@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/src/generic/ResolverBase.ts

@@ -1,5 +1,6 @@
 import {
   AggregateExpression,
+  AssertClientInputWritableForUser,
   BaseEntity,
   BaseEntityEvent,
   CompositeKey,
@@ -14,8 +15,10 @@ import {
   KeyValuePair,
   LogDebug,
   LogError,
+  LogErrorEx,
   LogStatus,
   Metadata,
+  ProjectEntityValuesForUser,
   ReadableFieldsTransportKey,
   RecordChangeFieldSecurityProjector,
   RecordChangePayloadFields,
@@ -23,8 +26,17 @@ import {
   RunViewParams,
   RunViewResult,
   UserInfo,
+  ViewPropertyValues,
 } from '@memberjunction/core';
-import { MJAuditLogEntity, MJErrorLogEntity, MJUserViewEntityExtended } from '@memberjunction/core-entities';
+import { MJAuditLogEntity, MJErrorLogEntity, MJUserViewEntityExtended, UserViewEngine } from '@memberjunction/core-entities';
+
+/**
+ * Extended RunViewResult carrying a non-enumerable reference to the resolved view entity
+ * so downstream resolvers (e.g. RunViewResolver) do not re-query `MJ: User Views` a third time.
+ */
+export type RunViewResultWithResolvedView<T = unknown> = RunViewResult<T> & {
+  _resolvedViewEntity?: MJUserViewEntityExtended;
+};
 import { SQLServerDataProvider } from '@memberjunction/sqlserver-dataprovider';
 import { ClientClauseScreen, UserCache, type EntityBaseViewAllowList } from '@memberjunction/generic-database-provider';
 import { PubSubEngine, AuthorizationError } from 'type-graphql';
@@ -37,11 +49,11 @@ import { httpTransport, CloudEvent, emitterFor } from 'cloudevents';
 import { RunViewGenericParams, UserPayload } from '../types.js';
 import { RunDynamicViewInput, RunViewByIDInput, RunViewByNameInput } from './RunViewResolver.js';
 import { DeleteOptionsInput } from './DeleteOptionsInput.js';
-import { MJEvent, MJEventType, MJGlobal, ENCRYPTED_SENTINEL, ReplaceByteArraysWithBase64, EscapeSQLString, IsValueEncrypted, IsOnlyTimezoneShift } from '@memberjunction/global';
-import { SQLParser, IsBalancedSQLFragment, LexSQL } from '@memberjunction/sql-parser';
+import { MJEvent, MJEventType, MJGlobal, UUIDsEqual, ENCRYPTED_SENTINEL, ReplaceByteArraysWithBase64, EscapeSQLString, IsValueEncrypted, IsOnlyTimezoneShift, Canonicalize } from '@memberjunction/global';
+import { SQLParser, IsBalancedSQLFragment, LexSQL, StrictFragmentValidator, type StrictStatementReads } from '@memberjunction/sql-parser';
 import type { SQLParserDialect } from '@memberjunction/sql-dialect';
 import { EncryptionEngine, IsEncryptionKeyUnavailable, ReportEncryptionKeyUnavailable } from '@memberjunction/encryption';
-import { PUSH_STATUS_UPDATES_TOPIC, PublishStatusUpdate } from './PushStatusResolver.js';
+import { PUSH_STATUS_UPDATES_TOPIC, PublishStatusUpdate, StatusUpdateOwnerID } from './PushStatusResolver.js';
 import { CACHE_INVALIDATION_TOPIC, MayBroadcastRecordData } from './CacheInvalidationResolver.js';
 import { PubSubManager } from './PubSubManager.js';
 import { FieldMapper } from '@memberjunction/graphql-dataprovider';
@@ -51,18 +63,43 @@ import { Subscription } from 'rxjs';
  * Entities whose update is always hydrated from the stored row, never from the client's `OldValues___`, though they
  * do not track record changes: their server-side write rules compare against the prior state, which a client could
  * otherwise supply itself (lower-case names). See `ResolverBase.MustLoadTruthFromDatabase`.
+ *
+ * `mj: conversations` and `mj: ai agent sessions` carry the anonymous realtime-session ownership key
+ * (`ExternalID` / `ConversationID`), which their server entities refuse an anonymous visitor to change — a rule
+ * that decides on `Dirty`, so the baseline must be the stored row, not a client-supplied one (#4931).
  */
 const ENTITIES_THAT_ALWAYS_LOAD_STORED_ROW: ReadonlySet<string> = new Set([
   'mj: record changes',
   'mj: conversation details',
   'mj: data context items',
+  'mj: conversations',
+  'mj: ai agent sessions',
+  'mj: ai agent runs',
 ]);
 
+/** One field's values in a concurrency-conflict diagnostic. */
+interface ConflictDiagnosticEntry<TValue> {
+  FieldName: string;
+  ClientOldValue?: TValue;
+  ClientNewValue?: TValue;
+  DBValue?: TValue;
+}
+
+interface ActiveEntitySessionListener {
+  pubSub: PubSubEngine;
+  userPayload: UserPayload;
+  lastSeenAt: number;
+}
+
+const ACTIVE_ENTITY_SESSION_TTL_MS = 24 * 60 * 60 * 1000;
+const ACTIVE_ENTITY_SESSION_MAX_PER_ENTITY = 2048;
+
 export class ResolverBase {
   private static _emit = process.env.CLOUDEVENTS_HTTP_TRANSPORT ? emitterFor(httpTransport(process.env.CLOUDEVENTS_HTTP_TRANSPORT)) : null;
   private static _cloudeventsHeaders = process.env.CLOUDEVENTS_HTTP_HEADERS ? JSON.parse(process.env.CLOUDEVENTS_HTTP_HEADERS) : {};
 
   private static _eventSubscriptionKey: string = '___MJServer___ResolverBase___EventSubscriptions';
+  private static _activeEntitySessionsKey: string = '___MJServer___ResolverBase___ActiveEntitySessions';
   private get eventSubscriptions(): Map<string, Subscription> {
     // here we use the global object store instead of a static member becuase in some cases based on import code paths/bundling/etc, the static member
     // could actually be duplicated and we'd end up with multiple instances of the same map, which would be bad.
@@ -71,7 +108,15 @@ export class ResolverBase {
       LogDebug(`>>>>> MJServer.ResolverBase.EventSubscriptions: Creating new Map - this should only happen once per server instance <<<<<<`);
       g[ResolverBase._eventSubscriptionKey] = new Map<string, Subscription>();
     }
-    return g[ResolverBase._eventSubscriptionKey];
+    return g[ResolverBase._eventSubscriptionKey] as Map<string, Subscription>;
+  }
+
+  private get activeEntitySessions(): Map<string, Map<string, ActiveEntitySessionListener>> {
+    const g = MJGlobal.Instance.GetGlobalObjectStore();
+    if (!g[ResolverBase._activeEntitySessionsKey]) {
+      g[ResolverBase._activeEntitySessionsKey] = new Map<string, Map<string, ActiveEntitySessionListener>>();
+    }
+    return g[ResolverBase._activeEntitySessionsKey] as Map<string, Map<string, ActiveEntitySessionListener>>;
   }
 
   /**
@@ -120,7 +165,7 @@ export class ResolverBase {
     if (!entityInfo) throw new Error(`Entity ${entityName} not found in metadata`);
 
     const denied = deniedReadFields ?? (
-      entityInfo.EnableFieldLevelSecurity && contextUser
+      entityInfo.FieldLevelSecurityApplies && contextUser
         ? entityInfo.GetDeniedReadFields(contextUser)
         : null
     );
@@ -369,6 +414,7 @@ export class ResolverBase {
     if (!loaded) {
       return null;
     }
+    // fls-guard: MapFieldNamesToCodeNames drops the fields the caller may not read
     const mapped = await this.MapFieldNamesToCodeNames(entityName, entityObject.GetAll(), contextUser);
     return mapped as T;
   }
@@ -418,30 +464,29 @@ export class ResolverBase {
       if (field.AllowDecryptInAPI) continue;
 
       // AllowDecryptInAPI is false - we need to filter the value
+      if (!field.SendEncryptedValue) {
+        // SendEncryptedValue is false - replace with sentinel immediately without touching EncryptionEngine
+        dataObject[fieldName] = ENCRYPTED_SENTINEL;
+        continue;
+      }
+
       const engine = EncryptionEngine.Instance;
       await engine.Config(false, contextUser);
       const keyMarker = field.EncryptionKeyID ? engine.GetKeyByID(field.EncryptionKeyID)?.Marker : undefined;
-      if (field.SendEncryptedValue) {
-        // Re-encrypt the value before sending
-        // Only re-encrypt if it's not already encrypted (data provider decrypted it)
-        if (typeof value === 'string' && !IsValueEncrypted(value, keyMarker)) {
-          try {
-            const encryptedValue = await engine.Encrypt(
-              value,
-              field.EncryptionKeyID as string,
-              contextUser
-            );
-            dataObject[fieldName] = encryptedValue;
-          } catch (err) {
-            // If re-encryption fails, use sentinel for safety
-            LogError(`Failed to re-encrypt field ${fieldName} for API response: ${err}`);
-            dataObject[fieldName] = ENCRYPTED_SENTINEL;
-          }
+      // Only encrypt if the value is not already encrypted (PreserveRestrictedApiCiphertext keeps DB/cache ciphertext intact)
+      if (typeof value === 'string' && !IsValueEncrypted(value, keyMarker)) {
+        try {
+          const encryptedValue = await engine.Encrypt(
+            value,
+            field.EncryptionKeyID as string,
+            contextUser
+          );
+          dataObject[fieldName] = encryptedValue;
+        } catch (err) {
+          // If re-encryption fails, use sentinel for safety
+          LogError(`Failed to re-encrypt field ${fieldName} for API response: ${err}`);
+          dataObject[fieldName] = ENCRYPTED_SENTINEL;
         }
-        // If already encrypted (shouldn't happen normally), keep as-is
-      } else {
-        // SendEncryptedValue is false - replace with sentinel
-        dataObject[fieldName] = ENCRYPTED_SENTINEL;
       }
     }
 
@@ -559,6 +604,53 @@ export class ResolverBase {
     }
   }
 
+  /**
+   * Resolves a User View by name, consulting the in-memory {@link UserViewEngine} cache first
+   * and falling back to a database `RunView` only on a cache miss.
+   */
+  protected async resolveUserViewByName(
+    viewName: string,
+    provider: DatabaseProviderBase,
+    contextUser?: UserInfo,
+  ): Promise<MJUserViewEntityExtended | null> {
+    if (UserViewEngine.Instance.Loaded) {
+      const cached = UserViewEngine.Instance.GetViewByName(viewName);
+      if (cached) {
+        return cached;
+      }
+    }
+    const rv = provider as unknown as IRunViewProvider;
+    const result = await rv.RunView<MJUserViewEntityExtended>({
+      EntityName: 'MJ: User Views',
+      // SECURITY: the view name is client-supplied and lands inside a SQL literal.
+      ExtraFilter: "Name='" + EscapeSQLString(viewName) + "'",
+    }, contextUser);
+    if (result && result.Success && result.Results.length > 0) {
+      return result.Results[0];
+    }
+    return null;
+  }
+
+  /**
+   * Resolves a User View by ID, consulting the in-memory {@link UserViewEngine} cache first
+   * and falling back to an entity `Load()` only on a cache miss.
+   */
+  protected async resolveUserViewByID(
+    viewID: string,
+    provider: DatabaseProviderBase,
+    contextUser?: UserInfo,
+  ): Promise<MJUserViewEntityExtended | null> {
+    if (UserViewEngine.Instance.Loaded) {
+      const cached = UserViewEngine.Instance.GetViewById(viewID);
+      if (cached) {
+        return cached;
+      }
+    }
+    const viewInfo = await provider.GetEntityObject<MJUserViewEntityExtended>('MJ: User Views', contextUser);
+    await viewInfo.Load(viewID);
+    return viewInfo;
+  }
+
   async RunViewByNameGeneric(viewInput: RunViewByNameInput, provider: DatabaseProviderBase, userPayload: UserPayload, pubSub: PubSubEngine) {
     try {
       // Log aggregate input for debugging
@@ -566,14 +658,8 @@ export class ResolverBase {
         LogStatus(`[ResolverBase] RunViewByNameGeneric received aggregates: viewName=${viewInput.ViewName}, aggregateCount=${viewInput.Aggregates.length}, aggregates=${JSON.stringify(viewInput.Aggregates.map(a => ({ expression: a.expression, alias: a.alias })))}`);
       }
 
-      const rv = provider as any as IRunViewProvider;
-      const result = await rv.RunView<MJUserViewEntityExtended>({
-        EntityName: 'MJ: User Views',
-        // SECURITY: the view name is client-supplied and lands inside a SQL literal.
-        ExtraFilter: "Name='" + EscapeSQLString(viewInput.ViewName) + "'",
-      }, userPayload.userRecord);
-      if (result && result.Success && result.Results.length > 0) {
-        const viewInfo = result.Results[0];
+      const viewInfo = await this.resolveUserViewByName(viewInput.ViewName, provider, userPayload.userRecord);
+      if (viewInfo) {
         return this.RunViewGenericInternal(
           provider,
           viewInfo,
@@ -598,7 +684,10 @@ export class ResolverBase {
             : undefined,
           viewInput.BypassCache,
           viewInput.DataSource,
-          viewInput.IncludeBinaryFields
+          viewInput.IncludeBinaryFields,
+          viewInput.AlternateBaseView,
+          viewInput.Properties,
+          viewInput.SkipTotalRowCount
         );
       }
       else {
@@ -619,8 +708,10 @@ export class ResolverBase {
       }
 
       const contextUser = this.GetUserFromPayload(userPayload);
-      const viewInfo = await provider.GetEntityObject<MJUserViewEntityExtended>('MJ: User Views', contextUser);
-      await viewInfo.Load(viewInput.ViewID);
+      const viewInfo = await this.resolveUserViewByID(viewInput.ViewID, provider, contextUser);
+      if (!viewInfo) {
+        return null;
+      }
       return this.RunViewGenericInternal(
         provider,
         viewInfo,
@@ -643,7 +734,10 @@ export class ResolverBase {
         undefined,
         viewInput.BypassCache,
         viewInput.DataSource,
-        viewInput.IncludeBinaryFields
+        viewInput.IncludeBinaryFields,
+        viewInput.AlternateBaseView,
+        viewInput.Properties,
+        viewInput.SkipTotalRowCount
       );
     } catch (err) {
       console.log(err);
@@ -691,7 +785,10 @@ export class ResolverBase {
         undefined,
         viewInput.BypassCache,
         viewInput.DataSource,
-        viewInput.IncludeBinaryFields
+        viewInput.IncludeBinaryFields,
+        viewInput.AlternateBaseView,
+        undefined,
+        viewInput.SkipTotalRowCount
       );
     } catch (err) {
       console.log(err);
@@ -712,15 +809,14 @@ export class ResolverBase {
         let viewInfo: MJUserViewEntityExtended | null = null;
 
         if (viewInput.ViewName) {
-          viewInfo = this.safeFirstArrayElement(await this.findBy(provider, 'MJ: User Views', { Name: viewInput.ViewName }, userPayload.userRecord));
+          viewInfo = await this.resolveUserViewByName(viewInput.ViewName, provider, userPayload.userRecord);
           // Populate EntityName on the input so callers (e.g. RunViews resolver) can
           // look up the entity without re-querying the view
           if (viewInfo && !viewInput.EntityName) {
             viewInput.EntityName = viewInfo.Entity;
           }
         } else if (viewInput.ViewID) {
-          viewInfo = await provider.GetEntityObject<MJUserViewEntityExtended>('MJ: User Views', contextUser);
-          await viewInfo.Load(viewInput.ViewID);
+          viewInfo = await this.resolveUserViewByID(viewInput.ViewID, provider, contextUser);
           // Populate EntityName on the input so callers can look up the entity
           if (viewInfo && !viewInput.EntityName) {
             viewInput.EntityName = viewInfo.Entity;
@@ -767,6 +863,9 @@ export class ResolverBase {
           bypassCache: viewInput.BypassCache,
           dataSource: viewInput.DataSource,
           includeBinaryFields: viewInput.IncludeBinaryFields,
+          skipTotalRowCount: viewInput.SkipTotalRowCount,
+          alternateBaseView: viewInput.AlternateBaseView,
+          properties: viewInput.Properties,
         });
       } catch (err) {
         LogError(err);
@@ -778,6 +877,31 @@ export class ResolverBase {
     return results;
   }
 
+  /**
+   * What an entity event may carry to a CloudEvents sink or a log line.
+   *
+   * The whole row for an entity without field security. For one where it applies (its own flag
+   * or an IS-A ancestor's), and for `MJ: Record Changes` (whose payload columns hold other
+   * entities' values), only the primary key and the names of the fields that changed: the sink
+   * is outside MemberJunction with no reader to project the row for, and these events fire for
+   * server-internal saves too, whose objects hold every column.
+   */
+  protected EntityEventPayload(baseEntity: BaseEntity, changedFieldNames?: string[]): Record<string, unknown> {
+    const entityInfo = baseEntity.EntityInfo;
+    if (!entityInfo?.FieldLevelSecurityApplies && !RecordChangeFieldSecurityProjector.IsRecordChangesEntity(entityInfo)) {
+      // fls-guard: entity without field security and not the audit trail; whole row is the documented payload
+      return baseEntity.GetAll();
+    }
+    return {
+      // Read through Get() rather than PrimaryKey, which builds every field object of a raw-mode record.
+      PrimaryKey: (entityInfo.PrimaryKeys ?? []).map((pk) => ({ FieldName: pk.Name, Value: baseEntity.Get(pk.Name) })),
+      // A completed save has already rebased the object, so nothing on it is dirty: the event
+      // carries the names the save wrote. Other events (save_started) still read them off the object.
+      // GetDirtyFieldNames answers without building field objects for a record still in raw mode.
+      ChangedFields: changedFieldNames ?? baseEntity.GetDirtyFieldNames(),
+    };
+  }
+
   private static _priorEmittedData: {Entity: string, PKey: CompositeKey}[] = [];
   protected async EmitCloudEvent({ component, event, eventCode, args }: MJEvent) {
     if (ResolverBase._emit && event === MJEventType.ComponentEvent && eventCode === BaseEntity.BaseEventCode) {
@@ -785,7 +909,7 @@ export class ResolverBase {
       const type = `MemberJunction.${event}${extendedType}`;
       const source = `${process.env.CLOUDEVENTS_SOURCE ?? 'MemberJunction'}`;
       const subject = args instanceof BaseEntityEvent ? args.baseEntity.EntityInfo.CodeName : undefined;
-      const data = args?.baseEntity?.GetAll() ?? {};
+      const data = args?.baseEntity ? this.EntityEventPayload(args.baseEntity, args.ChangedFieldNames) : {};
 
       const cloudEvent = new CloudEvent({ type, source, subject, data });
 
@@ -1007,7 +1131,7 @@ export class ResolverBase {
    * Fails closed: no user, or an unresolvable reference, refuses.
    *
    * The references come from a walk of the whole parse tree
-   * (`ClientClauseScreen.CollectStatementReads`). The statement is refused when that walk does not
+   * (`StrictFragmentValidator.ValidateReadOnlyStatement`). The statement is refused when that walk does not
    * account for every SELECT in the text, or when a FROM item names no table (a table function or
    * a row list).
    *
@@ -1028,14 +1152,7 @@ export class ResolverBase {
     }
     const dialect = this.dialectForProvider(provider);
     ClientClauseScreen.AssertNoIdentifierAliasNames(sqlText, dialect, label);
-    const parser = new SQLParser(sqlText, dialect);
-    if (!parser.IsValid || parser.HasWriteStatement || parser.StatementKind !== 'select') {
-      throw new Error(`Invalid ${label}: not a safe read-only statement — refusing under uncertainty`);
-    }
-    if (this.astContainsWriteNode(parser.AST)) {
-      throw new Error(`Invalid ${label}: write/DDL nested in a subquery is not permitted`);
-    }
-    const reads = ClientClauseScreen.CollectStatementReads(parser);
+    const reads = this.strictReadOnlyStatementReads(sqlText, dialect, label);
     ClientClauseScreen.AssertEverySelectAccountedFor(sqlText, dialect, reads, label);
     const allowed = this.entityBaseViewAllowList(provider);
     for (const relation of reads.Relations) {
@@ -1104,9 +1221,19 @@ export class ResolverBase {
     return LexSQL(clause, dialect).some((t) => (t.Kind === 'string' || t.Kind === 'identifier') && t.Text.includes('\\'));
   }
 
-  /** Write/DDL node walk shared with the clause screen; see `ClientClauseScreen.AstContainsWriteNode`. */
-  private astContainsWriteNode(node: unknown): boolean {
-    return ClientClauseScreen.AstContainsWriteNode(node);
+  /**
+   * Parses a whole statement with the strict validator and returns what it reads; throws unless it
+   * is one plain read-only SELECT with no write or DDL at any depth.
+   */
+  private strictReadOnlyStatementReads(sqlText: string, dialect: SQLParserDialect, label: string): StrictStatementReads {
+    const result = StrictFragmentValidator.ValidateReadOnlyStatement(sqlText, dialect, { CollectReads: true });
+    if (result.Refusal === 'NestedWrite') {
+      throw new Error(`Invalid ${label}: write/DDL nested in a subquery is not permitted`);
+    }
+    if (!result.IsValid || !result.Reads) {
+      throw new Error(`Invalid ${label}: not a safe read-only statement — refusing under uncertainty`);
+    }
+    return result.Reads;
   }
 
   private dialectForProvider(provider?: IMetadataProvider): SQLParserDialect {
@@ -1145,7 +1272,10 @@ export class ResolverBase {
     afterKey?: CompositeKey,
     bypassCache?: boolean,
     dataSource?: 'Live' | 'Materialized',
-    includeBinaryFields?: boolean
+    includeBinaryFields?: boolean,
+    alternateBaseView?: string,
+    properties?: ViewPropertyValues,
+    skipTotalRowCount?: boolean
   ) {
     try {
       if (!viewInfo || !userPayload) return null;
@@ -1207,6 +1337,7 @@ export class ResolverBase {
         {
           ViewID: viewInfo.ID,
           ViewName: viewInfo.Name,
+          ViewEntity: viewInfo.ID ? viewInfo : undefined,
           EntityName: viewInfo.Entity,
           ExtraFilter: extraFilter,
           OrderBy: orderBy,
@@ -1227,10 +1358,24 @@ export class ResolverBase {
           BypassCache: bypassCache,
           DataSource: dataSource,
           IncludeBinaryFields: includeBinaryFields,
+          SkipTotalRowCount: skipTotalRowCount,
+          AlternateBaseView: alternateBaseView,
+          Properties: properties,
+          TimeZone: userPayload?.TimeZone,
+          PreserveRestrictedApiCiphertext: true,
         },
         user
       );
 
+      if (result && typeof result === 'object') {
+        Object.defineProperty(result, '_resolvedViewEntity', {
+          value: viewInfo,
+          enumerable: false,
+          configurable: true,
+          writable: true,
+        });
+      }
+
       // Log aggregate results for debugging
       if (aggregates?.length) {
         LogStatus(`[ResolverBase] RunView result aggregate info: entityName=${viewInfo.Entity}, hasAggregateResults=${!!result?.AggregateResults}, aggregateResultCount=${result?.AggregateResults?.length || 0}, aggregateExecutionTime=${result?.AggregateExecutionTime}, aggregateResults=${JSON.stringify(result?.AggregateResults)}`);
@@ -1261,7 +1406,8 @@ export class ResolverBase {
         await this.ArrayFilterEncryptedFieldsForAPI(
           viewInfo.Entity,
           result.Results as Record<string, unknown>[],
-          user
+          user,
+          md
         );
       }
 
@@ -1357,6 +1503,7 @@ export class ResolverBase {
         runViewParams.push({
           ViewID: param.viewInfo.ID,
           ViewName: param.viewInfo.Name,
+          ViewEntity: param.viewInfo.ID ? param.viewInfo : undefined,
           EntityName: param.viewInfo.Entity,
           ExtraFilter: param.extraFilter,
           OrderBy: param.orderBy,
@@ -1377,6 +1524,11 @@ export class ResolverBase {
           BypassCache: param.bypassCache,
           DataSource: param.dataSource,
           IncludeBinaryFields: param.includeBinaryFields,
+          SkipTotalRowCount: param.skipTotalRowCount,
+          AlternateBaseView: param.alternateBaseView,
+          Properties: param.properties,
+          TimeZone: param.userPayload?.TimeZone,
+          PreserveRestrictedApiCiphertext: true,
         });
       }
 
@@ -1398,7 +1550,8 @@ export class ResolverBase {
             await this.ArrayFilterEncryptedFieldsForAPI(
               entityName,
               runViewResult.Results as Record<string, unknown>[],
-              contextUser
+              contextUser,
+              md
             );
           }
         }
@@ -1537,8 +1690,9 @@ export class ResolverBase {
    * skip redundant re-fetches (it already handled the event locally).
    *
    * The row itself rides along ONLY for entities opted in via
-   * `cacheSettings.recordDataBroadcastEntities` — this event reaches every connected client
-   * unfiltered, so the row would otherwise be readable by sessions that could not read the record.
+   * `cacheSettings.recordDataBroadcastEntities`, and never for one under field-level security —
+   * this event reaches every connected client unprojected, so the row would otherwise be readable
+   * by sessions that could not read the record or its restricted fields.
    */
   protected PublishCacheInvalidation(entityObject: BaseEntity, action: 'save' | 'delete', userPayload: UserPayload): void {
     const entityName = entityObject.EntityInfo.Name;
@@ -1550,7 +1704,8 @@ export class ResolverBase {
       timestamp: new Date(),
       originSessionId: userPayload?.sessionId || null,
       recordData:
-        action === 'save' && MayBroadcastRecordData(entityName)
+        action === 'save' && MayBroadcastRecordData(entityName, entityObject.EntityInfo)
+          // fls-guard: MayBroadcastRecordData refuses FLS entities and Record Changes
           ? JSON.stringify(entityObject.GetAll())
           : undefined,
     });
@@ -1558,27 +1713,56 @@ export class ResolverBase {
 
   /**
    * Publishes a push-status update to the client on {@link PUSH_STATUS_UPDATES_TOPIC}, stamping the
-   * authenticated owner's user ID from `userPayload` so the subscription filter can bind delivery
-   * to identity (see B49 / `statusUpdatesFilter`). The ergonomic wrapper every resolver should use
-   * instead of calling `pubSub.publish` on the topic directly — it makes omitting identity
-   * impossible. Non-resolver publishers (services, the liveness heartbeat) call the shared
-   * `publishStatusUpdate()` function directly with an explicit `ownerUserId`.
+   * owner key of `userPayload` (`StatusUpdateOwnerID`: the request's user, or the widget guest an
+   * elevated payload stands in for) so the subscription filter can bind delivery to identity (see B49 /
+   * `StatusUpdatesFilter`). The ergonomic wrapper every resolver should use instead of calling
+   * `pubSub.publish` on the topic directly — it makes omitting identity impossible. Non-resolver
+   * publishers (services, the liveness heartbeat) call the shared `PublishStatusUpdate()` function
+   * directly with an explicit `ownerUserId`.
    */
   protected PublishStatusUpdate(pubSub: PubSubEngine, sessionId: string, message: string | undefined, userPayload: UserPayload): void {
     PublishStatusUpdate(pubSub, {
       sessionId,
-      ownerUserId: userPayload?.userRecord?.ID ?? '',
+      ownerUserId: StatusUpdateOwnerID(userPayload),
       message,
     });
   }
 
   protected ListenForEntityMessages(entityObject: BaseEntity, pubSub: PubSubEngine, userPayload: UserPayload) {
-    // The unique key is set up for each entity object via it's primary key to ensure that we only have one listener at most for each unique
-    // entity in the system. This is important because we don't want to have multiple listeners for the same entity as it could
-    // cause issues with multiple messages for the same event.
+    // Maintain a single MJGlobal event listener per entity name so CloudEvents are emitted once
+    // per event, while routing WebSocket status updates dynamically across all active user sessions
+    // that have interacted with this entity type (instead of closing over only the first caller).
     const uniqueKey = entityObject.EntityInfo.Name;
+    const now = Date.now();
+    const isFreshSubscription = !this.eventSubscriptions.has(uniqueKey);
+
+    let sessionsForEntity = isFreshSubscription ? undefined : this.activeEntitySessions.get(uniqueKey);
+    if (!sessionsForEntity) {
+      sessionsForEntity = new Map<string, ActiveEntitySessionListener>();
+      this.activeEntitySessions.set(uniqueKey, sessionsForEntity);
+    } else {
+      // Opportunistically evict expired session entries and enforce a safe per-entity cap
+      for (const [key, entry] of sessionsForEntity) {
+        if (now - entry.lastSeenAt > ACTIVE_ENTITY_SESSION_TTL_MS) {
+          sessionsForEntity.delete(key);
+        }
+      }
+      if (sessionsForEntity.size >= ACTIVE_ENTITY_SESSION_MAX_PER_ENTITY) {
+        const oldestKey = sessionsForEntity.keys().next().value;
+        if (oldestKey !== undefined) {
+          sessionsForEntity.delete(oldestKey);
+        }
+      }
+    }
+
+    if (userPayload) {
+      const sessionKey = userPayload.sessionId
+        ? `${userPayload.userRecord?.ID ?? ''}:${userPayload.sessionId}`
+        : (userPayload.userRecord?.ID ?? '__anonymous__');
+      sessionsForEntity.set(sessionKey, { pubSub, userPayload, lastSeenAt: now });
+    }
 
-    if (!this.eventSubscriptions.has(uniqueKey)) {
+    if (isFreshSubscription) {
       // listen for events from the entityObject in case it is a long running task and we can push messages back to the client via pubSub
       LogDebug(`ResolverBase.ListenForEntityMessages: About to call MJGlobal.Instance.GetEventListener() to get the event listener subscription for ${uniqueKey}`);
       const theSub = MJGlobal.Instance.GetEventListener(false).subscribe(async (event: MJEvent) => {
@@ -1591,23 +1775,29 @@ export class ResolverBase {
             return;
           }
 
-          const baseEntityValues = baseEntity ? baseEntity.GetAll() : null;
-          const eventToLog = { entityName: entityObject.EntityInfo.Name, baseEntity: baseEntityValues, event: event.event, eventCode: event.eventCode };
+          const baseEntityValues = baseEntity ? this.EntityEventPayload(baseEntity, event.args instanceof BaseEntityEvent ? event.args.ChangedFieldNames : undefined) : null;
+          const eventToLog = { entityName: uniqueKey, baseEntity: baseEntityValues, event: event.event, eventCode: event.eventCode };
           LogDebug(`ResolverBase.ListenForEntityMessages: Received Event from within MJGlobal.Instance.GetEventListener() callback. Will call EmitCloudEvent() next\nEvent data:\n${JSON.stringify(eventToLog)}`);
           await this.EmitCloudEvent(event);
-          LogDebug(`ResolverBase.ListenForEntityMessages: EmitCloudEvent() completed successfully`);  
+          LogDebug(`ResolverBase.ListenForEntityMessages: EmitCloudEvent() completed successfully`);
 
           if (event.args && event.args instanceof BaseEntityEvent) {
-            const baseEntityEvent = event.args as BaseEntityEvent;
-            // message from our entity object, relay it to the client
-            LogDebug('ResolverBase.ListenForEntityMessages: About to publish PUSH_STATUS_UPDATES_TOPIC');
-            this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
-              status: 'OK',
-              type: 'EntityObjectStatusMessage',
-              entityName: baseEntityEvent.baseEntity.EntityInfo.Name,
-              primaryKey: baseEntityEvent.baseEntity.PrimaryKey,
-              message: event.args.payload,
-            }), userPayload);
+            const activeSessions = this.activeEntitySessions.get(uniqueKey);
+            if (activeSessions && activeSessions.size > 0) {
+              const eventNow = Date.now();
+              let serializedMessage: string | undefined;
+              for (const [sKey, session] of activeSessions) {
+                if (eventNow - session.lastSeenAt > ACTIVE_ENTITY_SESSION_TTL_MS) {
+                  activeSessions.delete(sKey);
+                  continue;
+                }
+                if (this.EntityEventBelongsToSession(event.args, session.userPayload)) {
+                  LogDebug('ResolverBase.ListenForEntityMessages: About to publish PUSH_STATUS_UPDATES_TOPIC');
+                  serializedMessage ??= this.EntityStatusMessage(event.args);
+                  this.PublishStatusUpdate(session.pubSub, session.userPayload.sessionId, serializedMessage, session.userPayload);
+                }
+              }
+            }
           }
         }
       });
@@ -1615,6 +1805,37 @@ export class ResolverBase {
     }
   }
 
+  /**
+   * Whether an entity event may be relayed to the session whose call created the listener. The
+   * listener is shared by every caller in the process for that entity, so an event raised by an
+   * object loaded for another user (or for the system user) is never relayed to this session.
+   */
+  protected EntityEventBelongsToSession(event: BaseEntityEvent, userPayload: UserPayload): boolean {
+    const sessionUserId = userPayload?.userRecord?.ID;
+    const objectUserId = event.baseEntity?.ContextCurrentUser?.ID;
+    return Boolean(sessionUserId && objectUserId && UUIDsEqual(sessionUserId, objectUserId));
+  }
+
+  /**
+   * The status message relayed for an entity event: the entity, key and event type. The event's
+   * payload is included only when it cannot carry record values: never for a delete (its payload
+   * is the whole deleted row), an entity under field-level security, or `MJ: Record Changes`.
+   */
+  protected EntityStatusMessage(event: BaseEntityEvent): string {
+    const entityInfo = event.baseEntity.EntityInfo;
+    const mayCarryPayload = event.type !== 'delete'
+      && !entityInfo.FieldLevelSecurityApplies
+      && !RecordChangeFieldSecurityProjector.IsRecordChangesEntity(entityInfo);
+    return JSON.stringify({
+      status: 'OK',
+      type: 'EntityObjectStatusMessage',
+      entityName: entityInfo.Name,
+      primaryKey: event.baseEntity.PrimaryKey,
+      eventType: event.type,
+      message: mayCarryPayload ? event.payload : undefined,
+    });
+  }
+
   /**
    * IS-A PROMOTION over the wire: an EXISTING parent record gaining a subtype — an Animal that is
    * now also a Dog. It arrives as the CHILD's create mutation carrying the existing parent's
@@ -1691,6 +1912,9 @@ export class ResolverBase {
       // IS-A promotion: bind the new child to its EXISTING parent row BEFORE the field
       // assignments, so values the client sent for parent fields land on the loaded parent
       // (as an update) instead of being wiped by the load.
+      // Field-level security: refuse a key the caller may not read, or that names no field, before
+      // anything is applied (the same gate as the update path).
+      AssertClientInputWritableForUser(entityObject.EntityInfo, fieldsForSet, this.GetUserFromPayload(userPayload));
       await this.attachToExistingParentIfPromotion(entityObject, fieldsForSet);
       entityObject.SetMany(fieldsForSet);
 
@@ -1707,6 +1931,7 @@ export class ResolverBase {
         // Cache invalidation is now handled globally by the MJGlobal listener in index.ts
         const contextUser = this.GetUserFromPayload(userPayload);
         // MapFieldNamesToCodeNames now handles encryption filtering as well
+        // fls-guard: MapFieldNamesToCodeNames drops the fields the caller may not read
         return await this.MapFieldNamesToCodeNames(entityName, entityObject.GetAll(), contextUser);
       }
       // save failed, throw error with message
@@ -1747,12 +1972,11 @@ export class ResolverBase {
       });
 
       // Field-level security: any value the client sends for a field it cannot READ is
-      // fabricated by construction (the field was stripped from every payload the client ever
-      // received), so strip such values before anything applies them. When any field is
-      // denied we also force the truth-load branch below — client OldValues for denied fields
-      // are equally fabricated, so hydrating from them (the no-DB-load path) would write
-      // fabricated state into the denied columns on save.
-      const hasDeniedReadFields = this.StripDeniedReadFieldsFromClientInput(entityInfo, userInfo, input, clientNewValues);
+      // fabricated by construction (the field was absent from every payload the client ever
+      // received), so the input is refused before anything applies it. When any field is
+      // denied we also force the truth-load branch below, so the denied columns keep what the
+      // database holds rather than anything derived from the client's OldValues.
+      const hasDeniedReadFields = this.AssertClientInputFieldSecurity(entityInfo, userInfo, input, clientNewValues);
       // The audit-trail equivalent. Its `true` matters most on THIS entity: 'MJ: Record Changes'
       // has TrackRecordChanges off, so without it a client sending OldValues takes the branch below
       // that hydrates from those values — never loading what the database actually holds.
@@ -1815,6 +2039,7 @@ export class ResolverBase {
         // Cache invalidation is now handled globally by the MJGlobal listener in index.ts
 
         // MapFieldNamesToCodeNames now handles encryption filtering as well
+        // fls-guard: MapFieldNamesToCodeNames drops the fields the caller may not read
         return await this.MapFieldNamesToCodeNames(entityName, entityObject.GetAll(), userInfo);
       } else {
         // CompleteMessage, not Message. A validation refusal puts its reasons in `Errors` and leaves
@@ -1871,7 +2096,7 @@ export class ResolverBase {
    * writable fields in `OldValues___`, so {@link hasCompleteOldValues} returns `false` and forces the
    * database load (`InnerLoad`) so untouched columns retain their stored values.
    *
-   * `EnableFieldLevelSecurity` is the security-critical one, and it is NOT redundant with
+   * `FieldLevelSecurityApplies` (own flag or an IS-A ancestor's) is the security-critical one, and it is NOT redundant with
    * `hasDeniedReadFields`. That flag reports READ denials, and the canonical FLS configuration is
    * Read Allow + Update Deny — which leaves it false. Such a caller would be hydrated from its own
    * `OldValues___`, and a value it supplies there for an update-denied field arrives through
@@ -1926,73 +2151,50 @@ export class ResolverBase {
       !this.hasCompleteOldValues(entityInfo, input.OldValues___) ||
       hasDeniedReadFields ||
       hasNarrowedAuditPayload ||
-      entityInfo.EnableFieldLevelSecurity ||
+      entityInfo.FieldLevelSecurityApplies ||
       !user ||
       entityInfo.GetEffectiveRowFilterWhereClause(user, EntityPermissionType.Update, '').length > 0
     );
   }
 
   /**
-   * Field-level security guard for the update path.
+   * Field-level security gate on the update path's client input.
    *
-   * Every denied-read field is stripped — new values AND OldValues. A field the user cannot
-   * read was absent from every payload that client ever received, so any value coming back for
-   * it is the transport's invention rather than user intent, and applying it would silently
-   * overwrite the real column. Stripping is what makes "load a record, edit an unrelated field,
-   * save" safe for a restricted user.
+   * For a caller denied at least one field on the entity, refuses (with a `FieldSecurityError`)
+   * any key in the new values or in `OldValues___` that names a field the caller cannot READ, or
+   * that names no field at all, with the same message for both (see
+   * `AssertClientInputWritableForUser`), so the refusal does not reveal which columns exist.
    *
-   * There is no split by update permission: Read is required for Update, so a user denied read
-   * is denied update too and denied-read ∩ denied-update is just denied-read.
+   * Refused rather than dropped: a field the caller cannot read was absent from every payload the
+   * client received, so a value for it can only be fabricated. A well-behaved client never sends
+   * one (it omits fields it did not load), so ordinary traffic is unaffected.
    *
-   * Silent narrowing, not rejection — consistent with the output projection the client already
-   * experiences, and with the ambiguous-error rule (naming the field would confirm it exists
-   * and is restricted).
+   * There is no split by update permission: Read is required for Update, so a user denied read is
+   * denied update too.
    *
-   * Returns true when the user has a non-empty denied-read set on this entity. The caller
-   * must then hydrate the entity from the DATABASE (never from client OldValues), so denied
-   * fields hold true values that an omitted key leaves untouched.
+   * Returns true when the user has a non-empty denied-read set on this entity. The caller must
+   * then hydrate the entity from the DATABASE (never from client OldValues), so denied fields hold
+   * true values the client input never touches.
    */
-  protected StripDeniedReadFieldsFromClientInput(
+  protected AssertClientInputFieldSecurity(
     entityInfo: EntityInfo,
     userInfo: UserInfo,
     input: { OldValues___?: Array<{ Key: string; Value: unknown }> } & Record<string, unknown>,
     clientNewValues: Record<string, unknown>
   ): boolean {
-    if (!entityInfo.EnableFieldLevelSecurity || !userInfo) {
+    if (!entityInfo.FieldLevelSecurityApplies || !userInfo) {
       return false;
     }
-    const deniedReadNames = entityInfo.GetDeniedReadFields(userInfo);
-    if (deniedReadNames.size === 0) {
+    if (entityInfo.GetDeniedReadFields(userInfo).size === 0) {
       return false;
     }
-
-    // Input keys are entity CodeNames (post ReverseMapInputFieldNames); the denied set holds
-    // lowercased field Names — bridge via the field metadata once.
-    const deniedReadCodeNames = new Set<string>();
-    for (const field of entityInfo.Fields) {
-      if (deniedReadNames.has(field.Name.trim().toLowerCase())) {
-        deniedReadCodeNames.add(field.CodeName.trim().toLowerCase());
-      }
-    }
-
-    const stripped: string[] = [];
-    for (const key of Object.keys(clientNewValues)) {
-      if (deniedReadCodeNames.has(key.trim().toLowerCase())) {
-        delete clientNewValues[key];
-        delete input[key];
-        stripped.push(key);
-      }
-    }
+    AssertClientInputWritableForUser(entityInfo, clientNewValues, userInfo);
     if (Array.isArray(input.OldValues___)) {
-      input.OldValues___ = input.OldValues___.filter(
-        (item) => !deniedReadCodeNames.has(String(item.Key).trim().toLowerCase())
-      );
-    }
-    if (stripped.length > 0) {
-      LogDebug(
-        `[FieldSecurity] UpdateRecord on '${entityInfo.Name}' for user ${userInfo.Email}: ` +
-          `stripped client-sent value(s) for denied-read field(s) ${stripped.join(', ')}`
-      );
+      const oldValueKeys: Record<string, unknown> = {};
+      for (const item of input.OldValues___) {
+        oldValueKeys[String(item.Key)] = null;
+      }
+      AssertClientInputWritableForUser(entityInfo, oldValueKeys, userInfo);
     }
     return true;
   }
@@ -2120,139 +2322,335 @@ export class ResolverBase {
     return entityInfo.Fields.find((f) => f.CodeName === key || f.Name === key);
   }
 
-  protected async TestAndSetClientOldValuesToDBValues(input: any, clientNewValues: any, entityObject: BaseEntity, contextUser: UserInfo) {
-    // we have OldValues, so we need to compare them to the values we just loaded from the DB
-    const clientOldValues = {};
-    // for each item in the oldValues array, add it to the clientOldValues object
-    input.OldValues___.forEach((item) => {
-      // we need to do a quick transform on the values to make sure they match the TS Type for the given field because item.Value will always be a string
-      const field = this.findEntityFieldByCodeNameOrName(entityObject.EntityInfo, item.Key);
-      const val = this.ClientOldValueToFieldValue(field, item.Value);
-      clientOldValues[item.Key] = val;
+  /**
+   * Whether the API never gives a client this field's stored value: an encrypted field that is not
+   * decrypted for the API reaches the client only as the sentinel or as fresh ciphertext, so the
+   * client's old value for it can never be compared with the database value.
+   */
+  private isFieldOpaqueToClient(field: EntityFieldInfo | undefined): boolean {
+    return Boolean(field?.Encrypt && !field.AllowDecryptInAPI);
+  }
+
+  /**
+   * The client's new values without the opaque fields it only echoed back: the sentinel, or the same
+   * value it received as the old value. Writing either would replace the stored secret.
+   */
+  private withoutEchoedOpaqueValues<TOldVal, TNewVal>(
+    entityInfo: EntityInfo,
+    clientNewValues: Record<string, TNewVal>,
+    clientOldValues: Record<string, TOldVal>,
+  ): Record<string, TNewVal> {
+    const kept: Record<string, TNewVal> = {};
+    for (const key of Object.keys(clientNewValues)) {
+      const f = this.findEntityFieldByCodeNameOrName(entityInfo, key);
+      const newValue = clientNewValues[key];
+      const unchanged = key in clientOldValues && !this.areEntityFieldValuesDifferent(f, clientOldValues[key], newValue, false);
+      const echoed = this.isFieldOpaqueToClient(f) && (newValue === ENCRYPTED_SENTINEL || unchanged);
+      if (!echoed) {
+        kept[key] = newValue;
+      }
+    }
+    return kept;
+  }
+
+  /**
+   * Copies concurrency-conflict diagnostic entries with every encrypted field's values replaced by
+   * the sentinel, so the console, the error log and `MJ: Error Logs` never hold a secret.
+   */
+  private redactEncryptedConflictValues<TValue>(
+    entityInfo: EntityInfo,
+    entries: ReadonlyArray<ConflictDiagnosticEntry<TValue>>,
+  ): ConflictDiagnosticEntry<TValue | string>[] {
+    return entries.map((entry) => {
+      if (!this.findEntityFieldByCodeNameOrName(entityInfo, entry.FieldName)?.Encrypt) {
+        return entry;
+      }
+      const redacted: ConflictDiagnosticEntry<TValue | string> = { FieldName: entry.FieldName };
+      if ('ClientOldValue' in entry) redacted.ClientOldValue = ENCRYPTED_SENTINEL;
+      if ('ClientNewValue' in entry) redacted.ClientNewValue = ENCRYPTED_SENTINEL;
+      if ('DBValue' in entry) redacted.DBValue = ENCRYPTED_SENTINEL;
+      return redacted;
     });
+  }
+
+  /**
+   * Compares two typed entity field values for semantic inequality, handling `Date` epoch equality
+   * (plus optional non-`datetimeoffset` timezone-hour-shift tolerance) and `null`/`undefined` normalization.
+   */
+  private areEntityFieldValuesDifferent<TLeft, TRight>(
+    field: EntityFieldInfo | undefined,
+    left: TLeft,
+    right: TRight,
+    allowTimezoneShiftWarning: boolean,
+    fieldKeyForLog?: string
+  ): boolean {
+    const normalizedLeft = left === undefined ? null : left;
+    const normalizedRight = right === undefined ? null : right;
+
+    if (normalizedLeft instanceof Date) {
+      const rightDate =
+        normalizedRight instanceof Date
+          ? normalizedRight
+          : field?.TSType === EntityFieldTSType.Date && normalizedRight !== null
+            ? this.ClientOldValueToFieldValue(field, normalizedRight)
+            : null;
+      if (!(rightDate instanceof Date) || isNaN(rightDate.getTime())) {
+        return true;
+      }
+      if (this.datesEqualAtColumnResolution(field, normalizedLeft, rightDate)) {
+        return false;
+      }
+      const sqlType = field?.SQLFullType?.trim().toLowerCase() || '';
+      if (sqlType !== 'datetimeoffset' && IsOnlyTimezoneShift(normalizedLeft, rightDate)) {
+        if (allowTimezoneShiftWarning && fieldKeyForLog) {
+          console.warn(
+            `Timezone hour shift detected on field "${fieldKeyForLog}" (${sqlType || 'datetime'}). ` +
+            `Client: ${normalizedLeft.toISOString()}, DB: ${rightDate.toISOString()}. ` +
+            `Consider using datetimeoffset to avoid timezone ambiguity.`
+          );
+        }
+        return false;
+      }
+      return true;
+    }
+
+    if (normalizedRight instanceof Date && field?.TSType === EntityFieldTSType.Date && normalizedLeft !== null) {
+      const leftDate = this.ClientOldValueToFieldValue(field, normalizedLeft);
+      if (leftDate instanceof Date && !isNaN(leftDate.getTime())) {
+        return !this.datesEqualAtColumnResolution(field, leftDate, normalizedRight);
+      }
+    }
+
+    if (typeof normalizedLeft === 'string' && typeof normalizedRight === 'string' && this.jsonStringsEquivalent(normalizedLeft, normalizedRight)) {
+      return false;
+    }
+
+    return Object.is(normalizedLeft, normalizedRight) ? false : normalizedLeft !== (normalizedRight as never);
+  }
+
+  /**
+   * True when two instants would be stored as the same value in the field's column: SQL Server
+   * `datetime` resolves to 1/300 s and `smalldatetime` to one minute; every other type keeps milliseconds.
+   */
+  private datesEqualAtColumnResolution(field: EntityFieldInfo | undefined, left: Date, right: Date): boolean {
+    return Math.abs(left.getTime() - right.getTime()) < this.dateColumnResolutionMs(field);
+  }
+
+  private dateColumnResolutionMs(field: EntityFieldInfo | undefined): number {
+    switch ((field?.Type ?? '').trim().toLowerCase()) {
+      case 'datetime':
+        return 1000 / 300;
+      case 'smalldatetime':
+        return 60_000;
+      default:
+        return 1;
+    }
+  }
+
+  /**
+   * True when both strings are JSON documents with the same content, ignoring whitespace and key order.
+   */
+  private jsonStringsEquivalent(left: string, right: string): boolean {
+    const canonicalLeft = this.canonicalJSONDocument(left);
+    return canonicalLeft !== null && canonicalLeft === this.canonicalJSONDocument(right);
+  }
 
-    // clientOldValues now has all of the oldValues the CLIENT passed us. Now we need to build the same kind of object
-    // with the DB values
+  /**
+   * Canonical form of a JSON object or array string, or null when the text is not one.
+   */
+  private canonicalJSONDocument(text: string): string | null {
+    const first = text.trimStart().charAt(0);
+    if (first !== '{' && first !== '[') {
+      return null;
+    }
+    try {
+      return Canonicalize(JSON.parse(text));
+    } catch {
+      return null;
+    }
+  }
+
+  protected async TestAndSetClientOldValuesToDBValues<
+    TOldVal,
+    TNewVal,
+    TInput extends { OldValues___?: ReadonlyArray<{ Key: string; Value: TOldVal }> | null }
+  >(
+    input: TInput,
+    rawClientNewValues: Record<string, TNewVal>,
+    entityObject: BaseEntity,
+    contextUser: UserInfo
+  ): Promise<void> {
+    type ConvertedFieldValue = ReturnType<ResolverBase['ClientOldValueToFieldValue']>;
+    const clientOldValues: Record<string, ConvertedFieldValue> = {};
+    for (const item of input.OldValues___ ?? []) {
+      // Transform string-serialized wire values to match the field's TypeScript type
+      const field = this.findEntityFieldByCodeNameOrName(entityObject.EntityInfo, item.Key);
+      clientOldValues[item.Key] = this.ClientOldValueToFieldValue(field, item.Value);
+    }
+    const clientNewValues = this.withoutEchoedOpaqueValues(entityObject.EntityInfo, rawClientNewValues, clientOldValues);
+
+    // fls-guard: compared on the server only, never returned
     const dbValues = entityObject.GetAll();
 
-    // now we need to compare clientOldValues and dbValues and have a new array that has entries for any differences and have FieldName, clientOldValue and dbValue as properties
-    const dbDifferences = [];
-    Object.keys(clientOldValues).forEach((key) => {
+    interface DBDifferenceEntry {
+      FieldName: string;
+      ClientOldValue: ConvertedFieldValue;
+      DBValue: ConvertedFieldValue;
+    }
+    interface ClientDifferenceEntry {
+      FieldName: string;
+      ClientOldValue: ConvertedFieldValue;
+      ClientNewValue: TNewVal;
+    }
+
+    const dbDifferences: DBDifferenceEntry[] = [];
+    const dbDiffByField = new Map<string, DBDifferenceEntry>();
+
+    for (const key of Object.keys(clientOldValues)) {
       const f = this.findEntityFieldByCodeNameOrName(entityObject.EntityInfo, key);
-      const dbVal = f && f.Name in dbValues ? dbValues[f.Name] : dbValues[key];
-      let different = false;
-      switch (typeof clientOldValues[key]) {
-        case 'number':
-          different = clientOldValues[key] !== dbVal;
-          break;
-        case 'boolean':
-          different = clientOldValues[key] !== dbVal;
-          break;
-        case 'object':
-          if (clientOldValues[key] instanceof Date) {
-            const clientDate = clientOldValues[key] as Date;
-            const dbDate = dbVal;
-            if (dbDate == null || !(dbDate instanceof Date)) {
-              different = true;
-            } else if (clientDate.getTime() !== dbDate.getTime()) {
-              // Check if this is a datetime/datetime2 field with only a timezone hour shift
-              const sqlType = f?.SQLFullType?.trim().toLowerCase() || '';
-              if (sqlType !== 'datetimeoffset' && IsOnlyTimezoneShift(clientDate, dbDate)) {
-                console.warn(
-                  `Timezone hour shift detected on field "${key}" (${sqlType || 'datetime'}). ` +
-                  `Client: ${clientDate.toISOString()}, DB: ${dbDate.toISOString()}. ` +
-                  `Consider using datetimeoffset to avoid timezone ambiguity.`
-                );
-                different = false; // Allow timezone shifts through for non-datetimeoffset fields
-              } else {
-                different = true;
-              }
-            }
-          } else if (clientOldValues[key] === null) {
-            different = dbVal !== null;
-          }
-          break;
-        default:
-          different = clientOldValues[key] !== dbVal;
-          break;
+      if (this.isFieldOpaqueToClient(f)) {
+        continue;
       }
+      const dbVal: ConvertedFieldValue = f && f.Name in dbValues ? dbValues[f.Name] : dbValues[key];
+      const different = this.areEntityFieldValuesDifferent(f, clientOldValues[key], dbVal, true, key);
       if (different && f && !f.ReadOnly) {
-        // only include updateable fields
-        dbDifferences.push({
+        const entry: DBDifferenceEntry = {
           FieldName: key,
           ClientOldValue: clientOldValues[key],
           DBValue: dbVal,
-        });
+        };
+        dbDifferences.push(entry);
+        dbDiffByField.set(key, entry);
       }
-    });
+    }
+
+    let fieldsToPreserveFromDB: Set<string> | undefined;
 
     if (dbDifferences.length > 0) {
-      // now we have an array of any dbDifferences with length > 0, between the clientOldValues and the dbValues, we need to check to see if any of the differences are on fields that the client is trying to update
-      // first step is to get clientNewValues into an object that is like clientOldValues, get the diff and then compare that diff to the differences array that shows diff between DB and ClientOld
-      const clientDifferences = [];
-      Object.keys(clientOldValues).forEach((key) => {
+      const clientDifferences: ClientDifferenceEntry[] = [];
+      const clientDiffFieldNames = new Set<string>();
+
+      for (const key of Object.keys(clientOldValues)) {
         const f = this.findEntityFieldByCodeNameOrName(entityObject.EntityInfo, key);
-        if (key in clientNewValues && clientOldValues[key] !== clientNewValues[key] && f && f.AllowUpdateAPI && !f.IsPrimaryKey) {
-          // only include updateable fields
+        if (
+          key in clientNewValues &&
+          f &&
+          f.AllowUpdateAPI &&
+          !f.IsPrimaryKey &&
+          this.areEntityFieldValuesDifferent(f, clientOldValues[key], clientNewValues[key], false)
+        ) {
           clientDifferences.push({
             FieldName: key,
             ClientOldValue: clientOldValues[key],
             ClientNewValue: clientNewValues[key],
           });
+          clientDiffFieldNames.add(key);
+        }
+      }
+
+      // True conflicting overlap: client modified a field whose authoritative DB value differs from BOTH
+      // ClientOldValue AND ClientNewValue (idempotent concurrent writes to the same value converge cleanly).
+      const overlap = clientDifferences.filter((cd) => {
+        const dd = dbDiffByField.get(cd.FieldName);
+        if (!dd) {
+          return false;
         }
+        const f = this.findEntityFieldByCodeNameOrName(entityObject.EntityInfo, cd.FieldName);
+        return this.areEntityFieldValuesDifferent(f, cd.ClientNewValue, dd.DBValue, true);
       });
 
-      // now we have clientDifferences which shows what the client thinks they are changing. And, we have the dbDifferences array that shows changes between the clientOldValues and the dbValues
-      // if there is ANY overlap in the FIELDS that appear in both arrays, we need to log a warning but allow the save to continue
-      const dbDiffFieldNames = new Set(dbDifferences.map((dd) => dd.FieldName));
-      const overlap = clientDifferences.filter((cd) => dbDiffFieldNames.has(cd.FieldName));
       if (overlap.length > 0) {
+        const conflictingFields = overlap.map((o) => o.FieldName);
+        const entityInfo = entityObject.EntityInfo;
+        const shownClientDifferences = this.redactEncryptedConflictValues<ConvertedFieldValue | TNewVal>(entityInfo, clientDifferences);
+        const shownDBDifferences = this.redactEncryptedConflictValues<ConvertedFieldValue | TNewVal>(entityInfo, dbDifferences);
+        const shownOverlap = this.redactEncryptedConflictValues<ConvertedFieldValue | TNewVal>(entityInfo, overlap);
         const msg = {
           Message:
-            'Inconsistency between old values provided for changed fields, and the values of one or more of those fields in the database. Save operation continued with warning.',
-          ClientDifferences: clientDifferences,
-          DBDifferences: dbDifferences,
-          Overlap: overlap,
+            'Concurrent modification conflict: one or more fields modified by the client were updated in the database since the record was loaded. Save rejected to prevent overwriting concurrent changes.',
+          ClientDifferences: shownClientDifferences,
+          DBDifferences: shownDBDifferences,
+          Overlap: shownOverlap,
         };
-        
-        // Log as warning to console and ErrorLog table instead of throwing error
-        console.warn('Entity save inconsistency detected but allowing save to continue:', JSON.stringify(msg));
-        LogError({
-          service: 'ResolverBase',
-          operation: 'TestAndSetClientOldValuesToDBValues',
-          error: `Entity save inconsistency detected: ${JSON.stringify(msg)}`,
-          details: {
+
+        console.warn('Entity save concurrency conflict detected — rejecting conflicting update:', JSON.stringify(msg));
+        LogErrorEx({
+          message: `Entity save inconsistency detected: ${JSON.stringify(msg)}`,
+          severity: 'warning',
+          category: 'ResolverBase.TestAndSetClientOldValuesToDBValues',
+          metadata: {
             entityName: entityObject.EntityInfo.Name,
-            clientDifferences: clientDifferences,
-            dbDifferences: dbDifferences,
-            overlap: overlap
-          }
+            clientDifferences: shownClientDifferences,
+            dbDifferences: shownDBDifferences,
+            overlap: shownOverlap,
+          },
         });
 
-        // Create ErrorLog record in the database — use the entity's bound provider so the
-        // ErrorLog write goes to the same connection as the entity that triggered it.
+        // Persist SAVE_INCONSISTENCY ErrorLog record on the entity's bound provider before rejecting
         try {
-          const md = entityObject.ProviderToUse as unknown as IMetadataProvider;
-          const errorLogEntity = await md.GetEntityObject<MJErrorLogEntity>('MJ: Error Logs', contextUser);
-          errorLogEntity.Code = 'ENTITY_SAVE_INCONSISTENCY';
-          errorLogEntity.Message = `Entity save inconsistency detected for ${entityObject.EntityInfo.Name}: ${JSON.stringify(msg)}`;
-          errorLogEntity.Status = 'Warning';
-          errorLogEntity.Category = 'Entity Save';
-          errorLogEntity.CreatedBy = contextUser.Email || contextUser.Name;
-          
-          const saveResult = await errorLogEntity.Save();
-          if (!saveResult) {
-            console.error('Failed to save ErrorLog record');
+          const hasEntityObjectFactory = (
+            p: object | null | undefined
+          ): p is Pick<IMetadataProvider, 'GetEntityObject'> => Boolean(p && 'GetEntityObject' in p);
+          const providerCandidate = entityObject.ProviderToUse;
+          if (hasEntityObjectFactory(providerCandidate)) {
+            const errorLogEntity = await providerCandidate.GetEntityObject<MJErrorLogEntity>('MJ: Error Logs', contextUser);
+            // Code is NCHAR(20); a longer value is rejected at the database
+            errorLogEntity.Code = 'SAVE_INCONSISTENCY';
+            errorLogEntity.Message = `Entity save inconsistency detected for ${entityObject.EntityInfo.Name}: ${JSON.stringify(msg)}`;
+            errorLogEntity.Status = 'Warning';
+            errorLogEntity.Category = 'Entity Save';
+            errorLogEntity.CreatedBy = contextUser.Email || contextUser.Name;
+
+            const saveResult = await errorLogEntity.Save();
+            if (!saveResult) {
+              console.error(
+                `Failed to save ErrorLog record for ${entityObject.EntityInfo.Name}: ${errorLogEntity.LatestResult?.CompleteMessage}`
+              );
+            }
           }
         } catch (errorLogError) {
           console.error('Error creating ErrorLog record:', errorLogError);
         }
+
+        throw new GraphQLError(
+          `Concurrent modification conflict on ${entityObject.EntityInfo.Name} for field(s): ${conflictingFields.join(', ')}. Reload the record and retry your changes.`,
+          {
+            extensions: {
+              code: 'CONCURRENT_MODIFICATION_CONFLICT',
+              entityName: entityObject.EntityInfo.Name,
+              conflictingFields,
+            },
+          }
+        );
+      }
+
+      // Non-overlapping concurrent DB edits: preserve any field that changed in the database
+      // when the client itself did NOT modify that field (prevents full-payload clients or forged
+      // OldValues___ from clobbering concurrent DB updates on untouched columns).
+      fieldsToPreserveFromDB = new Set<string>();
+      for (const dd of dbDifferences) {
+        if (!clientDiffFieldNames.has(dd.FieldName)) {
+          fieldsToPreserveFromDB.add(dd.FieldName);
+          const f = this.findEntityFieldByCodeNameOrName(entityObject.EntityInfo, dd.FieldName);
+          if (f) {
+            fieldsToPreserveFromDB.add(f.Name);
+            fieldsToPreserveFromDB.add(f.CodeName);
+          }
+        }
       }
     }
 
-    // If we get here that means we've not thrown an exception, so there is
-    // NO OVERLAP, so we can set the new values from the data provided from the client now...
-    entityObject.SetMany(clientNewValues);
+    if (fieldsToPreserveFromDB && fieldsToPreserveFromDB.size > 0) {
+      const mergedValues: Record<string, TNewVal> = {};
+      for (const key of Object.keys(clientNewValues)) {
+        if (!fieldsToPreserveFromDB.has(key)) {
+          mergedValues[key] = clientNewValues[key];
+        }
+      }
+      entityObject.SetMany(mergedValues);
+    } else {
+      entityObject.SetMany(clientNewValues);
+    }
   }
 
   protected async DeleteRecord(
@@ -2281,7 +2679,10 @@ export class ResolverBase {
           extensions: { code: 'LOAD_ENTITY_ERROR', entityName },
         });
       }
-      const returnValue = entityObject.GetAll(); // grab the values before we delete so we can return last state before delete if we are successful.
+      // Grab the values before we delete so we can return the last state if the delete succeeds,
+      // projected for the caller in case the object holds a column they may not read.
+      // fls-guard: projected by ProjectEntityValuesForUser
+      const returnValue = ProjectEntityValuesForUser(provider, entityObject.EntityInfo, entityObject.GetAll(), this.GetUserFromPayload(userPayload));
 
       this.ListenForEntityMessages(entityObject, pubSub, userPayload);