Option 1). Best-effort.
         await this.persistDirectActionTurn(session, undefined, toolName, argsJson, resultJson, undefined, contextUser, provider);
-        const promptRunID = this.readPromptRunID(session);
+        const runUser = ResolveScopedAnonymousRunUser(contextUser);
+        const promptRunID = await this.readPromptRunID(session, runUser, provider);
         if (!promptRunID) {
             return false;
         }
-        return this.clientSessionService.AppendPromptRunMessage(promptRunID, 'assistant', this.formatToolTurn(toolName, argsJson, resultJson), false, ResolveScopedAnonymousRunUser(contextUser), provider);
+        return this.clientSessionService.AppendPromptRunMessage(promptRunID, 'assistant', this.formatToolTurn(toolName, argsJson, resultJson), false, runUser, provider);
     }
     /**
      * Formats a co-agent tool call into a compact, human-readable run line: `🔧 <tool> <args> → <result>`,
@@ -726,14 +784,15 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         if (inputDelta === 0 && outputDelta === 0) {
             return true; // nothing to add — a no-op flush is a success, not a failure
         }
-        const promptRunID = this.readPromptRunID(session);
+        // Runs as the scoped-anonymous elevated user (issue #3371) — the caller's role holds no prompt-run grants.
+        const runUser = ResolveScopedAnonymousRunUser(contextUser);
+        const promptRunID = await this.readPromptRunID(session, runUser, provider);
         if (!promptRunID) {
             return false; // no observability prompt run for this session — logged in the helper
         }
         // Delegate to the service so usage writes share the per-run serialization with transcript-message
         // appends — otherwise the frequent usage save clobbers freshly-appended Messages (and vice-versa).
-        // Runs as the scoped-anonymous elevated user (issue #3371) — the caller's role holds no prompt-run grants.
-        return this.clientSessionService.AccumulatePromptRunUsage(promptRunID, inputDelta, outputDelta, ResolveScopedAnonymousRunUser(contextUser), provider);
+        return this.clientSessionService.AccumulatePromptRunUsage(promptRunID, inputDelta, outputDelta, runUser, provider);
     }
     /** Clamps a relayed token delta: negative / non-finite values become 0. */
     clampTokenDelta(value) {
@@ -757,23 +816,29 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
     }
     /**
      * Reads the co-agent `AIPromptRun` id from the session config WITHOUT the relay path's
-     * throw-on-missing-target semantics — usage relay is best-effort, so a missing/malformed
-     * config or absent id just logs and returns `null`.
+     * throw-on-missing-target semantics, and keeps it only when it is the prompt run of the
+     * session's co-agent run (the owner can edit the config). Usage relay is best-effort, so a
+     * missing/malformed config, an absent id, or an id of another session just logs and returns `null`.
+     *
+     * @param runUser The user the prompt-run write runs as; the check runs as the same user.
      */
-    readPromptRunID(session) {
-        try {
-            const config = this.readSessionConfig(session);
-            if (config.promptRunID) {
-                return config.promptRunID;
-            }
+    async readPromptRunID(session, runUser, provider) {
+        const config = this.tryReadSessionConfig(session);
+        if (!config) {
+            LogError(`RelayRealtimeUsage: session ${session.ID} has no parseable config — usage delta dropped.`);
+            return null;
+        }
+        if (!config.promptRunID) {
             LogStatus(`RelayRealtimeUsage: session ${session.ID} has no co-agent promptRunID (observability run ` +
                 'creation was skipped or failed) — usage delta dropped.');
             return null;
         }
-        catch {
-            LogError(`RelayRealtimeUsage: session ${session.ID} has no parseable config — usage delta dropped.`);
+        const verified = await this.runIDVerifier.Verify(session.ID, { CoAgentRunID: config.coAgentRunID, PromptRunID: config.promptRunID }, runUser, provider);
+        if (!verified.PromptRunID) {
+            LogError(`RelayRealtimeUsage: session ${session.ID} names a promptRunID that is not its co-agent prompt run — ignored.`);
             return null;
         }
+        return verified.PromptRunID;
     }
     /**
      * Persist an interactive channel's state of record (e.g. the live whiteboard's serialized
@@ -888,8 +953,10 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         return { contextUser, provider: GetReadWriteProvider(providers) };
     }
     /**
-     * Authorization gate for {@link RealtimeClientSessionResolver.StartRealtimeClientSession}: the
-     * caller must be able to run the **target** agent. Denial throws (no session is created).
+     * Authorization gate for the **target** agent: the caller must be able to run it. Denial throws.
+     * {@link RealtimeClientSessionResolver.StartRealtimeClientSession} runs it before any session is
+     * created, and {@link RealtimeClientSessionResolver.ExecuteRealtimeSessionTool} runs it on every
+     * relayed call, because the owner can edit the target in the session config.
      */
     async assertCanRunTarget(targetAgentId, contextUser, _provider) {
         const canRun = await AIAgentPermissionHelper.HasPermission(targetAgentId, contextUser, 'run');
@@ -1315,6 +1382,9 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
             // (allowed-agent union); the snapshot is injected into the system prompt at mint.
             ApplicationID: applicationId,
             AppContext: appContext,
+            // Scope-limited callers get no direct actions (see the authorization model above), so
+            // the model is not given tools that the relay refuses.
+            ExcludeDirectActions: IsScopeLimitedPrincipal(contextUser),
         }, 
         // SCOPED-ANONYMOUS ELEVATION (issue #3371): the prepare creates the co-agent
         // observability AIAgentRun/AIPromptRun/run-step, which a scoped anonymous caller's role
@@ -1346,9 +1416,10 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
     }
     /**
      * Writes the co-agent observability run ids into the session's `Config_` alongside the
-     * authoritative `targetAgentID`, then saves the session. These ids are read back on close to
-     * finalize the runs (and on relay to nest delegated runs). Best-effort: a save failure is logged,
-     * not thrown — the voice session still proceeds, it just won't carry the run ids.
+     * `targetAgentID`, then saves the session. These ids are read back on close to
+     * finalize the runs (and on relay to nest delegated runs). Relays never read the direct actions
+     * from it. Best-effort: a save failure is logged, not thrown — the voice session still proceeds,
+     * it just won't carry the run ids.
      */
     async persistObservabilityRunIDs(session, targetAgentID, coAgentRunID, promptRunID, coAgentRunStepID, applicationID, allowedAgents, directActions) {
         // Preserve any server-authoritative voice deadline stamped at session start (this rebuilds the
@@ -1367,7 +1438,7 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         session.Config_ = JSON.stringify(config);
         const saved = await session.Save();
         if (!saved) {
-            LogError(`RealtimeClientSessionResolver.persistObservabilityRunIDs save failed: ${session.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+            LogError(`RealtimeClientSessionResolver.persistObservabilityRunIDs save failed for session ${session.ID}: ${this.describeSaveFailure(session)}`);
         }
     }
     /**
@@ -1451,7 +1522,7 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         const saved = await row.Save();
         if (!saved) {
             LogError(`SaveSessionChannelState: save failed for session ${agentSessionID} / channel ${channelID}: ` +
-                `${row.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+                `${this.describeSaveFailure(row)}`);
         }
         return saved;
     }
@@ -1675,7 +1746,7 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         artifact.UserID = contextUser.ID;
         artifact.Visibility = 'Always';
         if (!(await artifact.Save())) {
-            const message = `SaveSessionChannelArtifact: artifact save failed: ${artifact.LatestResult?.CompleteMessage ?? 'unknown error'}`;
+            const message = `SaveSessionChannelArtifact: artifact save failed for session ${session.ID}: ${this.describeSaveFailure(artifact)}`;
             LogError(message);
             return { Success: false, ErrorMessage: message, ConversationDetailLinked: false };
         }
@@ -1686,7 +1757,7 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         version.Content = contentJson;
         version.UserID = contextUser.ID;
         if (!(await version.Save())) {
-            const message = `SaveSessionChannelArtifact: artifact version save failed: ${version.LatestResult?.CompleteMessage ?? 'unknown error'}`;
+            const message = `SaveSessionChannelArtifact: artifact version save failed for session ${session.ID} (artifact ${artifact.ID}): ${this.describeSaveFailure(version)}`;
             LogError(message);
             return { Success: false, ErrorMessage: message, ArtifactID: artifact.ID, ConversationDetailLinked: false };
         }
@@ -1736,21 +1807,29 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
      * queries (which scan junctions across ALL details) still surface the artifact. This is the
      * least-invasive correct anchor — no fake visible message, no orphaned artifact.
      *
+     * TWO PRINCIPALS, deliberately: the lookup (`findLatestSessionDetailID`) and the junction row
+     * itself (`saveDetailArtifactJunction`, `MJ: Conversation Detail Artifacts`) run as `runUser`
+     * (elevated for a scoped-anonymous caller) — that junction entity is outside an anonymous
+     * caller's relay grants. The hidden ANCHOR `Conversation Detail` this may need to create runs as
+     * `callerUser` instead: like every other `MJ: Conversation Details` write, the System user is
+     * refused because it is not the conversation's owner (see {@link persistDirectActionTurn},
+     * issue #4791) — only the actual caller can create it.
+     *
      * Strictly best-effort: every failure path logs and returns; a relayed tool call NEVER fails
      * because history linking did.
      */
-    async linkDelegatedArtifactsToConversation(session, artifacts, contextUser, provider) {
+    async linkDelegatedArtifactsToConversation(session, artifacts, runUser, callerUser, provider) {
         if (!artifacts || artifacts.length === 0 || !session.ConversationID) {
             return;
         }
         try {
-            const detailID = (await this.findLatestSessionDetailID(session, contextUser, provider)) ??
-                (await this.createHiddenSessionAnchorDetail(session, contextUser, provider));
+            const detailID = (await this.findLatestSessionDetailID(session, runUser, provider)) ??
+                (await this.createHiddenSessionAnchorDetail(session, callerUser, provider));
             if (!detailID) {
                 return; // anchor unavailable — logged in the helpers
             }
             for (const artifact of artifacts) {
-                await this.saveDetailArtifactJunction(detailID, artifact.ArtifactVersionID, contextUser, provider);
+                await this.saveDetailArtifactJunction(detailID, artifact.ArtifactVersionID, runUser, provider);
             }
         }
         catch (error) {
@@ -1781,22 +1860,22 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
      * {@link linkDelegatedArtifactsToConversation}). Returns the new detail's id, or `null`
      * (logged) when the save fails.
      */
-    async createHiddenSessionAnchorDetail(session, contextUser, provider) {
-        const detail = await provider.GetEntityObject(CONVERSATION_DETAIL_ENTITY, contextUser);
+    async createHiddenSessionAnchorDetail(session, callerUser, provider) {
+        const detail = await provider.GetEntityObject(CONVERSATION_DETAIL_ENTITY, callerUser);
         detail.NewRecord();
         detail.ConversationID = session.ConversationID;
         detail.Role = 'AI';
         detail.HiddenToUser = true;
         detail.Message = 'Artifacts produced during a realtime session (system anchor).';
         detail.AgentSessionID = session.ID;
-        // Attribute the anchor to the SESSION owner, not the (possibly elevated) writer — identical
-        // for every non-elevated caller, whose ownership of the session is already proven.
+        // Attribute to the SESSION owner — the caller writing this row, whose ownership
+        // `loadOwnedActiveSession` already proved.
         detail.UserID = session.UserID;
         if (await detail.Save()) {
             return detail.ID;
         }
         LogError(`ExecuteRealtimeSessionTool: hidden anchor detail save failed for session ${session.ID}: ` +
-            `${detail.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+            `${this.describeSaveFailure(detail)}`);
         return null;
     }
     /**
@@ -1812,7 +1891,7 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         const saved = await junction.Save();
         if (!saved) {
             LogError(`RealtimeClientSessionResolver: artifact junction save failed for detail ${conversationDetailID} / version ${artifactVersionID}: ` +
-                `${junction.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+                `${this.describeSaveFailure(junction)}`);
         }
         return saved;
     }
@@ -1841,7 +1920,7 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
             row.LastActiveAt = new Date();
             if (!(await row.Save())) {
                 LogError(`SaveSessionChannelArtifact: LastActiveAt stamp failed for session ${agentSessionID} / channel ${channelID}: ` +
-                    `${row.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+                    `${this.describeSaveFailure(row)}`);
             }
         }
         catch (error) {
@@ -1922,9 +2001,10 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
             tool.ParametersSchema !== null && typeof tool.ParametersSchema === 'object' && !Array.isArray(tool.ParametersSchema));
     }
     /**
-     * Parses the session's persisted config, returning the authoritative `targetAgentID` plus any
-     * observability run ids (`coAgentRunID`/`promptRunID`). Throws when the config is missing/malformed
-     * or carries no target — a relay cannot proceed without a target.
+     * Parses the session's persisted config, returning its `targetAgentID` plus any observability run
+     * ids (`coAgentRunID`/`promptRunID`). Throws when the config is missing/malformed or carries no
+     * target — a relay cannot proceed without a target. The owner can edit the config, so callers
+     * re-check what they act on.
      */
     readSessionConfig(session) {
         const raw = session.Config_;
@@ -1974,12 +2054,6 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         const minutes = elevation?.widget.VoiceMaxSessionMinutes;
         return minutes && minutes > 0 ? minutes * 60 : undefined;
     }
-    /**
-     * Persists a single transcript turn as a `Conversation Detail` stamped with the session's
-     * conversation, the mapped role, the turn text, the session id, and the owning user.
-     *
-     * @returns The boolean save result (logs `CompleteMessage` on failure).
-     */
     /**
      * Stamps `RecordingStartedAt` (the recording `t0` alignment origin) + `RecordingMedia` on a
      * just-started session when the browser captured WITH consent. Best-effort: a parse/save failure
@@ -2001,9 +2075,16 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         session.RecordingStartedAt = startedAt;
         session.RecordingMedia = 'Audio';
         if (!(await session.Save())) {
-            LogError(`RealtimeClientSessionResolver.stampRecordingStart save failed: ${session.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+            LogError(`RealtimeClientSessionResolver.stampRecordingStart save failed for session ${session.ID}: ${this.describeSaveFailure(session)}`);
         }
     }
+    /**
+     * Persists a single transcript turn as a `Conversation Detail` stamped with the session's
+     * conversation, the mapped role, the turn text, the session id, and the owning user.
+     *
+     * @returns The boolean save result. On failure it logs the session, the write user and the
+     * reason from {@link describeSaveFailure}.
+     */
     async persistTranscriptTurn(session, role, text, contextUser, provider, utteranceStartMs, utteranceEndMs) {
         const detail = await provider.GetEntityObject(CONVERSATION_DETAIL_ENTITY, contextUser);
         detail.NewRecord();
@@ -2020,7 +2101,7 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         }
         const saved = await detail.Save();
         if (!saved) {
-            LogError(`RealtimeClientSessionResolver.persistTranscriptTurn save failed: ${detail.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+            LogError(`RealtimeClientSessionResolver.persistTranscriptTurn save failed for session ${session.ID} (write user ${contextUser.ID}): ${this.describeSaveFailure(detail)}`);
         }
         return saved;
     }
@@ -2051,8 +2132,13 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         // ⚠️ ELEVATING INSTEAD WAS TRIED AND IS A TRAP. `ResolveScopedAnonymousRunUser` returns
         // `UserCache.GetSystemUser()`, which on this deployment resolves to the unconfigured
         // placeholder `not.set@nowhere.com` ("Configured provisioning user not found; falling back
-        // to an Owner"). Saving as a user that does not exist returns false with a NULL
-        // `LatestResult` — indistinguishable from a permission denial, and just as silent.
+        // to an Owner"). That user EXISTS — it is not a missing/invalid principal — and even carries
+        // full CRUD on `MJ: Conversation Details`. It is refused anyway:
+        // `MJConversationDetailEntityExtended`'s owner gate accepts only the conversation's OWNER or
+        // an Edit/Owner Resource Permission grantee, and the System user is neither. Measured on
+        // MJ#4791 (before the core-entities fix that now records the denial): `Save()` → `false`,
+        // `LatestResult` null — indistinguishable from a permission denial, and just as silent. The
+        // denial itself still happens; that fix only made it stop being silent.
         const writeUser = contextUser;
         const rv = RunView.FromMetadataProvider(provider);
         const result = await rv.RunView({
@@ -2070,8 +2156,8 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         //
         // `ResultType: 'entity_object'` hands back hydrated entities, but they do not carry the
         // context user the way `GetEntityObject(entity, user)` does — so `Save()` ran with no
-        // principal and failed with an EMPTY message ("unknown error"), which is what the elevation
-        // fix above looked like when it was still broken. The insert path beside this one has
+        // principal and failed with an EMPTY message ("unknown error"), which is what an empty-message
+        // failure here looked like before the re-load. The insert path beside this one has
         // always used `GetEntityObject`; this now matches it, which is also why they now succeed
         // and fail for the same reasons.
         const previous = await provider.GetEntityObject(CONVERSATION_DETAIL_ENTITY, writeUser);
@@ -2097,7 +2183,7 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
             LogError(`RealtimeClientSessionResolver.replacePreviousTranscriptTurn save failed for session `
                 + `${session.ID} — the ${mappedRole} turn keeps its PREVIOUS, shorter text and the `
                 + `transcript now understates what was said: `
-                + `${previous.LatestResult?.CompleteMessage || JSON.stringify(previous.LatestResult ?? null)}`);
+                + `${this.describeSaveFailure(previous)}`);
         }
         return saved;
     }
@@ -2114,14 +2200,30 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
      * Stored as stable facts (Role: 'AI', HiddenToUser: true, ExternalID: callId, CompletionTime: durationMs,
      * Message: JSON-serialized tool facts) so that session review can reconstruct the action card dynamically
      * on load (Option 1) without polluting user-facing speech chat bubbles.
+     *
+     * Writes as the CALLER, never the elevated run user (issue #4791). Owning the session
+     * (`loadOwnedActiveSession`'s gate has already run on every path here) does NOT imply owning
+     * the conversation: the conversation id was client-supplied at session start. What authorizes
+     * this write is the save itself, evaluated for the caller — the conversation owner gate in
+     * `MJConversationDetailEntityExtended`, plus the caller's own entity permission and Create RLS
+     * on `MJ: Conversation Details` (for the magic-link role that RLS scopes by the invite's
+     * `ScopeResourceID`, and the role belongs to a downstream app, not MJ core). That is why
+     * writing as the caller is safe even though the conversation id originated client-side.
+     * Elevating to the System user would bypass RLS entirely, and the owner gate refuses it anyway
+     * because the System user is not the conversation owner. Measured on MJ#4791 (before the
+     * core-entities fix that now records the denial): `Save()` returned `false` with a NULL `LatestResult` and an empty
+     * `ResultHistory` — indistinguishable from any other silent failure. Elevating this write is
+     * what silently dropped both hidden tool-execution turns of a real magic-link session; the
+     * denial itself still happens today, only its silence was fixed separately.
+     * `ResolveScopedAnonymousRunUser` elevates AI-**run**-entity writes only (prompt runs, agent
+     * runs, the relayed dispatch itself) — never this one.
      */
     async persistDirectActionTurn(session, callId, toolName, argsJson, resultJson, durationMs, contextUser, provider) {
         if (!session.ConversationID) {
             return false;
         }
         try {
-            const writeUser = ResolveScopedAnonymousRunUser(contextUser);
-            const detail = await provider.GetEntityObject(CONVERSATION_DETAIL_ENTITY, writeUser);
+            const detail = await provider.GetEntityObject(CONVERSATION_DETAIL_ENTITY, contextUser);
             detail.NewRecord();
             detail.ConversationID = session.ConversationID;
             detail.Role = 'AI';
@@ -2159,13 +2261,13 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
             detail.Message = JSON.stringify(factPayload);
             const saved = await detail.Save();
             if (!saved) {
-                LogError(`RealtimeClientSessionResolver.persistDirectActionTurn save failed: ${detail.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+                LogError(`RealtimeClientSessionResolver.persistDirectActionTurn save failed for session ${session.ID} (tool '${toolName}', call ${callId ?? 'n/a'}, write user ${contextUser.ID}): ${this.describeSaveFailure(detail)}`);
             }
             return saved;
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            LogError(`RealtimeClientSessionResolver.persistDirectActionTurn unexpected error: ${message}`);
+            LogError(`RealtimeClientSessionResolver.persistDirectActionTurn unexpected error for session ${session.ID}: ${message}`);
             return false;
         }
     }