@memberjunction/sqlserver-dataprovider 6.2.0-edge.3 → 6.2.0-edge.5

package/dist/SQLServerDataProvider.js

@@ -22,6 +22,7 @@ import { GenericDatabaseProvider } from '@memberjunction/generic-database-provid
 import sql from 'mssql';
 import { BehaviorSubject, Subject, concatMap, from, catchError, of } from 'rxjs';
 import { SQLServerTransactionGroup } from './SQLServerTransactionGroup.js';
+import { EXECUTED_VARIABLE_SUFFIX, IsSaveParameterList, RenderSaveSQL, SaveParameterCollector, } from './saveParameters.js';
 import { SQLServerProviderConfigData } from './types.js';
 import { EscapeSQLString, IsByteArray, TryBase64ToBytes } from '@memberjunction/global';
 import { SQLServerDialect } from '@memberjunction/sql-dialect';
@@ -72,6 +73,13 @@ function buildRequest(connectionSource, query, parameters) {
     else {
         request = new sql.Request(connectionSource);
     }
+    if (IsSaveParameterList(parameters)) {
+        // A save or delete statement (saveParameters.ts): named inputs typed from the columns.
+        for (const p of parameters) {
+            request.input(p.Name, p.Type, p.Value);
+        }
+        return { request, processedQuery: query };
+    }
     let processedQuery = query;
     if (parameters) {
         if (Array.isArray(parameters)) {
@@ -150,22 +158,20 @@ async function executeSQLCore(query, parameters, context, options, isRetry = fal
         error.code = 'POOL_CLOSED';
         throw error;
     }
-    // Handle logging
-    let logPromise;
-    if (options && !options.ignoreLogging && context.logSqlStatement) {
-        logPromise = context.logSqlStatement(query, parameters, options.description, options.ignoreLogging, options.isMutation, options.simpleSQLFallback, options.contextUser);
-    }
-    else {
-        logPromise = Promise.resolve();
-    }
     try {
         const { request, processedQuery } = buildRequest(connectionSource, query, parameters);
-        // Execute query and logging in parallel
-        const [result] = await Promise.all([
-            options?.timeoutMs ? QueryWithTimeout(request, processedQuery, options.timeoutMs) : request.query(processedQuery),
-            logPromise
-        ]);
-        return result;
+        const queryPromise = options?.timeoutMs
+            ? QueryWithTimeout(request, processedQuery, options.timeoutMs)
+            : request.query(processedQuery);
+        if (options && !options.ignoreLogging && context.logSqlStatement) {
+            const literalSQL = options.literalSQL;
+            const [result] = await Promise.all([
+                queryPromise,
+                context.logSqlStatement(literalSQL ?? query, literalSQL ? undefined : parameters, options.description, options.ignoreLogging, options.isMutation, options.simpleSQLFallback, options.contextUser)
+            ]);
+            return result;
+        }
+        return await queryPromise;
     }
     catch (error) {
         // Retry once for stale connection errors on non-transactional queries.
@@ -185,10 +191,11 @@ async function executeSQLCore(query, parameters, context, options, isRetry = fal
                 .map((e) => e?.message ?? String(e))
                 .join(' | ')}`
             : '';
+        const literalSQL = options?.literalSQL;
         const errorMessage = `Error executing SQL
     Error: ${error?.message ? error.message : error}${precedingMsgs}
-    Query: ${query}
-    Parameters: ${parameters ? JSON.stringify(parameters) : 'None'}`;
+    Query: ${literalSQL ?? query}
+    Parameters: ${literalSQL || !parameters ? 'None' : JSON.stringify(parameters)}`;
         // Preserve the original error type (ConnectionError vs RequestError) so callers
         // can structurally distinguish infrastructure failures from query-level errors.
         // Attach the detailed message while keeping the error's class identity and code.
@@ -206,8 +213,6 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
         this._refreshSuspendCount = 0;
         /** Refresh() calls waiting for `_refreshSuspendCount` to reach zero. */
         this._refreshResumeWaiters = [];
-        this._needsDatetimeOffsetAdjustment = false;
-        this._datetimeOffsetTestComplete = false;
         /**
          * Per-entity base-view column order — the view's column NAMES in physical (`column_id`) order,
          * keyed by `'<schema>.<baseview>'` lowercased. Populated in {@link Config} (after metadata
@@ -255,8 +260,9 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
      * (batch separator, quoted identifiers, etc.) are sourced from
      * `@memberjunction/sql-dialect` rather than hardcoded strings.
      */
+    static { this._dialectInstance = new SQLServerDialect(); }
     getDialect() {
-        return new SQLServerDialect();
+        return SQLServerDataProvider._dialectInstance;
     }
     QuoteIdentifier(name) {
         // Double embedded closing brackets so a name containing `]` cannot terminate the
@@ -276,6 +282,29 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
     }
     /** Longest an explicit Refresh() waits for in-flight saves before giving up (returning false). */
     static { this.REFRESH_WAIT_TIMEOUT_MS = 30_000; }
+    static { this._needsDatetimeOffsetAdjustment = false; }
+    static { this._datetimeOffsetTestComplete = false; }
+    static { this._datetimeOffsetTestPromise = null; }
+    /** When the last datetimeoffset probe failed (ms since epoch), or null if it hasn't failed since the last success. */
+    static { this._datetimeOffsetTestFailedAt = null; }
+    /** After a failed probe, callers use the safe default for this long before probing again. */
+    static { this.DATETIMEOFFSET_PROBE_RETRY_MS = 30_000; }
+    get _needsDatetimeOffsetAdjustment() {
+        return SQLServerDataProvider._needsDatetimeOffsetAdjustment;
+    }
+    set _needsDatetimeOffsetAdjustment(value) {
+        SQLServerDataProvider._needsDatetimeOffsetAdjustment = value;
+    }
+    get _datetimeOffsetTestComplete() {
+        return SQLServerDataProvider._datetimeOffsetTestComplete;
+    }
+    set _datetimeOffsetTestComplete(value) {
+        SQLServerDataProvider._datetimeOffsetTestComplete = value;
+        if (!value) {
+            SQLServerDataProvider._datetimeOffsetTestPromise = null;
+            SQLServerDataProvider._datetimeOffsetTestFailedAt = null;
+        }
+    }
     /**
      * Process-wide view-column-order cache, scoped PER CONNECTION POOL and shared across provider
      * instances. MJServer creates 1–2 fresh, fully-Config()'d provider instances per GraphQL request
@@ -370,8 +399,6 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
     async Config(configData, providerToUse) {
         try {
             this._pool = configData.ConnectionPool; // Now expects a ConnectionPool instead of DataSource
-            // Initialize the instance queue processor
-            this.initializeQueueProcessor();
             const configured = await super.Config(configData, providerToUse); // now parent class can do it's config
             // After metadata is loaded, capture each base view's REAL column order so the save-capture
             // @ResultTable is declared to match it (see _viewColumnOrderCache + getAllEntityColumnsSQL).
@@ -600,7 +627,7 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
         // Build array of SQL statements for batch execution
         const sqlStatements = [];
         for (const { query } of items) {
-            // CacheValidationSQL should return MaxUpdatedAt and RowCount
+            // CacheValidationSQL returns MaxUpdatedAt and a row count (TotalRows or RowCount)
             sqlStatements.push(query.CacheValidationSQL);
         }
         try {
@@ -610,17 +637,8 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
             for (let i = 0; i < items.length; i++) {
                 const { index } = items[i];
                 const resultSet = resultSets[i];
-                if (resultSet && resultSet.length > 0) {
-                    const row = resultSet[0];
-                    results.set(index, {
-                        success: true,
-                        rowCount: row.RowCount,
-                        maxUpdatedAt: row.MaxUpdatedAt ? new Date(row.MaxUpdatedAt).toISOString() : undefined,
-                    });
-                }
-                else {
-                    results.set(index, { success: true, rowCount: 0, maxUpdatedAt: undefined });
-                }
+                // Shared reader: accepts the documented `TotalRows` as well as `RowCount`.
+                results.set(index, this.QueryCacheStatusFromRow(resultSet?.[0]));
             }
         }
         catch (e) {
@@ -669,8 +687,7 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
             // unconditional GetEffectiveBaseView) so a Building/DriftHold/Disabled/never-minted snapshot probes the
             // LIVE base view — mirroring the read path — instead of a held or missing materialized_vw wrapper.
             const effectiveView = await this.resolveEffectiveBaseView(entityInfo, item.params, contextUser);
-            const statusSQL = `SELECT COUNT(*) AS TotalRows, MAX(__mj_UpdatedAt) AS MaxUpdatedAt FROM [${entityInfo.SchemaName}].${effectiveView}${whereSQL ? ' WHERE ' + whereSQL : ''}`;
-            sqlStatements.push(statusSQL);
+            sqlStatements.push(this.BuildCacheStatusSQL(entityInfo, effectiveView, whereSQL));
         }
         try {
             // Execute the batched SQL using existing ExecuteSQLBatch method
@@ -693,11 +710,15 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
             }
         }
         catch (e) {
-            // If batch fails, mark all items as failed
-            const errorMessage = e instanceof Error ? e.message : String(e);
-            for (const { index } of items) {
-                results.set(index, { success: false, errorMessage });
-            }
+            // One bad statement fails the WHOLE batch on SQL Server, which used to mark every item
+            // failed — so a single problematic entity blinded the sweep for its entire engine. Fall back
+            // to the per-item path, which runs each probe on its own and fails only what deserves it
+            //.
+            LogStatusEx({
+                message: `SQLServerDataProvider.getBatchedServerCacheStatus: batched probe failed (${e instanceof Error ? e.message : String(e)}) — retrying ${items.length} probe(s) individually`,
+                verboseOnly: true,
+            });
+            return await super.getBatchedServerCacheStatus(items, contextUser);
         }
         return results;
     }
@@ -888,9 +909,11 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
         // SQLServerTransactionGroup-batched saves regenerate per-item SQL when
         // transaction variables get rebound. `_spName` is preserved for back-compat
         // with that caller; the dialect-driven pipeline derives it from entity
-        // metadata via `GetCreateUpdateSPName`.
+        // metadata via `GetCreateUpdateSPName`. Outside a TransactionGroup,
+        // `fullSQL` holds `@p$0` parameter placeholders, so return `literalSQL`
+        // for standalone callers.
         const result = await this.GenerateSaveSQL(entity, bNewRecord, user);
-        return result.fullSQL;
+        return result.literalSQL ?? result.fullSQL;
     }
     /**
      * Queue the AI action task only once the save is durable: through {@link RunAfterCommit}, so it
@@ -903,6 +926,7 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
             await QueueManager.AddTask('Entity AI Action', params, null, user);
         }, 'Entity AI Action', postCommitToken);
     }
+    static { this._entityColumnsSQLCache = new WeakMap(); }
     getAllEntityColumnsSQL(entityInfo) {
         // This builds the column list for the @ResultTable/@ResultChangesTable that captures
         // `SELECT * FROM <BaseView>` via a POSITIONAL `INSERT INTO @table EXEC ...`. SQL Server maps the
@@ -927,10 +951,17 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
         // — the only case where a base-column-after-a-join could mis-route by position — we WARN loudly
         // (warnOnViewOrderFallback), because the metadata order can no longer be checked against the view and
         // a silent fallback there would let the very bug this fix prevents persist undetected.
-        let orderedFields;
-        let fallbackReason;
         const viewKey = `${entityInfo.SchemaName}.${entityInfo.BaseView}`.toLowerCase();
         const viewOrder = this._viewColumnOrderCache.get(viewKey);
+        const cached = SQLServerDataProvider._entityColumnsSQLCache.get(entityInfo);
+        if (cached &&
+            cached.viewOrderRef === viewOrder &&
+            cached.fieldCount === entityInfo.Fields.length &&
+            !cached.usedFallback) {
+            return cached.sql;
+        }
+        let orderedFields;
+        let fallbackReason;
         if (!viewOrder) {
             fallbackReason = `base view not captured in the column-order cache (cache load failed at Config, or a custom/overridden sproc whose view was not read)`;
         }
@@ -938,16 +969,16 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
             fallbackReason = `base view exposes ${viewOrder.length} column(s) but the entity declares ${entityInfo.Fields.length} field(s) — cannot align 1:1 by position`;
         }
         else {
-            const fieldByName = new Map(entityInfo.Fields.map((f) => [f.Name.toLowerCase(), f]));
-            const mapped = viewOrder.map((colName) => fieldByName.get(colName.toLowerCase()));
-            if (mapped.every((f) => f !== undefined)) {
+            const mapped = viewOrder.map((colName) => entityInfo.FieldByName(colName));
+            if (mapped.every((f) => f !== null && f !== undefined)) {
                 orderedFields = mapped; // every view column resolved 1:1 to a field
             }
             else {
-                const unmatched = viewOrder.filter((colName) => !fieldByName.has(colName.toLowerCase()));
+                const unmatched = viewOrder.filter((colName) => !entityInfo.FieldByName(colName));
                 fallbackReason = `view column(s) without a matching EntityField: ${unmatched.join(', ')}`;
             }
         }
+        const usedFallback = !orderedFields;
         if (!orderedFields) {
             this.warnIfBaseFieldSequencedAfterVirtual(entityInfo);
             this.warnOnViewOrderFallback(entityInfo, fallbackReason);
@@ -960,8 +991,35 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
             sRet += '[' + f.Name + '] ' + f.SQLFullType + ' ' + (f.AllowsNull || f.IsVirtual ? 'NULL' : 'NOT NULL');
             outputCount++;
         }
+        SQLServerDataProvider._entityColumnsSQLCache.set(entityInfo, {
+            viewOrderRef: viewOrder,
+            fieldCount: entityInfo.Fields.length,
+            usedFallback,
+            sql: sRet,
+        });
         return sRet;
     }
+    /**
+     * Builds the column declarations for `@ResultTable` when `entityInfo.SaveReturnMode === 'datestamps_only'`.
+     *
+     * Matches the exact column order emitted by CodeGen's `buildCRUDReturnSelect` via
+     * {@link EntityInfo.DatestampReturnFields} (primary key(s), followed by `__mj_CreatedAt` and `__mj_UpdatedAt`),
+     * ensuring positional `INSERT INTO @ResultTable EXEC spCreate/spUpdate` alignment.
+     */
+    getDatestampEntityColumnsSQL(entityInfo) {
+        return entityInfo.DatestampReturnFields
+            .map((f) => `${this.QuoteIdentifier(f.Name)} ${f.SQLFullType} ${f.AllowsNull || f.IsVirtual ? 'NULL' : 'NOT NULL'}`)
+            .join(',\n');
+    }
+    /**
+     * Selects the `@ResultTable` column declarations matching the compiled stored procedure's
+     * return shape (`returnContext.spReturnsDatestampsOnly`).
+     */
+    getSaveResultTableColumnsSQL(entityInfo, returnContext) {
+        return returnContext.spReturnsDatestampsOnly
+            ? this.getDatestampEntityColumnsSQL(entityInfo)
+            : this.getAllEntityColumnsSQL(entityInfo);
+    }
     /** Entities already warned about base-after-virtual field-order skew — so we warn once, not every save. */
     static { this._fieldOrderWarnedEntities = new Set(); }
     /**
@@ -1060,7 +1118,7 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
         if (value && field.Type.trim().toLowerCase() === 'datetimeoffset') {
             return { kind: 'use', value: new Date(value).toISOString() };
         }
-        if (!isUpdate && field.Type.trim().toLowerCase() === 'uniqueidentifier' && !field.IsPrimaryKey) {
+        if (!isUpdate && field.IsUniqueIdentifier && !field.IsPrimaryKey) {
             if (typeof value === 'string' && value.includes('()')) {
                 return { kind: 'skip' };
             }
@@ -1080,7 +1138,53 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
      * `EntityFieldInfo.NeedsClearCompanion`.
      */
     RenderSaveCallBinding(entity, fieldValues, isUpdate, _spName) {
-        const uniqueSuffix = this.allocateSaveCallSuffix(entity);
+        // The statement that runs uses one constant variable suffix and a parameter per value, so its
+        // text repeats across records. The per-record suffix is kept for the literal form.
+        const params = new SaveParameterCollector();
+        const binding = this.renderSaveCallBindingWithSuffix(entity, fieldValues, isUpdate, EXECUTED_VARIABLE_SUFFIX, params);
+        const saveBinding = { ...binding, parameters: params.Parameters, recordSuffix: this.allocateSaveCallSuffix(entity) };
+        return saveBinding;
+    }
+    /** The binding as RenderSaveCallBinding built it; throws for any other shape. */
+    asSaveBinding(binding, caller) {
+        if (binding.kind !== 'mssql-declare-exec' || !('recordSuffix' in binding)) {
+            throw new Error(`SQLServerDataProvider.${caller}: unexpected binding kind '${binding.kind}'`);
+        }
+        return binding;
+    }
+    /**
+     * The fragment for a statement built with typed parameters. A transaction-group item gets the
+     * literal form only, as before: the group combines and regenerates its items' SQL as text. A
+     * statement with no values to bind runs as built, which is already valid SQL.
+     *
+     * `literalSQL` is exposed as a lazy memoized getter so saves with SQL logging off avoid running
+     * the `RenderSaveSQL` regex substitution pass on every write.
+     */
+    toSaveFragment(entity, executedSQL, parameters, recordSuffix) {
+        if (entity.TransactionGroup) {
+            return { sql: RenderSaveSQL(executedSQL, parameters, recordSuffix) };
+        }
+        let cachedLiteralSQL;
+        const fragment = parameters.length > 0 ? { sql: executedSQL, parameters: [...parameters] } : { sql: executedSQL };
+        Object.defineProperty(fragment, 'literalSQL', {
+            enumerable: true,
+            configurable: true,
+            get() {
+                if (cachedLiteralSQL === undefined) {
+                    cachedLiteralSQL = RenderSaveSQL(executedSQL, parameters, recordSuffix);
+                }
+                return cachedLiteralSQL;
+            },
+        });
+        return fragment;
+    }
+    /**
+     * The binding for a given variable suffix, with each value bound through `params`. Split out of
+     * RenderSaveCallBinding so the update replay form can re-render a subset of the fields under the
+     * SAME suffix without allocating another one (inside a TransactionGroup that would consume a `_n`
+     * ordinal).
+     */
+    renderSaveCallBindingWithSuffix(entity, fieldValues, isUpdate, uniqueSuffix, params) {
         const declarations = [];
         const setStatements = [];
         const execParams = [];
@@ -1094,7 +1198,7 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
             const hasValue = value !== null && value !== undefined;
             const binaryLiteral = hasValue && f.IsBinaryFieldType ? this.FormatBinaryLiteral(f, value) : undefined;
             if (hasValue) {
-                setStatements.push(`SET ${varName} = ${binaryLiteral ?? this.generateSetStatementValue(f, value)}`);
+                setStatements.push(`SET ${varName} = ${params.AddField(f, binaryLiteral ?? this.generateSetStatementValue(f, value))}`);
             }
             execParams.push(`@${f.CodeName}=${varName}`);
             simpleParams += this.generateSingleSPParam(f, value, bFirst, binaryLiteral);
@@ -1107,12 +1211,12 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
         // UPDATE: tail-append PK declarations from the loaded entity's PrimaryKey.
         if (isUpdate && execParams.length > 0) {
             for (const pkv of entity.PrimaryKey.KeyValuePairs) {
-                const f = entity.EntityInfo.Fields.find((x) => x.Name.trim().toLowerCase() === pkv.FieldName.trim().toLowerCase());
+                const f = entity.EntityInfo.FieldByName(pkv.FieldName);
                 if (!f)
                     continue;
                 const varName = `@${f.CodeName}${uniqueSuffix}`;
                 declarations.push(`${varName} ${f.SQLFullType.toUpperCase()}`);
-                setStatements.push(`SET ${varName} = ${this.generateSetStatementValue(f, pkv.Value)}`);
+                setStatements.push(`SET ${varName} = ${params.AddField(f, this.generateSetStatementValue(f, pkv.Value))}`);
                 execParams.push(`@${f.CodeName}=${varName}`);
                 const pkeyQuotes = f.NeedsQuotes ? "'" : '';
                 simpleParams += `, @${f.CodeName} = ${pkeyQuotes}${pkv.Value}${pkeyQuotes}`;
@@ -1155,23 +1259,46 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
      * there is nothing to look up).
      */
     RenderReplaySaveSQL(binding, entity, fieldValues) {
-        if (binding.kind !== 'mssql-declare-exec') {
-            throw new Error(`SQLServerDataProvider.RenderReplaySaveSQL: unexpected binding kind '${binding.kind}'`);
-        }
+        const saveBinding = this.asSaveBinding(binding, 'RenderReplaySaveSQL');
         const info = entity.EntityInfo;
         const pks = info.PrimaryKeys;
         if (pks.length === 0 || !pks.every((pk) => fieldValues.has(pk))) {
             return undefined;
         }
         const schema = info.SchemaName;
-        const where = pks.map((pk) => `[${pk.Name}] = @${pk.CodeName}${binding.suffix}`).join(' AND ');
+        const where = pks.map((pk) => `[${pk.Name}] = @${pk.CodeName}${saveBinding.suffix}`).join(' AND ');
         const createSpName = this.GetCreateUpdateSPName(entity, true);
-        const createBranch = `IF NOT EXISTS (SELECT 1 FROM [${schema}].[${info.BaseTable}] WHERE ${where})\nBEGIN\n    EXEC [${schema}].${createSpName} ${binding.callArgsSQL}\nEND`;
+        const createBranch = `IF NOT EXISTS (SELECT 1 FROM [${schema}].[${info.BaseTable}] WHERE ${where})\nBEGIN\n    EXEC [${schema}].${createSpName} ${saveBinding.callArgsSQL}\nEND`;
         const hasUpdateProc = info.AllowUpdateAPI && info.spUpdateGenerated && !info.VirtualEntity;
         const updateBranch = hasUpdateProc
-            ? `\nELSE\nBEGIN\n    EXEC [${schema}].${this.GetCreateUpdateSPName(entity, false)} ${binding.callArgsSQL}\nEND`
+            ? `\nELSE\nBEGIN\n    EXEC [${schema}].${this.GetCreateUpdateSPName(entity, false)} ${saveBinding.callArgsSQL}\nEND`
             : '';
-        return `${this.renderDeclareSetHead(binding)}${createBranch}${updateBranch}`;
+        return RenderSaveSQL(`${this.renderDeclareSetHead(saveBinding)}${createBranch}${updateBranch}`, saveBinding.parameters, saveBinding.recordSuffix);
+    }
+    /**
+     * Replay form of an UPDATE for the SQL log (never executed): `EXEC spUpdate` with only the
+     * fields this save changed, plus the primary key. The update procs keep every column whose
+     * parameter is not passed (`ISNULL(@p, [Col])`), so replaying the recording applies exactly
+     * the change that was made and leaves the target's other columns — including settings a
+     * consumer tuned on an MJ-owned row — alone. A field changed to NULL still carries its
+     * `_Clear` companion (derived from the same map). A save whose changes touch no proc
+     * parameter has nothing to replay, so it is logged as a comment. A hand-written update proc
+     * (spUpdateGenerated off) makes no ISNULL promise, so it keeps the full-row form.
+     */
+    RenderReplayUpdateSQL(binding, entity, changedFieldValues) {
+        const saveBinding = this.asSaveBinding(binding, 'RenderReplayUpdateSQL');
+        const info = entity.EntityInfo;
+        if (!info.spUpdateGenerated) {
+            return undefined;
+        }
+        if (changedFieldValues.size === 0) {
+            const key = entity.PrimaryKey.ToString().replace(/[\r\n]+/g, ' ');
+            return `-- ${info.Name} (${key}): saved with no field changes; nothing to replay`;
+        }
+        const params = new SaveParameterCollector();
+        const changed = this.renderSaveCallBindingWithSuffix(entity, changedFieldValues, true, saveBinding.suffix, params);
+        const spName = this.GetCreateUpdateSPName(entity, false);
+        return RenderSaveSQL(`${this.renderDeclareSetHead(changed)}EXEC [${info.SchemaName}].${spName} ${changed.callArgsSQL}`, params.Parameters, saveBinding.recordSuffix);
     }
     /** `DECLARE ...\n\nSET ...\n\n` when the binding declares variables, else empty. */
     renderDeclareSetHead(binding) {
@@ -1182,58 +1309,66 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
      * shape: `DECLARE ... ; SET ... ; EXEC [schema].sp callArgs`. When
      * record-change tracking is on, this output is further wrapped by
      * `WrapSaveCallWithRecordChange`.
+     *
+     * When `returnContext.needsDatestampProjection` is true (either passed by
+     * `GenericDatabaseProvider.GenerateSaveSQL` or resolved from `options`),
+     * delegates to {@link ProjectSaveCallToDatestamps}.
      */
-    WrapSaveCallForResult(binding, entity, spName) {
-        if (binding.kind !== 'mssql-declare-exec') {
-            throw new Error(`SQLServerDataProvider.WrapSaveCallForResult: unexpected binding kind '${binding.kind}'`);
+    WrapSaveCallForResult(binding, entity, spName, options, returnContext) {
+        const resolvedReturn = returnContext ?? this.ResolveSaveReturnContext(entity, options);
+        if (resolvedReturn.needsDatestampProjection) {
+            return this.ProjectSaveCallToDatestamps(binding, entity, spName, resolvedReturn);
         }
-        const execSQL = `EXEC [${entity.EntityInfo.SchemaName}].${spName} ${binding.callArgsSQL}`;
-        return { sql: `${this.renderDeclareSetHead(binding)}${execSQL}` };
+        const saveBinding = this.asSaveBinding(binding, 'WrapSaveCallForResult');
+        const execSQL = `EXEC [${entity.EntityInfo.SchemaName}].${spName} ${saveBinding.callArgsSQL}`;
+        return this.toSaveFragment(entity, `${this.renderDeclareSetHead(saveBinding)}${execSQL}`, saveBinding.parameters, saveBinding.recordSuffix);
+    }
+    /**
+     * Captures the stored procedure's output into `@ResultTable` and projects only
+     * `returnContext.datestampSelectColumnsSQL` (`SELECT [ID], [__mj_CreatedAt], [__mj_UpdatedAt] FROM @ResultTable;`)
+     * when a caller requests `SaveReturnMode: 'datestamps_only'` at runtime on an entity whose
+     * compiled stored procedure returns the full row.
+     */
+    ProjectSaveCallToDatestamps(binding, entity, spName, returnContext) {
+        const saveBinding = this.asSaveBinding(binding, 'ProjectSaveCallToDatestamps');
+        const execSQL = `EXEC [${entity.EntityInfo.SchemaName}].${spName} ${saveBinding.callArgsSQL}`;
+        const resultTableColumnsSQL = this.getSaveResultTableColumnsSQL(entity.EntityInfo, returnContext);
+        const sql = `${this.renderDeclareSetHead(saveBinding)}DECLARE @ResultTable TABLE (\n    ${resultTableColumnsSQL}\n);\n\nINSERT INTO @ResultTable\n${execSQL};\n\nSELECT ${returnContext.datestampSelectColumnsSQL} FROM @ResultTable;`;
+        return this.toSaveFragment(entity, sql, saveBinding.parameters, saveBinding.recordSuffix);
     }
     /**
      * Wraps the save SQL with SQL Server's @ResultTable + inline
      * `spCreateRecordChange_Internal` EXEC pattern. The CONCAT-built `@ID`
      * inline supports composite-key entities.
+     *
+     * Consumes {@link SaveReturnContext} resolved by `GenericDatabaseProvider`:
+     * - `@ResultTable` column declarations match the compiled stored procedure's return mode
+     *   (`returnContext.spReturnsDatestampsOnly`).
+     * - The final `SELECT` from `@ResultTable` uses `returnContext.finalSelectColumnsSQL`.
      */
-    WrapSaveCallWithRecordChange(_saveSQL, binding, payload, entity) {
-        if (binding.kind !== 'mssql-declare-exec') {
-            throw new Error(`SQLServerDataProvider.WrapSaveCallWithRecordChange: unexpected binding kind '${binding.kind}'`);
-        }
-        const recordChangesEntityInfo = this.Entities.find((e) => e.Name === 'MJ: Record Changes');
+    WrapSaveCallWithRecordChange(_saveSQL, binding, payload, entity, options, returnContext) {
+        const saveBinding = this.asSaveBinding(binding, 'WrapSaveCallWithRecordChange');
+        const params = new SaveParameterCollector(saveBinding.parameters);
+        const recordChangesEntityInfo = this.EntityByName('MJ: Record Changes');
         const spName = this.GetCreateUpdateSPName(entity, payload.type === 'Create');
         const concatPKIDString = `CONCAT(${entity.EntityInfo.PrimaryKeys
             .map((pk) => `'${pk.CodeName}','${CompositeKey.DefaultValueDelimiter}',[${pk.Name}]`)
             .join(`,'${CompositeKey.DefaultFieldDelimiter}',`)})`;
         // Build the inline `EXEC spCreateRecordChange_Internal` from the payload,
         // referencing `@ID` (set below from the result table).
-        const lineageClause = payload.source === 'Restore'
-            ? `,
-                                                                                        @Source='Restore',
-                                                                                        @RestoredFromID='${payload.restoredFromID}',
-                                                                                        @RestoreReason=${payload.restoreReason ? `N'${payload.restoreReason.replace(/'/g, "''")}'` : 'NULL'}`
-            : payload.source === 'Clone'
-                ? `,
-                                                                                        @Source='Clone',
-                                                                                        @ChangeContext=N'${EscapeSQLString(payload.changeContext)}'`
-                : '';
-        const recordChangeEXEC = `EXEC [${this.MJCoreSchemaName}].spCreateRecordChange_Internal @EntityName='${entity.EntityInfo.Name}',
-                                                                                        @RecordID=@ID,
-                                                                                        @UserID='${payload.userID}',
-                                                                                        @Type='${payload.type}',
-                                                                                        @ChangesJSON='${payload.changesJSON}',
-                                                                                        @ChangesDescription='${payload.changesDescription}',
-                                                                                        @FullRecordJSON='${payload.fullRecordJSON}',
-                                                                                        @Status='Complete',
-                                                                                        @Comments=null${lineageClause}`;
-        const execSQL = `EXEC [${entity.EntityInfo.SchemaName}].${spName} ${binding.callArgsSQL}`;
+        const recordChangeEXEC = this.renderRecordChangeEXEC(entity.EntityInfo.Name, '@ID', payload, params);
+        const execSQL = `EXEC [${entity.EntityInfo.SchemaName}].${spName} ${saveBinding.callArgsSQL}`;
+        const resolvedReturn = returnContext ?? this.ResolveSaveReturnContext(entity, options);
+        const resultTableColumnsSQL = this.getSaveResultTableColumnsSQL(entity.EntityInfo, resolvedReturn);
+        const finalSelectSQL = `SELECT ${resolvedReturn.finalSelectColumnsSQL} FROM @ResultTable;`;
         const sql = `
-                    ${binding.preambleSQL}
+                    ${saveBinding.preambleSQL}
 
                     DECLARE @ResultTable TABLE (
-                        ${this.getAllEntityColumnsSQL(entity.EntityInfo)}
+                        ${resultTableColumnsSQL}
                     );
 
-                    ${binding.setSQL}
+                    ${saveBinding.setSQL}
 
                     INSERT INTO @ResultTable
                     ${execSQL};
@@ -1252,8 +1387,44 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
                         ${recordChangeEXEC};
                     END;
 
-                    SELECT * FROM @ResultTable;`;
-        return { sql };
+                    ${finalSelectSQL}`;
+        return this.toSaveFragment(entity, sql, params.Parameters, saveBinding.recordSuffix);
+    }
+    /**
+     * `EXEC spCreateRecordChange_Internal …` for a payload. With `params`, each per-change value is
+     * bound as a parameter typed from its Record Changes column, and the literal it replaces is kept
+     * for the rendered form; without, the literals are written in directly. The entity name and change
+     * type stay literal: they are constant for an entity and operation.
+     */
+    renderRecordChangeEXEC(entityName, recordIDSQL, payload, params) {
+        const bind = (fieldName, literal) => (params ? params.AddField(this.recordChangeField(fieldName), literal) : literal);
+        const lineageClause = payload.source === 'Restore'
+            ? `,
+                                                                                        @Source='Restore',
+                                                                                        @RestoredFromID=${bind('RestoredFromID', `'${payload.restoredFromID}'`)},
+                                                                                        @RestoreReason=${payload.restoreReason ? bind('RestoreReason', `N'${payload.restoreReason.replace(/'/g, "''")}'`) : 'NULL'}`
+            : payload.source === 'Clone'
+                ? `,
+                                                                                        @Source='Clone',
+                                                                                        @ChangeContext=${bind('ChangeContext', `N'${EscapeSQLString(payload.changeContext)}'`)}`
+                : '';
+        return `EXEC [${this.MJCoreSchemaName}].spCreateRecordChange_Internal @EntityName=N'${entityName}',
+                                                                                        @RecordID=${recordIDSQL},
+                                                                                        @UserID=${bind('UserID', `'${payload.userID}'`)},
+                                                                                        @Type='${payload.type}',
+                                                                                        @ChangesJSON=${bind('ChangesJSON', `N'${payload.changesJSON}'`)},
+                                                                                        @ChangesDescription=${bind('ChangesDescription', `N'${payload.changesDescription}'`)},
+                                                                                        @FullRecordJSON=${bind('FullRecordJSON', `N'${payload.fullRecordJSON}'`)},
+                                                                                        @Status='Complete',
+                                                                                        @Comments=null${lineageClause}`;
+    }
+    /** A field of `MJ: Record Changes`, whose column types type the Record Change parameters. */
+    recordChangeField(fieldName) {
+        const field = this.EntityByName('MJ: Record Changes')?.FieldByName(fieldName);
+        if (!field) {
+            throw new Error(`SQLServerDataProvider: field "${fieldName}" of "MJ: Record Changes" is not in the metadata`);
+        }
+        return field;
     }
     /**
      * Generates the value portion of a SET statement for a field
@@ -1424,32 +1595,22 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
         return unicodePrefix + quoteString + pVal + quoteString;
     }
     GetLogRecordChangeSQL(newData, oldData, entityName, recordID, entityInfo, type, user, wrapRecordIdInQuotes, restoreContext, cloneContext) {
+        return this.renderLogRecordChangeSQL(newData, oldData, entityName, recordID, entityInfo, type, user, wrapRecordIdInQuotes, restoreContext, cloneContext);
+    }
+    /**
+     * Renders the `spCreateRecordChange_Internal` call for `GetLogRecordChangeSQL` (literal form) and
+     * for the delete batch (`params` supplied, so the payload values bind as typed inputs).
+     */
+    renderLogRecordChangeSQL(newData, oldData, entityName, recordID, entityInfo, type, user, wrapRecordIdInQuotes, restoreContext, cloneContext, params) {
         // Dialect-agnostic payload assembly is hoisted into DatabaseProviderBase
         // so SQL Server and PostgreSQL share one implementation. We only render
         // the T-SQL EXEC wrapper here.
         const payload = this.BuildRecordChangePayload(newData, oldData, String(recordID), entityInfo, type, user, restoreContext, "'", cloneContext);
         if (!payload)
             return null;
-        const quotes = wrapRecordIdInQuotes ? "'" : '';
-        const lineageClause = payload.source === 'Restore'
-            ? `,
-                                                                                        @Source='Restore',
-                                                                                        @RestoredFromID='${payload.restoredFromID}',
-                                                                                        @RestoreReason=${payload.restoreReason ? `N'${payload.restoreReason.replace(/'/g, "''")}'` : 'NULL'}`
-            : payload.source === 'Clone'
-                ? `,
-                                                                                        @Source='Clone',
-                                                                                        @ChangeContext=N'${EscapeSQLString(payload.changeContext)}'`
-                : '';
-        return `EXEC [${this.MJCoreSchemaName}].spCreateRecordChange_Internal @EntityName='${entityName}',
-                                                                                        @RecordID=${quotes}${recordID}${quotes},
-                                                                                        @UserID='${payload.userID}',
-                                                                                        @Type='${payload.type}',
-                                                                                        @ChangesJSON='${payload.changesJSON}',
-                                                                                        @ChangesDescription='${payload.changesDescription}',
-                                                                                        @FullRecordJSON='${payload.fullRecordJSON}',
-                                                                                        @Status='Complete',
-                                                                                        @Comments=null${lineageClause}`;
+        const recordIDSQL = wrapRecordIdInQuotes ? `N'${EscapeSQLString(String(recordID))}'` : String(recordID);
+        const boundRecordID = params && wrapRecordIdInQuotes ? params.AddField(this.recordChangeField('RecordID'), recordIDSQL) : recordIDSQL;
+        return this.renderRecordChangeEXEC(entityName, boundRecordID, payload, params);
     }
     /**
      * Implements the abstract BuildRecordChangeSQL from DatabaseProviderBase.
@@ -1474,19 +1635,30 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
         return result.fullSQL;
     }
     /**
-     * This function generates both the full SQL (with record change metadata) and the simple stored procedure call for delete
-     * @returns Object with fullSQL and simpleSQL properties
+     * Generates the delete statement with both full SQL (including record changes) and simple SQL.
+     * With `params`, primary-key and Record Change values are bound as `@p0, @p1, …` and their
+     * literals are kept on the parameters for `RenderSaveSQL`.
+     * For a TrackRecordChanges entity with CascadeDeletes, the full SQL runs the proc uncaptured and selects the key twice:
+     * first whether the row existed (read by transaction groups), last whether it was deleted (read by direct execution).
      */
-    getDeleteSQLWithDetails(entity, user, skipRecordChanges = false) {
-        let sSQL = '';
+    getDeleteSQLWithDetails(entity, user, skipRecordChanges = false, params) {
         const spName = entity.EntityInfo.spDelete ? entity.EntityInfo.spDelete : `spDelete${entity.EntityInfo.BaseTableCodeName}`;
-        const sParams = entity.PrimaryKey.KeyValuePairs.map((kv) => {
-            const f = entity.EntityInfo.Fields.find((f) => f.Name.trim().toLowerCase() === kv.FieldName.trim().toLowerCase());
-            const quotes = f.NeedsQuotes ? "'" : '';
-            return `@${f.CodeName}=${quotes}${kv.Value}${quotes}`;
-        }).join(', ');
+        const pkRefs = entity.PrimaryKey.KeyValuePairs.map((kv) => {
+            const f = entity.EntityInfo.FieldByName(kv.FieldName);
+            if (!f) {
+                throw new Error(`SQLServerDataProvider.getDeleteSQLWithDetails: primary key field "${kv.FieldName}" not found on "${entity.EntityInfo.Name}"`);
+            }
+            // Quoted keys are escaped by generateSetStatementValue; an unquoted (numeric) key must be a plain number.
+            const literal = f.NeedsQuotes
+                ? this.generateSetStatementValue(f, kv.Value)
+                : SQLServerDataProvider.RenderKeyValueLiteral(kv.Value, false, f.Name, entity.EntityInfo.Name);
+            // One reference per key, reused by every statement below that names the key.
+            return { Field: f, Ref: params ? params.AddField(f, literal) : literal };
+        });
+        const sParams = pkRefs.map((pk) => `@${pk.Field.CodeName}=${pk.Ref}`).join(', ');
         const sSimpleSQL = `EXEC [${entity.EntityInfo.SchemaName}].[${spName}] ${sParams}`;
-        const recordChangesEntityInfo = this.Entities.find((e) => e.Name === 'MJ: Record Changes');
+        const recordChangesEntityInfo = this.EntityByName('MJ: Record Changes');
+        let sSQL;
         if (entity.EntityInfo.TrackRecordChanges && !skipRecordChanges && entity.EntityInfo.Name.trim().toLowerCase() !== 'record changes') {
             // don't track changes for the record changes entity
             const oldData = entity.GetAll(true); // get all the OLD values
@@ -1506,6 +1678,40 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
             const sReturnList = entity.PrimaryKeys.map((pk) => {
                 return `@${pk.CodeName} AS [${pk.Name}]`;
             }).join(', ');
+            const recordChangeSQL = this.renderLogRecordChangeSQL(null /*pass in null for new data for deleted records*/, oldData, entity.EntityInfo.Name, sCombinedPrimaryKey, entity.EntityInfo, 'Delete', user, true, entity.RestoreContext, entity.CloneContext, params);
+            if (entity.EntityInfo.CascadeDeletes) {
+                // A cascading spDelete EXECs other procs (spUpdate* to null references, spDelete* for
+                // children) and each emits its own result set, spUpdate*'s being the full row. Capturing the
+                // call with INSERT INTO @ResultTable EXEC takes every one of them, so the first full row fails
+                // with error 213. Run the proc uncaptured instead and judge success by whether the row is
+                // gone. The key is selected first (transaction groups read the first result set) and last
+                // (direct execution reads the last, see ValidateDeleteResult); NULL when nothing was deleted.
+                // The checks read the base view, not the table: runtime logins hold SELECT on base views
+                // only, and for a soft-delete entity the view hides the row spDelete just soft-deleted.
+                const sView = `[${entity.EntityInfo.SchemaName}].[${entity.EntityInfo.BaseView}]`;
+                const sWhere = pkRefs.map((pk) => `[${pk.Field.Name}]=${pk.Ref}`).join(' AND ');
+                const sKeyWhen = (flag) => pkRefs.map((pk) => `CASE WHEN ${flag} = 1 THEN ${pk.Ref} END AS [${pk.Field.Name}]`).join(', ');
+                sSQL = `
+                    DECLARE @MJDeleteRowExisted BIT = CASE WHEN EXISTS (SELECT 1 FROM ${sView} WHERE ${sWhere}) THEN 1 ELSE 0 END
+                    SELECT ${sKeyWhen('@MJDeleteRowExisted')}
+
+                    IF @MJDeleteRowExisted = 1
+                        ${sSimpleSQL}
+
+                    DECLARE @MJDeleteRowDeleted BIT = CASE WHEN @MJDeleteRowExisted = 1 AND NOT EXISTS (SELECT 1 FROM ${sView} WHERE ${sWhere}) THEN 1 ELSE 0 END
+                    IF @MJDeleteRowDeleted = 1
+                    BEGIN
+                        DECLARE @ResultChangesTable TABLE (
+                            ${this.getAllEntityColumnsSQL(recordChangesEntityInfo)}
+                        )
+
+                        INSERT INTO @ResultChangesTable
+                        ${recordChangeSQL}
+                    END
+
+                    SELECT ${sKeyWhen('@MJDeleteRowDeleted')}`;
+                return { fullSQL: sSQL, simpleSQL: sSimpleSQL };
+            }
             sSQL = `
                     IF OBJECT_ID('tempdb..#ResultTable') IS NOT NULL
                         DROP TABLE #ResultTable
@@ -1526,7 +1732,7 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
                         )
 
                         INSERT INTO @ResultChangesTable
-                        ${this.GetLogRecordChangeSQL(null /*pass in null for new data for deleted records*/, oldData, entity.EntityInfo.Name, sCombinedPrimaryKey, entity.EntityInfo, 'Delete', user, true, entity.RestoreContext, entity.CloneContext)}
+                        ${recordChangeSQL}
                     END
 
                     SELECT ${sReturnList}`;
@@ -1549,10 +1755,22 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
     // WrapSaveCallWithRecordChange (see this file's "Save Grammar" section
     // above). See plans/sp-save-builder-generic-layer-refactor.md (rev 4).
     GenerateDeleteSQL(entity, user, options) {
-        const sqlDetails = this.getDeleteSQLWithDetails(entity, user, options?.SkipRecordChanges === true);
+        const params = new SaveParameterCollector();
+        const sqlDetails = this.getDeleteSQLWithDetails(entity, user, options?.SkipRecordChanges === true, params);
+        const fragment = this.toSaveFragment(entity, sqlDetails.fullSQL, params.Parameters, '');
+        let cachedSimpleSQL;
         return {
-            fullSQL: sqlDetails.fullSQL,
-            simpleSQL: sqlDetails.simpleSQL,
+            fullSQL: fragment.sql,
+            get simpleSQL() {
+                if (cachedSimpleSQL === undefined) {
+                    cachedSimpleSQL = RenderSaveSQL(sqlDetails.simpleSQL, params.Parameters, '');
+                }
+                return cachedSimpleSQL;
+            },
+            parameters: fragment.parameters ?? null,
+            get literalSQL() {
+                return fragment.literalSQL;
+            },
         };
     }
     OnSuspendRefresh() {
@@ -1677,6 +1895,7 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
         }
         // For transactional queries, use the instance queue to ensure serialization
         // This prevents EREQINPROG errors when multiple queries try to use the same transaction
+        this.initializeQueueProcessor();
         return new Promise((resolve, reject) => {
             this._sqlQueue$.next({
                 kind: 'query',
@@ -1719,7 +1938,7 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
      * @remarks
      * - Always creates a new Request object for each query to avoid "EREQINPROG" errors
      * - Handles both positional (?) and named (@param) parameter styles
-     * - Automatically uses active transaction if one exists, otherwise uses connection pool
+     * - Uses the ambient transaction when the caller is part of it (#4786), otherwise uses connection pool
      * - Handles SQL logging in parallel with query execution
      * - Provides automatic retry with pool connection if transaction fails
      *
@@ -1733,25 +1952,40 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
         if (connectionSource instanceof sql.Transaction) {
             transaction = connectionSource;
         }
-        else if (!connectionSource && !loggingOptions?.ignoreAmbientTransaction) {
+        else if (!connectionSource && !loggingOptions?.ignoreAmbientTransaction && this.IsCallerInAmbientTransaction()) {
+            // A caller outside the open transaction's scope runs on the pool as if none were open (#4786).
             this.AssertAmbientTransactionUsable();
             transaction = this._transaction;
         }
+        const shouldLogSql = !loggingOptions?.ignoreLogging && (this.HasActiveSqlLoggingSessions ||
+            Object.prototype.hasOwnProperty.call(this, '_logSqlStatement') ||
+            Object.getPrototypeOf(this) !== SQLServerDataProvider.prototype);
+        if (shouldLogSql && !this._boundLogSqlStatement) {
+            this._boundLogSqlStatement = this._logSqlStatement.bind(this);
+        }
+        if (!this._boundClearTransaction) {
+            this._boundClearTransaction = () => {
+                this._transaction = null;
+            };
+        }
         // Create the execution context
         const context = {
             pool: this._pool,
             transaction: transaction,
-            logSqlStatement: this._logSqlStatement.bind(this),
-            clearTransaction: () => {
-                this._transaction = null;
-            }
+            logSqlStatement: shouldLogSql ? this._boundLogSqlStatement : undefined,
+            clearTransaction: this._boundClearTransaction
         };
         // Convert logging options to internal format
         const options = loggingOptions ? {
             description: loggingOptions.description,
             ignoreLogging: loggingOptions.ignoreLogging,
             isMutation: loggingOptions.isMutation,
-            simpleSQLFallback: loggingOptions.simpleSQLFallback,
+            get simpleSQLFallback() {
+                return loggingOptions.simpleSQLFallback;
+            },
+            get literalSQL() {
+                return loggingOptions.literalSQL;
+            },
             contextUser: loggingOptions.contextUser,
             // A statement inside a transaction follows the transaction's limits (see ExecuteSQLOptions).
             timeoutMs: transaction ? undefined : loggingOptions.timeoutMs
@@ -1774,7 +2008,12 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
                 description: options?.description,
                 ignoreLogging: options?.ignoreLogging,
                 isMutation: options?.isMutation,
-                simpleSQLFallback: options?.simpleSQLFallback,
+                get simpleSQLFallback() {
+                    return options?.simpleSQLFallback;
+                },
+                get literalSQL() {
+                    return options?.literalSQL;
+                },
                 contextUser: contextUser,
                 ignoreAmbientTransaction: options?.ignoreAmbientTransaction,
                 timeoutMs: options?.timeoutMs,
@@ -1970,9 +2209,12 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
      */
     async ExecuteSQLBatch(queries, parameters, options, contextUser) {
         try {
-            // A read that does not join the ambient transaction cannot autocommit anything on the pool,
-            // which is what the doomed-transaction assert protects; skip it for that case (#4514).
-            if (!options?.ignoreAmbientTransaction) {
+            // A batch joins the ambient transaction only when the caller opted in (default) AND is in
+            // its scope (#4786) — a caller outside that scope runs on the pool as if none were open. A
+            // read that does not join it cannot autocommit anything on the pool, which is what the
+            // doomed-transaction assert protects; skip the assert for that case too (#4514).
+            const joinsAmbient = !options?.ignoreAmbientTransaction && this.IsCallerInAmbientTransaction();
+            if (joinsAmbient) {
                 this.AssertAmbientTransactionUsable();
             }
             // Build combined batch SQL and parameters (same as static method)
@@ -2022,7 +2264,7 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
             // Create execution context
             const context = {
                 pool: this._pool,
-                transaction: options?.ignoreAmbientTransaction ? null : this._transaction,
+                transaction: joinsAmbient ? this._transaction : null,
                 logSqlStatement: this._logSqlStatement.bind(this),
                 clearTransaction: () => {
                     this._transaction = null;
@@ -2078,8 +2320,19 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
         if (this._datetimeOffsetTestComplete) {
             return this._needsDatetimeOffsetAdjustment;
         }
-        // Run the test
-        await this.testDatetimeOffsetHandling();
+        // A recent probe failed: keep its safe default until the backoff passes, rather than re-probing
+        // (and logging the failure again) on every call while the database is unreachable.
+        const failedAt = SQLServerDataProvider._datetimeOffsetTestFailedAt;
+        if (failedAt !== null && Date.now() - failedAt < SQLServerDataProvider.DATETIMEOFFSET_PROBE_RETRY_MS) {
+            return this._needsDatetimeOffsetAdjustment;
+        }
+        // Deduplicate concurrent tests across per-request provider instances
+        if (!SQLServerDataProvider._datetimeOffsetTestPromise) {
+            SQLServerDataProvider._datetimeOffsetTestPromise = this.testDatetimeOffsetHandling().finally(() => {
+                SQLServerDataProvider._datetimeOffsetTestPromise = null;
+            });
+        }
+        await SQLServerDataProvider._datetimeOffsetTestPromise;
         return this._needsDatetimeOffsetAdjustment;
     }
     /**
@@ -2124,13 +2377,15 @@ export class SQLServerDataProvider extends GenericDatabaseProvider {
             }
             // Mark the test as complete
             this._datetimeOffsetTestComplete = true;
+            SQLServerDataProvider._datetimeOffsetTestFailedAt = null;
         }
         catch (e) {
             // If the test fails, log the error but don't prevent initialization
             console.error('SQLServerDataProvider: Failed to test datetimeoffset handling:', e);
-            // Default to assuming adjustment is needed for safety
+            // Default to assuming adjustment is needed for safety on this provider,
+            // but leave _datetimeOffsetTestComplete false so a call after the backoff retries.
             this._needsDatetimeOffsetAdjustment = true;
-            this._datetimeOffsetTestComplete = true;
+            SQLServerDataProvider._datetimeOffsetTestFailedAt = Date.now();
         }
     }
     /**
@@ -2207,12 +2462,12 @@ DECLARE ${varName} NVARCHAR(MAX) = (
 );
 IF ${varName} IS NOT NULL
     EXEC [${this.MJCoreSchemaName}].spCreateRecordChange_Internal
-        @EntityName='${safeEntityName}',
-        @RecordID='${recordID}',
+        @EntityName=N'${safeEntityName}',
+        @RecordID=N'${recordID}',
         @UserID='${safeUserId}',
         @Type='Update',
-        @ChangesJSON='${safeChangesJSON}',
-        @ChangesDescription='${safeChangesDesc}',
+        @ChangesJSON=N'${safeChangesJSON}',
+        @ChangesDescription=N'${safeChangesDesc}',
         @FullRecordJSON=${varName},
         @Status='Complete',
         @Comments=NULL${lineageClause};`;
@@ -2265,6 +2520,7 @@ IF ${varName} IS NOT NULL
      * that queued ambient queries behind it are rejected rather than run on the doomed handle.
      */
     enqueueTransactionAction(description, handle, run) {
+        this.initializeQueueProcessor();
         return new Promise((resolve, reject) => {
             this._sqlQueue$.next({ kind: 'action', description, handle, run, resolve, reject });
         });
@@ -2340,16 +2596,20 @@ IF ${varName} IS NOT NULL
     /**
      * Override RefreshIfNeeded to skip refresh when a transaction is active
      * This prevents conflicts between metadata refresh operations and active transactions
+     * @param providerToUse - passed through to the base implementation
+     * @param bypassMinCheckInterval - passed through; event-driven callers (a metadata change notice
+     *   from another server) set it so the check throttle cannot drop their check. Dropping the
+     *   arguments here used to discard it.
      * @returns Promise<boolean> - true if refresh was performed, false if skipped or no refresh needed
      */
-    async RefreshIfNeeded() {
+    async RefreshIfNeeded(providerToUse, bypassMinCheckInterval) {
         // Skip refresh if a transaction is active
         if (this.IsTransactionActive) {
             LogStatus('Skipping metadata refresh - transaction is active');
             return false;
         }
         // Call parent implementation if no transaction
-        return super.RefreshIfNeeded();
+        return super.RefreshIfNeeded(providerToUse, bypassMinCheckInterval);
     }
     get FileSystemProvider() {
         if (!this._fileSystemProvider)