v5.51.0: Security hardening, lazy-loading fixes, and reliability improvements

New Features

• Scoped anonymous elevation for realtime relayed tools (@memberjunction/server, @memberjunction/ai-agents): delegated agent runs, co-agent observability writes, and recording uploads now execute under the system user once magic-link session ownership is proven — gated on MagicLinkScope, excluding public web-widget guests, and failing closed when no system user is available. The session’s allowedAgents colleague union is CanRun-gated against the original caller before dispatch so elevation cannot widen agent authority, and delegated runs carry the visitor’s ID so run attribution and context-memory scope stay correct. Adds the IT68 scoped-anon-elevation deterministic integration bundle.
• Qwen 3.7 Flash added to the AI model inventory: Alibaba Cloud’s Flash/speed tier of the Qwen 3.7 family (released July 27, 2026) — 1M-token context, 65,536 max output, priced at $0.03/$0.13 per 1M tokens. Roughly 8× cheaper on input than Qwen 3.6 Flash. Available via Alibaba Cloud (developer + inference) and OpenRouter.
• Claude Opus 4.1 retirement note corrected: description rewritten with absolute retirement date (2026-08-05) and explicit condition for flipping IsActive.

Improvements

• Explorer lazy module registry hardened (@memberjunction/ng-explorer-core, @memberjunction/codegen-lib): chunks are now deduped by an explicit chunkId instead of loader source text, which previously collapsed all 18 chunks into one and stopped lazy-only registrations like FeaturePipelinesResource from ever loading. Lookups fall back to the subclass key alone so resolution survives build-mode renames of the base class. Failed chunk imports retry on the next navigation instead of caching the rejection for the rest of the session. Generated entries changed shape from a loader function to { chunkId, load }, and GetSnapshot().chunkCount was renamed loadedChunkCount — downstream apps must regenerate their lazy config after upgrading.
• BaseEngine cache fingerprint consistency (@memberjunction/core): extracted a shared BuildRunViewParamsForConfig method to ensure consistent RunViewParams across LoadSingleEntityConfig, LoadMultipleEntityConfigs, and RegisterCacheChangeCallbacks, fixing cross-server cache invalidation via Redis pub/sub that was silently broken by fingerprint mismatches.
• React CDN script load-order race eliminated (@memberjunction/react-runtime): library-loader now enforces sequential script loading, preventing intermittent failures when CDN scripts executed out of order.
• ChangeDetectorRef made optional in BaseResourceComponent (@memberjunction/ng-shared): prevents NG0201 injection errors in contexts where Angular’s change detector is not available.

Bug Fixes

• spDeleteAIPrompt and spDeleteAIConfiguration stored procedures regenerated: removed stale AIPromptRun.AgentRunID cascade references that caused delete failures — the column does not exist on AIPromptRun.
• Live-agent harness prompt-run linkage corrected (@memberjunction/integration-test-suite): three live-harness helpers were filtering MJ: AI Prompt Runs on AgentRunID (a column that does not exist). Prompt runs are now reached through MJ: AI Agent Run Steps rows whose TargetLogID points to the prompt run. Two named step-type sets encode the correct rule: PROMPT_RUN_BEARING_STEP_TYPES (Prompt + Compaction + Tool, for exhaustive deletion) and ROLLUP_BEARING_STEP_TYPES (Prompt + Compaction, for token reconciliation). deepDeleteRunTrees now resolves prompt runs before deleting steps. Teardown paths log instead of silently swallowing RunView errors.
• RS7 integration test threshold drift fixed: the test probed with a 2-character query while SearchEngine.MIN_TERM_LENGTH is now 2, making it no longer test the short-circuit it claimed to test. It now probes with a single character, below the threshold.