fix(attachments): use only qbit-object-storage's api package

Stop reading the bucket cap through StorageBucket.config() (the non-api
StorageBucketConfig, flagged by the qbit-bom guardrails, G1-arch).
Collaboration enforces its per-table cap; object storage still enforces
the bucket cap at put time. An api accessor is requested upstream.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,4 +6,35 @@ All notable changes are documented here, following [Keep a Changelog](https://ke
 
 ### Added
 
+- Phase-h links, share previews, recipient-safe notifications and SHARED followers; access requests with requester/admin locks, duplicate OPEN handling, optional permission-holder directory and streamed Mark granted/Decline outcomes.
+- Phase-i tasks with assignee validation, injectable-clock reminder/overdue receipts, complete/reopen/cancel, due-date cursor paging and streamed task actions.
+- Qbit owner/assignee services, configured Assign to/Take ownership bulk actions, My work summaries and mention read receipts.
+- Four audited tables, task-title search metadata, work/share home cards, committed parent-delete cleanup, PostgreSQL tables/indexes and a mention readAt migration.
+- Acceptance tests for security, notifications, request existence neutrality, actual streamed actions, reminders, summaries, cleanup and schema. Existing JaCoCo gates retained; UI API endpoints remain separate.
+
+- Phase-d tag vocabulary and record assignments on QQQ 4.1.0-RC.5; normalized names, FREE/APPROVED_ONLY policy resolved from system-read scoped feature settings, explicit global/manage permissions, parent-checked idempotent assignment, usage counts and TAGGED/UNTAGGED activity without follower notifications.
+- Tags navigation, secured Record Tags child list, FIELD audit, label search, approved/scoped table PVS, streamed Approve/Merge/Delete and configured host Add/Remove actions, parent cleanup and real Tags home metrics. Bulk multi-select intent is exposed in picker metadata for the separate Next UI implementation.
+- Standalone `TagFilterTranslator` for IN/CONTAINS_ALL/NOT_IN/IS_BLANK/IS_NOT_BLANK with a 10,000 matching-ID cap. Filter/quick-search integration lands after QRun-IO/qqq#1140 is released.
+- Tag service, security, vocabulary, settings, schema, cap and streamed Review/Result tests; existing JaCoCo gates retained.
+
+- Phase-e comments/mentions, one-level threads, edit revisions, author/admin soft deletion, resolve/reopen, ranked mention candidates and keyset pagination on QQQ 4.1.0-RC.5.
+- Comments, Comment History, Mentions, Followers, Activity and durable Follow Digests tables, child-list widgets, service-only writes, shared parent-table query restrictions, schema indexes and real home counts.
+- Lazy people-directory upserts with ten-minute throttling from comments/follow/favorites/recents/attachments entry points; bounded active-name/email search.
+- Configurable notifier and recipient-session stand-ins, default no-op and recording transports, conservative unknown-access handling and RC.5 after-commit delivery with fresh access checks.
+- Follow preferences, generic streamed ETL Follow/Unfollow actions, configured RC.5 change listeners and a hidden minute scheduler for five-minute digests.
+- Timeline merging enforced core audit reads with collaboration activity, field-visibility filtering and tuple cursors. Attachments now record FILE_ADDED/FILE_REMOVED activity.
+- Memory-backed tests for recipient access, transactions, moderation, pagination, real ETL Review/Result, digest batching, directory ranking, schema and audit timeline security. Existing JaCoCo gates retained; endpoint publication deferred to #1128.
+
+- Phase-c attachments against QQQ 4.1.0-RC.5 and object storage 0.1.0-RC.2: parent-checked upload/list/download/rename/describe/delete service, bounded streaming, SHA-256 and configurable byte/extension limits.
+- Visible `collaboration_attachment` table, FIELD auditing, file-name/description search fields, virtual presigned FILE_PREVIEW/FILE_DOWNLOAD adornments, PostgreSQL BIGINT size and parent index, and an approximate count/bytes home card.
+- Temporary `ParentRecordAccess`, readable-table query restriction through RC.5's permission hook and parent post-filtering. Panel calls do not require the admin browse grant; direct attachment table writes are service-managed.
+- Streamed ETL **Delete attachments** Review/Result record action and retryable `AttachmentCleanup.onParentsDeleted` callback. No Attach files table action; endpoint integration awaits #1128 and cleanup registration awaits core.
+- Memory-backed attachment/security/process tests. Thumbnails use FILE_PREVIEW; `thumbnailKey` remains nullable/unused because object storage has no generator.
+
 - Repository scaffold; feature settings and people tables.
+- Phase-b favorites and recents on QQQ 4.1.0-RC.5: visible `collaboration_favorite` and `collaboration_recent` tables, target-type possible values, unique personal targets and audit disabled for high-volume data.
+- `CollaborationSecurity` owner locks based on the session user's ID reference, with admin all-access keys and automatic initialization before enforced table actions and in services/home. No collaboration permission is required to manage one's own rows.
+- `FavoritesService` and `FavoriteEntry`: idempotent star/unstar, reorder/folders, refreshed labels, batched record visibility checks, unavailable-target redaction and Next UI paths.
+- `RecentsService`: persisted one-minute throttling, visible newest-first lists (up to 50), and hidden daily `collaborationTrimRecents` scheduling with configurable per-user retention (default 200).
+- Home row/distinct-user summaries, PostgreSQL 15+ unique indexes that treat null record IDs as equal, and memory-backend security/service/retention tests.
+- UI API endpoints (§10.2) deferred to a follow-up PR after QQQ's UI API extension point ([QRun-IO/qqq#1128](https://github.com/QRun-IO/qqq/pull/1128)) is released; no unreleased core classes are required.

README.md

@@ -1,6 +1,6 @@
 # QBit Collaboration
 
-Record collaboration for QQQ: attachments, tags, custom fields, comments with mentions, presence, sharing, favorites, follow, timeline and tasks. **Implemented now:** the phase-a repository scaffold, feature settings and people tables, and the Collaboration app home with real session-scoped counts. Feature services in phases b to i are planned; stored settings are not yet applied as runtime overrides and people are not yet populated automatically.
+Record collaboration for QQQ: attachments, tags, custom fields, comments with mentions, presence, sharing, favorites, follow, timeline and tasks. **Implemented now:** feature settings and people tables, favorites and recents services (phase b), per-user security, daily recents retention, phase-c attachments (upload/list/download/rename/delete, previews and parent cleanup), and the Collaboration app home with real session-scoped counts. Phase e adds comments/mentions, follow actions and digests, the audit/activity timeline, and automatic people-directory updates. Phase d adds tags, vocabulary policies, management and bulk actions, and standalone filter translation. Phases h/i add sharing/access requests, tasks/reminders, assignments and My work services. Phases f/g remain planned; general runtime overrides are still deferred. TAGS mode settings are read directly by the service.
 
 Design: [QRun-IO/qqq PR #1136](https://github.com/QRun-IO/qqq/pull/1136), `docs/COLLABORATION.md`. See [the phase table](docs/DESIGN.md).
 
@@ -8,8 +8,9 @@ Design: [QRun-IO/qqq PR #1136](https://github.com/QRun-IO/qqq/pull/1136), `docs/
 
 - Java 21.
 - QQQ 4.1.0-RC.5 or newer compatible 4.1 release. The build pins RC.5.
-- A configured QQQ backend supporting the table operations. PostgreSQL is the intended persistent store; tests use the memory backend.
-- Later phases and runtime overrides need the core contracts from the QQQ collaboration PRs. This scaffold uses string enum ids matching the spec until those contracts are released.
+- A configured QQQ backend supporting query, get, insert, update, delete, count and aggregate actions. PostgreSQL 15+ is the intended persistent store (the generated personal-target indexes use `NULLS NOT DISTINCT`); tests use the memory backend.
+- Attachments require `qbit-object-storage:0.1.0-RC.2` (a pinned dependency), installed with a PRIVATE bucket alias matching `attachmentsBucketName`. Configure its connection and credentials in the host; this qbit does not provision buckets.
+- Later phases and runtime overrides need the core contracts from the QQQ collaboration PRs. Favorites and recents use only APIs released in RC.5. String enum ids match the spec until the core collaboration enums are released.
 
 ## Install
 
@@ -44,39 +45,169 @@ Omit `withParentAppName` for a top-level app. Run normal QQQ instance validation
 |---|---|
 | `collaboration_feature_setting` (Feature Settings) | Scope type (INSTANCE, APP, TABLE), scope name, one of the 12 record features, enabled flag, settings JSON stored as TEXT, permission mode. Unique on scope type + scope name + feature; FIELD-level audit. |
 | `collaboration_user` (People) | Unique session user ID, display name, email, avatar URL, last seen timestamp and active flag. Service-managed, read-only to users. |
+| `collaboration_favorite` (Favorites) | `userId`, `targetType`, `targetName`, optional `recordId`, cached `label`, `sortOrder`, optional `folder`. Unique on user + type + name + record ID. Owner-locked, audit off. |
+| `collaboration_recent` (Recently Viewed) | `userId`, `targetType`, `targetName`, optional `recordId`, cached `label`, `lastViewedAt`, `viewCount`. Same unique key and owner lock; audit off. |
+| `collaboration_attachment` (Attachments) | Parent table and record ID, file metadata, SHA-256, bucket/key, optional description/thumbnail key, author and parent-deleted flag. FIELD audit; parent-based security. Preview/download URLs are virtual, never stored. |
 
-Both include `id`, `createDate` and `modifyDate`, identity/details/dates sections, and table possible-value sources. SQL table names match metadata table names; SQL columns use snake_case. Use a stable nonempty scope name (convention: `instance` for INSTANCE; the metadata app/table name otherwise). JSON validation and override resolution arrive with the provider, not in this scaffold.
+| `collaboration_comment` (Comments) | Markdown body, author, root/reply reference, optional field anchor, latest thread activity, edit/resolve/delete timestamps. FIELD audit and body search. |
+| `collaboration_comment_revision` (Comment History) | Prior body, edit timestamp and editor; comment child list. |
+| `collaboration_mention` (Mentions) | Unique comment + mentioned user, recipient visibility and actual delivery timestamp; comment child list. |
+| `collaboration_follow` (Followers) | Unique parent + user, reason, change/comment notification preferences and mute timestamp. Admin browse only; Followers child list on Comments. |
+| `collaboration_activity` (Activity) | Event time, actor, type, summary and reference. Read-only admin main table. |
+| `collaboration_share` (Shares) | Recipient, sender, message, access outcome and sent/opened times. Parent security and FIELD audit. |
+| `collaboration_access_request` (Access Requests) | Requester/admin visibility, optional share reference, OPEN/GRANTED/DECLINED/WITHDRAWN status and outcome fields. FIELD audit; no parent-data lookup. |
+| `collaboration_task` (Tasks) | Title, markdown notes, assignee, due/reminder/delivery times and completion fields. Parent security, FIELD audit and title search metadata. |
+| `collaboration_record_assignment` (Record Owners) | Unique parent reference with owner/assignee. Admin-only nav with HIDDEN denial, parent security and FIELD audit. |
+| `collaboration_follow_digest` (Follow Digests) | Service-managed pending five-minute batches, unique parent + recipient, due timestamp and changed-field summaries. Admin browse only, outside navigation. |
 
-The home reports persisted enabled settings by scope type, people known and people seen within the inclusive last seven days. Recent activity is based on `lastSeenAt`, independently of the directory's `active` account flag. Empty states explain missing data. These counts do not represent resolved feature enablement on host tables.
+All tables include `id`, `createDate` and `modifyDate`, identity/details/dates sections, and table possible-value sources. SQL table names match metadata table names; SQL columns use snake_case. Use a stable nonempty scope name (convention: `instance` for INSTANCE; the metadata app/table name otherwise). JSON validation and override resolution arrive with the provider, not in this scaffold.
+
+The home reports persisted enabled settings by scope type, people known and people seen within the inclusive last seven days, plus Favorites and Recently viewed row counts and distinct user counts, attachment count and total bytes, comments in the last seven days, open root threads, and follower subscriptions (admins). Attachment aggregates are explicitly approximate until core can mirror parent locks. Recent activity is based on `lastSeenAt`, independently of the directory's `active` account flag. Empty states explain missing data. These counts do not represent resolved feature enablement on host tables.
 
 ## Permissions
 
 | Permission | Behavior |
 |---|---|
-| `collaboration.view` | Read both tables, the app and home. |
-| `collaboration.admin` | Write feature settings; also grants read access. Does not permit direct People writes. |
+| `collaboration.view` | Browse Comments, their revisions/mentions and Attachments; read Feature Settings, People, the app and home. Not required for personal favorites or recents. |
+| `collaboration.admin` | Write feature settings, read the app/home, access all users' favorite/recent rows, and run recents retention. Can moderate others' attachments and delete others' comments after the parent check. Browses Followers, Activity and Follow Digests. Does not permit editing another author's comment or bypassing service-only table writes. |
 | `collaboration.fields.manage` | Reserved constant for the later custom-field designer. |
 | `collaboration.tags.manage` | Reserved constant for later tag management. |
 
-These use the reference qbit's custom `QPermissionRules` checker. Extra permissions are constants, not automatically registered catalog entries. Configure permission grants in your host. Home count actions explicitly enforce permissions and honor record security locks. Hosts should enable `qInstance.setEnforcePermissionsInCoreActions(true)` for direct model API calls as well as middleware checks.
+These use the reference qbit's custom `QPermissionRules` checker. Extra permissions are constants, not automatically registered catalog entries. Configure permission grants in your host. Home count actions explicitly enforce permissions; attachment totals have the parent-lock approximation described below. Hosts should enable `qInstance.setEnforcePermissionsInCoreActions(true)` for direct model API calls as well as middleware checks.
+
+Personal tables use `PermissionLevel.NOT_PROTECTED` with a `READ_AND_WRITE` owner lock on `userId`. Every signed-in user can manage their own rows. `CollaborationSecurity` derives `collaboration_user` from `QSession.getUser().getIdReference()` and gives `collaboration_user_all_access` to admins. Its custom permission checker initializes keys before enforced table actions; services and the home also call `ensureSessionKeys`. Hosts may call `applyToSession(qInstance, session)` after authentication. Refreshing keys also removes revoked admin access. System sessions are untouched; create scheduler system sessions after the full instance is registered so QQQ includes the all-access key.
+
+Favorites and recents are omitted from app nav sections. They remain normal, addressable QQQ tables, including for admin inspection. The header and palette will use the services through the follow-up API. These two personal tables intentionally skip audit logging. Personal service methods explicitly filter the current owner even when called by an admin; they never elevate the session. Use standard table actions for admin-wide management.
+
+## Favorites and recents services
+
+Call these static methods inside the caller's `QContext`:
+
+```java
+FavoritesService.star("RECORD", "order", "123");
+FavoritesService.star("TABLE", "order", null);
+List<FavoriteEntry> favorites = FavoritesService.list();
+FavoritesService.reorder(List.of(12, 8), Map.of(12, "Work"));
+FavoritesService.unstar("RECORD", "order", "123");
+
+RecentsService.recordView("RECORD", "order", "123");
+List<FavoriteEntry> recents = RecentsService.list(50);
+```
+
+`FavoritesService` and `FavoriteEntry` are in `com.kingsrook.qbits.collaboration.favorites`; `RecentsService` is in `com.kingsrook.qbits.collaboration.recents`. Target types are `TABLE`, `APP`, `RECORD`, `PROCESS`, `REPORT` and `SAVED_VIEW`. Only `RECORD` accepts a non-null record ID. For `SAVED_VIEW`, `targetName` is the saved view ID; the instance must contain a readable core `savedView` table and the view's target table must also be readable.
+
+- Star and unstar are idempotent. New stars append to the existing sort order. Reorder moves the supplied IDs first and preserves the order of omitted favorites; folder entries may be null to clear a folder. All supplied IDs must belong to the current user.
+- Targets are checked using core table/app/process/report permissions; record targets use `GetAction` and the session's record locks. Invisible and missing targets both fail with `Not found`.
+- Lists refresh labels, using one batched record query per target table per batch. Favorites retain unavailable entries as `available=false`, `label="Unavailable"`, `href=null`; the cached label is never returned. Unstar remains possible after access is lost. Recents drop unavailable entries and refill from older rows up to the requested limit (1–50).
+- `FavoriteEntry` contains `id`, `targetType`, `targetName`, `recordId`, `label`, `folder`, `sortOrder`, `available` and `href`. Recents use the same target DTO in newest-first order; their folder and sort order are null. `viewCount` and `lastViewedAt` remain available on the underlying recent table.
+- Hrefs mirror Next's accepted flat routes: `/app/<table>/`, `/app/<table>/<id>/`, `/app/<app-or-process-or-report>/`, and `/app/<table>/savedView/<id>/`. Segments are URL-encoded. This avoids reconstructing nested app paths; trailing slashes support dotted process names.
+- Record views upsert a unique personal target. If its persisted `lastViewedAt` is less than 60 seconds ago, nothing is written; otherwise its timestamp, cached label and count update. The hidden backend-only `collaborationTrimRecents` process retains the newest `recentsPerUser` targets independently for each user, breaking timestamp ties by ID.
+
+The UI API endpoints in spec §10.2 will arrive in a **follow-up PR once QQQ's UI API extension point ([QRun-IO/qqq#1128](https://github.com/QRun-IO/qqq/pull/1128)) is released**. This PR adds no endpoint or unreleased core dependency. Runtime feature overrides and the record-feature summary SPI also await released core contracts; the home counts are implemented now.
+
+## Attachments
+
+Call the service inside the caller's `QContext`; configure object storage before using it:
+
+```java
+AttachmentsService attachments = new AttachmentsService();
+AttachmentEntry added = attachments.upload("order", "123", "invoice.pdf", "application/pdf", stream, "Signed invoice");
+List<AttachmentEntry> files = attachments.list("order", "123");
+URL download = attachments.downloadUrl(added.id(), false);
+attachments.rename(added.id(), "invoice-final.pdf", null); // null leaves a field unchanged
+attachments.describe(added.id(), "");                    // empty clears the description
+attachments.delete(List.of(added.id()));
+```
+
+Uploads check the parent and `attach`, count bytes and compute SHA-256 while streaming to a temporary file, then stream that file through object storage. This keeps memory bounded and rejects oversize files before a put. Temporary files are removed on success and failure; the caller owns the input stream. A failed row insert triggers object cleanup. Storage and SQL are not a distributed transaction: a cleanup failure is attached to the original error and requires operational reconciliation. Deletion removes the object first and retains the row on a storage failure for retry.
+
+File names are reduced to a safe basename (maximum 255 characters). Object keys are `attachments/{table}/{recordId}/{uuid}/{fileName}`; table/id segments are URL-encoded to protect string primary keys containing slashes. Renames change the display name and subsequent download filename, retaining the original storage key. `AttachmentEntry` returns display metadata, creation time and `canDelete` (author or admin); it omits bucket/key and signed URLs. Lists are newest first. Changing or deleting an own row also rechecks `attach`; admins may moderate another author's row but must still see its parent. A batch authorizes all selected rows before deleting its first object.
+
+**Permission model.** The panel service checks the parent with an enforced `GetAction` under the caller's session. Missing, unreadable and locked parents produce `QNotFoundException("Not found")`. Upload requires `<permissionBaseName>.attach` or table EDIT plus a visible parent. This is the explicitly temporary approximation of write-lock checks; distinct WRITE-only parent locks are not enforced until core's record-reference helper is released. Explicit `attach` grants work without EDIT. Collaboration tables cannot themselves be parents.
+
+The admin Attachments table additionally requires `collaboration.view` (or `collaboration.admin`). The panel service bypasses that browse grant only after its own parent/feature/ownership checks. Direct table insert/update/delete is denied; use the service and record action so storage and rows remain coordinated. Storage operations use `ObjectStorage.asSystem("collaboration", runId).bucket(alias)` after these checks, preserving calling-qbit/initiating-user operation logging without requiring users to hold `object_storage.*` grants.
+
+RC.5 has no PRE_QUERY customizer. `AttachmentSecurity` uses its custom permission checker as the pre-query hook, adding `tableName IN (readable parent tables)` to queries, counts and aggregates. Enable core permission enforcement for direct model API use. A POST_QUERY customizer checks each row's parent and removes invisible rows before signing any URLs. This applies to direct get/query as well as browsing. **Counts and aggregate bytes are approximate, and pages may be short** because parent record locks are checked after querying; the home labels the approximation. RC.5 cannot publish an `approximate` flag or refill pages through this hook. Replace this stand-in with core's record-reference security when released. Per-table feature enablement/settings and permission catalog integration also await those contracts.
+
+**Preview and download.** The record view has `FILE_PREVIEW` and `FILE_DOWNLOAD` virtual fields, filled with five-minute presigned GETs only for visible rows (up to 200 rows per query). Downloads use RC.2's `PresignGet.downloadAs(fileName)`. RC.2 has no arbitrary response-header override for explicit inline disposition, so uploads store `Content-Disposition: inline`, and previews leave that header unchanged. URLs are never persisted. Images/PDF use the standard media preview; the host must allow its storage host in the frontend CSP (PDF frames need compatible `frame-src`). `thumbnailKey` is nullable and unused: object storage has no thumbnail generator, so thumbnails use FILE_PREVIEW rather than generated thumbnail files.
+
+**Actions and cleanup.** `Delete attachments` is a standard streamed ETL record action with Review/Result counts, skipped unauthorized rows, permission rechecks at execution and per-row failure summaries. It is not in navigation. Soft deletion follows the bucket's versioning/trash; without either, deletion is permanent. There is deliberately no **Attach files** table action: uploads come through the API/panel. The current browse action requires `collaboration.view`; the panel may call the service without that grant.
+
+After a parent deletion commits, trusted host code can call `new AttachmentCleanup().onParentsDeleted(table, ids)`. It deletes objects and rows in batches and is retryable. It cannot check an already-deleted parent and must never be exposed as a user endpoint. Wiring to core's `RecordReferenceCleanupInterface` waits for its release. UI API endpoints and the panel transport wait for [#1128](https://github.com/QRun-IO/qqq/pull/1128); direct/presigned upload endpoints and realtime events remain future integrations. Upload/delete now write FILE_ADDED/FILE_REMOVED activity. The table declares `fileName`/`description` search fields and uses normal QQQ writes, so host-configured record-change/ESB listeners receive events; this qbit does not install an ESB publication or Quick Search provider.
+
+Tests use real QQQ memory actions and record locks plus an in-memory `AttachmentStorage` adapter. Object storage RC.2 exposes no fake bucket; its provider conformance suite uses MinIO/Testcontainers. This suite requires no Docker and does not claim MinIO/S3 conformance.
+
+## Comments, follow and timeline
+
+Run services in the caller's `QContext`. Register host tables before producing the qbit when using the follow configuration lists:
+
+```java
+config.withNotifier(new QCodeReference(MyCollaborationNotifier.class))
+   .withUserSessionSupplier(new QCodeReference(MyUserSessions.class))
+   .withFollowActionTables(List.of("order"))
+   .withFollowChangeTables(List.of("order"))
+   .withSchedulerName("scheduler");
+
+CommentsService comments = new CommentsService();
+CommentEntry root = comments.post("order", "123", "Please review @[Sam](user:sam)", null, null);
+CommentEntry reply = comments.post("order", "123", "Reply", root.id(), null);
+CommentPage page = comments.list("order", "123", null, 20);
+comments.edit(reply.id(), "Updated reply");
+comments.history(reply.id());
+comments.resolve(root.id());
+comments.reopen(root.id());
+comments.delete(reply.id());
+comments.mentionCandidates("order", "123", "Sam");
+
+FollowService follow = new FollowService();
+follow.follow("order", "123", null, null);
+follow.state("order", "123");
+follow.followers("order", "123");
+follow.unfollow("order", "123");
+TimelinePage timeline = new TimelineService().timeline("order", "123", null, 20, Set.of());
+```
+
+Classes live in the `comments`, `follow`, `timeline`, `people` and `notify` packages under `com.kingsrook.qbits.collaboration`.
+
+- Comments require visible parents and the `comment` feature check (explicit `<table>.comment` or table EDIT). Markdown is nonblank and at most 20,000 characters; clients must sanitize rendered HTML. Replies to replies attach to the root. Roots have null `threadId`; replies store the root ID in both thread/parent fields. Deleted DTO bodies are null. Authors alone edit; authors with comment permission or admins delete. Resolve/reopen applies only to roots. History follows parent READ.
+- Mentions use `@[Name](user:<userId>)`, deduplicate IDs and reject more than 50. `OtherUserAccess.canRead` returns `Optional<Boolean>` using a supplied recipient session and an enforced GetAction in a temporary context. Missing providers/sessions and mismatched identities are unknown. False/unknown recipients get neither record data nor automatic follows. Edits notify only previously unmentioned users. Mention delivery and ordinary follower delivery are deduplicated; authors never receive their own comment notifications.
+- `CommentEntry` includes author display name, capabilities, deleted/resolved state, mentions with visibility, and ordered replies. `CommentPage` pages 1–50 root threads by latest activity then ID, with replies oldest first. Pass `nextCursor` unchanged. Cursors are opaque, versioned Base64 tuple encodings, not authorization tokens.
+- Manual/assigned follow creation defaults change notifications on; other reasons default them off. Comment notifications default on. Existing preferences survive automatic follows and repeated calls; non-null arguments to `follow` change preferences. Follow needs only parent READ. The internal `ensureFollower` helper also verifies other-user access. Muted subscriptions are skipped until `mutedUntil` expires.
+- `FollowProcesses.processesFor(tableName)` returns the same Follow/Unfollow processes for manual host registration. Review performs no writes; Result rechecks permissions and reports successes/failures. They work with the host's actual primary-key field, not just `id`, and are never navigation entries.
+- RC.5 has `RecordChangeListenerInterface` and `QBackendTransaction.addAfterCommitCallback`. The configured UPDATE listener queues changed-field summaries after commit, excluding the actor's own subscription. The trusted `FollowChangeBatcher.recordChange` helper may also be called by host code after its write commits. `collaborationSendFollowDigests` runs every minute and sends batches due five minutes after their first change, rechecking preferences, mute and recipient access. Pending data survives process restarts. Run one digest scheduler per installation; local synchronization is not a distributed lock. A transport crash after delivery but before row deletion can cause a retry; an adapter needing exactly-once delivery must provide idempotency.
+- Notifications carry recipient ID, title, markdown body, MENTION/SHARE/FOLLOW/TASK category, source table/record and `/app/<table>/<id>` href. Without a transport, `NoOpNotifier` sends nothing and activity remains available. With a `QContext` transaction, delivery waits for commit and is discarded on rollback; otherwise it follows the write immediately. Access is checked again at delivery. Mention `notifiedAt` is recorded only after a real transport returns successfully. `RecordingNotifier` provides an in-memory test sink.
+- Timeline merges collaboration activity and RC.5 `audit`/`auditDetail`/`auditTable`/`auditUser` through enforced QueryActions. Missing or denied audit access omits that stream. Audit details exclude fields absent from the caller's personalized table. Core audits have actor names but no session user IDs, so their `actorUserId` is null. Paging uses `(at, kind, id)`; `types` accepts AUDIT, ACTIVITY or individual activity type names. Each source query is bounded before merging.
+- `PeopleService.touch()` upserts the signed-in user's full name and last-seen timestamp at most once per ten minutes, using the persisted timestamp. Comments/follow and existing favorites/recents/attachment entry points call it. `search(q, limit)` matches active users' names/emails case-insensitively. QUser in RC.5 has no email/avatar fields; trusted directory integrations can enrich those columns. Mention candidates rank followers/commenters before applying the 50-result limit.
+
+The main comments/activity tables, revision/mention child joins and Followers child list are ordinary QQQ metadata. Direct API writes are refused; services authorize the actual parent. Shared `ParentTableRestriction` protects attachment and conversation queries/counts/aggregates; parent post-filtering protects row reads. Aggregate counts remain approximate and browse pages can be short for unmirrored parent locks. Raw persistence, activity writing and change-hook helpers are trusted internal boundaries and must not become public endpoints.
+
+UI API endpoints remain deferred to [QRun-IO/qqq#1128](https://github.com/QRun-IO/qqq/pull/1128). Runtime feature enablement, mirrored WRITE locks and core record-access/session contracts remain replacement points; the services do not claim to resolve feature-setting overrides. QAlerts.notify integration waits for #1125. Host-configured ESB listeners receive ordinary QQQ writes; realtime/UI and Quick Search provider registration remain host/later-phase integrations.
 
 ## Configuration
 
 | Property | Default | Meaning |
 |---|---|---|
-| `backendName` | Required | Existing QQQ backend used by both tables. |
-| `schedulerName` | None | Reserved for scheduled work in later phases; unused now. |
+| `backendName` | Required | Existing QQQ backend used by all eleven tables. |
+| `schedulerName` | None | Existing scheduler for daily recents trimming and minute-by-minute follow digest delivery. Without it, both hidden processes remain available for explicit admin/system execution. |
+| `attachmentsBucketName` | `collaboration` | PRIVATE object-storage bucket alias for new uploads; existing rows retain their bucket alias. |
+| `defaultMaxBytes` | `104857600` (100 MiB) | Positive byte limit, capped by the bucket's `maxUploadBytes`. |
+| `blockedExtensions` | Empty | Case-insensitive extension denylist, with or without leading dots. |
+| `recentsPerUser` | `200` | Positive retention count per user. Enforced by the trim process. |
+| `notifier` | `QCodeReference(NoOpNotifier.class)` | Implements `CollaborationNotifier`; replace with a QAlerts.notify adapter when QRun-IO/qqq#1125 is released. |
+| `userSessionSupplier` | None | `QCodeReference` implementing `UserSessionSupplier`; missing user sessions mean unknown access. |
+| `followActionTables` | Empty | Existing host tables to receive standard Follow and Unfollow Review/Result processes. |
+| `followChangeTables` | Empty | Existing host tables whose UPDATE events should produce five-minute follow digests. |
 | `appName` | `collaboration` | Metadata name of the app. |
 | `parentAppName` | None | Optional existing parent, such as `admin`. |
-| `adminApp` | `true` | Set false for tables without the app and widget. |
+| `adminApp` | `true` | Set false to omit the app/home. Record child-list widgets remain available. |
 
 ## Adopting in another app
 
 1. Register the host backend and optional Admin app, then invoke the producer above.
 2. For PostgreSQL, generate `CollaborationSchema.postgresScript(config)` and apply it with the host's migration tool. It creates tables and unique indexes, never executes DDL, and does not migrate existing schemas. QQQ owns date/default values on writes.
 3. Grant `collaboration.view` and `collaboration.admin` as appropriate; wire the host's audit persistence for FIELD audit events.
-4. Validate the assembled instance. Navigate to Collaboration for Feature Settings and People. Expect empty tables until settings or trusted directory integrations provide rows.
-5. Wait for the released core contracts and later qbit phases before enabling collaboration features on host records. This phase installs no endpoints, scheduler jobs or host-table overlays.
+4. Validate the assembled instance. Navigate to Collaboration for Comments, Attachments, Activity (admins), Feature Settings and People. People populate as signed-in users call collaboration services.
+5. Wait for the released core contracts and later qbit phases before enabling collaboration features on host records. Favorites, recents, attachments, comments, follow and timeline services can be used now. This phase installs no endpoints or host-table overlays; scheduled work is opt-in.
 
 ## Build
 
@@ -91,3 +222,170 @@ Offline verification: `./mvnw -o -q verify` (Windows: `./mvnw.cmd -o -q verify`)
 ## License
 
 [Apache License 2.0](LICENSE). Copyright 2026 Kingsrook, LLC; see [NOTICE](NOTICE).
+
+## Tags
+
+Phase d builds against **QQQ 4.1.0-RC.5**. Register host actions with
+`config.withTagActionTables(List.of("order"))`; `withDefaultTagMode("FREE")` is the
+default. Set `collaboration_feature_setting.feature = TAGS` and JSON
+`{"mode":"APPROVED_ONLY"}` to require approval. The service reads settings as the
+system, in TABLE → preferred APP → INSTANCE order, falling back to config. The
+first scope containing `mode` wins; `enabled` remains part of future general
+feature resolution. Invalid policy JSON or mode fails closed.
+
+`TagsService` provides:
+
+- `vocabulary(table, query, limit)`: global and table vocabulary, approved tags plus
+  the caller's pending suggestions, excluding merged aliases; usage descending,
+  then label. Default limit 20, maximum 100.
+- `create(tableOrNull, label, color)`: trimmed, lowercase, collapsed name of 1–60
+  characters; the label retains its case. Duplicate names reuse the existing tag.
+  Per-table creation requires `<table>.tag` or table EDIT and READ. FREE creates
+  approved tags; APPROVED_ONLY creates suggestions unless the caller holds
+  `collaboration.tags.manage`. Global creation always requires that manage grant.
+- `tagsFor(table, recordId)` and `apply(table, recordId, add, remove)`: parent READ
+  and record locks are checked first. Writes also require the tag feature grant or
+  EDIT. Numeric values are tag IDs; strings are labels. Unknown add labels are
+  created in FREE; in APPROVED_ONLY they fail with
+  “Pick an approved tag (or suggest one)”. Pending tags cannot be applied by anyone.
+  Repeated changes are idempotent; actual changes write TAGGED/UNTAGGED activity,
+  recount usage, and do not notify followers.
+
+Tags is a main navigation table with FIELD auditing and native label search.
+Record Tags is a secured child list. Both use service-managed writes. Standard
+streamed **Approve tags**, **Merge tags**, and **Delete tags** actions require
+`collaboration.tags.manage`; Delete Review counts distinct affected parents.
+Merge deduplicates references and retains the source as an alias. Targets must be
+approved and in the source scope or global; a global source cannot merge into a
+single table's vocabulary.
+
+Host **Add tags** and **Remove tags** actions use the table-type
+`collaboration_tag` PVS, filtered to approved, unmerged global or same-table tags.
+Each record is rechecked during Review and execution. Input `tags` is a list of
+integer IDs (comma-separated IDs are also accepted); `targetTagId` is a scalar.
+The picker step exposes `EDIT_FORM` with `multiSelectFields = ["tags"]`. RC.5 has
+no native multi-valued field type: rendering this component-value contract as a
+multi-select belongs to the separate Next UI phase. The qbit tests exercise the
+submitted arrays and real streamed Review/Result lifecycle.
+
+`AttachmentCleanup.onParentsDeleted` now also removes tag assignments and
+recounts vocabulary usage. Hosts keep using this trusted callback until the core
+cleanup registration contract ships. The home shows session-visible vocabulary
+size, pending suggestions, and the five most-used approved tags.
+
+`TagFilterTranslator.recordIds(table, operatorName, tags)` supports `IN` (any),
+`CONTAINS_ALL`, `NOT_IN` (none), `IS_BLANK`, and `IS_NOT_BLANK`. Every operator
+returns matching visible parent IDs as strings, including complements. Exactly
+10,000 results are allowed; larger results throw. Unknown tags match nothing;
+empty IN matches nothing and empty CONTAINS_ALL/NOT_IN match all visible parents.
+Numeric inputs are IDs, strings are normalized names; if a global and local tag
+share a name, the global tag wins (use IDs to disambiguate).
+
+**Filter/quick-search integration lands after QRun-IO/qqq#1140 is released.** This
+phase does not register a virtual filter field, core expander, `QSubQuery`, tag
+column filler, or `#tag`/host-record quick-search provider. The standalone
+translator deliberately imports none of those unreleased types.
+
+## Sharing and work services (phases h/i)
+
+Services run in the caller's `QContext`. UI API endpoints and screens follow in a separate PR.
+
+```java
+SharingService sharing = new SharingService();
+sharing.link("order", "123"); // Link(url, label)
+sharing.preview("order", "123", List.of("sam")); // canRead: true, false or null (unknown)
+sharing.share("order", "123", List.of("sam"), "Please review");
+sharing.markOpened(shareId); // recipient only
+
+AccessRequestService access = new AccessRequestService();
+access.request("order", "123", "Please grant access", shareId); // optional shareId
+access.withdraw(requestId);
+
+TasksService tasks = new TasksService();
+QRecord task = tasks.create("order", "123", "Review order", "Markdown notes", "sam", dueAt, null);
+tasks.complete(task.getValueInteger("id"));
+tasks.reopen(task.getValueInteger("id"));
+tasks.cancel(task.getValueInteger("id"));
+tasks.list("order", "123", false);
+tasks.mine("OPEN", 20, null); // Page(tasks, nextCursor)
+
+AssignmentService assignments = new AssignmentService();
+assignments.assign("order", "123", "owner", "sam");
+assignments.get("order", "123");
+assignments.myRecords(null, 20); // owner OR assignee; per-table count and first 20
+new MyWorkService().summary();
+new MyWorkService().markMentionsRead(null); // all visible unread mentions; or supply IDs
+```
+
+Set `frontendBaseUrl` for absolute record links; omission produces
+`/app/{encodedTable}/{encodedId}`. Sharing and notifications reuse `TargetResolver.recordHref`.
+This is trusted host configuration. Sharing requires parent READ and `<table>.share` or EDIT,
+1-25 recipients (deduplicated), and a message of at most 2,000 characters. Readers get the
+record label/message/link and SHARED following. False/unknown recipients get only sender name,
+table label and an access-request link. The sender's message is omitted because it may contain
+record data. The prefill route for the follow-up UI is:
+
+`/app/collaboration_access_request/create?tableName={encodedTable}&recordId={encodedId}&shareId={id}`
+
+The UI consumes these parameters and calls `request`; a supplied share ID must match its
+recipient and parent reference. Sharing never grants access. Parent-data notifications recheck
+recipient access at delivery, after commit. Access notices contain no parent data and can reach
+nonreaders.
+
+Any signed-in user may request access, without a parent read or existence check. Existing and
+nonexistent targets return the same request shape and OPEN status; generated IDs/timestamps
+and submitted targets naturally differ. Duplicate OPEN requests return the existing row.
+A PostgreSQL partial unique index protects that natural key across instances. Ordinary table
+reads are requester/admin only; all direct writes are denied. Approver actions use an explicitly
+authorized extractor without widening ordinary table visibility.
+
+Set TABLE-scope SHARING `settings` to `{"accessApproverPermission":"order.approve"}` (default:
+`collaboration.admin`). Configure `.withPermissionHolderDirectory(new QCodeReference(MyDirectory.class))`;
+`sharing.PermissionHolderDirectory.userIdsWithPermission(permission)` returns stable user IDs.
+Recipients are the union of admin holders, configured approver holders and the qbit record owner.
+Without a directory, only the owner is notified and a warning is logged once per JVM. Mark granted
+and Decline accept an optional note and tell the requester the outcome. Review explicitly says
+"Record the outcome; grant access in your identity system first." No permission is changed.
+Notifications omit free-form messages and notes.
+
+Task create requires `task`. Changes additionally require creator, assignee or admin authority,
+while retaining parent visibility and task permission checks. Titles contain 1-200 characters;
+notes are markdown TEXT. An omitted create assignee defaults to self. Other assignees need a
+positive read check; false/unknown is refused with "Sam can't open this record." The full-field
+`update(id, title, notes, assignee, due, remind)` replaces editable fields: null clears an assignee
+or due time; null remind computes the default from due. The reminder defaults to due minus one
+day, or due itself when less than a day away. Assignments add ASSIGNED following and notify the
+new assignee unless self. Creation/completion writes activity and queues notify-on-change follower
+digests. Reopen clears completion fields but retains delivery history; changing due/reminder time
+or assignee resets the relevant delivery receipt.
+
+The hidden `collaborationSendTaskReminders` process runs every 60 seconds with `schedulerName`.
+It requires an admin/system session and no open transaction. `TaskReminders(Clock)` and
+`TasksService(Clock)` allow deterministic time. Separate timestamps track successful reminder
+and overdue delivery; revoked/unknown access and the no-op notifier do not mark delivery.
+Run one scheduler per installation. A crash between delivery and receipt can cause a retry;
+stronger guarantees require transport idempotency, as with follow digests.
+
+Configure `assignActionTables` for streamed Assign to and Take ownership actions. Assign needs
+`<table>.assign` or EDIT and verifies both roles can read (self passes after the parent check).
+`assign` replaces both roles, with null clearing a role; bulk actions preserve the other role.
+For host tables with their own owner/assignee columns, use core `RecordOwnership` metadata and
+normal host-table updates instead. Do not use the qbit assignment table or configure these bulk
+actions for such tables. Core phase-i virtual fields, CurrentUser and filter integration remain
+separate work; RC.5 does not provide that contract.
+
+My work returns the exact visible open-task count and first ten, assigned-record counts per
+table, and delivered unread mentions. Personal lists/counts recheck each parent. This portable
+RC.5 implementation materializes matching candidates for null-last sorting/counting; large
+installations should replace it with core mirrored-lock queries when available. Task cursors
+encode `(dueAt, id)` and limits are 1-100. My records limits returned rows per table, counting all
+visible matches.
+
+The home adds open access requests, open/overdue tasks and shares in the last seven days.
+Task/share aggregate counts retain the existing approximation for parent record locks until
+core mirrors them. `WorkCleanup` is registered for committed host deletes: it removes tasks,
+assignments and shares, retaining access requests. Attachment cleanup also invokes the
+idempotent hook. Schema generation includes the four tables, supporting indexes and
+`ALTER TABLE collaboration_mention ADD COLUMN IF NOT EXISTS read_at TIMESTAMPTZ` for upgrades.
+Hosts apply generated SQL through their migration tooling; ESB/search publication uses the same
+host integrations as other collaboration tables.

docs/DESIGN.md

@@ -2,11 +2,11 @@
 
 The authoritative design is [QRun-IO/qqq PR #1136](https://github.com/QRun-IO/qqq/pull/1136), `docs/COLLABORATION.md` ([develop document](https://github.com/QRun-IO/qqq/blob/develop/docs/COLLABORATION.md)).
 
-Collaboration adds metadata-driven record features to QQQ: attachments, tags, custom fields, comments and mentions, presence, sharing, favorites, follow, timeline, recents, tasks and assignment. Core owns security, query and runtime metadata contracts; this qbit owns visible `collaboration_*` tables and feature services. This scaffold implements the phase-a configuration, feature settings and people tables, and a home with real counts. The override provider awaits released core contracts; phases b to i remain planned. The table below is the full roadmap from the specification, not a list of shipped functionality.
+Collaboration adds metadata-driven record features to QQQ: attachments, tags, custom fields, comments and mentions, presence, sharing, favorites, follow, timeline, recents, tasks and assignment. Core owns security, query and runtime metadata contracts; this qbit owns visible `collaboration_*` tables and feature services. Implemented: phase-a configuration, feature settings and people tables, plus phase-b favorites/recents tables, services, owner locks, retention and home counts against QQQ 4.1.0-RC.5. The phase-b UI API endpoints await the released extension point from QRun-IO/qqq#1128. The override and record-feature summary providers await released core contracts; phase-c attachments are implemented on object storage 0.1.0-RC.2; phase e comments/follow/timeline is implemented against released RC.5; phase d tags and phases h/i sharing, tasks and ownership services are implemented. Phases f/g and endpoint publication remain separate work. The table below is the full roadmap from the specification, not a list of shipped functionality.
 
 | Phase | Core | Qbit | Next UI |
 |---|---|---|---|
-| a. Contracts | `RecordFeaturesMetaData` + resolver + frontend publication; `RecordReference`, `RecordReferenceTableMetaData` and the security rules of §3.2 (table filter, mirrored locks, parent check, post-filter, cleanup hook); feature permissions in the catalog; `RecordFeatureSummaryProviderInterface` and `GET /table/{t}/{pk}/features`; `RuntimeMetaDataProviderInterface` and overlay (generation only, no fields yet); `RecordAccessCheckerInterface`, `UserSessionProviderInterface` | repo scaffold, qbit config, `collaboration_feature_setting`, `collaboration_user`, override provider, home skeleton | types for `RecordFeaturesV1` |
+| a. Contracts | `RecordFeaturesMetaData` + resolver + frontend publication; `RecordReference`, `RecordReferenceTableMetaData` and the security rules of §3.2 (table filter, mirrored locks, parent check, post-filter, cleanup hook); feature permissions in the catalog; `RecordFeatureSummaryProviderInterface` and `GET /table/{t}/{pk}/features`; `RuntimeMetaDataProviderInterface` and overlay (generation only, no fields yet); `RecordAccessCheckerInterface`, `UserSessionProviderInterface` | repo scaffold, qbit config, `collaboration_feature_setting`, `collaboration_user`, override provider, home skeleton | types for `RecordFeaturesV1` |
 | b. Favorites, recents, palette | | favorites, recents, endpoints, summary provider | star in record and table headers, favorites menu, palette favorites group, server recents |
 | c. Attachments | | attachments with object storage, previews and thumbnails, delete action | Files tab, upload, preview |
 | d. Tags | `QSubQuery`; virtual field criteria expander in query, count, aggregate and search; `CONTAINS_ALL`; `#tag` search | tags, vocabulary modes, bulk actions, filter field | tag chips, Tags filter and column, `#tag` in palette and search |
@@ -16,3 +16,105 @@ Collaboration adds metadata-driven record features to QQQ: attachments, tags, cu
 | h. Sharing | | link, shares with preview, access requests | share dialog, request-access page |
 | i. Tasks, owner/assignee | `CurrentUser` expression, ownership metadata, "My records" view | tasks, reminders, assignment table and virtual fields, assign actions, My work | Tasks tab, My work page, assign actions |
 
+
+## Phase-c implementation choices
+
+- `ParentRecordAccess` is the named replacement point for the unreleased core helper. GetAction enforces parent READ and locks. Attach is an explicit feature grant or EDIT plus visible parent; separate WRITE locks remain an approximation.
+- Admin browsing requires collaboration.view, while panel service calls authorize the parent directly. Direct table writes are denied. Internal persistence uses explicit per-action permission bypasses after service checks, and per-input metadata clones without preview customizers. The caller's session is never elevated or replaced. Cloning also lets delete prefetch find rows after the parent is deleted, while preserving FIELD audits and record-change listeners.
+- RC.5 offers no PRE_QUERY customizer. The attachment permission checker adds a readable-table IN filter before query/count/aggregate; POST_QUERY filters parent locks before presigning. Approximate counts/bytes and short pages are documented. Full mirrored locks, page refill and API approximate flags await core.
+- Uploads spool to bounded temporary disk while hashing; no full-file heap buffer. The bucket cap also applies. Keys contain a UUID and safe basename; renames do not move bytes. Object/row writes are ordered with best-effort compensation, not a distributed transaction.
+- The object-storage adapter uses the calling-qbit system facade only after authorization. Soft deletion follows bucket policy. Object retention failures leave retryable rows. In-memory adapter tests exercise QQQ actions and security; provider conformance stays with object storage's MinIO suite.
+- Previews/downloads are virtual fields in the RECORD_VIEW alternative section (RC.5 disallows virtual fields in base sections). Five-minute URLs are never stored. RC.2 supports attachment filename overrides, but not explicit inline overrides; uploads carry an inline header. There is no thumbnail generator or generated thumbnail file.
+- Delete attachments uses standard streamed ETL. Attach files is omitted for API/panel uploads. Cleanup is a trusted public after-commit callback pending RecordReferenceCleanupInterface. Endpoints await #1128; runtime feature settings and realtime publication are future integrations; attachment services now write activity. Native search fields are present; ESB and Quick Search publication are host integrations.
+
+See [README](../README.md#attachments) for the service contract, permissions and configuration.
+
+
+## Phase-e implementation choices
+
+- **Released core only.** RC.5 includes record-change listeners and transaction after-commit callbacks. The producer registers a listener only when `followChangeTables` is nonempty. Notification delivery uses the context transaction; temporary recipient contexts never inherit the caller's permission-bypass scope. The notifier/access interfaces are explicit stand-ins for #1125 and the unreleased recipient/session contracts.
+- **Security at both boundaries.** Services check the real parent before disclosing any row. Direct table writes are denied even to admins. `ParentTableRestriction` adds a READ-table condition outside caller OR clauses; `ParentRowCustomizer` checks record locks on fetched rows. Revision and mention rows mirror their comment's parent reference to use the same pre-query restriction. Core mirrored locks/page refill and runtime feature resolution remain deferred; counts and unpinned page lengths have the same limits as attachments.
+- **Conversations are persisted relationships.** Roots have null thread IDs; replies flatten to a root. `lastActivityAt` is maintained on roots to support indexed keyset paging. Revisions retain the old body. Mention uniqueness prevents re-notification on subsequent edits. Visible mentions auto-follow; unknown is never a grant. Notifications deduplicate mentions versus followers and recheck access after commit. The default no-op transport does not mark mentions delivered.
+- **Durable follow batches.** The additional standard `collaboration_follow_digest` table stores one pending batch per parent/recipient. Due time is fixed at the first change plus five minutes. Record-change listeners copy event data and queue only after commit; batches contain field/actor summaries, never old/new values. Delivery rechecks current follow preferences and recipient access. One scheduled sender per installation is required; local synchronization and a unique key are not a cross-pod lease. Delivery/delete is at-least-once across a process crash; adapter idempotency is needed for stronger delivery guarantees.
+- **Audit reads preserve the user's authority.** Timeline uses core's released audit table names/fields with ENFORCE on every query, then applies core table personalization to field details. Headers are queried separately from details so a joined-row limit cannot cut an event in half. Denied audits are omitted. Core stores audit actor names without stable session user IDs; the DTO leaves those IDs null. Both streams are bounded and merged by descending `(at, kind, id)`. Cursor IDs are compared as numeric strings because RC.5's memory equality distinguishes Integer and Long values.
+- **Directory throttling is persistent.** Ten-minute last-seen checks survive service recreation and rollback without maintaining an in-memory cache. QUser supplies full name/ID only; email/avatar enrichment stays with trusted host integrations. Mention ranking queries participants first so the limit cannot hide an existing follower behind many other users.
+- **User-facing metadata.** Comments and admin-only Activity are main nav tables. Revisions, mentions and Followers are child lists; digest/follow tables are admin-browsable with HIDDEN deny behavior. Follow actions use generic streamed ETL Review/Result against any host key. The home reads real session-scoped comments/open-thread/follower counts. Standard QQQ writes remain available to host ESB listeners.
+
+The service API and configuration are documented in [README](../README.md#comments-follow-and-timeline). Endpoints remain deferred to QRun-IO/qqq#1128; no unreleased core dependency, runtime overlay, mirrored-lock implementation or realtime/UI delivery is introduced.
+
+## Phase-d implementation choices
+
+- **RC.5 boundary.** `tags/TagFilterTranslator` uses operator names, QQQ queries and
+  string parent IDs. It returns matching rows for all operators, so NOT_IN and
+  IS_BLANK enumerate the visible host-table complement. The 10,000 limit applies
+  to final matching IDs, not assignment count. It pages parent reads under the
+  caller's permissions and locks. Filter/quick-search integration lands after
+  QRun-IO/qqq#1140 is released; no unreleased core types or virtual fields are used.
+- **Vocabulary versus assignments.** Tag names are unique per nullable scope;
+  PostgreSQL DDL emits NULLS NOT DISTINCT for nullable unique-key components.
+  Record Tags inherits `ParentTableRestriction` and the parent row customizer,
+  including the existing approximation for aggregate counts and short pages.
+  Vocabulary pickers need no collaboration.view grant: ordinary users see
+  approved tags and their own suggestions in readable scopes, while manage sees
+  all vocabulary for moderation. Direct writes are denied; services/actions
+  preserve normalization, approval and counts.
+- **Policy lookup.** Settings are read in a temporary system context, retaining
+  the transaction and restoring the caller. TABLE overrides preferred APP (QQQ's
+  app-affinity path), then INSTANCE, then `defaultTagMode`. Missing mode inherits;
+  malformed JSON/invalid mode throws. General enabled/permission-mode runtime
+  overrides remain outside this phase. Name collision resolution prefers global
+  vocabulary; IDs provide an unambiguous selection.
+- **Mutation boundaries.** Like existing services, writes participate in the
+  caller's QQQ transaction and serialize within the installed config's monitor.
+  Unique keys enforce assignment identity. Counts are recomputed from stored
+  links, including merge deduplication, deletion and trusted parent cleanup.
+  This is not a cross-pod lock: concurrent writers in separate instances need
+  host transaction/serialization coordination for exact denormalized counts.
+  Standard ETL runs with its process transaction. Activity is generated only for
+  actual apply/remove changes and never calls follower notification services.
+- **Review and Result.** Actions derive operation and table from installed process
+  metadata. Management requires collaboration.tags.manage at both stages. Bulk
+  actions resolve approved PVS selections and recheck every parent and feature
+  permission at both stages. Review is read-only, counts already-satisfied rows,
+  and Delete reports distinct affected parents. Result reports successful and
+  failed records separately. The picker exposes multiSelectFields on EDIT_FORM
+  for the separate Next client; RC.5 itself has no native multi-value form field.
+- **Presentation.** Tags is in the admin app nav; Record Tags is a child widget.
+  The home queries under the caller session and HTML-escapes labels. Native tag
+  label search metadata is present; host-record tag search awaits #1140.
+
+
+## Phases h/i implementation choices
+
+- Shares, tasks and assignments reuse parent checks, extension restrictions and FIELD audits.
+  Access requests use requester/admin locks, no parent read, and metadata-only table labels.
+  Trusted persistence removes only the request owner lock on a private metadata clone after
+  explicit service authorization. Standard table actions retain that lock; audit keeps the caller.
+- Previews retain true/false/unknown. Unknown never enables record-data delivery or following.
+  Safe access notices use after-commit delivery without a parent check and omit record labels,
+  sender messages and approver notes. Record-data notifications recheck access at delivery.
+- OPEN request identity is `(tableName, recordId, requesterUserId)`. Local serialization and a
+  PostgreSQL partial unique index protect it; insert collisions reread the existing row. No
+  parent query distinguishes existing from missing records. Permission-holder resolution is an
+  optional host SPI, with the qbit record owner as fallback. TABLE-scope SHARING settings supply
+  the approver permission; native ownership integration awaits the released core phase-i API.
+- Streamed actions choose table/operation from installed metadata, validate in Review and again
+  at load, and report Result counts. Configured approvers use an authorized request extractor
+  without widening ordinary table reads. Grant records an identity-system outcome only.
+- Tasks default to the creator, compute reminder times using an injectable Clock, and keep
+  independent reminder/overdue delivery receipts. Creation/completion also enter the existing
+  follow digest. Run one scheduler per installation; delivery then receipt has the same crash
+  retry/idempotency limitation as follow digests. Unknown access and no-op delivery leave no receipt.
+- Assignment is a qbit fallback. Hosts with owner/assignee columns use core RecordOwnership and
+  ordinary updates, not collaboration_record_assignment or its configured actions. Bulk actions
+  preserve the other role. Virtual fields and CurrentUser integration belong to core phase i.
+- My work/my-records counts recheck parents, removing invisible content and counts. RC.5 candidate
+  rows are materialized for portable null-last sorting/counting. Home aggregates retain the
+  existing documented parent-lock approximation until core mirrored locks are released.
+- The producer registers a host DELETE listener with after-commit cleanup. Access requests
+  survive deletion. Schema SQL includes partial request/reminder indexes and a readAt migration
+  for the existing mention table. Task title search metadata is present; ESB/Quick Search
+  publication remains a host integration.
+
+See the README for service signatures, defaults, configuration and the exact access-request
+prefill route. UI API endpoints and screens follow in their separate PR.

pom.xml

@@ -67,6 +67,11 @@
    </scm>
 
    <dependencies>
+      <dependency>
+         <groupId>com.kingsrook.qbits</groupId>
+         <artifactId>qbit-object-storage</artifactId>
+         <version>0.1.0-RC.2</version>
+      </dependency>
       <dependency>
          <groupId>com.kingsrook.qqq</groupId>
          <artifactId>qqq-backend-core</artifactId>

src/main/java/com/kingsrook/qbits/collaboration/CollaborationQBitConfig.java

@@ -23,7 +23,9 @@ package com.kingsrook.qbits.collaboration;
 
 
 import java.util.List;
+import com.kingsrook.qbits.collaboration.notify.NoOpNotifier;
 import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
 import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitConfig;
 import com.kingsrook.qqq.backend.core.utils.StringUtils;
 
@@ -36,11 +38,24 @@ public class CollaborationQBitConfig implements QBitConfig
    public static final String TABLE_NAME_PREFIX = "collaboration_";
    public static final String PERMISSION_BASE_NAME = "collaboration";
 
+   private QCodeReference notifier = new QCodeReference(NoOpNotifier.class);
+   private QCodeReference userSessionSupplier = null;
+   private String defaultTagMode = "FREE";
+   private List<String> tagActionTables = List.of();
+   private List<String> followActionTables = List.of();
+   private List<String> followChangeTables = List.of();
+   private String frontendBaseUrl;
+   private QCodeReference permissionHolderDirectory;
+   private List<String> assignActionTables = List.of();
    private String backendName;
    private String schedulerName;
    private String appName = "collaboration";
    private String parentAppName;
    private Boolean adminApp = true;
+   private Integer recentsPerUser = 200;
+   private String attachmentsBucketName = "collaboration";
+   private Long defaultMaxBytes = 100L * 1024 * 1024;
+   private List<String> blockedExtensions = List.of();
 
 
 
@@ -199,6 +214,37 @@ public class CollaborationQBitConfig implements QBitConfig
 
 
 
+   /*******************************************************************************
+    ** Maximum retained recent targets per user.
+    *******************************************************************************/
+   public Integer getRecentsPerUser()
+   {
+      return (recentsPerUser);
+   }
+
+
+
+   /*******************************************************************************
+    ** Configure retention; validated when the producer is installed.
+    *******************************************************************************/
+   public void setRecentsPerUser(Integer recentsPerUser)
+   {
+      this.recentsPerUser = recentsPerUser;
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent retention configuration.
+    *******************************************************************************/
+   public CollaborationQBitConfig withRecentsPerUser(Integer recentsPerUser)
+   {
+      setRecentsPerUser(recentsPerUser);
+      return (this);
+   }
+
+
+
    /*******************************************************************************
     ** Validate the configured backend and app placement.
     *******************************************************************************/
@@ -209,6 +255,24 @@ public class CollaborationQBitConfig implements QBitConfig
       {
          assertCondition(instance.getBackend(backendName) != null, "Unknown Collaboration backend: " + backendName, errors);
       }
+      assertCondition(List.of("FREE", "APPROVED_ONLY").contains(defaultTagMode == null ? "" : defaultTagMode), "defaultTagMode must be FREE or APPROVED_ONLY", errors);
+      assertCondition(notifier != null, "notifier is required", errors);
+      for(List<String> tables : List.of(followActionTables, followChangeTables, tagActionTables, assignActionTables))
+      {
+         for(String table : tables)
+         {
+            assertCondition(table != null && !table.startsWith(TABLE_NAME_PREFIX) && instance.getTable(table) != null
+               && instance.getTable(table).getPrimaryKeyField() != null, "Follow configuration needs a host table with a primary key: " + table, errors);
+         }
+      }
+      assertCondition(StringUtils.hasContent(attachmentsBucketName), "attachmentsBucketName is required", errors);
+      assertCondition(defaultMaxBytes != null && defaultMaxBytes > 0, "defaultMaxBytes must be positive", errors);
+      assertCondition(blockedExtensions != null && blockedExtensions.stream().allMatch(value -> value != null && !value.isBlank()), "blockedExtensions must contain nonblank extensions", errors);
+      assertCondition(recentsPerUser != null && recentsPerUser > 0, "recentsPerUser must be positive", errors);
+      if(schedulerName != null)
+      {
+         assertCondition(instance.getScheduler(schedulerName) != null, "Unknown Collaboration scheduler: " + schedulerName, errors);
+      }
       if(Boolean.TRUE.equals(adminApp))
       {
          assertCondition(StringUtils.hasContent(appName), "appName is required when adminApp is enabled", errors);
@@ -229,4 +293,241 @@ public class CollaborationQBitConfig implements QBitConfig
    {
       return (backendName);
    }
+
+
+   /*******************************************************************************
+    ** Getter for attachmentsBucketName.
+    *******************************************************************************/
+   public String getAttachmentsBucketName()
+   {
+      return (attachmentsBucketName);
+   }
+
+
+   /*******************************************************************************
+    ** Setter for attachmentsBucketName.
+    *******************************************************************************/
+   public void setAttachmentsBucketName(String attachmentsBucketName)
+   {
+      this.attachmentsBucketName = attachmentsBucketName;
+   }
+
+
+   /*******************************************************************************
+    ** Fluent setter for attachmentsBucketName.
+    *******************************************************************************/
+   public CollaborationQBitConfig withAttachmentsBucketName(String attachmentsBucketName)
+   {
+      setAttachmentsBucketName(attachmentsBucketName);
+      return (this);
+   }
+
+
+   /*******************************************************************************
+    ** Getter for defaultMaxBytes.
+    *******************************************************************************/
+   public Long getDefaultMaxBytes()
+   {
+      return (defaultMaxBytes);
+   }
+
+
+   /*******************************************************************************
+    ** Setter for defaultMaxBytes.
+    *******************************************************************************/
+   public void setDefaultMaxBytes(Long defaultMaxBytes)
+   {
+      this.defaultMaxBytes = defaultMaxBytes;
+   }
+
+
+   /*******************************************************************************
+    ** Fluent setter for defaultMaxBytes.
+    *******************************************************************************/
+   public CollaborationQBitConfig withDefaultMaxBytes(Long defaultMaxBytes)
+   {
+      setDefaultMaxBytes(defaultMaxBytes);
+      return (this);
+   }
+
+
+   /*******************************************************************************
+    ** Getter for blockedExtensions.
+    *******************************************************************************/
+   public List<String> getBlockedExtensions()
+   {
+      return (blockedExtensions);
+   }
+
+
+   /*******************************************************************************
+    ** Setter for blockedExtensions.
+    *******************************************************************************/
+   public void setBlockedExtensions(List<String> blockedExtensions)
+   {
+      this.blockedExtensions = blockedExtensions;
+   }
+
+
+   /*******************************************************************************
+    ** Fluent setter for blockedExtensions.
+    *******************************************************************************/
+   public CollaborationQBitConfig withBlockedExtensions(List<String> blockedExtensions)
+   {
+      setBlockedExtensions(blockedExtensions);
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Get notifier.
+    *******************************************************************************/
+   public QCodeReference getNotifier()
+   {
+      return (notifier);
+   }
+
+   /*******************************************************************************
+    ** Configure notifier.
+    *******************************************************************************/
+   public CollaborationQBitConfig withNotifier(QCodeReference notifier)
+   {
+      this.notifier = notifier;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Get userSessionSupplier.
+    *******************************************************************************/
+   public QCodeReference getUserSessionSupplier()
+   {
+      return (userSessionSupplier);
+   }
+
+   /*******************************************************************************
+    ** Configure userSessionSupplier.
+    *******************************************************************************/
+   public CollaborationQBitConfig withUserSessionSupplier(QCodeReference userSessionSupplier)
+   {
+      this.userSessionSupplier = userSessionSupplier;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Get followActionTables.
+    *******************************************************************************/
+   public List<String> getFollowActionTables()
+   {
+      return (followActionTables);
+   }
+
+   /*******************************************************************************
+    ** Configure followActionTables.
+    *******************************************************************************/
+   public CollaborationQBitConfig withFollowActionTables(List<String> followActionTables)
+   {
+      this.followActionTables = followActionTables;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Get followChangeTables.
+    *******************************************************************************/
+   public List<String> getFollowChangeTables()
+   {
+      return (followChangeTables);
+   }
+
+   /*******************************************************************************
+    ** Configure followChangeTables.
+    *******************************************************************************/
+   public CollaborationQBitConfig withFollowChangeTables(List<String> followChangeTables)
+   {
+      this.followChangeTables = followChangeTables;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Default vocabulary policy when no persisted override supplies a mode.
+    *******************************************************************************/
+   public String getDefaultTagMode()
+   {
+      return (defaultTagMode);
+   }
+
+   /*******************************************************************************
+    ** Configure the default tag policy.
+    *******************************************************************************/
+   public CollaborationQBitConfig withDefaultTagMode(String mode)
+   {
+      this.defaultTagMode = mode;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Host tables receiving Add tags and Remove tags actions.
+    *******************************************************************************/
+   public List<String> getTagActionTables()
+   {
+      return (tagActionTables);
+   }
+
+   /*******************************************************************************
+    ** Configure host tag actions.
+    *******************************************************************************/
+   public CollaborationQBitConfig withTagActionTables(List<String> tables)
+   {
+      this.tagActionTables = tables;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Host configuration for frontendBaseUrl.
+    *******************************************************************************/
+   public String getFrontendBaseUrl()
+   {
+      return (frontendBaseUrl);
+   }
+
+   /*******************************************************************************
+    ** Configure frontendBaseUrl.
+    *******************************************************************************/
+   public CollaborationQBitConfig withFrontendBaseUrl(String value)
+   {
+      this.frontendBaseUrl = value;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Host configuration for permissionHolderDirectory.
+    *******************************************************************************/
+   public QCodeReference getPermissionHolderDirectory()
+   {
+      return (permissionHolderDirectory);
+   }
+
+   /*******************************************************************************
+    ** Configure permissionHolderDirectory.
+    *******************************************************************************/
+   public CollaborationQBitConfig withPermissionHolderDirectory(QCodeReference value)
+   {
+      this.permissionHolderDirectory = value;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Host configuration for assignActionTables.
+    *******************************************************************************/
+   public List<String> getAssignActionTables()
+   {
+      return (assignActionTables);
+   }
+
+   /*******************************************************************************
+    ** Configure assignActionTables.
+    *******************************************************************************/
+   public CollaborationQBitConfig withAssignActionTables(List<String> value)
+   {
+      this.assignActionTables = value;
+      return (this);
+   }
 }

src/main/java/com/kingsrook/qbits/collaboration/CollaborationQBitProducer.java

@@ -23,7 +23,9 @@ package com.kingsrook.qbits.collaboration;
 
 
 import com.kingsrook.qbits.collaboration.app.CollaborationHome;
+import com.kingsrook.qbits.collaboration.attachments.DeleteAttachmentsProcess;
 import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.recents.TrimRecentsProcess;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.model.metadata.MetaDataProducerMultiOutput;
 import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
@@ -124,6 +126,30 @@ public class CollaborationQBitProducer implements QBitMetaDataProducer<Collabora
       QBitMetaData qBit = getQBitMetaData();
       instance.addQBit(qBit);
       MetaDataProducerMultiOutput output = new MetaDataProducerMultiOutput();
+      CollaborationSecurity.buildSecurityKeyTypes().forEach(output::add);
+      output.add(TrimRecentsProcess.metadata(qBitConfig));
+      output.add(com.kingsrook.qbits.collaboration.tasks.SendTaskRemindersProcess.metadata(qBitConfig));
+      WorkProcesses.management().forEach(output::add);
+      for(String table : qBitConfig.getAssignActionTables())
+      {
+         WorkProcesses.assignments(table).forEach(output::add);
+      }
+      instance.withRecordChangeListener(new com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference(WorkCleanup.class));
+      output.add(com.kingsrook.qbits.collaboration.follow.SendFollowDigestsProcess.metadata(qBitConfig));
+      for(String table : qBitConfig.getFollowActionTables())
+      {
+         com.kingsrook.qbits.collaboration.follow.FollowProcesses.processesFor(table).forEach(output::add);
+      }
+      if(!qBitConfig.getFollowChangeTables().isEmpty())
+      {
+         instance.withRecordChangeListener(new com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference(com.kingsrook.qbits.collaboration.follow.FollowChangeBatcher.class));
+      }
+      com.kingsrook.qbits.collaboration.tags.TagProcesses.management().forEach(output::add);
+      for(String table : qBitConfig.getTagActionTables())
+      {
+         com.kingsrook.qbits.collaboration.tags.TagProcesses.processesFor(table).forEach(output::add);
+      }
+      output.add(DeleteAttachmentsProcess.metadata());
       for(QPossibleValueSource source : CollaborationTables.possibleValueSources())
       {
          output.add(source);
@@ -139,6 +165,7 @@ public class CollaborationQBitProducer implements QBitMetaDataProducer<Collabora
          output.add(CollaborationHome.app(qBitConfig));
       }
       output.addSelfToInstance(instance);
+      com.kingsrook.qbits.collaboration.model.ConversationChildren.install(instance);
       if(Boolean.TRUE.equals(qBitConfig.getAdminApp()) && qBitConfig.getParentAppName() != null)
       {
          QAppMetaData parent = instance.getApp(qBitConfig.getParentAppName());

src/main/java/com/kingsrook/qbits/collaboration/CollaborationRecords.java

@@ -0,0 +1,149 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.io.Serializable;
+import java.util.List;
+import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Internal persistence for trusted services. Callers must authorize the parent
+ ** before reading or writing. Never expose these methods as API operations.
+ *******************************************************************************/
+public final class CollaborationRecords
+{
+   /*******************************************************************************
+    ** Static persistence boundary.
+    *******************************************************************************/
+   private CollaborationRecords()
+   {
+   }
+
+   /*******************************************************************************
+    ** Resolve the installed qbit configuration.
+    *******************************************************************************/
+   public static CollaborationQBitConfig config()
+   {
+      return ((CollaborationQBitConfig) QContext.getQInstance().getQBits().values().stream()
+         .filter(bit -> bit.getConfig() instanceof CollaborationQBitConfig).findFirst().orElseThrow().getConfig());
+   }
+
+   /*******************************************************************************
+    ** Restrict a service query to one canonical parent.
+    *******************************************************************************/
+   public static QQueryFilter parent(String table, String id)
+   {
+      return (new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, table)
+         .withCriteria("recordId", QCriteriaOperator.EQUALS, id).withCriteria("parentDeleted", QCriteriaOperator.EQUALS, false));
+   }
+
+   /*******************************************************************************
+    ** Raw reads retain transaction visibility but omit presentation customizers.
+    *******************************************************************************/
+   public static List<QRecord> query(String table, QQueryFilter filter) throws QException
+   {
+      QueryInput input = new QueryInput(table).withFilter(filter).withShouldFetchHeavyFields(true).withTransaction(QContext.getQBackendTransaction());
+      input.setTableMetaData(serviceMetadata(table));
+      input.withPermissionBypass("Trusted collaboration service performs parent/ownership authorization.");
+      return (new QueryAction().execute(input).getRecords().stream().map(QRecord::new).toList());
+   }
+
+   /*******************************************************************************
+    ** Persist generated keys and propagate record validation errors.
+    *******************************************************************************/
+   public static QRecord insert(String table, QRecord row) throws QException
+   {
+      InsertInput input = new InsertInput(table).withRecords(List.of(row)).withTransaction(QContext.getQBackendTransaction());
+      input.setTableMetaData(serviceMetadata(table));
+      input.withPermissionBypass("Trusted collaboration service authorized this write.");
+      List<QRecord> result = new InsertAction().execute(input).getRecords();
+      check(result);
+      return (result.getFirst());
+   }
+
+   /*******************************************************************************
+    ** Only supplied fields are changed; preserve auditing.
+    *******************************************************************************/
+   public static void update(String table, QRecord row) throws QException
+   {
+      UpdateInput input = new UpdateInput(table).withRecords(List.of(row)).withTransaction(QContext.getQBackendTransaction());
+      input.setTableMetaData(serviceMetadata(table));
+      input.withPermissionBypass("Trusted collaboration service authorized this write.");
+      check(new UpdateAction().execute(input).getRecords());
+   }
+
+   /*******************************************************************************
+    ** Delete a service-selected row.
+    *******************************************************************************/
+   public static void delete(String table, Serializable id) throws QException
+   {
+      DeleteInput input = new DeleteInput(table).withPrimaryKeys(List.of(id)).withTransaction(QContext.getQBackendTransaction());
+      input.setTableMetaData(serviceMetadata(table));
+      input.withPermissionBypass("Trusted collaboration service authorized this deletion.");
+      check(new DeleteAction().execute(input).getRecordsWithErrors());
+   }
+
+   /*******************************************************************************
+    ** Access-request services enforce requester/approver authority explicitly.
+    ** Bypass only that owner lock on a private metadata clone, retaining the caller
+    ** for audit attribution. Standard actions always retain the installed lock.
+    *******************************************************************************/
+   private static QTableMetaData serviceMetadata(String table)
+   {
+      QTableMetaData metadata = QContext.getQInstance().getTable(table).clone().withCustomizers(null);
+      if(table.equals(com.kingsrook.qbits.collaboration.model.CollaborationTables.ACCESS_REQUEST))
+      {
+         metadata.setRecordSecurityLocks(null);
+      }
+      return (metadata);
+   }
+
+   /*******************************************************************************
+    ** Core actions can return validation errors instead of throwing.
+    *******************************************************************************/
+   private static void check(List<QRecord> rows) throws QException
+   {
+      if(rows != null)
+      {
+         for(QRecord row : rows)
+         {
+            if(row.getErrors() != null && !row.getErrors().isEmpty())
+            {
+               throw (new QException("Could not save collaboration record: " + row.getErrors()));
+            }
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/CollaborationSchema.java

@@ -57,17 +57,38 @@ public final class CollaborationSchema
          for(QFieldMetaData field : table.getFields().values())
          {
             String type = field.getName().equals(table.getPrimaryKeyField()) ? "INTEGER GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY" : sqlType(field);
-            columns.add("   " + field.getBackendName() + " " + type + (Boolean.TRUE.equals(field.getIsRequired()) ? " NOT NULL" : ""));
+            columns.add("   " + field.getBackendName() + " " + type + (field.getName().equals("parentDeleted") ? " DEFAULT FALSE" : "") + (Boolean.TRUE.equals(field.getIsRequired()) ? " NOT NULL" : ""));
          }
          statements.add("CREATE TABLE IF NOT EXISTS " + table.getName() + " (\n" + String.join(",\n", columns) + "\n)");
          int index = 0;
-         for(UniqueKey key : table.getUniqueKeys())
+         for(UniqueKey key : table.getUniqueKeys() == null ? List.<UniqueKey>of() : table.getUniqueKeys())
          {
             index++;
             List<String> names = key.getFieldNames().stream().map(name -> table.getField(name).getBackendName()).toList();
-            statements.add("CREATE UNIQUE INDEX IF NOT EXISTS uq_" + table.getName() + "_" + index + " ON " + table.getName() + " (" + String.join(", ", names) + ")");
+            statements.add("CREATE UNIQUE INDEX IF NOT EXISTS uq_" + table.getName() + "_" + index + " ON " + table.getName() + " (" + String.join(", ", names) + ")"
+               + (key.getFieldNames().stream().anyMatch(name -> !Boolean.TRUE.equals(table.getField(name).getIsRequired())) ? " NULLS NOT DISTINCT" : ""));
          }
       }
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_record_tag_tag ON collaboration_record_tag (tag_id)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_attachment_parent ON collaboration_attachment (table_name, record_id)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_comment_parent ON collaboration_comment (table_name, record_id, last_activity_at, id)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_comment_created ON collaboration_comment (table_name, record_id, create_date)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_comment_thread ON collaboration_comment (thread_id, create_date, id)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_revision_comment ON collaboration_comment_revision (comment_id, edited_at, id)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_activity_parent ON collaboration_activity (table_name, record_id, at, id)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_digest_due ON collaboration_follow_digest (due_at)");
+      statements.add("CREATE UNIQUE INDEX IF NOT EXISTS uq_collaboration_access_request_open ON collaboration_access_request (table_name, record_id, requester_user_id) WHERE status = 'OPEN'");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_share_parent ON collaboration_share (table_name, record_id)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_share_sent ON collaboration_share (sent_at)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_access_request_requester ON collaboration_access_request (requester_user_id, status)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_task_parent ON collaboration_task (table_name, record_id)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_task_mine ON collaboration_task (assignee_user_id, status, due_at, id)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_task_reminder ON collaboration_task (remind_at) WHERE status = 'OPEN' AND reminded_at IS NULL");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_task_overdue ON collaboration_task (due_at) WHERE status = 'OPEN' AND overdue_notified_at IS NULL");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_assignment_owner ON collaboration_record_assignment (owner_user_id)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_assignment_assignee ON collaboration_record_assignment (assignee_user_id)");
+      statements.add("ALTER TABLE collaboration_mention ADD COLUMN IF NOT EXISTS read_at TIMESTAMPTZ");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_mention_unread ON collaboration_mention (mentioned_user_id) WHERE notified_at IS NOT NULL AND read_at IS NULL");
       return (String.join(";\n", statements) + ";\n");
    }
 
@@ -83,6 +104,7 @@ public final class CollaborationSchema
          case STRING -> "VARCHAR(" + (field.getMaxLength() == null ? 255 : field.getMaxLength()) + ")";
          case TEXT -> "TEXT";
          case INTEGER -> "INTEGER";
+         case LONG -> "BIGINT";
          case BOOLEAN -> "BOOLEAN";
          case DATE_TIME -> "TIMESTAMPTZ";
          case DATE -> "DATE";

src/main/java/com/kingsrook/qbits/collaboration/CollaborationSecurity.java

@@ -0,0 +1,135 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.security.QSecurityKeyType;
+import com.kingsrook.qqq.backend.core.model.metadata.security.RecordSecurityLock;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
+
+
+/*******************************************************************************
+ ** Personal tables require no collaboration.view grant: NOT_PROTECTED plus a
+ ** READ_AND_WRITE owner lock lets every signed-in user manage their own rows.
+ ** Administrators receive the all-access key. The permission checker initializes
+ ** keys before enforced core actions (RC.5 has no pre-query customizer); services
+ ** and the home also ensure keys, like Alerts. Hosts may call applyToSession
+ ** after authentication. System sessions are left untouched.
+ *******************************************************************************/
+public class CollaborationSecurity implements CustomPermissionChecker
+{
+   public static final String KEY_USER = "collaboration_user";
+   public static final String KEY_USER_ALL_ACCESS = "collaboration_user_all_access";
+
+
+
+   /*******************************************************************************
+    ** Register the owner key and its administrator override.
+    *******************************************************************************/
+   public static List<QSecurityKeyType> buildSecurityKeyTypes()
+   {
+      return (List.of(new QSecurityKeyType().withName(KEY_USER).withAllAccessKeyName(KEY_USER_ALL_ACCESS)));
+   }
+
+
+
+   /*******************************************************************************
+    ** Apply ownership to reads and writes, including changes to the owner field.
+    *******************************************************************************/
+   public static RecordSecurityLock ownerLock(String fieldName)
+   {
+      return (new RecordSecurityLock().withSecurityKeyType(KEY_USER).withFieldName(fieldName)
+         .withLockScope(RecordSecurityLock.LockScope.READ_AND_WRITE));
+   }
+
+
+
+   /*******************************************************************************
+    ** Replace our keys so a changed user or revoked admin permission cannot linger.
+    *******************************************************************************/
+   public static void applyToSession(QInstance instance, QSession session)
+   {
+      if(instance == null || session == null || session instanceof QSystemUserSession)
+      {
+         return;
+      }
+      if(session.getSecurityKeyValues() != null)
+      {
+         session.getSecurityKeyValues().remove(KEY_USER);
+         session.getSecurityKeyValues().remove(KEY_USER_ALL_ACCESS);
+      }
+      String userId = userId(session);
+      if(userId != null && !userId.isBlank())
+      {
+         session.withSecurityKeyValue(KEY_USER, userId);
+         if(session.hasPermission(CollaborationPermissions.ADMIN))
+         {
+            session.withSecurityKeyValue(KEY_USER_ALL_ACCESS, true);
+         }
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Cheaply refresh the two keys on every entry point; no metadata scan needed.
+    *******************************************************************************/
+   public static void ensureSessionKeys(QInstance instance, QSession session)
+   {
+      applyToSession(instance, session);
+   }
+
+
+
+   /*******************************************************************************
+    ** Authentication's stable user reference, never a display name or session id.
+    *******************************************************************************/
+   public static String userId(QSession session)
+   {
+      return (session == null || session.getUser() == null ? null : session.getUser().getIdReference());
+   }
+
+
+
+   /*******************************************************************************
+    ** Initialize before direct query/get/count/aggregate/insert/update/delete.
+    *******************************************************************************/
+   @Override
+   public void checkPermissionsThrowing(AbstractActionInput input, MetaDataWithPermissionRules metadata) throws QPermissionDeniedException
+   {
+      QSession session = QContext.getQSession();
+      ensureSessionKeys(QContext.getQInstance(), session);
+      if(!(session instanceof QSystemUserSession) && (userId(session) == null || userId(session).isBlank()))
+      {
+         throw (new QPermissionDeniedException("Sign in to manage favorites and recents."));
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/PersonalRecords.java

@@ -0,0 +1,179 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+
+import java.io.Serializable;
+import java.util.List;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+
+/*******************************************************************************
+ ** Shared current-session persistence. Explicit user filters keep personal service
+ ** calls scoped to the caller even when administrators hold the all-access key.
+ *******************************************************************************/
+public final class PersonalRecords
+{
+   /*******************************************************************************
+    ** Static operations only.
+    *******************************************************************************/
+   private PersonalRecords()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Require an authenticated owner before accepting a personal operation.
+    *******************************************************************************/
+   public static String currentUserId() throws QPermissionDeniedException
+   {
+      CollaborationSecurity.ensureSessionKeys(QContext.getQInstance(), QContext.getQSession());
+      String userId = CollaborationSecurity.userId(QContext.getQSession());
+      if(userId == null || userId.isBlank())
+      {
+         throw (new QPermissionDeniedException("Sign in to manage favorites and recents."));
+      }
+      return (userId);
+   }
+
+
+
+   /*******************************************************************************
+    ** Always constrain personal services to the current owner.
+    *******************************************************************************/
+   public static QQueryFilter ownFilter() throws QPermissionDeniedException
+   {
+      return (new QQueryFilter().withCriteria("userId", QCriteriaOperator.EQUALS, currentUserId()));
+   }
+
+
+
+   /*******************************************************************************
+    ** Null record ids use IS_BLANK, not SQL equality with NULL.
+    *******************************************************************************/
+   public static QQueryFilter targetFilter(String type, String name, String recordId) throws QPermissionDeniedException
+   {
+      QQueryFilter filter = ownFilter().withCriteria("targetType", QCriteriaOperator.EQUALS, type)
+         .withCriteria("targetName", QCriteriaOperator.EQUALS, name);
+      if(recordId == null)
+      {
+         filter.withCriteria("recordId", QCriteriaOperator.IS_BLANK);
+      }
+      else
+      {
+         filter.withCriteria("recordId", QCriteriaOperator.EQUALS, recordId);
+      }
+      return (filter);
+   }
+
+
+
+   /*******************************************************************************
+    ** Enforce permissions independently of the host's core-action default.
+    *******************************************************************************/
+   public static List<QRecord> query(String table, QQueryFilter filter) throws QException
+   {
+      QueryInput input = new QueryInput(table).withFilter(filter);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      return (new QueryAction().execute(input).getRecords());
+   }
+
+
+
+   /*******************************************************************************
+    ** Propagate per-record validation failures instead of reporting success.
+    *******************************************************************************/
+   public static QRecord insert(String table, QRecord record) throws QException
+   {
+      InsertInput input = new InsertInput(table).withRecords(List.of(record));
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      QRecord result = new InsertAction().execute(input).getRecords().getFirst();
+      checkErrors(List.of(result));
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** Update only fields supplied by the service, using the current session.
+    *******************************************************************************/
+   public static void update(String table, List<QRecord> records) throws QException
+   {
+      if(records.isEmpty())
+      {
+         return;
+      }
+      UpdateInput input = new UpdateInput(table).withRecords(records);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      checkErrors(new UpdateAction().execute(input).getRecords());
+   }
+
+
+
+   /*******************************************************************************
+    ** Delete already selected ids; row locks are still enforced by DeleteAction.
+    *******************************************************************************/
+   public static void delete(String table, List<Serializable> ids) throws QException
+   {
+      if(ids.isEmpty())
+      {
+         return;
+      }
+      DeleteInput input = new DeleteInput(table).withPrimaryKeys(ids);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      checkErrors(new DeleteAction().execute(input).getRecordsWithErrors());
+   }
+
+
+
+   /*******************************************************************************
+    ** QQQ actions can return record errors without throwing.
+    *******************************************************************************/
+   private static void checkErrors(List<QRecord> records) throws QException
+   {
+      if(records != null)
+      {
+         for(QRecord record : records)
+         {
+            if(record.getErrors() != null && !record.getErrors().isEmpty())
+            {
+               throw (new QException("Could not save personal target: " + record.getErrors()));
+            }
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/RecordCursor.java

@@ -0,0 +1,92 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.nio.charset.StandardCharsets;
+import java.time.Instant;
+import java.util.Base64;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+/*******************************************************************************
+ ** Versioned opaque keyset cursor shared by comments and timeline.
+ *******************************************************************************/
+public record RecordCursor(Instant at, String kind, Long id)
+{
+   /*******************************************************************************
+    ** No record data is embedded in a cursor.
+    *******************************************************************************/
+   public String encode()
+   {
+      return (Base64.getUrlEncoder().withoutPadding().encodeToString(("1\n" + at + "\n" + kind + "\n" + id).getBytes(StandardCharsets.UTF_8)));
+   }
+
+   /*******************************************************************************
+    ** Reject malformed cursors with a consistent service error.
+    *******************************************************************************/
+   public static RecordCursor decode(String cursor) throws QException
+   {
+      try
+      {
+         String[] parts = new String(Base64.getUrlDecoder().decode(cursor), StandardCharsets.UTF_8).split("\n", -1);
+         if(parts.length != 4 || !parts[0].equals("1") || !java.util.List.of("COMMENT", "ACTIVITY", "AUDIT").contains(parts[2]))
+         {
+            throw (new IllegalArgumentException("Invalid cursor"));
+         }
+         return (new RecordCursor(Instant.parse(parts[1]), parts[2], Long.valueOf(parts[3])));
+      }
+      catch(RuntimeException e)
+      {
+         throw (new QException("Invalid cursor", e));
+      }
+   }
+
+   /*******************************************************************************
+    ** Strict ordering for descending (time, kind, id) pagination.
+    *******************************************************************************/
+   public boolean isBefore(RecordCursor other)
+   {
+      int time = at.compareTo(other.at);
+      int type = kind.compareTo(other.kind);
+      return (time < 0 || (time == 0 && (type < 0 || (type == 0 && id < other.id))));
+   }
+
+   /*******************************************************************************
+    ** Apply the same tuple ordering in backend queries, including equal timestamps.
+    *******************************************************************************/
+   public QQueryFilter beforeFilter(String atField, String streamKind)
+   {
+      QQueryFilter filter = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR)
+         .withSubFilter(new QQueryFilter().withCriteria(atField, QCriteriaOperator.LESS_THAN, at));
+      if(streamKind.compareTo(kind) <= 0)
+      {
+         QQueryFilter equal = new QQueryFilter().withCriteria(atField, QCriteriaOperator.EQUALS, at);
+         if(streamKind.equals(kind))
+         {
+            equal.withCriteria("id", QCriteriaOperator.LESS_THAN, id.toString());
+         }
+         filter.withSubFilter(equal);
+      }
+      return (filter);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/TargetResolver.java

@@ -0,0 +1,325 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+
+import java.io.Serializable;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.favorites.FavoriteEntry;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionsHelper;
+import com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType;
+import com.kingsrook.qqq.backend.core.actions.tables.GetAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.exceptions.QValueException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.utils.ValueUtils;
+
+
+/*******************************************************************************
+ ** Resolves targets only with released RC.5 APIs. Each list batches record label
+ ** refreshes by table, preserving table permissions and record security locks.
+ ** Next accepts the flat /app/name/ routes, including dotted process names.
+ *******************************************************************************/
+public final class TargetResolver
+{
+   private static final Set<String> TYPES = Set.of("TABLE", "APP", "RECORD", "PROCESS", "REPORT", "SAVED_VIEW");
+
+
+
+   /*******************************************************************************
+    ** Static operations only.
+    *******************************************************************************/
+   private TargetResolver()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Validate target shape without requiring visibility (also used to unstar).
+    *******************************************************************************/
+   public static String recordId(String type, String name, Serializable recordId) throws QException
+   {
+      String id = recordId == null ? null : recordId.toString();
+      if(type == null || !TYPES.contains(type) || name == null || name.isBlank()
+         || ("RECORD".equals(type) ? id == null || id.isBlank() : id != null))
+      {
+         throw (new QException("Invalid target"));
+      }
+      if("RECORD".equals(type))
+      {
+         QTableMetaData table = QContext.getQInstance().getTable(name);
+         if(table != null && table.getPrimaryKeyField() != null)
+         {
+            try
+            {
+               id = ValueUtils.getValueAsFieldType(table.getField(table.getPrimaryKeyField()).getType(), id).toString();
+            }
+            catch(QValueException expected)
+            {
+               throw (new QException("Not found"));
+            }
+         }
+      }
+      return (id);
+   }
+
+
+
+   /*******************************************************************************
+    ** Resolve one target for writes; missing and invisible have the same error.
+    *******************************************************************************/
+   public static FavoriteEntry require(String type, String name, Serializable id) throws QException
+   {
+      String recordId = recordId(type, name, id);
+      QRecord row = new QRecord().withValue("targetType", type).withValue("targetName", name).withValue("recordId", recordId);
+      FavoriteEntry entry;
+      if("RECORD".equals(type))
+      {
+         QRecord record = get(name, recordId);
+         entry = entry(row, record == null ? null : record.getRecordLabel(), record == null ? null : path(name) + encode(recordId) + "/");
+      }
+      else
+      {
+         entry = metadataEntry(row);
+      }
+      if(!entry.available())
+      {
+         throw (new QException("Not found"));
+      }
+      return (entry);
+   }
+
+
+
+   /*******************************************************************************
+    ** One QueryAction per referenced record table; no cached labels escape.
+    *******************************************************************************/
+   public static List<FavoriteEntry> refresh(List<QRecord> rows) throws QException
+   {
+      Map<String, List<String>> idsByTable = new LinkedHashMap<>();
+      for(QRecord row : rows)
+      {
+         if("RECORD".equals(row.getValueString("targetType")))
+         {
+            idsByTable.computeIfAbsent(row.getValueString("targetName"), key -> new ArrayList<>()).add(row.getValueString("recordId"));
+         }
+      }
+      Map<String, Map<String, QRecord>> recordsByTable = new HashMap<>();
+      for(Map.Entry<String, List<String>> group : idsByTable.entrySet())
+      {
+         String table = group.getKey();
+         Map<String, QRecord> records = new HashMap<>();
+         recordsByTable.put(table, records);
+         if(canReadTable(table))
+         {
+            QueryInput input = new QueryInput(table).withShouldGenerateDisplayValues(true)
+               .withFilter(new QQueryFilter().withCriteria(QContext.getQInstance().getTable(table).getPrimaryKeyField(), QCriteriaOperator.IN, group.getValue()));
+            input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+            try
+            {
+               for(QRecord record : new QueryAction().execute(input).getRecords())
+               {
+                  records.put(record.getValueString(QContext.getQInstance().getTable(table).getPrimaryKeyField()), record);
+               }
+            }
+            catch(QPermissionDeniedException expected)
+            {
+               // Permission may have changed since the metadata check; fail closed.
+            }
+         }
+      }
+      List<FavoriteEntry> entries = new ArrayList<>();
+      for(QRecord row : rows)
+      {
+         String table = row.getValueString("targetName");
+         String id = row.getValueString("recordId");
+         if("RECORD".equals(row.getValueString("targetType")))
+         {
+            QRecord record = recordsByTable.get(table).get(id);
+            entries.add(entry(row, record == null ? null : record.getRecordLabel(), record == null ? null : path(table) + encode(id) + "/"));
+         }
+         else
+         {
+            entries.add(metadataEntry(row));
+         }
+      }
+      return (entries);
+   }
+
+
+
+   /*******************************************************************************
+    ** Metadata targets use the same permission helpers as core. Saved views also
+    ** require a visible savedView row and READ on the view's target table.
+    *******************************************************************************/
+   private static FavoriteEntry metadataEntry(QRecord row) throws QException
+   {
+      QInstance instance = QContext.getQInstance();
+      AbstractActionInput input = new AbstractActionInput();
+      String name = row.getValueString("targetName");
+      String label = null;
+      String href = null;
+      switch(row.getValueString("targetType"))
+      {
+         case "TABLE" ->
+         {
+            if(canReadTable(name))
+            {
+               label = instance.getTable(name).getLabel();
+               href = path(name);
+            }
+         }
+         case "APP" ->
+         {
+            if(PermissionsHelper.hasAppPermission(input, name))
+            {
+               label = instance.getApp(name).getLabel();
+               href = path(name);
+            }
+         }
+         case "PROCESS" ->
+         {
+            if(PermissionsHelper.hasProcessPermission(input, name))
+            {
+               label = instance.getProcess(name).getLabel();
+               href = path(name);
+            }
+         }
+         case "REPORT" ->
+         {
+            if(PermissionsHelper.hasReportPermission(input, name))
+            {
+               label = instance.getReport(name).getLabel();
+               href = path(name);
+            }
+         }
+         case "SAVED_VIEW" ->
+         {
+            QRecord view = get("savedView", name);
+            if(view != null && canReadTable(view.getValueString("tableName")))
+            {
+               label = view.getValueString("label");
+               href = path(view.getValueString("tableName")) + "savedView/" + encode(name) + "/";
+            }
+         }
+         default ->
+         {
+            // Unknown persisted types are unavailable rather than exposing their cache.
+         }
+      }
+      return (entry(row, label, href));
+   }
+
+
+
+   /*******************************************************************************
+    ** Both table visibility and per-record security are checked by GetAction.
+    *******************************************************************************/
+   private static QRecord get(String table, Serializable id) throws QException
+   {
+      if(!canReadTable(table))
+      {
+         return (null);
+      }
+      GetInput input = new GetInput(table).withPrimaryKey(id).withShouldGenerateDisplayValues(true);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      try
+      {
+         return (new GetAction().execute(input).getRecord());
+      }
+      catch(QPermissionDeniedException expected)
+      {
+         return (null);
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Guard existence before invoking the core table permission helper.
+    *******************************************************************************/
+   private static boolean canReadTable(String table)
+   {
+      return (table != null && QContext.getQInstance().getTable(table) != null
+         && PermissionsHelper.hasTablePermission(new AbstractActionInput(), table, TablePermissionSubType.READ));
+   }
+
+
+
+   /*******************************************************************************
+    ** A missing href means unavailable; never substitute a cached label.
+    *******************************************************************************/
+   private static FavoriteEntry entry(QRecord row, String label, String href)
+   {
+      return (new FavoriteEntry(row.getValueInteger("id"), row.getValueString("targetType"), row.getValueString("targetName"),
+         row.getValueString("recordId"), href == null ? "Unavailable" : label == null ? row.getValueString("targetName") : label,
+         row.getValueString("folder"), row.getValueInteger("sortOrder"), href != null, href));
+   }
+
+
+
+   /*******************************************************************************
+    ** Shared canonical record href, with optional configured frontend origin.
+    *******************************************************************************/
+   public static String recordHref(String table, String id)
+   {
+      String base = CollaborationRecords.config().getFrontendBaseUrl();
+      return ((base == null ? "" : base.replaceAll("/+$", "")) + path(table) + encode(id));
+   }
+
+   /*******************************************************************************
+    ** Flat Next router path; trailing slash also supports dotted process names.
+    *******************************************************************************/
+   private static String path(String name)
+   {
+      return ("/app/" + encode(name) + "/");
+   }
+
+
+
+   /*******************************************************************************
+    ** Encode a single route segment, including slash, hash and spaces in ids.
+    *******************************************************************************/
+   public static String encode(String value)
+   {
+      return (URLEncoder.encode(value, StandardCharsets.UTF_8).replace("+", "%20"));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/WorkCleanup.java

@@ -0,0 +1,111 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.io.Serializable;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.actions.tables.listeners.RecordChangeEvent;
+import com.kingsrook.qqq.backend.core.actions.tables.listeners.RecordChangeListenerInterface;
+import com.kingsrook.qqq.backend.core.actions.tables.listeners.RecordChangeType;
+import com.kingsrook.qqq.backend.core.context.CapturedContext;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Trusted after-delete hook. Access requests deliberately survive parent deletion.
+ *******************************************************************************/
+public class WorkCleanup implements RecordChangeListenerInterface
+{
+   /*******************************************************************************
+    ** Host deletions only; extension deletes must not recursively invoke cleanup.
+    *******************************************************************************/
+   @Override
+   public boolean appliesTo(String table, RecordChangeType type)
+   {
+      return (type == RecordChangeType.DELETE && !table.startsWith(CollaborationQBitConfig.TABLE_NAME_PREFIX));
+   }
+
+   /*******************************************************************************
+    ** Defer cleanup until the parent deletion commits.
+    *******************************************************************************/
+   @Override
+   public void onRecordsChanged(RecordChangeEvent event) throws QException
+   {
+      if(!appliesTo(event.getTableName(), event.getType()))
+      {
+         return;
+      }
+      String table = event.getTableName();
+      String key = QContext.getQInstance().getTable(table).getPrimaryKeyField();
+      List<Serializable> ids = event.getRecords().stream().map(row -> row.getValue(key)).toList();
+      if(event.getTransaction() == null)
+      {
+         onParentsDeleted(table, ids);
+      }
+      else
+      {
+         CapturedContext context = new CapturedContext(QContext.getQInstance(), QContext.getQSession());
+         event.getTransaction().addAfterCommitCallback(() ->
+         {
+            try
+            {
+               QContext.withTemporaryContext(context, () -> onParentsDeleted(table, ids));
+            }
+            catch(QException e)
+            {
+               throw (new IllegalStateException("Could not clean up collaboration work", e));
+            }
+         });
+      }
+   }
+
+   /*******************************************************************************
+    ** Bounded batches and idempotent deletion also support explicit host callbacks.
+    *******************************************************************************/
+   public void onParentsDeleted(String table, List<? extends Serializable> ids) throws QException
+   {
+      if(ids.isEmpty())
+      {
+         return;
+      }
+      for(String child : List.of(CollaborationTables.TASK, CollaborationTables.RECORD_ASSIGNMENT, CollaborationTables.SHARE))
+      {
+         while(true)
+         {
+            List<QRecord> rows = CollaborationRecords.query(child, new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, table)
+               .withCriteria("recordId", QCriteriaOperator.IN, ids.stream().map(Object::toString).toList()).withLimit(200));
+            if(rows.isEmpty())
+            {
+               break;
+            }
+            for(QRecord row : rows)
+            {
+               CollaborationRecords.delete(child, row.getValue("id"));
+            }
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/WorkProcesses.java

@@ -0,0 +1,373 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.collaboration.assignment.AssignmentService;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qbits.collaboration.sharing.AccessRequestService;
+import com.kingsrook.qbits.collaboration.tasks.TasksService;
+import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLine;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLineInterface;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.Status;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QComponentType;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QFrontendComponentMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QFrontendStepMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.AbstractLoadStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.AbstractTransformStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.ExtractViaQueryStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.ProcessSummaryProviderInterface;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.StreamedETLWithFrontendProcess;
+
+/*******************************************************************************
+ ** Streamed Review/Result actions. Services reauthorize all writes at load time.
+ *******************************************************************************/
+public final class WorkProcesses
+{
+   /*******************************************************************************
+    ** Metadata factory.
+    *******************************************************************************/
+   private WorkProcesses()
+   {
+   }
+
+   /*******************************************************************************
+    ** Record actions stay on their source tables, never in app navigation.
+    *******************************************************************************/
+   public static List<QProcessMetaData> management()
+   {
+      return (List.of(process(CollaborationTables.ACCESS_REQUEST, "Grant", "Mark granted"), process(CollaborationTables.ACCESS_REQUEST, "Decline", "Decline"),
+         process(CollaborationTables.TASK, "Done", "Mark done"), process(CollaborationTables.TASK, "Reopen", "Reopen")));
+   }
+
+   /*******************************************************************************
+    ** Hosts opt in only tables without their own ownership columns.
+    *******************************************************************************/
+   public static List<QProcessMetaData> assignments(String table)
+   {
+      return (List.of(process(table, "Assign", "Assign to"), process(table, "Own", "Take ownership")));
+   }
+
+   /*******************************************************************************
+    ** Optional notes and assignee input precede the standard Review screen.
+    *******************************************************************************/
+   private static QProcessMetaData process(String table, String operation, String label)
+   {
+      boolean access = table.equals(CollaborationTables.ACCESS_REQUEST);
+      Map<String, Serializable> values = new HashMap<>();
+      values.put(StreamedETLWithFrontendProcess.FIELD_SOURCE_TABLE, table);
+      values.put(StreamedETLWithFrontendProcess.FIELD_DESTINATION_TABLE, table);
+      values.put(StreamedETLWithFrontendProcess.FIELD_SUPPORTS_FULL_VALIDATION, true);
+      values.put(StreamedETLWithFrontendProcess.FIELD_DO_FULL_VALIDATION, true);
+      values.put(StreamedETLWithFrontendProcess.FIELD_PREVIEW_MESSAGE, access
+         ? "Record the outcome; grant access in your identity system first." : label + " for the selected records.");
+      QProcessMetaData process = StreamedETLWithFrontendProcess.defineProcessMetaData(access ? AccessExtract.class : ExtractViaQueryStep.class, Review.class, Apply.class, values)
+         .withName("collaboration" + operation + "_" + table).withLabel(label).withTableName(table).withIcon(new QIcon("assignment"))
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.NOT_PROTECTED).withCustomPermissionChecker(new QCodeReference(ActionSecurity.class)));
+      if(access || operation.equals("Assign"))
+      {
+         QFieldMetaData field = new QFieldMetaData(access ? "note" : "assigneeUserId", access ? QFieldType.TEXT : QFieldType.STRING)
+            .withLabel(access ? "Note" : "Assignee user ID").withIsRequired(!access).withMaxLength(access ? 2000 : 255);
+         process.withStep(0, new QFrontendStepMetaData().withName("details").withLabel(label).withFormField(field)
+            .withComponent(new QFrontendComponentMetaData().withType(QComponentType.EDIT_FORM)));
+      }
+      return (process);
+   }
+
+   /*******************************************************************************
+    ** Operation and table come from installed process metadata.
+    *******************************************************************************/
+   private static String operation(RunBackendStepInput input)
+   {
+      return (input.getProcess().getName().substring("collaboration".length()).split("_")[0]);
+   }
+
+   /*******************************************************************************
+    ** Share the same dry-run authorization between Review and load.
+    *******************************************************************************/
+   private static void validate(RunBackendStepInput input, QRecord row) throws QException
+   {
+      String table = input.getProcess().getTableName();
+      if(table.equals(CollaborationTables.ACCESS_REQUEST))
+      {
+         new AccessRequestService().requireApprover(row.getValueInteger("id"));
+         WorkSupport.text(input.getValueString("note"), 2000, false);
+      }
+      else if(table.equals(CollaborationTables.TASK))
+      {
+         new TasksService().requireManager(row.getValueInteger("id"));
+      }
+      else
+      {
+         Serializable id = row.getValue(QContext.getQInstance().getTable(table).getPrimaryKeyField());
+         ParentRecordAccess.requireFeature(table, id, "assign");
+         if(operation(input).equals("Assign"))
+         {
+            WorkSupport.text(input.getValueString("assigneeUserId"), 255, true);
+            WorkSupport.requireReader(input.getValueString("assigneeUserId"), table, id);
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Preserve the role that the selected action does not modify.
+    *******************************************************************************/
+   private static void apply(RunBackendStepInput input, QRecord row) throws QException
+   {
+      validate(input, row);
+      String table = input.getProcess().getTableName();
+      String operation = operation(input);
+      if(table.equals(CollaborationTables.ACCESS_REQUEST))
+      {
+         new AccessRequestService().handle(row.getValueInteger("id"), operation.equals("Grant") ? "GRANTED" : "DECLINED", input.getValueString("note"));
+      }
+      else if(table.equals(CollaborationTables.TASK))
+      {
+         if(operation.equals("Done"))
+         {
+            new TasksService().complete(row.getValueInteger("id"));
+         }
+         else
+         {
+            new TasksService().reopen(row.getValueInteger("id"));
+         }
+      }
+      else
+      {
+         Serializable id = row.getValue(QContext.getQInstance().getTable(table).getPrimaryKeyField());
+         AssignmentService service = new AssignmentService();
+         QRecord old = service.get(table, id).orElse(new QRecord());
+         service.assign(table, id, operation.equals("Own") ? PersonalRecords.currentUserId() : old.getValueString("ownerUserId"),
+            operation.equals("Assign") ? input.getValueString("assigneeUserId") : old.getValueString("assigneeUserId"));
+      }
+   }
+
+   /*******************************************************************************
+    ** Consistent Review and Result counts.
+    *******************************************************************************/
+   private static ProcessSummaryLine line(Status status, String future, String past)
+   {
+      ProcessSummaryLine line = new ProcessSummaryLine(status, 0, null);
+      line.setSingularFutureMessage(future);
+      line.setPluralFutureMessage(future);
+      line.setSingularPastMessage(past);
+      line.setPluralPastMessage(past);
+      return (line);
+   }
+
+   /*******************************************************************************
+    ** Restrict action availability while keeping row authorization in the services.
+    *******************************************************************************/
+   public static class ActionSecurity implements CustomPermissionChecker
+   {
+      /*******************************************************************************
+       ** Access actions require admin or a configured approver permission.
+       *******************************************************************************/
+      @Override
+      public void checkPermissionsThrowing(AbstractActionInput input, MetaDataWithPermissionRules metadata) throws QPermissionDeniedException
+      {
+         PersonalRecords.currentUserId();
+         String table = ((QProcessMetaData) metadata).getTableName();
+         if(table.equals(CollaborationTables.ACCESS_REQUEST))
+         {
+            if(QContext.getQSession().hasPermission("collaboration.admin"))
+            {
+               return;
+            }
+            try
+            {
+               for(String host : QContext.getQInstance().getTables().keySet())
+               {
+                  if(!host.startsWith(CollaborationQBitConfig.TABLE_NAME_PREFIX)
+                     && QContext.getQSession().hasPermission(new AccessRequestService().approverPermission(host)))
+                  {
+                     return;
+                  }
+               }
+            }
+            catch(QException e)
+            {
+               throw (new QPermissionDeniedException("Could not resolve access approver permission", e));
+            }
+            throw (new QPermissionDeniedException("This needs the access approver permission."));
+         }
+         if(!table.equals(CollaborationTables.TASK))
+         {
+            try
+            {
+               ParentRecordAccess.requireTableFeature(table, "assign");
+            }
+            catch(QException e)
+            {
+               throw (new QPermissionDeniedException("This needs the table assign permission or EDIT.", e));
+            }
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Approvers can process requests without broadening requester/admin table reads.
+    *******************************************************************************/
+   public static class AccessExtract extends ExtractViaQueryStep
+   {
+      /*******************************************************************************
+       ** Only authorized rows enter the process pipe or appear in its preview.
+       *******************************************************************************/
+      @Override
+      public void run(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         int count = 0;
+         for(QRecord row : CollaborationRecords.query(CollaborationTables.ACCESS_REQUEST, getQueryFilter(input)))
+         {
+            new AccessRequestService().requireApprover(row.getValueInteger("id"));
+            getRecordPipe().addRecord(row);
+            count++;
+            if(getLimit() != null && count >= getLimit())
+            {
+               break;
+            }
+         }
+      }
+
+      /*******************************************************************************
+       ** Avoid exposing an unfiltered count outside the table owner lock.
+       *******************************************************************************/
+      @Override
+      public Integer doCount(RunBackendStepInput input)
+      {
+         return (null);
+      }
+   }
+
+   /*******************************************************************************
+    ** Review validates recipient access and authority without writing.
+    *******************************************************************************/
+   public static class Review extends AbstractTransformStep implements ProcessSummaryProviderInterface
+   {
+      private final ProcessSummaryLine selected = line(Status.OK, "records will be processed", "records processed");
+      private final ProcessSummaryLine skipped = line(Status.WARNING, "records unavailable (skipped)", "records skipped");
+
+      /*******************************************************************************
+       ** Only validated rows advance to load.
+       *******************************************************************************/
+      @Override
+      public void runOnePage(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         if(input.getProcess().getTableName().equals(CollaborationTables.ACCESS_REQUEST))
+         {
+            selected.setSingularFutureMessage("Record the outcome; grant access in your identity system first.");
+            selected.setPluralFutureMessage("Record the outcome; grant access in your identity system first.");
+         }
+         for(QRecord row : input.getRecords())
+         {
+            try
+            {
+               validate(input, row);
+               output.getRecords().add(row);
+               selected.incrementCountAndAddPrimaryKey(row.getValue(QContext.getQInstance().getTable(input.getProcess().getTableName()).getPrimaryKeyField()));
+            }
+            catch(QException expected)
+            {
+               skipped.incrementCountAndAddPrimaryKey(row.getValue("id"));
+            }
+         }
+      }
+
+      /*******************************************************************************
+       ** Explicit identity-system prerequisite accompanies access-request reviews.
+       *******************************************************************************/
+      @Override
+      public ArrayList<ProcessSummaryLineInterface> getProcessSummary(RunBackendStepOutput output, boolean isForResultScreen)
+      {
+         ArrayList<ProcessSummaryLineInterface> lines = new ArrayList<>();
+         selected.addSelfToListIfAnyCount(lines);
+         skipped.addSelfToListIfAnyCount(lines);
+         return (lines);
+      }
+   }
+
+   /*******************************************************************************
+    ** Result reports actual writes and any permission changes since Review.
+    *******************************************************************************/
+   public static class Apply extends AbstractLoadStep implements ProcessSummaryProviderInterface
+   {
+      private final ProcessSummaryLine done = line(Status.OK, "records will be processed", "records processed");
+      private final ProcessSummaryLine failed = line(Status.ERROR, "records cannot be processed", "records failed (retry required)");
+
+      /*******************************************************************************
+       ** Each write goes through its service authorization again.
+       *******************************************************************************/
+      @Override
+      public void runOnePage(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         for(QRecord row : input.getRecords())
+         {
+            try
+            {
+               apply(input, row);
+               done.incrementCountAndAddPrimaryKey(row.getValue("id"));
+            }
+            catch(QException expected)
+            {
+               failed.incrementCountAndAddPrimaryKey(row.getValue("id"));
+            }
+         }
+      }
+
+      /*******************************************************************************
+       ** Retain Review skips alongside successful and failed loads.
+       *******************************************************************************/
+      @Override
+      public ArrayList<ProcessSummaryLineInterface> getProcessSummary(RunBackendStepOutput output, boolean isForResultScreen)
+      {
+         ArrayList<ProcessSummaryLineInterface> lines = new ArrayList<>();
+         done.addSelfToListIfAnyCount(lines);
+         failed.addSelfToListIfAnyCount(lines);
+         if(getTransformStep() instanceof Review review)
+         {
+            review.skipped.addSelfToListIfAnyCount(lines);
+         }
+         return (lines);
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/WorkSupport.java

@@ -0,0 +1,96 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.io.Serializable;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.people.PeopleService;
+import com.kingsrook.qbits.collaboration.security.OtherUserAccess;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Shared validation for service-managed work records.
+ *******************************************************************************/
+public final class WorkSupport
+{
+   /*******************************************************************************
+    ** Static helpers only.
+    *******************************************************************************/
+   private WorkSupport()
+   {
+   }
+
+   /*******************************************************************************
+    ** Look up an extension row and enforce its parent before returning data.
+    *******************************************************************************/
+   public static QRecord visible(String table, Integer id) throws QException
+   {
+      QRecord row = row(table, id);
+      if(Boolean.TRUE.equals(row.getValueBoolean("parentDeleted")))
+      {
+         throw (new QNotFoundException("Not found"));
+      }
+      ParentRecordAccess.requireVisibleParent(row.getValueString("tableName"), row.getValueString("recordId"));
+      return (row);
+   }
+
+   /*******************************************************************************
+    ** Trusted lookup: callers must authorize ownership or parent access themselves.
+    *******************************************************************************/
+   public static QRecord row(String table, Integer id) throws QException
+   {
+      List<QRecord> rows = CollaborationRecords.query(table, new QQueryFilter().withCriteria("id", QCriteriaOperator.EQUALS, id));
+      if(rows.isEmpty())
+      {
+         throw (new QNotFoundException("Not found"));
+      }
+      return (rows.getFirst());
+   }
+
+   /*******************************************************************************
+    ** Self passes after the caller's parent check; unknown others fail closed.
+    *******************************************************************************/
+   public static void requireReader(String user, String table, Serializable id) throws QException
+   {
+      if(user != null && (user.isBlank() || (!user.equals(PersonalRecords.currentUserId())
+         && !new OtherUserAccess().canRead(user, table, id).orElse(false))))
+      {
+         throw (new QException(new PeopleService().displayName(user) + " can't open this record."));
+      }
+   }
+
+   /*******************************************************************************
+    ** Bounded text validation before any write or notification.
+    *******************************************************************************/
+   public static void text(String value, int max, boolean required) throws QException
+   {
+      if((required && (value == null || value.isBlank())) || (value != null && value.length() > max))
+      {
+         throw (new QException("Text must contain " + (required ? "1" : "0") + " to " + max + " characters."));
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/activity/ActivityWriter.java

@@ -0,0 +1,53 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.activity;
+
+import java.time.Instant;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Internal activity writer; the calling service has already checked the parent.
+ *******************************************************************************/
+public final class ActivityWriter
+{
+   /*******************************************************************************
+    ** Static service boundary.
+    *******************************************************************************/
+   private ActivityWriter()
+   {
+   }
+
+   /*******************************************************************************
+    ** Store references, never copies of comment bodies or attachment contents.
+    *******************************************************************************/
+   public static void write(String table, String recordId, String type, String summary, String refTable, String refId) throws QException
+   {
+      CollaborationRecords.insert(CollaborationTables.ACTIVITY, new QRecord().withValue("tableName", table).withValue("recordId", recordId)
+         .withValue("at", Instant.now()).withValue("actorUserId", CollaborationSecurity.userId(QContext.getQSession()))
+         .withValue("type", type).withValue("summary", summary).withValue("refTableName", refTable).withValue("refId", refId).withValue("parentDeleted", false));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/app/CollaborationHome.java

@@ -26,15 +26,23 @@ import java.time.Instant;
 import java.time.temporal.ChronoUnit;
 import java.util.List;
 import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
 import com.kingsrook.qbits.collaboration.model.CollaborationTables;
 import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
 import com.kingsrook.qqq.backend.core.actions.dashboard.widgets.AbstractWidgetRenderer;
 import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.AggregateAction;
 import com.kingsrook.qqq.backend.core.actions.tables.CountAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.Aggregate;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateResult;
 import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterCriteria;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
 import com.kingsrook.qqq.backend.core.model.actions.widgets.RenderWidgetInput;
 import com.kingsrook.qqq.backend.core.model.actions.widgets.RenderWidgetOutput;
@@ -75,7 +83,7 @@ public final class CollaborationHome
          .withPermissionRules(CollaborationPermissions.permissionRules())
          .withWidgets(List.of(HOME_WIDGET))
          .withSection(new QAppSection().withName("collaboration").withLabel("Collaboration").withIcon(new QIcon("forum"))
-            .withTables(List.of(CollaborationTables.FEATURE_SETTING, CollaborationTables.USER)));
+            .withTables(List.of(CollaborationTables.COMMENT, CollaborationTables.ATTACHMENT, CollaborationTables.TAG, CollaborationTables.TASK, CollaborationTables.SHARE, CollaborationTables.ACCESS_REQUEST, CollaborationTables.RECORD_ASSIGNMENT, CollaborationTables.ACTIVITY, CollaborationTables.FEATURE_SETTING, CollaborationTables.USER)));
       app.setParentAppName(config.getParentAppName());
       return (app);
    }
@@ -100,6 +108,7 @@ public final class CollaborationHome
     *******************************************************************************/
    public static String render(Instant now) throws QException
    {
+      CollaborationSecurity.ensureSessionKeys(QContext.getQInstance(), QContext.getQSession());
       StringBuilder html = new StringBuilder("<div style=\"display:flex;flex-direction:column;gap:1rem;width:100%;overflow-wrap:anywhere;\"><section><h3>Feature settings</h3>");
       long settings = count(CollaborationTables.FEATURE_SETTING, new QQueryFilter());
       if(settings == 0)
@@ -128,7 +137,94 @@ public final class CollaborationHome
       {
          html.append("<p>No people yet: the directory will be filled by collaboration calls when the feature services are installed.</p>");
       }
-      return (html.append("</section></div>").toString());
+      html.append("</section>");
+      personalSummary(html, CollaborationTables.FAVORITE, "Favorites");
+      personalSummary(html, CollaborationTables.RECENT, "Recently viewed");
+      attachmentSummary(html);
+      tagSummary(html);
+      html.append("<section><h3>Open access requests</h3><p>").append(count(CollaborationTables.ACCESS_REQUEST,
+         new QQueryFilter().withCriteria("status", QCriteriaOperator.EQUALS, "OPEN"))).append("</p></section>");
+      html.append("<section><h3>Open tasks</h3><p>").append(count(CollaborationTables.TASK,
+         new QQueryFilter().withCriteria("status", QCriteriaOperator.EQUALS, "OPEN"))).append("</p></section>");
+      html.append("<section><h3>Overdue tasks</h3><p>").append(count(CollaborationTables.TASK,
+         new QQueryFilter().withCriteria("status", QCriteriaOperator.EQUALS, "OPEN").withCriteria("dueAt", QCriteriaOperator.LESS_THAN, now))).append("</p></section>");
+      html.append("<section><h3>Shares this week</h3><p>").append(count(CollaborationTables.SHARE,
+         new QQueryFilter().withCriteria("sentAt", QCriteriaOperator.GREATER_THAN_OR_EQUALS, now.minus(7, ChronoUnit.DAYS))
+            .withCriteria("sentAt", QCriteriaOperator.LESS_THAN_OR_EQUALS, now))).append("</p></section>");
+      html.append("<section><h3>Comments this week</h3><p>").append(count(CollaborationTables.COMMENT, new QQueryFilter()
+         .withCriteria("createDate", QCriteriaOperator.GREATER_THAN_OR_EQUALS, now.minus(7, ChronoUnit.DAYS))
+         .withCriteria("createDate", QCriteriaOperator.LESS_THAN_OR_EQUALS, now).withCriteria("deletedAt", QCriteriaOperator.IS_BLANK))).append("</p></section>");
+      html.append("<section><h3>Open threads</h3><p>").append(count(CollaborationTables.COMMENT, new QQueryFilter()
+         .withCriteria("threadId", QCriteriaOperator.IS_BLANK).withCriteria("resolvedAt", QCriteriaOperator.IS_BLANK)
+         .withCriteria("deletedAt", QCriteriaOperator.IS_BLANK))).append("</p></section>");
+      if(QContext.getQSession().hasPermission(CollaborationPermissions.ADMIN))
+      {
+         html.append("<section><h3>Followers</h3><p>").append(count(CollaborationTables.FOLLOW, new QQueryFilter())).append("</p></section>");
+      }
+      html.append("<p>Conversation totals are approximate where parent record locks require post-filtering.</p>");
+      return (html.append("</div>").toString());
+   }
+
+
+
+   /*******************************************************************************
+    ** Caller-filtered vocabulary totals and five most used active tags.
+    *******************************************************************************/
+   private static void tagSummary(StringBuilder html) throws QException
+   {
+      QQueryFilter active = new QQueryFilter().withCriteria("mergedIntoTagId", QCriteriaOperator.IS_BLANK);
+      html.append("<section><h3>Tags</h3><p>Vocabulary size: ").append(count(CollaborationTables.TAG, active))
+         .append("</p><p>Pending suggestions: ").append(count(CollaborationTables.TAG, new QQueryFilter()
+            .withCriteria("mergedIntoTagId", QCriteriaOperator.IS_BLANK).withCriteria("approved", QCriteriaOperator.EQUALS, false)))
+         .append("</p><ul>");
+      com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput input = new com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput(CollaborationTables.TAG)
+         .withFilter(active.withCriteria("approved", QCriteriaOperator.EQUALS, true).withOrderBy(new QFilterOrderBy("usageCount", false)).withOrderBy(new QFilterOrderBy("label")).withLimit(5));
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      for(com.kingsrook.qqq.backend.core.model.data.QRecord tag : new com.kingsrook.qqq.backend.core.actions.tables.QueryAction().execute(input).getRecords())
+      {
+         html.append("<li>").append(tag.getValueString("label").replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;"))
+            .append(": ").append(tag.getValueInteger("usageCount")).append("</li>");
+      }
+      html.append("</ul></section>");
+   }
+
+   /*******************************************************************************
+    ** Real table aggregates, restricted to readable parent tables. Parent locks
+    ** are post-filtered on rows, so these aggregate totals are approximate.
+    *******************************************************************************/
+   private static void attachmentSummary(StringBuilder html) throws QException
+   {
+      Aggregate count = new Aggregate().withFieldName("id").withOperator(AggregateOperator.COUNT);
+      Aggregate bytes = new Aggregate().withFieldName("sizeBytes").withOperator(AggregateOperator.SUM);
+      AggregateInput input = new AggregateInput(CollaborationTables.ATTACHMENT).withAggregates(List.of(count, bytes));
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      List<AggregateResult> results = new AggregateAction().execute(input).getResults();
+      Object rowCount = results.isEmpty() ? 0 : results.getFirst().getAggregateValue(count);
+      Object totalBytes = results.isEmpty() ? 0 : results.getFirst().getAggregateValue(bytes);
+      html.append("<section><h3>Attachments</h3><p>Attachments: ").append(rowCount)
+         .append("</p><p>Total size (bytes): ").append(totalBytes == null ? 0 : totalBytes)
+         .append("</p><p>Approximate totals: parent record locks are applied when browsing attachments.</p>");
+      if("0".equals(String.valueOf(rowCount)))
+      {
+         html.append("<p>No attachments yet.</p>");
+      }
+      html.append("</section>");
+   }
+
+
+
+   /*******************************************************************************
+    ** Aggregate rows and distinct owners without loading high-volume personal data.
+    *******************************************************************************/
+   private static void personalSummary(StringBuilder html, String table, String label) throws QException
+   {
+      Aggregate rows = new Aggregate().withFieldName("id").withOperator(AggregateOperator.COUNT);
+      Aggregate users = new Aggregate().withFieldName("userId").withOperator(AggregateOperator.COUNT_DISTINCT);
+      AggregateInput input = new AggregateInput(table).withAggregates(List.of(rows, users));
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      List<AggregateResult> results = new AggregateAction().execute(input).getResults();
+      html.append("<section><h3>").append(label).append("</h3><p>Rows: ").append(results.isEmpty() ? 0 : results.getFirst().getAggregateValue(rows))
+         .append("</p><p>Distinct users: ").append(results.isEmpty() ? 0 : results.getFirst().getAggregateValue(users)).append("</p></section>");
    }
 
 

src/main/java/com/kingsrook/qbits/collaboration/assignment/AssignmentService.java

@@ -0,0 +1,156 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.assignment;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.WorkSupport;
+import com.kingsrook.qbits.collaboration.activity.ActivityWriter;
+import com.kingsrook.qbits.collaboration.follow.FollowService;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.notify.CollaborationNotification;
+import com.kingsrook.qbits.collaboration.notify.Notifications;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Ownership storage for hosts without native RecordOwnership columns.
+ *******************************************************************************/
+public class AssignmentService
+{
+   /*******************************************************************************
+    ** Full replacement of both roles; null clears a role.
+    *******************************************************************************/
+   public QRecord assign(String table, Serializable recordId, String ownerUserId, String assigneeUserId) throws QException
+   {
+      ParentRecordAccess.requireFeature(table, recordId, "assign");
+      String id = FollowService.canonicalId(table, recordId);
+      WorkSupport.requireReader(ownerUserId, table, id);
+      WorkSupport.requireReader(assigneeUserId, table, id);
+      synchronized(CollaborationRecords.config())
+      {
+         Optional<QRecord> old = get(table, id);
+         QRecord change = new QRecord().withValue("ownerUserId", ownerUserId).withValue("assigneeUserId", assigneeUserId);
+         QRecord row;
+         if(old.isEmpty())
+         {
+            row = CollaborationRecords.insert(CollaborationTables.RECORD_ASSIGNMENT, change.withValue("tableName", table).withValue("recordId", id).withValue("parentDeleted", false));
+         }
+         else
+         {
+            CollaborationRecords.update(CollaborationTables.RECORD_ASSIGNMENT, change.withValue("id", old.get().getValue("id")));
+            row = get(table, id).orElseThrow();
+         }
+         ActivityWriter.write(table, id, "ASSIGNED", "Record assignment changed", CollaborationTables.RECORD_ASSIGNMENT, row.getValueString("id"));
+         if(assigneeUserId != null && (old.isEmpty() || !Objects.equals(old.get().getValueString("assigneeUserId"), assigneeUserId)))
+         {
+            new FollowService().ensureFollower(assigneeUserId, table, id, "ASSIGNED");
+            if(!assigneeUserId.equals(PersonalRecords.currentUserId()))
+            {
+               Notifications.send(new CollaborationNotification(assigneeUserId, "A record was assigned to you", null,
+                  CollaborationNotification.Category.TASK, table, id, Notifications.link(table, id)));
+            }
+         }
+         return (row);
+      }
+   }
+
+   /*******************************************************************************
+    ** Parent readers can see assignment independently of the admin-only table nav.
+    *******************************************************************************/
+   public Optional<QRecord> get(String table, Serializable recordId) throws QException
+   {
+      return (CollaborationRecords.query(CollaborationTables.RECORD_ASSIGNMENT, CollaborationRecords.parent(table, FollowService.canonicalId(table, recordId))).stream().findFirst());
+   }
+
+   /*******************************************************************************
+    ** Counts cover all visible matches; limit bounds the rows returned per table.
+    *******************************************************************************/
+   public Map<String, Group> myRecords(String table, Integer limit) throws QException
+   {
+      int size = limit == null ? 20 : limit;
+      if(size < 1 || size > 100)
+      {
+         throw (new QException("Limit must be between 1 and 100."));
+      }
+      Map<String, List<QRecord>> groups = new LinkedHashMap<>();
+      for(QRecord row : mineRows(table, false))
+      {
+         groups.computeIfAbsent(row.getValueString("tableName"), key -> new ArrayList<>()).add(row);
+      }
+      Map<String, Group> result = new LinkedHashMap<>();
+      groups.forEach((name, rows) -> result.put(name, new Group((long) rows.size(), rows.stream().limit(size).toList())));
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Fresh parent checks protect both personal rows and counts after access changes.
+    *******************************************************************************/
+   public List<QRecord> mineRows(String table, Boolean assignedOnly) throws QException
+   {
+      String user = PersonalRecords.currentUserId();
+      QQueryFilter roles = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR).withCriteria("assigneeUserId", QCriteriaOperator.EQUALS, user);
+      if(!Boolean.TRUE.equals(assignedOnly))
+      {
+         roles.withCriteria("ownerUserId", QCriteriaOperator.EQUALS, user);
+      }
+      QQueryFilter filter = new QQueryFilter().withSubFilter(roles).withCriteria("parentDeleted", QCriteriaOperator.EQUALS, false)
+         .withOrderBy(new QFilterOrderBy("tableName")).withOrderBy(new QFilterOrderBy("id"));
+      if(table != null)
+      {
+         filter.withCriteria("tableName", QCriteriaOperator.EQUALS, table);
+      }
+      List<QRecord> visible = new ArrayList<>();
+      for(QRecord row : CollaborationRecords.query(CollaborationTables.RECORD_ASSIGNMENT, filter))
+      {
+         try
+         {
+            ParentRecordAccess.requireVisibleParent(row.getValueString("tableName"), row.getValueString("recordId"));
+            visible.add(row);
+         }
+         catch(QNotFoundException expected)
+         {
+            // Revoked access must not contribute even to the count.
+         }
+      }
+      return (visible);
+   }
+
+   /*******************************************************************************
+    ** Total and first page for one host table.
+    *******************************************************************************/
+   public record Group(Long count, List<QRecord> records)
+   {
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentCleanup.java

@@ -0,0 +1,80 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import java.io.Serializable;
+import java.util.List;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Trusted after-commit callback. Wire to core RecordReferenceCleanupInterface
+ ** when released. Never expose as a user endpoint: the parent is already gone.
+ *******************************************************************************/
+public class AttachmentCleanup
+{
+   private final AttachmentsService service;
+
+   /*******************************************************************************
+    ** Production cleanup using the installed qbit and object storage.
+    *******************************************************************************/
+   public AttachmentCleanup()
+   {
+      this(new AttachmentsService());
+   }
+
+   /*******************************************************************************
+    ** Use the same storage boundary as normal deletion.
+    *******************************************************************************/
+   public AttachmentCleanup(AttachmentsService service)
+   {
+      this.service = service;
+   }
+
+   /*******************************************************************************
+    ** Repeated calls are safe; provider failures leave the row for a later retry.
+    *******************************************************************************/
+   public void onParentsDeleted(String table, List<? extends Serializable> ids) throws QException
+   {
+      if(ids.isEmpty())
+      {
+         return;
+      }
+      new com.kingsrook.qbits.collaboration.WorkCleanup().onParentsDeleted(table, ids);
+      new com.kingsrook.qbits.collaboration.tags.TagsService().onParentsDeleted(table, ids);
+      while(true)
+      {
+         List<QRecord> rows = AttachmentRecords.query(new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, table)
+            .withCriteria("recordId", QCriteriaOperator.IN, ids.stream().map(Object::toString).toList()).withLimit(200));
+         if(rows.isEmpty())
+         {
+            return;
+         }
+         for(QRecord row : rows)
+         {
+            service.deleteStoredRow(row);
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentEntry.java

@@ -0,0 +1,32 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import java.time.Instant;
+
+/*******************************************************************************
+ ** Panel DTO. Storage locations and ephemeral signed URLs stay server-side.
+ *******************************************************************************/
+public record AttachmentEntry(Integer id, String tableName, String recordId, String fileName, String contentType,
+   Long sizeBytes, String sha256, String description, String createdByUserId, Instant createDate, Boolean canDelete)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentPreviewCustomizer.java

@@ -0,0 +1,100 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import java.util.ArrayList;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizerInterface;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.logging.QLogger;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrGetInputInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Filter invisible parents before generating ephemeral preview/download URLs.
+ ** Counts are approximate and pages can be short until core mirrors locks.
+ *******************************************************************************/
+public class AttachmentPreviewCustomizer implements TableCustomizerInterface
+{
+   private static final QLogger LOG = QLogger.getLogger(AttachmentPreviewCustomizer.class);
+
+   /*******************************************************************************
+    ** GetAction expects one result: throw Not found rather than return an empty list.
+    *******************************************************************************/
+   @Override
+   public List<QRecord> postQuery(QueryOrGetInputInterface input, List<QRecord> records) throws QException
+   {
+      return (filter(records, input instanceof GetInput, new AttachmentsService()));
+   }
+
+   /*******************************************************************************
+    ** Keep filtering every row even when the preview generation cap is reached.
+    *******************************************************************************/
+   List<QRecord> filter(List<QRecord> records, boolean isGet, AttachmentsService service) throws QException
+   {
+      List<QRecord> visible = new ArrayList<>();
+      for(QRecord record : records)
+      {
+         try
+         {
+            if(Boolean.TRUE.equals(record.getValueBoolean("parentDeleted")))
+            {
+               throw (new QNotFoundException("Not found"));
+            }
+            ParentRecordAccess.requireVisibleParent(record.getValueString("tableName"), record.getValueString("recordId"));
+         }
+         catch(QNotFoundException expected)
+         {
+            if(isGet)
+            {
+               throw (expected);
+            }
+            continue;
+         }
+         // Never retain URLs from a previous read of a memory-backend record.
+         QRecord row = new QRecord(record);
+         row.setValue("previewUrl", null);
+         row.setValue("downloadUrl", null);
+         row.withDisplayValue("downloadUrl", null).withDisplayValue("downloadUrl:downloadUrlDynamic", null);
+         visible.add(row);
+         if(visible.size() <= 200)
+         {
+            try
+            {
+               row.setValue("previewUrl", service.url(row, true).toString());
+               String downloadUrl = service.url(row, false).toString();
+               row.setValue("downloadUrl", downloadUrl);
+               row.withDisplayValue("downloadUrl", row.getValueString("fileName"))
+                  .withDisplayValue("downloadUrl:downloadUrlDynamic", downloadUrl);
+            }
+            catch(RuntimeException e)
+            {
+               LOG.debug("Could not make an attachment preview URL", e);
+            }
+         }
+      }
+      return (visible);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentRecords.java

@@ -0,0 +1,83 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Package-private raw reads for services and trusted parent cleanup. Callers
+ ** must check the parent before exposing any values or performing user writes.
+ *******************************************************************************/
+final class AttachmentRecords
+{
+   /*******************************************************************************
+    ** Static persistence helpers only.
+    *******************************************************************************/
+   private AttachmentRecords()
+   {
+   }
+
+   /*******************************************************************************
+    ** Use a per-input clone so shared metadata and session remain unchanged.
+    *******************************************************************************/
+   static List<QRecord> query(QQueryFilter filter) throws QException
+   {
+      QueryInput input = new QueryInput(CollaborationTables.ATTACHMENT).withFilter(filter).withShouldFetchHeavyFields(true);
+      input.setTableMetaData(storageTable());
+      input.withPermissionBypass("Attachment service checks parent access; cleanup is a trusted after-delete callback.");
+      return (new QueryAction().execute(input).getRecords());
+   }
+
+   /*******************************************************************************
+    ** Internal persistence must not generate URLs or filter a deleted parent.
+    ** Clone only this action's metadata; retain auditing and backend behavior.
+    *******************************************************************************/
+   static QTableMetaData storageTable()
+   {
+      return (QContext.getQInstance().getTable(CollaborationTables.ATTACHMENT).clone().withCustomizers(null));
+   }
+
+   /*******************************************************************************
+    ** QQQ validation errors may be returned on rows rather than thrown.
+    *******************************************************************************/
+   static void checkErrors(List<QRecord> records) throws QException
+   {
+      if(records != null)
+      {
+         for(QRecord record : records)
+         {
+            if(record.getErrors() != null && !record.getErrors().isEmpty())
+            {
+               throw (new QException("Could not save attachment: " + record.getErrors()));
+            }
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentSecurity.java

@@ -0,0 +1,66 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissionChecker;
+import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrCountInputInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
+
+/*******************************************************************************
+ ** RC.5 has no PRE_QUERY customizer. Its permission checker provides the
+ ** pre-query restriction for query, count and aggregate; post-query checks
+ ** handle parent record locks. Direct writes must use the attachment service.
+ *******************************************************************************/
+public class AttachmentSecurity implements CustomPermissionChecker
+{
+   /*******************************************************************************
+    ** Browse requires collaboration.view; writes cannot bypass storage lifecycle.
+    *******************************************************************************/
+   @Override
+   public void checkPermissionsThrowing(AbstractActionInput input, MetaDataWithPermissionRules metadata) throws QPermissionDeniedException
+   {
+      if(input instanceof InsertInput || input instanceof UpdateInput || input instanceof DeleteInput)
+      {
+         throw (new QPermissionDeniedException("Use the attachment service or Delete attachments action."));
+      }
+      new CollaborationPermissionChecker().checkPermissionsThrowing(input, metadata);
+      if(input instanceof QueryOrCountInputInterface query)
+      {
+         restrict(query);
+      }
+   }
+
+   /*******************************************************************************
+    ** AND the restriction outside any user OR clauses; preserve paging and sort.
+    ** Counts and aggregates are approximate because parent locks are post-filtered.
+    *******************************************************************************/
+   public static void restrict(QueryOrCountInputInterface input)
+   {
+      com.kingsrook.qbits.collaboration.security.ParentTableRestriction.restrict(input);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentStorage.java

@@ -0,0 +1,84 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import java.net.URL;
+import java.util.UUID;
+import com.kingsrook.qbits.objectstorage.api.DeleteMode;
+import com.kingsrook.qbits.objectstorage.api.DeleteRequest;
+import com.kingsrook.qbits.objectstorage.api.ObjectStorage;
+import com.kingsrook.qbits.objectstorage.api.PresignGet;
+import com.kingsrook.qbits.objectstorage.api.PutRequest;
+import com.kingsrook.qbits.objectstorage.api.StorageBucket;
+
+/*******************************************************************************
+ ** Narrow storage boundary. The caller must check collaboration access first.
+ ** Tests can substitute an in-memory implementation without an S3 service.
+ *******************************************************************************/
+public class AttachmentStorage
+{
+   /*******************************************************************************
+    ** Tag storage operations as the calling qbit, retaining the initiating user.
+    *******************************************************************************/
+   private StorageBucket bucket(String name)
+   {
+      return (ObjectStorage.asSystem("collaboration", UUID.randomUUID().toString()).bucket(name));
+   }
+
+   /*******************************************************************************
+    ** The bucket's own upload cap, when object storage exposes it through its api
+    ** package.  It does not yet (requested from qbit-object-storage), so this
+    ** returns Long.MAX_VALUE: collaboration enforces its configured per-table cap,
+    ** and object storage still enforces the bucket's cap when the object is put.
+    *******************************************************************************/
+   public long maxBytes(String name)
+   {
+      return (Long.MAX_VALUE);
+   }
+
+   /*******************************************************************************
+    ** Put a bounded stream through object storage's multipart implementation.
+    *******************************************************************************/
+   public void put(String name, PutRequest request)
+   {
+      bucket(name).put(request);
+   }
+
+   /*******************************************************************************
+    ** Prefer soft deletion; allow permanent deletion only where no soft mode exists.
+    *******************************************************************************/
+   public void delete(String name, String key)
+   {
+      if(bucket(name).delete(DeleteRequest.of(key).withAllowPermanentWhenNoSoftDelete(true)).getMode() == DeleteMode.SKIPPED_OBJECT_LOCK)
+      {
+         throw (new IllegalStateException("Object retention prevents attachment deletion."));
+      }
+   }
+
+   /*******************************************************************************
+    ** Create a temporary link, never a persistent table value.
+    *******************************************************************************/
+   public URL presign(String name, PresignGet request)
+   {
+      return (bucket(name).presignGet(request));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentsService.java

@@ -0,0 +1,399 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.Serializable;
+import java.net.URL;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.time.Duration;
+import java.util.ArrayList;
+import java.util.HexFormat;
+import java.util.List;
+import java.util.Locale;
+import java.util.UUID;
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qbits.objectstorage.api.PresignGet;
+import com.kingsrook.qbits.objectstorage.api.PutRequest;
+import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Attachment operations with parent access checked using the caller's session.
+ *******************************************************************************/
+public class AttachmentsService
+{
+   private final CollaborationQBitConfig config;
+   private final AttachmentStorage storage;
+
+   /*******************************************************************************
+    ** Resolve the installed configuration without a global mutable singleton.
+    *******************************************************************************/
+   public AttachmentsService()
+   {
+      this((CollaborationQBitConfig) QContext.getQInstance().getQBits().values().stream()
+         .filter(qbit -> qbit.getConfig() instanceof CollaborationQBitConfig).findFirst().orElseThrow().getConfig(), new AttachmentStorage());
+   }
+
+   /*******************************************************************************
+    ** Injectable storage boundary for deterministic service tests.
+    *******************************************************************************/
+   public AttachmentsService(CollaborationQBitConfig config, AttachmentStorage storage)
+   {
+      this.config = config;
+      this.storage = storage;
+   }
+
+   /*******************************************************************************
+    ** Stream to a bounded temporary file while hashing, then put and insert.
+    ** The caller owns the input stream. Oversize files never reach object storage.
+    *******************************************************************************/
+   public AttachmentEntry upload(String tableName, Serializable recordId, String fileName, String contentType, InputStream stream, String description) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      ParentRecordAccess.requireFeature(tableName, recordId, "attach");
+      String user = requireUser();
+      String id = canonicalId(tableName, recordId);
+      String name = sanitize(fileName);
+      String bucket = config.getAttachmentsBucketName();
+      String key = "attachments/" + segment(tableName) + "/" + segment(id) + "/" + UUID.randomUUID() + "/" + name;
+      if(tableName.length() > 128 || id.length() > 64 || user.length() > 255 || bucket.length() > 255 || key.length() > 1024
+         || (contentType != null && contentType.length() > 255))
+      {
+         throw (new QException("Attachment metadata exceeds the supported field lengths."));
+      }
+      long limit = Math.min(config.getDefaultMaxBytes(), storage.maxBytes(bucket));
+      Path temporary = null;
+      try
+      {
+         MessageDigest digest = MessageDigest.getInstance("SHA-256");
+         temporary = Files.createTempFile("collaboration-attachment-", ".upload");
+         long size = 0;
+         try(OutputStream out = Files.newOutputStream(temporary))
+         {
+            byte[] buffer = new byte[8192];
+            int read;
+            while((read = stream.read(buffer)) != -1)
+            {
+               if(read > limit - size)
+               {
+                  throw (new QException("Attachment exceeds the size limit of " + limit + " bytes."));
+               }
+               size += read;
+               digest.update(buffer, 0, read);
+               out.write(buffer, 0, read);
+            }
+         }
+         String type = contentType == null || contentType.isBlank() ? "application/octet-stream" : contentType;
+         try(InputStream upload = Files.newInputStream(temporary))
+         {
+            storage.put(bucket, PutRequest.of(key, upload).withContentLength(size).withContentType(type).withContentDisposition("inline"));
+         }
+         boolean rowSaved = false;
+         try
+         {
+            QRecord row = new QRecord().withValue("tableName", tableName).withValue("recordId", id).withValue("fileName", name)
+               .withValue("contentType", type).withValue("sizeBytes", size).withValue("sha256", HexFormat.of().formatHex(digest.digest()))
+               .withValue("bucketName", bucket).withValue("storageKey", key).withValue("description", description)
+               .withValue("createdByUserId", user).withValue("parentDeleted", false);
+            InsertInput input = new InsertInput(CollaborationTables.ATTACHMENT).withRecords(List.of(row));
+            input.withPermissionBypass("AttachmentsService checked parent and attach permission before upload.");
+            List<QRecord> records = new InsertAction().execute(input).getRecords();
+            AttachmentRecords.checkErrors(records);
+            rowSaved = true;
+            com.kingsrook.qbits.collaboration.activity.ActivityWriter.write(tableName, id, "FILE_ADDED", "File added", CollaborationTables.ATTACHMENT, records.getFirst().getValueString("id"));
+            return (entry(records.getFirst()));
+         }
+         catch(QException | RuntimeException failure)
+         {
+            try
+            {
+               if(!rowSaved)
+               {
+                  storage.delete(bucket, key);
+               }
+            }
+            catch(RuntimeException cleanupFailure)
+            {
+               failure.addSuppressed(cleanupFailure);
+            }
+            throw (failure);
+         }
+      }
+      catch(IOException | NoSuchAlgorithmException e)
+      {
+         throw (new QException("Could not read attachment upload", e));
+      }
+      finally
+      {
+         if(temporary != null)
+         {
+            try
+            {
+               Files.deleteIfExists(temporary);
+            }
+            catch(IOException e)
+            {
+               temporary.toFile().deleteOnExit();
+            }
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Newest first, independently of collaboration.view.
+    *******************************************************************************/
+   public List<AttachmentEntry> list(String tableName, Serializable recordId) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      String id = canonicalId(tableName, recordId);
+      List<AttachmentEntry> entries = new ArrayList<>();
+      for(QRecord row : AttachmentRecords.query(new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, tableName)
+         .withCriteria("recordId", QCriteriaOperator.EQUALS, id).withCriteria("parentDeleted", QCriteriaOperator.NOT_EQUALS, true)
+         .withOrderBy(new QFilterOrderBy("createDate", false)).withOrderBy(new QFilterOrderBy("id", false))))
+      {
+         entries.add(entry(row));
+      }
+      return (entries);
+   }
+
+   /*******************************************************************************
+    ** Re-check the attachment's actual parent before signing a five-minute GET.
+    ** Inline uses the stored inline header; RC.2 only overrides attachment names.
+    *******************************************************************************/
+   public URL downloadUrl(Serializable attachmentId, boolean inline) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      return (url(requireRow(attachmentId), inline));
+   }
+
+   /*******************************************************************************
+    ** Sign an already-authorized row, also used by the preview customizer.
+    *******************************************************************************/
+   URL url(QRecord row, boolean inline)
+   {
+      PresignGet request = PresignGet.of(row.getValueString("storageKey")).ttl(Duration.ofMinutes(5));
+      if(!inline)
+      {
+         request.downloadAs(row.getValueString("fileName"));
+      }
+      return (storage.presign(row.getValueString("bucketName"), request));
+   }
+
+   /*******************************************************************************
+    ** Authorize all selected rows before the first storage mutation.
+    *******************************************************************************/
+   public void delete(List<? extends Serializable> attachmentIds) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      List<QRecord> rows = new ArrayList<>();
+      for(Serializable id : attachmentIds.stream().distinct().toList())
+      {
+         rows.add(requireMutable(id));
+      }
+      for(QRecord row : rows)
+      {
+         deleteStoredRow(row);
+         com.kingsrook.qbits.collaboration.activity.ActivityWriter.write(row.getValueString("tableName"), row.getValueString("recordId"), "FILE_REMOVED", "File removed", CollaborationTables.ATTACHMENT, row.getValueString("id"));
+      }
+   }
+
+   /*******************************************************************************
+    ** Change display metadata only; the immutable storage key stays stable.
+    ** Null means unchanged; an empty description clears it.
+    *******************************************************************************/
+   public AttachmentEntry rename(Serializable attachmentId, String fileName, String description) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      QRecord row = requireMutable(attachmentId);
+      QRecord change = new QRecord().withValue("id", row.getValue("id"));
+      if(fileName != null)
+      {
+         change.setValue("fileName", sanitize(fileName));
+      }
+      if(description != null)
+      {
+         change.setValue("description", description);
+      }
+      UpdateInput input = new UpdateInput(CollaborationTables.ATTACHMENT).withRecords(List.of(change));
+      input.setTableMetaData(AttachmentRecords.storageTable());
+      input.withPermissionBypass("AttachmentsService checked the actual parent and author/admin before metadata update.");
+      AttachmentRecords.checkErrors(new UpdateAction().execute(input).getRecords());
+      return (entry(requireRow(attachmentId)));
+   }
+
+   /*******************************************************************************
+    ** Description-only convenience operation.
+    *******************************************************************************/
+   public AttachmentEntry describe(Serializable attachmentId, String description) throws QException
+   {
+      return (rename(attachmentId, null, description));
+   }
+
+   /*******************************************************************************
+    ** Process Review uses persisted identity rather than trusting client rows.
+    *******************************************************************************/
+   public QRecord requireMutable(Serializable attachmentId) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      QRecord row = requireRow(attachmentId);
+      requireUser();
+      if(!canDelete(row))
+      {
+         throw (new QPermissionDeniedException("Only the author or collaboration.admin can change this attachment."));
+      }
+      if(!isAdmin())
+      {
+         ParentRecordAccess.requireFeature(row.getValueString("tableName"), row.getValueString("recordId"), "attach");
+      }
+      return (row);
+   }
+
+   /*******************************************************************************
+    ** Delete storage first so a provider failure leaves a retryable row.
+    *******************************************************************************/
+   void deleteStoredRow(QRecord row) throws QException
+   {
+      storage.delete(row.getValueString("bucketName"), row.getValueString("storageKey"));
+      DeleteInput input = new DeleteInput(CollaborationTables.ATTACHMENT).withPrimaryKeys(List.of(row.getValue("id")));
+      input.setTableMetaData(AttachmentRecords.storageTable());
+      input.withPermissionBypass("Attachment service authorized deletion, or trusted parent cleanup selected this row.");
+      AttachmentRecords.checkErrors(new DeleteAction().execute(input).getRecordsWithErrors());
+   }
+
+   /*******************************************************************************
+    ** Missing rows and invisible parents have the same response.
+    *******************************************************************************/
+   private QRecord requireRow(Serializable id) throws QException
+   {
+      List<QRecord> rows = AttachmentRecords.query(new QQueryFilter().withCriteria("id", QCriteriaOperator.EQUALS, id));
+      if(rows.isEmpty() || Boolean.TRUE.equals(rows.getFirst().getValueBoolean("parentDeleted")))
+      {
+         throw (new QNotFoundException("Not found"));
+      }
+      QRecord row = rows.getFirst();
+      ParentRecordAccess.requireVisibleParent(row.getValueString("tableName"), row.getValueString("recordId"));
+      return (row);
+   }
+
+   /*******************************************************************************
+    ** Use the parent's actual primary key so alternate numeric strings converge.
+    *******************************************************************************/
+   private String canonicalId(String table, Serializable id) throws QException
+   {
+      return (ParentRecordAccess.requireVisibleParent(table, id).getValueString(QContext.getQInstance().getTable(table).getPrimaryKeyField()));
+   }
+
+   /*******************************************************************************
+    ** Ownership is layered on parent visibility; admins still need that visibility.
+    *******************************************************************************/
+   private boolean canDelete(QRecord row)
+   {
+      String user = CollaborationSecurity.userId(QContext.getQSession());
+      return (user != null && (isAdmin() || user.equals(row.getValueString("createdByUserId"))));
+   }
+
+   /*******************************************************************************
+    ** Collaboration moderation grant.
+    *******************************************************************************/
+   private boolean isAdmin()
+   {
+      return (QContext.getQSession() != null && QContext.getQSession().hasPermission(CollaborationPermissions.ADMIN));
+   }
+
+   /*******************************************************************************
+    ** Stable author identity is mandatory for writes.
+    *******************************************************************************/
+   private String requireUser() throws QPermissionDeniedException
+   {
+      String user = CollaborationSecurity.userId(QContext.getQSession());
+      if(user == null || user.isBlank())
+      {
+         throw (new QPermissionDeniedException("Sign in to manage attachments."));
+      }
+      return (user);
+   }
+
+   /*******************************************************************************
+    ** Return display data, without internal storage coordinates.
+    *******************************************************************************/
+   private AttachmentEntry entry(QRecord row)
+   {
+      return (new AttachmentEntry(row.getValueInteger("id"), row.getValueString("tableName"), row.getValueString("recordId"),
+         row.getValueString("fileName"), row.getValueString("contentType"), row.getValueLong("sizeBytes"), row.getValueString("sha256"),
+         row.getValueString("description"), row.getValueString("createdByUserId"), row.getValueInstant("createDate"), canDelete(row)));
+   }
+
+   /*******************************************************************************
+    ** Strip paths and unsafe header/key characters; enforce extension policy.
+    *******************************************************************************/
+   private String sanitize(String fileName) throws QException
+   {
+      if(fileName == null || fileName.isBlank())
+      {
+         throw (new QException("A file name is required."));
+      }
+      String name = fileName.replace('\\', '/');
+      name = name.substring(name.lastIndexOf('/') + 1).replaceAll("[^A-Za-z0-9._ -]", "_").strip();
+      if(name.isBlank() || name.equals(".") || name.equals("..") || name.length() > 255)
+      {
+         throw (new QException("Invalid file name."));
+      }
+      String extension = name.substring(name.lastIndexOf('.') + 1).toLowerCase(Locale.ROOT);
+      if(config.getBlockedExtensions().stream().anyMatch(blocked -> extension.equals(blocked.replaceFirst("^\\.", "").toLowerCase(Locale.ROOT))))
+      {
+         throw (new QException("This file extension is blocked."));
+      }
+      return (name);
+   }
+
+   /*******************************************************************************
+    ** Keep arbitrary string primary keys inside one object-key segment.
+    *******************************************************************************/
+   private String segment(String value)
+   {
+      return (URLEncoder.encode(value, StandardCharsets.UTF_8).replace("+", "%20").replace(".", "%2E"));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/attachments/DeleteAttachmentsProcess.java

@@ -0,0 +1,210 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLine;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLineInterface;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.Status;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.AbstractLoadStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.AbstractTransformStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.ExtractViaQueryStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.ProcessSummaryProviderInterface;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.StreamedETLWithFrontendProcess;
+
+/*******************************************************************************
+ ** Record action with the standard streamed ETL Review and Result screens.
+ *******************************************************************************/
+public final class DeleteAttachmentsProcess
+{
+   public static final String NAME = "collaborationDeleteAttachments";
+
+   /*******************************************************************************
+    ** Metadata factory only.
+    *******************************************************************************/
+   private DeleteAttachmentsProcess()
+   {
+   }
+
+   /*******************************************************************************
+    ** Register on the table, never in navigation.
+    *******************************************************************************/
+   public static QProcessMetaData metadata()
+   {
+      Map<String, Serializable> values = new HashMap<>();
+      values.put(StreamedETLWithFrontendProcess.FIELD_SOURCE_TABLE, CollaborationTables.ATTACHMENT);
+      values.put(StreamedETLWithFrontendProcess.FIELD_DESTINATION_TABLE, CollaborationTables.ATTACHMENT);
+      values.put(StreamedETLWithFrontendProcess.FIELD_SUPPORTS_FULL_VALIDATION, true);
+      values.put(StreamedETLWithFrontendProcess.FIELD_DO_FULL_VALIDATION, true);
+      values.put(StreamedETLWithFrontendProcess.FIELD_PREVIEW_MESSAGE,
+         "Delete the selected attachments. Storage uses versioning or trash where configured; otherwise deletion is permanent.");
+      return (StreamedETLWithFrontendProcess.defineProcessMetaData(ExtractViaQueryStep.class, Review.class, Delete.class, values)
+         .withName(NAME).withLabel("Delete attachments").withIcon(new QIcon("delete"))
+         .withTableName(CollaborationTables.ATTACHMENT).withPermissionRules(CollaborationPermissions.permissionRules()));
+   }
+
+   /*******************************************************************************
+    ** Future and past wording for the standard summary renderer.
+    *******************************************************************************/
+   private static ProcessSummaryLine line(Status status, String future, String past)
+   {
+      ProcessSummaryLine line = new ProcessSummaryLine(status, 0, null);
+      line.setSingularFutureMessage("attachment " + future);
+      line.setPluralFutureMessage("attachments " + future);
+      line.setSingularPastMessage("attachment " + past);
+      line.setPluralPastMessage("attachments " + past);
+      return (line);
+   }
+
+   /*******************************************************************************
+    ** Review re-reads persisted rows and skips unauthorized selections.
+    *******************************************************************************/
+   public static class Review extends AbstractTransformStep implements ProcessSummaryProviderInterface
+   {
+      private final AttachmentsService service;
+      private final ProcessSummaryLine selected = line(Status.OK, "will be deleted", "deleted");
+      private final ProcessSummaryLine skipped = line(Status.WARNING, "cannot be deleted (skipped)", "skipped");
+
+      /*******************************************************************************
+       ** QQQ constructor.
+       *******************************************************************************/
+      public Review()
+      {
+         this(new AttachmentsService());
+      }
+
+      /*******************************************************************************
+       ** Injectable service for process tests.
+       *******************************************************************************/
+      public Review(AttachmentsService service)
+      {
+         this.service = service;
+      }
+
+      /*******************************************************************************
+       ** Dry run only; no object or row mutations.
+       *******************************************************************************/
+      @Override
+      public void runOnePage(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         for(QRecord row : input.getRecords())
+         {
+            try
+            {
+               QRecord checked = service.requireMutable(row.getValue("id"));
+               output.getRecords().add(checked);
+               selected.incrementCountAndAddPrimaryKey(checked.getValue("id"));
+            }
+            catch(QException expected)
+            {
+               skipped.incrementCountAndAddPrimaryKey(row.getValue("id"));
+            }
+         }
+      }
+
+      /*******************************************************************************
+       ** Review summary includes authorized and skipped counts.
+       *******************************************************************************/
+      @Override
+      public ArrayList<ProcessSummaryLineInterface> getProcessSummary(RunBackendStepOutput output, boolean isForResultScreen)
+      {
+         ArrayList<ProcessSummaryLineInterface> lines = new ArrayList<>();
+         selected.addSelfToListIfAnyCount(lines);
+         skipped.addSelfToListIfAnyCount(lines);
+         return (lines);
+      }
+   }
+
+   /*******************************************************************************
+    ** Execute and re-authorize each row; one failure does not stop the batch.
+    *******************************************************************************/
+   public static class Delete extends AbstractLoadStep implements ProcessSummaryProviderInterface
+   {
+      private final AttachmentsService service;
+      private final ProcessSummaryLine deleted = line(Status.OK, "will be deleted", "deleted");
+      private final ProcessSummaryLine failed = line(Status.ERROR, "could not be deleted", "could not be deleted (retry required)");
+
+      /*******************************************************************************
+       ** QQQ constructor.
+       *******************************************************************************/
+      public Delete()
+      {
+         this(new AttachmentsService());
+      }
+
+      /*******************************************************************************
+       ** Injectable service for process tests.
+       *******************************************************************************/
+      public Delete(AttachmentsService service)
+      {
+         this.service = service;
+      }
+
+      /*******************************************************************************
+       ** Count success only after both storage and row deletion succeed.
+       *******************************************************************************/
+      @Override
+      public void runOnePage(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         for(QRecord row : input.getRecords())
+         {
+            try
+            {
+               service.delete(List.of(row.getValue("id")));
+               deleted.incrementCountAndAddPrimaryKey(row.getValue("id"));
+            }
+            catch(QException | RuntimeException expected)
+            {
+               failed.incrementCountAndAddPrimaryKey(row.getValue("id"));
+            }
+         }
+      }
+
+      /*******************************************************************************
+       ** Actual results, plus the Review's skipped rows.
+       *******************************************************************************/
+      @Override
+      public ArrayList<ProcessSummaryLineInterface> getProcessSummary(RunBackendStepOutput output, boolean isForResultScreen)
+      {
+         ArrayList<ProcessSummaryLineInterface> lines = new ArrayList<>();
+         deleted.addSelfToListIfAnyCount(lines);
+         if(getTransformStep() instanceof Review review)
+         {
+            review.skipped.addSelfToListIfAnyCount(lines);
+         }
+         failed.addSelfToListIfAnyCount(lines);
+         return (lines);
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/comments/CommentEntry.java

@@ -0,0 +1,32 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.comments;
+
+import java.time.Instant;
+import java.util.List;
+
+/*******************************************************************************
+ ** Thread item; deleted bodies are never returned.
+ *******************************************************************************/
+public record CommentEntry(Integer id, Integer threadId, Integer parentCommentId, String body, String fieldName, String authorUserId, String authorDisplayName, Instant createdAt, Instant editedAt, Boolean deleted, Boolean resolved, Boolean canEdit, Boolean canDelete, List<MentionEntry> mentions, List<CommentEntry> replies)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/comments/CommentPage.java

@@ -0,0 +1,31 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.comments;
+
+import java.util.List;
+
+/*******************************************************************************
+ ** A page counts root threads; replies stay grouped under each root.
+ *******************************************************************************/
+public record CommentPage(List<CommentEntry> threads, String nextCursor)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/comments/CommentRevision.java

@@ -0,0 +1,31 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.comments;
+
+import java.time.Instant;
+
+/*******************************************************************************
+ ** Prior body and the identity/time of the edit that replaced it.
+ *******************************************************************************/
+public record CommentRevision(Integer id, String body, Instant editedAt, String editedByUserId)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/comments/CommentsService.java

@@ -0,0 +1,435 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.comments;
+
+import java.io.Serializable;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.RecordCursor;
+import com.kingsrook.qbits.collaboration.activity.ActivityWriter;
+import com.kingsrook.qbits.collaboration.follow.FollowEntry;
+import com.kingsrook.qbits.collaboration.follow.FollowService;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.notify.CollaborationNotification;
+import com.kingsrook.qbits.collaboration.notify.Notifications;
+import com.kingsrook.qbits.collaboration.people.PeopleService;
+import com.kingsrook.qbits.collaboration.people.PersonEntry;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qbits.collaboration.security.OtherUserAccess;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Record comments, one-level threads, edit history and recipient-safe mentions.
+ *******************************************************************************/
+public class CommentsService
+{
+   private static final Pattern MENTION = Pattern.compile("@\\[[^\\]\\r\\n]+]\\(user:([^()\\s]+)\\)");
+
+   /*******************************************************************************
+    ** Validate all input and the optional reply target before inserting anything.
+    *******************************************************************************/
+   public CommentEntry post(String table, Serializable recordId, String body, Integer parentCommentId, String fieldName) throws QException
+   {
+      new PeopleService().touch();
+      ParentRecordAccess.requireFeature(table, recordId, "comment");
+      String id = FollowService.canonicalId(table, recordId);
+      Set<String> mentions = parse(body);
+      Integer rootId = null;
+      if(parentCommentId != null)
+      {
+         QRecord parent = requireComment(parentCommentId);
+         if(!table.equals(parent.getValueString("tableName")) || !id.equals(parent.getValueString("recordId")))
+         {
+            throw (new QNotFoundException("Not found"));
+         }
+         rootId = parent.getValueInteger("threadId") == null ? parent.getValueInteger("id") : parent.getValueInteger("threadId");
+      }
+      if(fieldName != null && !QContext.getQInstance().getTable(table).getFields().containsKey(fieldName))
+      {
+         throw (new QException("Unknown field"));
+      }
+      Instant now = Instant.now();
+      QRecord row = CollaborationRecords.insert(CollaborationTables.COMMENT, reference(table, id).withValue("body", body)
+         .withValue("threadId", rootId).withValue("parentCommentId", rootId).withValue("fieldName", fieldName)
+         .withValue("authorUserId", PersonalRecords.currentUserId()).withValue("lastActivityAt", now));
+      bumpRoot(row, now);
+      Set<String> notified = processMentions(row, mentions);
+      new FollowService().ensureFollower(PersonalRecords.currentUserId(), table, id, "COMMENTED");
+      ActivityWriter.write(table, id, "COMMENTED", "Comment added", CollaborationTables.COMMENT, row.getValueString("id"));
+      notifyFollowers(row, notified);
+      return (entry(row, List.of()));
+   }
+
+   /*******************************************************************************
+    ** Keyset-page root threads by latest activity; fetch replies oldest first.
+    *******************************************************************************/
+   public CommentPage list(String table, Serializable recordId, String cursor, Integer limit) throws QException
+   {
+      new PeopleService().touch();
+      String id = FollowService.canonicalId(table, recordId);
+      requireLimit(limit);
+      RecordCursor before = cursor == null ? null : RecordCursor.decode(cursor);
+      if(before != null && !before.kind().equals("COMMENT"))
+      {
+         throw (new QException("Invalid comment cursor"));
+      }
+      QQueryFilter filter = CollaborationRecords.parent(table, id).withCriteria("threadId", QCriteriaOperator.IS_BLANK)
+         .withOrderBy(new QFilterOrderBy("lastActivityAt", false)).withOrderBy(new QFilterOrderBy("id", false));
+      if(before != null)
+      {
+         filter.withSubFilter(before.beforeFilter("lastActivityAt", "COMMENT"));
+      }
+      List<QRecord> roots = CollaborationRecords.query(CollaborationTables.COMMENT, filter.withLimit(limit + 1));
+      List<CommentEntry> result = new ArrayList<>();
+      for(QRecord row : roots.stream().limit(limit).toList())
+      {
+         List<CommentEntry> replies = new ArrayList<>();
+         for(QRecord reply : CollaborationRecords.query(CollaborationTables.COMMENT, CollaborationRecords.parent(table, id)
+            .withCriteria("threadId", QCriteriaOperator.EQUALS, row.getValue("id"))
+            .withOrderBy(new QFilterOrderBy("createDate")).withOrderBy(new QFilterOrderBy("id"))))
+         {
+            replies.add(entry(reply, List.of()));
+         }
+         result.add(entry(row, replies));
+      }
+      return (new CommentPage(List.copyOf(result), roots.size() > limit ? key(roots.get(limit - 1)).encode() : null));
+   }
+
+   /*******************************************************************************
+    ** Authors alone can edit; administrators cannot rewrite another author's body.
+    *******************************************************************************/
+   public CommentEntry edit(Serializable commentId, String body) throws QException
+   {
+      new PeopleService().touch();
+      QRecord row = requireComment(commentId);
+      requireAuthor(row);
+      requireCommentFeature(row);
+      Set<String> mentions = parse(body);
+      Instant now = Instant.now();
+      CollaborationRecords.insert(CollaborationTables.COMMENT_REVISION, reference(row.getValueString("tableName"), row.getValueString("recordId"))
+         .withValue("commentId", row.getValue("id")).withValue("body", row.getValueString("body")).withValue("editedAt", now)
+         .withValue("editedByUserId", PersonalRecords.currentUserId()));
+      CollaborationRecords.update(CollaborationTables.COMMENT, new QRecord().withValue("id", row.getValue("id")).withValue("body", body)
+         .withValue("editedAt", now).withValue("lastActivityAt", now));
+      row.withValue("body", body).withValue("editedAt", now);
+      bumpRoot(row, now);
+      processMentions(row, mentions);
+      ActivityWriter.write(row.getValueString("tableName"), row.getValueString("recordId"), "COMMENT_EDITED", "Comment edited", CollaborationTables.COMMENT, row.getValueString("id"));
+      return (entry(row, List.of()));
+   }
+
+   /*******************************************************************************
+    ** Soft delete; moderators still need to see the actual parent.
+    *******************************************************************************/
+   public void delete(Serializable commentId) throws QException
+   {
+      new PeopleService().touch();
+      QRecord row = requireComment(commentId);
+      if(!isAdmin())
+      {
+         requireAuthor(row);
+         requireCommentFeature(row);
+      }
+      Instant now = Instant.now();
+      CollaborationRecords.update(CollaborationTables.COMMENT, new QRecord().withValue("id", row.getValue("id"))
+         .withValue("deletedAt", now).withValue("deletedByUserId", PersonalRecords.currentUserId()).withValue("lastActivityAt", now));
+      bumpRoot(row, now);
+   }
+
+   /*******************************************************************************
+    ** Resolve only a root thread.
+    *******************************************************************************/
+   public void resolve(Serializable commentId) throws QException
+   {
+      setResolved(commentId, true);
+   }
+
+   /*******************************************************************************
+    ** Reopen only a root thread.
+    *******************************************************************************/
+   public void reopen(Serializable commentId) throws QException
+   {
+      setResolved(commentId, false);
+   }
+
+   /*******************************************************************************
+    ** Anyone able to comment can change root resolution state.
+    *******************************************************************************/
+   private void setResolved(Serializable commentId, boolean resolved) throws QException
+   {
+      new PeopleService().touch();
+      QRecord row = requireComment(commentId);
+      requireCommentFeature(row);
+      if(row.getValue("threadId") != null)
+      {
+         throw (new QException("Resolve or reopen the root comment."));
+      }
+      Instant now = Instant.now();
+      CollaborationRecords.update(CollaborationTables.COMMENT, new QRecord().withValue("id", row.getValue("id"))
+         .withValue("resolvedAt", resolved ? now : null).withValue("resolvedByUserId", resolved ? PersonalRecords.currentUserId() : null).withValue("lastActivityAt", now));
+      ActivityWriter.write(row.getValueString("tableName"), row.getValueString("recordId"), resolved ? "COMMENT_RESOLVED" : "COMMENT_REOPENED",
+         resolved ? "Thread resolved" : "Thread reopened", CollaborationTables.COMMENT, row.getValueString("id"));
+   }
+
+   /*******************************************************************************
+    ** History follows parent read access without requiring edit permission.
+    *******************************************************************************/
+   public List<CommentRevision> history(Serializable commentId) throws QException
+   {
+      new PeopleService().touch();
+      QRecord row = requireComment(commentId);
+      return (CollaborationRecords.query(CollaborationTables.COMMENT_REVISION, new QQueryFilter().withCriteria("commentId", QCriteriaOperator.EQUALS, row.getValue("id"))
+         .withOrderBy(new QFilterOrderBy("editedAt")).withOrderBy(new QFilterOrderBy("id"))).stream()
+         .map(revision -> new CommentRevision(revision.getValueInteger("id"), revision.getValueString("body"), revision.getValueInstant("editedAt"), revision.getValueString("editedByUserId"))).toList());
+   }
+
+   /*******************************************************************************
+    ** Rank current participants before other matching active directory users.
+    *******************************************************************************/
+   public List<MentionCandidate> mentionCandidates(String table, Serializable recordId, String q) throws QException
+   {
+      new PeopleService().touch();
+      String id = FollowService.canonicalId(table, recordId);
+      Set<String> participants = new HashSet<>();
+      new FollowService().followers(table, id).forEach(follower -> participants.add(follower.userId()));
+      CollaborationRecords.query(CollaborationTables.COMMENT, CollaborationRecords.parent(table, id)).forEach(row -> participants.add(row.getValueString("authorUserId")));
+      List<PersonEntry> people = new PeopleService().search(q, 50, participants);
+      List<MentionCandidate> result = new ArrayList<>();
+      for(PersonEntry person : people)
+      {
+         result.add(new MentionCandidate(person, new OtherUserAccess().canRead(person.userId(), table, id)));
+      }
+      return (List.copyOf(result));
+   }
+
+   /*******************************************************************************
+    ** Validate before persistence; deduplicate and reject more than fifty mentions.
+    *******************************************************************************/
+   private Set<String> parse(String body) throws QException
+   {
+      if(body == null || body.isBlank() || body.length() > 20000)
+      {
+         throw (new QException("Comment body must contain 1 to 20000 characters."));
+      }
+      Set<String> users = new LinkedHashSet<>();
+      Matcher matcher = MENTION.matcher(body);
+      while(matcher.find())
+      {
+         if(matcher.group(1).length() > 255)
+         {
+            throw (new QException("Mention user ID is too long."));
+         }
+         users.add(matcher.group(1));
+      }
+      if(users.size() > 50)
+      {
+         throw (new QException("A comment may mention at most 50 users."));
+      }
+      return (users);
+   }
+
+   /*******************************************************************************
+    ** Keep historical mentions so an edit never re-notifies an already mentioned user.
+    *******************************************************************************/
+   private Set<String> processMentions(QRecord row, Set<String> users) throws QException
+   {
+      Set<String> existing = new HashSet<>();
+      mentionRows(row).forEach(mention -> existing.add(mention.getValueString("mentionedUserId")));
+      Set<String> notified = new HashSet<>();
+      String table = row.getValueString("tableName");
+      String id = row.getValueString("recordId");
+      for(String user : users)
+      {
+         if(existing.contains(user))
+         {
+            continue;
+         }
+         boolean visible = new OtherUserAccess().canRead(user, table, id).orElse(false);
+         QRecord mention = CollaborationRecords.insert(CollaborationTables.MENTION, reference(table, id).withValue("commentId", row.getValue("id"))
+            .withValue("mentionedUserId", user).withValue("visible", visible));
+         if(visible)
+         {
+            new FollowService().ensureFollower(user, table, id, "MENTIONED");
+            if(!user.equals(PersonalRecords.currentUserId()))
+            {
+               notify(row, user, CollaborationNotification.Category.MENTION, "You were mentioned in a comment", mention.getValueInteger("id"));
+               notified.add(user);
+            }
+         }
+      }
+      return (notified);
+   }
+
+   /*******************************************************************************
+    ** Mention recipients get one notification; muted and author subscriptions are skipped.
+    *******************************************************************************/
+   private void notifyFollowers(QRecord row, Set<String> mentioned) throws QException
+   {
+      String author = PersonalRecords.currentUserId();
+      for(FollowEntry follower : new FollowService().followers(row.getValueString("tableName"), row.getValueString("recordId")))
+      {
+         if(!author.equals(follower.userId()) && !mentioned.contains(follower.userId()) && Boolean.TRUE.equals(follower.notifyOnComment())
+            && (follower.mutedUntil() == null || !follower.mutedUntil().isAfter(Instant.now())))
+         {
+            notify(row, follower.userId(), CollaborationNotification.Category.FOLLOW, "New comment on a followed record", null);
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Delivery re-checks recipient access, including after transaction commit.
+    *******************************************************************************/
+   private void notify(QRecord row, String user, CollaborationNotification.Category category, String title, Integer mentionId) throws QException
+   {
+      Notifications.send(new CollaborationNotification(user, title, row.getValueString("body"), category,
+         row.getValueString("tableName"), row.getValueString("recordId"), Notifications.link(row.getValueString("tableName"), row.getValueString("recordId"))),
+         mentionId == null ? null : () -> CollaborationRecords.update(CollaborationTables.MENTION,
+            new QRecord().withValue("id", mentionId).withValue("notifiedAt", Instant.now())));
+   }
+
+   /*******************************************************************************
+    ** Generic child reference for query security.
+    *******************************************************************************/
+   private QRecord reference(String table, String id)
+   {
+      return (new QRecord().withValue("tableName", table).withValue("recordId", id).withValue("parentDeleted", false));
+   }
+
+   /*******************************************************************************
+    ** Parent visibility is checked before exposing even ownership metadata.
+    *******************************************************************************/
+   private QRecord requireComment(Serializable id) throws QException
+   {
+      List<QRecord> rows = CollaborationRecords.query(CollaborationTables.COMMENT, new QQueryFilter().withCriteria("id", QCriteriaOperator.EQUALS, id));
+      if(rows.isEmpty() || Boolean.TRUE.equals(rows.getFirst().getValueBoolean("parentDeleted")))
+      {
+         throw (new QNotFoundException("Not found"));
+      }
+      QRecord row = rows.getFirst();
+      ParentRecordAccess.requireVisibleParent(row.getValueString("tableName"), row.getValueString("recordId"));
+      return (row);
+   }
+
+   /*******************************************************************************
+    ** Deleted comments cannot be edited by their author.
+    *******************************************************************************/
+   private void requireAuthor(QRecord row) throws QException
+   {
+      if(!PersonalRecords.currentUserId().equals(row.getValueString("authorUserId")) || row.getValue("deletedAt") != null)
+      {
+         throw (new QPermissionDeniedException("Only the author can edit or delete this comment."));
+      }
+   }
+
+   /*******************************************************************************
+    ** Shared feature permission stand-in.
+    *******************************************************************************/
+   private void requireCommentFeature(QRecord row) throws QException
+   {
+      ParentRecordAccess.requireFeature(row.getValueString("tableName"), row.getValueString("recordId"), "comment");
+   }
+
+   /*******************************************************************************
+    ** Update root ordering whenever a reply changes.
+    *******************************************************************************/
+   private void bumpRoot(QRecord row, Instant at) throws QException
+   {
+      if(row.getValue("threadId") != null)
+      {
+         CollaborationRecords.update(CollaborationTables.COMMENT, new QRecord().withValue("id", row.getValue("threadId")).withValue("lastActivityAt", at));
+      }
+   }
+
+   /*******************************************************************************
+    ** Comment cursor key uses root activity, not creation time.
+    *******************************************************************************/
+   private RecordCursor key(QRecord row)
+   {
+      return (new RecordCursor(row.getValueInstant("lastActivityAt"), "COMMENT", row.getValueLong("id")));
+   }
+
+   /*******************************************************************************
+    ** Bound public collection responses.
+    *******************************************************************************/
+   private void requireLimit(Integer limit) throws QException
+   {
+      if(limit == null || limit < 1 || limit > 50)
+      {
+         throw (new QException("Limit must be between 1 and 50"));
+      }
+   }
+
+   /*******************************************************************************
+    ** Child rows are safe after comment or parent authorization.
+    *******************************************************************************/
+   private List<QRecord> mentionRows(QRecord row) throws QException
+   {
+      return (CollaborationRecords.query(CollaborationTables.MENTION, new QQueryFilter().withCriteria("commentId", QCriteriaOperator.EQUALS, row.getValue("id"))));
+   }
+
+   /*******************************************************************************
+    ** Capabilities reflect ownership and the same write permission as mutations.
+    *******************************************************************************/
+   private CommentEntry entry(QRecord row, List<CommentEntry> replies) throws QException
+   {
+      boolean author = PersonalRecords.currentUserId().equals(row.getValueString("authorUserId"));
+      boolean deleted = row.getValue("deletedAt") != null;
+      boolean feature;
+      try
+      {
+         requireCommentFeature(row);
+         feature = true;
+      }
+      catch(QPermissionDeniedException expected)
+      {
+         feature = false;
+      }
+      List<MentionEntry> mentions = mentionRows(row).stream().map(mention -> new MentionEntry(mention.getValueString("mentionedUserId"), mention.getValueBoolean("visible"))).toList();
+      return (new CommentEntry(row.getValueInteger("id"), row.getValueInteger("threadId"), row.getValueInteger("parentCommentId"), deleted ? null : row.getValueString("body"),
+         row.getValueString("fieldName"), row.getValueString("authorUserId"), new PeopleService().displayName(row.getValueString("authorUserId")), row.getValueInstant("createDate"),
+         row.getValueInstant("editedAt"), deleted, row.getValue("resolvedAt") != null, author && feature && !deleted, !deleted && ((author && feature) || isAdmin()), mentions, replies));
+   }
+
+   /*******************************************************************************
+    ** Moderation is distinct from permission to edit another author's text.
+    *******************************************************************************/
+   private boolean isAdmin()
+   {
+      return (QContext.getQSession().hasPermission(CollaborationPermissions.ADMIN));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/comments/MentionCandidate.java

@@ -0,0 +1,32 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.comments;
+
+import java.util.Optional;
+import com.kingsrook.qbits.collaboration.people.PersonEntry;
+
+/*******************************************************************************
+ ** Tri-state access is exposed only after the caller can read the parent.
+ *******************************************************************************/
+public record MentionCandidate(PersonEntry person, Optional<Boolean> canRead)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/comments/MentionEntry.java

@@ -0,0 +1,30 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.comments;
+
+
+/*******************************************************************************
+ ** Mention visibility is the recipient access result at processing time.
+ *******************************************************************************/
+public record MentionEntry(String userId, Boolean visible)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/favorites/FavoriteEntry.java

@@ -0,0 +1,32 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.favorites;
+
+
+/*******************************************************************************
+ ** A freshly permission-checked target. Unavailable entries never expose the
+ ** cached label or a navigable href. Also used for the ordered recents list.
+ *******************************************************************************/
+public record FavoriteEntry(Integer id, String targetType, String targetName, String recordId,
+   String label, String folder, Integer sortOrder, Boolean available, String href)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/favorites/FavoritesService.java

@@ -0,0 +1,157 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.favorites;
+
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.TargetResolver;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+
+/*******************************************************************************
+ ** Current-user favorites. All actions preserve QContext; administrators use the
+ ** standard table screens for cross-user management, not these personal methods.
+ *******************************************************************************/
+public final class FavoritesService
+{
+   /*******************************************************************************
+    ** Static service.
+    *******************************************************************************/
+   private FavoritesService()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Idempotently star a visible target, appending it after existing favorites.
+    *******************************************************************************/
+   public static void star(String targetType, String targetName, Serializable recordId) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      String userId = PersonalRecords.currentUserId();
+      FavoriteEntry target = TargetResolver.require(targetType, targetName, recordId);
+      QQueryFilter filter = PersonalRecords.targetFilter(targetType, targetName, target.recordId());
+      if(!PersonalRecords.query(CollaborationTables.FAVORITE, filter).isEmpty())
+      {
+         return;
+      }
+      List<QRecord> last = PersonalRecords.query(CollaborationTables.FAVORITE, PersonalRecords.ownFilter()
+         .withOrderBy(new QFilterOrderBy("sortOrder", false)).withLimit(1));
+      Integer order = last.isEmpty() ? 0 : Math.addExact(last.getFirst().getValueInteger("sortOrder"), 1);
+      QRecord row = new QRecord().withValue("userId", userId).withValue("targetType", targetType).withValue("targetName", targetName)
+         .withValue("recordId", target.recordId()).withValue("label", target.label()).withValue("sortOrder", order);
+      try
+      {
+         PersonalRecords.insert(CollaborationTables.FAVORITE, row);
+      }
+      catch(QException e)
+      {
+         if(PersonalRecords.query(CollaborationTables.FAVORITE, filter).isEmpty())
+         {
+            throw (e);
+         }
+         // A concurrent star won the unique-key race; the requested state exists.
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Removing a star does not require continued access to its target.
+    *******************************************************************************/
+   public static void unstar(String targetType, String targetName, Serializable recordId) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      String id = TargetResolver.recordId(targetType, targetName, recordId);
+      List<QRecord> rows = PersonalRecords.query(CollaborationTables.FAVORITE, PersonalRecords.targetFilter(targetType, targetName, id));
+      PersonalRecords.delete(CollaborationTables.FAVORITE, rows.stream().map(row -> row.getValue("id")).toList());
+   }
+
+
+
+   /*******************************************************************************
+    ** Ordered favorites with freshly checked labels and availability.
+    *******************************************************************************/
+   public static List<FavoriteEntry> list() throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      return (TargetResolver.refresh(PersonalRecords.query(CollaborationTables.FAVORITE, PersonalRecords.ownFilter()
+         .withOrderBy(new QFilterOrderBy("sortOrder")).withOrderBy(new QFilterOrderBy("id")))));
+   }
+
+
+
+   /*******************************************************************************
+    ** Move the supplied ids first, preserving order of omitted favorites. Folder
+    ** values may be null to clear them. Validate all ids before writing anything.
+    *******************************************************************************/
+   public static void reorder(List<Integer> ids, Map<Integer, String> folders) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      List<QRecord> rows = PersonalRecords.query(CollaborationTables.FAVORITE, PersonalRecords.ownFilter()
+         .withOrderBy(new QFilterOrderBy("sortOrder")).withOrderBy(new QFilterOrderBy("id")));
+      Set<Integer> owned = new HashSet<>(rows.stream().map(row -> row.getValueInteger("id")).toList());
+      if(ids == null || folders == null || new HashSet<>(ids).size() != ids.size() || !owned.containsAll(ids) || !owned.containsAll(folders.keySet()))
+      {
+         throw (new QException("Invalid favorite ids"));
+      }
+      for(String folder : folders.values())
+      {
+         if(folder != null && folder.length() > 255)
+         {
+            throw (new QException("Folder is too long"));
+         }
+      }
+      List<Integer> order = new ArrayList<>(ids);
+      for(QRecord row : rows)
+      {
+         Integer id = row.getValueInteger("id");
+         if(!ids.contains(id))
+         {
+            order.add(id);
+         }
+      }
+      List<QRecord> changes = new ArrayList<>();
+      for(int i = 0; i < order.size(); i++)
+      {
+         Integer id = order.get(i);
+         QRecord change = new QRecord().withValue("id", id).withValue("sortOrder", i);
+         if(folders.containsKey(id))
+         {
+            change.setValue("folder", folders.get(id));
+         }
+         changes.add(change);
+      }
+      PersonalRecords.update(CollaborationTables.FAVORITE, changes);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/follow/FollowChangeBatcher.java

@@ -0,0 +1,214 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.follow;
+
+import java.time.Clock;
+import java.time.Instant;
+import java.util.Arrays;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Objects;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.notify.CollaborationNotification;
+import com.kingsrook.qbits.collaboration.notify.Notifications;
+import com.kingsrook.qqq.backend.core.actions.tables.listeners.RecordChangeEvent;
+import com.kingsrook.qqq.backend.core.actions.tables.listeners.RecordChangeListenerInterface;
+import com.kingsrook.qqq.backend.core.actions.tables.listeners.RecordChangeType;
+import com.kingsrook.qqq.backend.core.context.CapturedContext;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Durable five-minute follow digests. RC.5 listeners queue only committed updates.
+ ** The scheduler must run once per installation; local synchronization coordinates
+ ** listener instances, while unique keys protect subscription/batch identity.
+ *******************************************************************************/
+public class FollowChangeBatcher implements RecordChangeListenerInterface
+{
+   private final Clock clock;
+
+   /*******************************************************************************
+    ** Core creates a listener instance for each event.
+    *******************************************************************************/
+   public FollowChangeBatcher()
+   {
+      this(Clock.systemUTC());
+   }
+
+   /*******************************************************************************
+    ** Inject time for deterministic batching tests.
+    *******************************************************************************/
+   public FollowChangeBatcher(Clock clock)
+   {
+      this.clock = clock;
+   }
+
+   /*******************************************************************************
+    ** Only configured host-table updates need old records fetched by core.
+    *******************************************************************************/
+   @Override
+   public boolean appliesTo(String tableName, RecordChangeType type)
+   {
+      return (type == RecordChangeType.UPDATE && CollaborationRecords.config().getFollowChangeTables().contains(tableName));
+   }
+
+   /*******************************************************************************
+    ** Copy event data before retaining anything in an after-commit callback.
+    *******************************************************************************/
+   @Override
+   public void onRecordsChanged(RecordChangeEvent event) throws QException
+   {
+      if(!appliesTo(event.getTableName(), event.getType()))
+      {
+         return;
+      }
+      String actor = CollaborationSecurity.userId(QContext.getQSession());
+      String primaryKey = QContext.getQInstance().getTable(event.getTableName()).getPrimaryKeyField();
+      CapturedContext context = new CapturedContext(QContext.getQInstance(), QContext.getQSession());
+      for(int i = 0; i < event.getRecords().size(); i++)
+      {
+         QRecord row = event.getRecords().get(i);
+         QRecord old = event.getOldRecords() == null ? null : event.getOldRecords().get(i);
+         Set<String> fields = new LinkedHashSet<>();
+         for(String field : row.getValues().keySet())
+         {
+            if(!field.equals(primaryKey) && !field.equals("modifyDate") && (old == null || !Objects.equals(row.getValue(field), old.getValue(field))))
+            {
+               fields.add(field);
+            }
+         }
+         String id = row.getValueString(primaryKey);
+         if(!fields.isEmpty())
+         {
+            if(event.getTransaction() == null)
+            {
+               recordChange(event.getTableName(), id, actor, fields);
+            }
+            else
+            {
+               event.getTransaction().addAfterCommitCallback(() ->
+               {
+                  try
+                  {
+                     QContext.withTemporaryContext(context, () -> recordChange(event.getTableName(), id, actor, fields));
+                  }
+                  catch(QException e)
+                  {
+                     throw (new IllegalStateException("Could not queue follow digest", e));
+                  }
+               });
+            }
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Trusted host-hook helper; invoke after the host update commits. Values are
+    ** never copied into digests, and a recipient's own changes are never queued.
+    *******************************************************************************/
+   public void recordChange(String table, String id, String actor, Set<String> fields) throws QException
+   {
+      if(fields.isEmpty())
+      {
+         return;
+      }
+      synchronized(CollaborationRecords.config())
+      {
+         Instant now = clock.instant();
+         for(QRecord follower : CollaborationRecords.query(CollaborationTables.FOLLOW, CollaborationRecords.parent(table, id)))
+         {
+            String user = follower.getValueString("userId");
+            if(user.equals(actor) || !eligible(follower, now))
+            {
+               continue;
+            }
+            List<QRecord> batches = CollaborationRecords.query(CollaborationTables.FOLLOW_DIGEST,
+               CollaborationRecords.parent(table, id).withCriteria("userId", QCriteriaOperator.EQUALS, user));
+            Set<String> changes = new LinkedHashSet<>();
+            if(!batches.isEmpty())
+            {
+               changes.addAll(Arrays.asList(batches.getFirst().getValueString("changes").split("\n")));
+            }
+            for(String field : fields)
+            {
+               changes.add(field + " (by " + (actor == null ? "system" : actor) + ")");
+            }
+            QRecord batch = new QRecord().withValue("changes", String.join("\n", changes));
+            if(batches.isEmpty())
+            {
+               CollaborationRecords.insert(CollaborationTables.FOLLOW_DIGEST, batch.withValue("tableName", table).withValue("recordId", id)
+                  .withValue("userId", user).withValue("dueAt", now.plusSeconds(300)).withValue("parentDeleted", false));
+            }
+            else
+            {
+               CollaborationRecords.update(CollaborationTables.FOLLOW_DIGEST, batch.withValue("id", batches.getFirst().getValue("id")));
+            }
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** The scheduler invokes outside a transaction so deletion follows delivery.
+    ** Re-check current subscription, mute and access; failures retain a retryable row.
+    *******************************************************************************/
+   public void sendDue() throws QException
+   {
+      new SendFollowDigestsProcess().checkPermissionsThrowing(null, null);
+      if(QContext.getQBackendTransaction() != null)
+      {
+         throw (new QException("Send follow digests outside a transaction."));
+      }
+      synchronized(CollaborationRecords.config())
+      {
+         Instant now = clock.instant();
+         for(QRecord batch : CollaborationRecords.query(CollaborationTables.FOLLOW_DIGEST, new QQueryFilter().withCriteria("dueAt", QCriteriaOperator.LESS_THAN_OR_EQUALS, now)))
+         {
+            String table = batch.getValueString("tableName");
+            String id = batch.getValueString("recordId");
+            String user = batch.getValueString("userId");
+            List<QRecord> follows = CollaborationRecords.query(CollaborationTables.FOLLOW,
+               CollaborationRecords.parent(table, id).withCriteria("userId", QCriteriaOperator.EQUALS, user));
+            if(!follows.isEmpty() && eligible(follows.getFirst(), now))
+            {
+               Notifications.send(new CollaborationNotification(user, "Changes to a followed record", batch.getValueString("changes"),
+                  CollaborationNotification.Category.FOLLOW, table, id, Notifications.link(table, id)));
+            }
+            CollaborationRecords.delete(CollaborationTables.FOLLOW_DIGEST, batch.getValue("id"));
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Mute ends at its timestamp, including exact equality with now.
+    *******************************************************************************/
+   private boolean eligible(QRecord row, Instant now)
+   {
+      return (Boolean.TRUE.equals(row.getValueBoolean("notifyOnChange"))
+         && (row.getValueInstant("mutedUntil") == null || !row.getValueInstant("mutedUntil").isAfter(now)));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/follow/FollowEntry.java

@@ -0,0 +1,31 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.follow;
+
+import java.time.Instant;
+
+/*******************************************************************************
+ ** Record follower preferences; users can only mutate their own state publicly.
+ *******************************************************************************/
+public record FollowEntry(Integer id, String userId, String reason, Boolean notifyOnChange, Boolean notifyOnComment, Instant mutedUntil)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/follow/FollowProcesses.java

@@ -0,0 +1,205 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.follow;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType;
+import com.kingsrook.qqq.backend.core.actions.permissions.UseTablePermissionCustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLine;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLineInterface;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.Status;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.AbstractLoadStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.AbstractTransformStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.ExtractViaQueryStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.ProcessSummaryProviderInterface;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.StreamedETLWithFrontendProcess;
+
+/*******************************************************************************
+ ** Standard streamed ETL Follow/Unfollow actions for any host table with a key.
+ *******************************************************************************/
+public final class FollowProcesses
+{
+   /*******************************************************************************
+    ** Metadata factory.
+    *******************************************************************************/
+   private FollowProcesses()
+   {
+   }
+
+   /*******************************************************************************
+    ** Hosts can register these directly or configure followActionTables.
+    *******************************************************************************/
+   public static List<QProcessMetaData> processesFor(String tableName)
+   {
+      return (List.of(process(tableName, true), process(tableName, false)));
+   }
+
+   /*******************************************************************************
+    ** Process table association puts actions on records, never in navigation.
+    *******************************************************************************/
+   private static QProcessMetaData process(String table, boolean follow)
+   {
+      Map<String, Serializable> values = new HashMap<>();
+      values.put(StreamedETLWithFrontendProcess.FIELD_SOURCE_TABLE, table);
+      values.put(StreamedETLWithFrontendProcess.FIELD_DESTINATION_TABLE, table);
+      values.put(StreamedETLWithFrontendProcess.FIELD_SUPPORTS_FULL_VALIDATION, true);
+      values.put(StreamedETLWithFrontendProcess.FIELD_DO_FULL_VALIDATION, true);
+      values.put(StreamedETLWithFrontendProcess.FIELD_PREVIEW_MESSAGE, (follow ? "Follow" : "Unfollow") + " the selected records.");
+      return (StreamedETLWithFrontendProcess.defineProcessMetaData(ExtractViaQueryStep.class, Review.class, Apply.class, values)
+         .withName("collaboration" + (follow ? "Follow_" : "Unfollow_") + table).withLabel(follow ? "Follow" : "Unfollow")
+         .withTableName(table).withIcon(new QIcon(follow ? "notifications" : "notifications_off"))
+         .withPermissionRules(new QPermissionRules().withCustomPermissionChecker(UseTablePermissionCustomPermissionChecker.build(table, TablePermissionSubType.READ))));
+   }
+
+   /*******************************************************************************
+    ** Stable process metadata, not client values, chooses table and operation.
+    *******************************************************************************/
+   private static String table(RunBackendStepInput input)
+   {
+      return (input.getProcess().getTableName());
+   }
+
+   /*******************************************************************************
+    ** Summary renderer has both Review and Result wording.
+    *******************************************************************************/
+   private static ProcessSummaryLine line(Status status, String future, String past)
+   {
+      ProcessSummaryLine line = new ProcessSummaryLine(status, 0, null);
+      line.setSingularFutureMessage("record " + future);
+      line.setPluralFutureMessage("records " + future);
+      line.setSingularPastMessage("record " + past);
+      line.setPluralPastMessage("records " + past);
+      return (line);
+   }
+
+   /*******************************************************************************
+    ** Dry-run authorization re-reads parents under the current session.
+    *******************************************************************************/
+   public static class Review extends AbstractTransformStep implements ProcessSummaryProviderInterface
+   {
+      private final ProcessSummaryLine selected = line(Status.OK, "will be processed", "processed");
+      private final ProcessSummaryLine skipped = line(Status.WARNING, "is unavailable (skipped)", "skipped");
+
+      /*******************************************************************************
+       ** No writes during review.
+       *******************************************************************************/
+      @Override
+      public void runOnePage(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         String table = table(input);
+         String key = QContext.getQInstance().getTable(table).getPrimaryKeyField();
+         for(QRecord row : input.getRecords())
+         {
+            try
+            {
+               QRecord parent = ParentRecordAccess.requireVisibleParent(table, row.getValue(key));
+               output.getRecords().add(parent);
+               selected.incrementCountAndAddPrimaryKey(parent.getValue(key));
+            }
+            catch(QNotFoundException expected)
+            {
+               skipped.incrementCountAndAddPrimaryKey(row.getValue(key));
+            }
+         }
+      }
+
+      /*******************************************************************************
+       ** Authorized and skipped selections.
+       *******************************************************************************/
+      @Override
+      public ArrayList<ProcessSummaryLineInterface> getProcessSummary(RunBackendStepOutput output, boolean isForResultScreen)
+      {
+         ArrayList<ProcessSummaryLineInterface> lines = new ArrayList<>();
+         selected.addSelfToListIfAnyCount(lines);
+         skipped.addSelfToListIfAnyCount(lines);
+         return (lines);
+      }
+   }
+
+   /*******************************************************************************
+    ** Re-authorize during load; report actual successes and failures.
+    *******************************************************************************/
+   public static class Apply extends AbstractLoadStep implements ProcessSummaryProviderInterface
+   {
+      private final ProcessSummaryLine done = line(Status.OK, "will be processed", "processed");
+      private final ProcessSummaryLine failed = line(Status.ERROR, "cannot be processed", "failed (retry required)");
+
+      /*******************************************************************************
+       ** A failed record does not prevent other selections being processed.
+       *******************************************************************************/
+      @Override
+      public void runOnePage(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         String table = table(input);
+         String key = QContext.getQInstance().getTable(table).getPrimaryKeyField();
+         for(QRecord row : input.getRecords())
+         {
+            try
+            {
+               if(input.getProcessName().equals("collaborationFollow_" + table))
+               {
+                  new FollowService().follow(table, row.getValue(key), null, null);
+               }
+               else
+               {
+                  new FollowService().unfollow(table, row.getValue(key));
+               }
+               done.incrementCountAndAddPrimaryKey(row.getValue(key));
+            }
+            catch(QException expected)
+            {
+               failed.incrementCountAndAddPrimaryKey(row.getValue(key));
+            }
+         }
+      }
+
+      /*******************************************************************************
+       ** Result includes review skips and load failures.
+       *******************************************************************************/
+      @Override
+      public ArrayList<ProcessSummaryLineInterface> getProcessSummary(RunBackendStepOutput output, boolean isForResultScreen)
+      {
+         ArrayList<ProcessSummaryLineInterface> lines = new ArrayList<>();
+         done.addSelfToListIfAnyCount(lines);
+         if(getTransformStep() instanceof Review review)
+         {
+            review.skipped.addSelfToListIfAnyCount(lines);
+         }
+         failed.addSelfToListIfAnyCount(lines);
+         return (lines);
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/follow/FollowService.java

@@ -0,0 +1,176 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.follow;
+
+import java.io.Serializable;
+import java.util.List;
+import java.util.Optional;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.activity.ActivityWriter;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.people.PeopleService;
+import com.kingsrook.qbits.collaboration.security.OtherUserAccess;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Following requires parent visibility, without a separate feature permission.
+ *******************************************************************************/
+public class FollowService
+{
+   /*******************************************************************************
+    ** Nullable preferences retain existing settings on repeat calls.
+    *******************************************************************************/
+   public FollowEntry follow(String table, Serializable recordId, Boolean notifyOnChange, Boolean notifyOnComment) throws QException
+   {
+      new PeopleService().touch();
+      String id = canonicalId(table, recordId);
+      QRecord row = ensure(PersonalRecords.currentUserId(), table, id, "MANUAL");
+      QRecord update = new QRecord().withValue("id", row.getValue("id"));
+      if(notifyOnChange != null)
+      {
+         update.withValue("notifyOnChange", notifyOnChange);
+      }
+      if(notifyOnComment != null)
+      {
+         update.withValue("notifyOnComment", notifyOnComment);
+      }
+      CollaborationRecords.update(CollaborationTables.FOLLOW, update);
+      return (state(table, id).orElseThrow());
+   }
+
+   /*******************************************************************************
+    ** Remove only the caller's subscription and queued digest.
+    *******************************************************************************/
+   public void unfollow(String table, Serializable recordId) throws QException
+   {
+      new PeopleService().touch();
+      String id = canonicalId(table, recordId);
+      for(String target : List.of(CollaborationTables.FOLLOW, CollaborationTables.FOLLOW_DIGEST))
+      {
+         for(QRecord row : CollaborationRecords.query(target, mine(table, id)))
+         {
+            CollaborationRecords.delete(target, row.getValue("id"));
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Current-user state; absent means not followed.
+    *******************************************************************************/
+   public Optional<FollowEntry> state(String table, Serializable recordId) throws QException
+   {
+      new PeopleService().touch();
+      List<QRecord> rows = CollaborationRecords.query(CollaborationTables.FOLLOW, mine(table, canonicalId(table, recordId)));
+      return (rows.stream().findFirst().map(FollowService::entry));
+   }
+
+   /*******************************************************************************
+    ** Parent readers may see its followers independently of admin table browsing.
+    *******************************************************************************/
+   public List<FollowEntry> followers(String table, Serializable recordId) throws QException
+   {
+      new PeopleService().touch();
+      return (CollaborationRecords.query(CollaborationTables.FOLLOW, CollaborationRecords.parent(table, canonicalId(table, recordId)))
+         .stream().map(FollowService::entry).toList());
+   }
+
+   /*******************************************************************************
+    ** Internal automatic follow; unknown access never grants a subscription.
+    *******************************************************************************/
+   public void ensureFollower(String userId, String table, Serializable recordId, String reason) throws QException
+   {
+      new PeopleService().touch();
+      String id = canonicalId(table, recordId);
+      if(!userId.equals(PersonalRecords.currentUserId()) && !new OtherUserAccess().canRead(userId, table, id).orElse(false))
+      {
+         return;
+      }
+      ensure(userId, table, id, reason);
+   }
+
+   /*******************************************************************************
+    ** Existing preferences always win over automatic follow defaults.
+    *******************************************************************************/
+   private QRecord ensure(String user, String table, String id, String reason) throws QException
+   {
+      if(!List.of("MANUAL", "AUTHOR", "COMMENTED", "MENTIONED", "ASSIGNED", "SHARED").contains(reason))
+      {
+         throw (new QException("Unknown follow reason"));
+      }
+      QQueryFilter filter = CollaborationRecords.parent(table, id).withCriteria("userId", QCriteriaOperator.EQUALS, user);
+      List<QRecord> rows = CollaborationRecords.query(CollaborationTables.FOLLOW, filter);
+      if(!rows.isEmpty())
+      {
+         return (rows.getFirst());
+      }
+      QRecord row;
+      try
+      {
+         row = CollaborationRecords.insert(CollaborationTables.FOLLOW, new QRecord().withValue("tableName", table).withValue("recordId", id)
+            .withValue("userId", user).withValue("reason", reason).withValue("notifyOnChange", reason.equals("MANUAL") || reason.equals("ASSIGNED"))
+            .withValue("notifyOnComment", true).withValue("parentDeleted", false));
+      }
+      catch(QException e)
+      {
+         rows = CollaborationRecords.query(CollaborationTables.FOLLOW, filter);
+         if(rows.isEmpty())
+         {
+            throw (e);
+         }
+         return (rows.getFirst());
+      }
+      ActivityWriter.write(table, id, "FOLLOWED", "Record followed", CollaborationTables.FOLLOW, row.getValueString("id"));
+      return (row);
+   }
+
+   /*******************************************************************************
+    ** Normalize numeric aliases to the parent's actual primary key.
+    *******************************************************************************/
+   public static String canonicalId(String table, Serializable id) throws QException
+   {
+      return (ParentRecordAccess.requireVisibleParent(table, id).getValueString(QContext.getQInstance().getTable(table).getPrimaryKeyField()));
+   }
+
+   /*******************************************************************************
+    ** Ownership filter always accompanies parent selection.
+    *******************************************************************************/
+   private QQueryFilter mine(String table, String id) throws QPermissionDeniedException
+   {
+      return (CollaborationRecords.parent(table, id).withCriteria("userId", QCriteriaOperator.EQUALS, PersonalRecords.currentUserId()));
+   }
+
+   /*******************************************************************************
+    ** Immutable public view.
+    *******************************************************************************/
+   private static FollowEntry entry(QRecord row)
+   {
+      return (new FollowEntry(row.getValueInteger("id"), row.getValueString("userId"), row.getValueString("reason"),
+         row.getValueBoolean("notifyOnChange"), row.getValueBoolean("notifyOnComment"), row.getValueInstant("mutedUntil")));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/follow/SendFollowDigestsProcess.java

@@ -0,0 +1,99 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.follow;
+
+
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.actions.processes.BackendStep;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QBackendStepMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.scheduleing.QScheduleMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
+
+
+/*******************************************************************************
+ ** Hidden minute-by-minute digest job. Runs with its caller's session, which must be a
+ ** scheduler system session or collaboration admin; never elevates a user.
+ *******************************************************************************/
+public class SendFollowDigestsProcess implements BackendStep, CustomPermissionChecker
+{
+   public static final String NAME = "collaborationSendFollowDigests";
+
+
+
+   /*******************************************************************************
+    ** Always register the backend-only process; scheduling is opt-in.
+    *******************************************************************************/
+   public static QProcessMetaData metadata(CollaborationQBitConfig config)
+   {
+      QProcessMetaData process = new QProcessMetaData().withName(NAME).withLabel("Send follow digests").withIsHidden(true).withIcon(new QIcon("history"))
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.HAS_ACCESS_PERMISSION)
+            .withPermissionBaseName("collaboration").withCustomPermissionChecker(new QCodeReference(SendFollowDigestsProcess.class)))
+         .withStep(new QBackendStepMetaData().withName("run").withCode(new QCodeReference(SendFollowDigestsProcess.class)));
+      if(config.getSchedulerName() != null)
+      {
+         process.withSchedule(new QScheduleMetaData().withSchedulerName(config.getSchedulerName()).withRepeatSeconds(60).withInitialDelaySeconds(60));
+      }
+      return (process);
+   }
+
+
+
+   /*******************************************************************************
+    ** Hidden is a presentation setting, so explicitly guard execution as well.
+    *******************************************************************************/
+   @Override
+   public void checkPermissionsThrowing(AbstractActionInput input, MetaDataWithPermissionRules metadata) throws QPermissionDeniedException
+   {
+      QSession session = QContext.getQSession();
+      if(!(session instanceof QSystemUserSession) && (session == null || !session.hasPermission(CollaborationPermissions.ADMIN)))
+      {
+         throw (new QPermissionDeniedException("This needs the collaboration.admin permission."));
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Deliver due batches using fresh recipient permissions.
+    *******************************************************************************/
+   @Override
+   public void run(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+   {
+      checkPermissionsThrowing(input, null);
+      new FollowChangeBatcher().sendDue();
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/model/CollaborationTables.java

@@ -25,17 +25,28 @@ package com.kingsrook.qbits.collaboration.model;
 import java.util.ArrayList;
 import java.util.List;
 import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
+import com.kingsrook.qbits.collaboration.attachments.AttachmentPreviewCustomizer;
+import com.kingsrook.qbits.collaboration.attachments.AttachmentSecurity;
 import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizers;
 import com.kingsrook.qqq.backend.core.instances.QInstanceEnricher;
 import com.kingsrook.qqq.backend.core.model.metadata.audits.AuditLevel;
 import com.kingsrook.qqq.backend.core.model.metadata.audits.QAuditRules;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.AdornmentType;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.FieldAdornment;
 import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
 import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QVirtualFieldMetaData;
 import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
 import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValue;
 import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValueSource;
 import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValueSourceType;
 import com.kingsrook.qqq.backend.core.model.metadata.tables.QFieldSection;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QFieldSectionAlternativeType;
 import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
 import com.kingsrook.qqq.backend.core.model.metadata.tables.Tier;
 import com.kingsrook.qqq.backend.core.model.metadata.tables.UniqueKey;
@@ -47,7 +58,23 @@ import com.kingsrook.qqq.backend.core.model.metadata.tables.UniqueKey;
  *******************************************************************************/
 public final class CollaborationTables
 {
+   public static final String SHARE = "collaboration_share";
+   public static final String ACCESS_REQUEST = "collaboration_access_request";
+   public static final String TASK = "collaboration_task";
+   public static final String RECORD_ASSIGNMENT = "collaboration_record_assignment";
+   public static final String TAG = "collaboration_tag";
+   public static final String RECORD_TAG = "collaboration_record_tag";
+   public static final String COMMENT = "collaboration_comment";
+   public static final String COMMENT_REVISION = "collaboration_comment_revision";
+   public static final String MENTION = "collaboration_mention";
+   public static final String FOLLOW = "collaboration_follow";
+   public static final String ACTIVITY = "collaboration_activity";
+   public static final String FOLLOW_DIGEST = "collaboration_follow_digest";
+   public static final String ATTACHMENT = "collaboration_attachment";
    public static final String FEATURE_SETTING = "collaboration_feature_setting";
+   public static final String FAVORITE = "collaboration_favorite";
+   public static final String RECENT = "collaboration_recent";
+   public static final String TARGET_TYPE = "collaboration_target_type";
    public static final String USER = "collaboration_user";
    public static final String SCOPE_TYPE = "collaboration_scope_type";
    public static final String FEATURE = "collaboration_feature";
@@ -70,6 +97,14 @@ public final class CollaborationTables
    public static List<QPossibleValueSource> possibleValueSources()
    {
       return (List.of(
+         QPossibleValueSource.newForTable(SHARE), QPossibleValueSource.newForTable(ACCESS_REQUEST),
+         QPossibleValueSource.newForTable(TASK), QPossibleValueSource.newForTable(RECORD_ASSIGNMENT),
+         enumSource("collaboration_access_request_status", "OPEN", "GRANTED", "DECLINED", "WITHDRAWN"),
+         enumSource("collaboration_task_status", "OPEN", "DONE", "CANCELLED"),
+         QPossibleValueSource.newForTable(TAG), QPossibleValueSource.newForTable(RECORD_TAG),
+         QPossibleValueSource.newForTable(COMMENT), QPossibleValueSource.newForTable(COMMENT_REVISION), QPossibleValueSource.newForTable(MENTION), QPossibleValueSource.newForTable(FOLLOW), QPossibleValueSource.newForTable(ACTIVITY), QPossibleValueSource.newForTable(FOLLOW_DIGEST),
+         enumSource(TARGET_TYPE, "TABLE", "APP", "RECORD", "PROCESS", "REPORT", "SAVED_VIEW"),
+         QPossibleValueSource.newForTable(ATTACHMENT), QPossibleValueSource.newForTable(FAVORITE), QPossibleValueSource.newForTable(RECENT),
          enumSource(SCOPE_TYPE, "INSTANCE", "APP", "TABLE"),
          enumSource(FEATURE, "ATTACHMENTS", "TAGS", "CUSTOM_FIELDS", "COMMENTS", "PRESENCE", "SHARING",
             "FAVORITES", "FOLLOW", "TIMELINE", "RECENTS", "TASKS", "ASSIGNMENT"),
@@ -127,7 +162,18 @@ public final class CollaborationTables
       {
          field.setIsEditable(false);
       }
-      List<QTableMetaData> tables = List.of(settings, people);
+      QTableMetaData favorites = personal(config, FAVORITE, "Favorites", "star")
+         .withField(new QFieldMetaData("sortOrder", QFieldType.INTEGER).withLabel("Sort Order").withIsRequired(true).withDefaultValue(0))
+         .withField(string("folder", "Folder", 255))
+         .withSection(new QFieldSection("details", new QIcon("star"), Tier.T2, List.of("label", "sortOrder", "folder")).withLabel("Details"));
+      QTableMetaData recents = personal(config, RECENT, "Recently Viewed", "history")
+         .withField(new QFieldMetaData("lastViewedAt", QFieldType.DATE_TIME).withLabel("Last Viewed At").withIsRequired(true))
+         .withField(new QFieldMetaData("viewCount", QFieldType.INTEGER).withLabel("View Count").withIsRequired(true).withDefaultValue(1))
+         .withSection(new QFieldSection("details", new QIcon("history"), Tier.T2, List.of("label", "lastViewedAt", "viewCount")).withLabel("Details"));
+      List<QTableMetaData> tables = new ArrayList<>(List.of(settings, people, favorites, recents, attachment(config)));
+      tables.addAll(conversationTables(config));
+      tables.addAll(tagTables(config));
+      tables.addAll(workTables(config));
       for(QTableMetaData table : tables)
       {
          table.withSection(new QFieldSection("dates", new QIcon("calendar_today"), Tier.T3, List.of("createDate", "modifyDate")).withLabel("Dates"));
@@ -152,6 +198,30 @@ public final class CollaborationTables
 
 
 
+   /*******************************************************************************
+    ** Personal high-volume data: owner locks replace a table-level permission.
+    ** Kept out of app navigation; the standard tables remain addressable by admins.
+    *******************************************************************************/
+   private static QTableMetaData personal(CollaborationQBitConfig config, String name, String label, String icon)
+   {
+      return (base(config, name, label, icon)
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.NOT_PROTECTED)
+            .withCustomPermissionChecker(new QCodeReference(CollaborationSecurity.class)))
+         .withRecordSecurityLock(CollaborationSecurity.ownerLock("userId"))
+         .withAuditRules(new QAuditRules().withAuditLevel(AuditLevel.NONE))
+         .withRecordLabelFormatAndFields("%s", "label")
+         .withField(string("userId", "User ID", 255).withIsRequired(true))
+         .withField(string("targetType", "Target Type", 20).withIsRequired(true).withPossibleValueSourceName(TARGET_TYPE))
+         .withField(string("targetName", "Target Name", 255).withIsRequired(true))
+         .withField(string("recordId", "Record ID", 255))
+         .withField(string("label", "Label", 1024))
+         .withUniqueKey(new UniqueKey("userId", "targetType", "targetName", "recordId"))
+         .withSection(new QFieldSection("identity", new QIcon("badge"), Tier.T1,
+            List.of("id", "userId", "targetType", "targetName", "recordId")).withLabel("Identity")));
+   }
+
+
+
    /*******************************************************************************
     ** A bounded string field.
     *******************************************************************************/
@@ -159,4 +229,223 @@ public final class CollaborationTables
    {
       return (new QFieldMetaData(name, QFieldType.STRING).withLabel(label).withMaxLength(length));
    }
+
+   /*******************************************************************************
+    ** Main attachment table; virtual URLs never have backend columns.
+    *******************************************************************************/
+   private static QTableMetaData attachment(CollaborationQBitConfig config)
+   {
+      return (base(config, ATTACHMENT, "Attachments", "attach_file")
+         .withPermissionRules(CollaborationPermissions.permissionRules()
+            .withCustomPermissionChecker(new QCodeReference(AttachmentSecurity.class)))
+         .withRecordLabelFormatAndFields("%s", "fileName")
+         .withSearchFields(List.of("fileName", "description"))
+         .withAuditRules(new QAuditRules().withAuditLevel(AuditLevel.FIELD))
+         .withField(string("tableName", "Table", 128).withIsRequired(true))
+         .withField(string("recordId", "Record ID", 64).withIsRequired(true))
+         .withField(string("fileName", "File Name", 255).withIsRequired(true))
+         .withField(string("contentType", "Content Type", 255).withIsRequired(true))
+         .withField(new QFieldMetaData("sizeBytes", QFieldType.LONG).withLabel("Size (bytes)").withIsRequired(true))
+         .withField(string("sha256", "SHA-256", 64).withIsRequired(true))
+         .withField(string("bucketName", "Bucket", 255).withIsRequired(true))
+         .withField(string("storageKey", "Storage Key", 1024).withIsRequired(true))
+         .withField(string("thumbnailKey", "Thumbnail Key", 1024))
+         .withField(new QFieldMetaData("description", QFieldType.TEXT).withLabel("Description"))
+         .withField(string("createdByUserId", "Created By", 255).withIsRequired(true))
+         .withField(new QFieldMetaData("parentDeleted", QFieldType.BOOLEAN).withLabel("Parent Deleted").withIsRequired(true).withDefaultValue(false))
+         .withVirtualField(new QVirtualFieldMetaData("previewUrl", QFieldType.STRING).withLabel("Preview").withIsEditable(false).withIsQuerySelectable(true)
+            .withFieldAdornment(AdornmentType.FilePreviewValues.newFieldAdornment()
+               .withValue(AdornmentType.FilePreviewValues.FILE_NAME_FIELD, "fileName")
+               .withValue(AdornmentType.FilePreviewValues.MIME_TYPE_FIELD, "contentType")
+               .withValue(AdornmentType.FilePreviewValues.SIZE_BYTES_FIELD, "sizeBytes")
+               .withValue(AdornmentType.FilePreviewValues.THUMBNAIL_MAX_SIZE, 48)))
+         .withVirtualField(new QVirtualFieldMetaData("downloadUrl", QFieldType.STRING).withLabel("Download").withIsEditable(false).withIsQuerySelectable(true)
+            .withFieldAdornment(new FieldAdornment(AdornmentType.FILE_DOWNLOAD)
+               .withValue(AdornmentType.FileDownloadValues.FILE_NAME_FIELD, "fileName")
+               .withValue(AdornmentType.FileDownloadValues.DOWNLOAD_URL_DYNAMIC, true)))
+         .withCustomizer(TableCustomizers.POST_QUERY_RECORD, new QCodeReference(AttachmentPreviewCustomizer.class))
+         .withSection(new QFieldSection("file", new QIcon("attach_file"), Tier.T1,
+            List.of("fileName", "contentType", "sizeBytes", "description")).withLabel("File")
+            .withAlternative(QFieldSectionAlternativeType.RECORD_VIEW, section -> section.setFieldNames(List.of("previewUrl", "downloadUrl", "fileName", "contentType", "sizeBytes", "description"))))
+         .withSection(new QFieldSection("parent", new QIcon("link"), Tier.T2,
+            List.of("tableName", "recordId", "createdByUserId", "parentDeleted")).withLabel("Parent"))
+         .withSection(new QFieldSection("storage", new QIcon("storage"), Tier.T3,
+            List.of("id", "bucketName", "storageKey", "thumbnailKey", "sha256")).withLabel("Storage")));
+   }
+
+
+   /*******************************************************************************
+    ** Conversation tables share immutable parent references and service-only writes.
+    *******************************************************************************/
+   private static List<QTableMetaData> conversationTables(CollaborationQBitConfig config)
+   {
+      QTableMetaData comments = referenced(config, COMMENT, "Comments", "forum")
+         .withAuditRules(new QAuditRules().withAuditLevel(AuditLevel.FIELD))
+         .withSearchFields(List.of("body"))
+         .withField(new QFieldMetaData("threadId", QFieldType.INTEGER).withPossibleValueSourceName(COMMENT))
+         .withField(new QFieldMetaData("parentCommentId", QFieldType.INTEGER).withPossibleValueSourceName(COMMENT))
+         .withField(new QFieldMetaData("body", QFieldType.TEXT).withMaxLength(20000))
+         .withField(string("fieldName", "Field", 128))
+         .withField(string("authorUserId", "Author", 255).withIsRequired(true))
+         .withField(new QFieldMetaData("lastActivityAt", QFieldType.DATE_TIME).withIsRequired(true))
+         .withField(new QFieldMetaData("editedAt", QFieldType.DATE_TIME))
+         .withField(new QFieldMetaData("resolvedAt", QFieldType.DATE_TIME))
+         .withField(string("resolvedByUserId", "Resolved By", 255))
+         .withField(new QFieldMetaData("deletedAt", QFieldType.DATE_TIME))
+         .withField(string("deletedByUserId", "Deleted By", 255))
+         .withRecordLabelFormatAndFields("Comment %s", "id");
+      QTableMetaData revisions = referenced(config, COMMENT_REVISION, "Comment History", "history")
+         .withField(new QFieldMetaData("commentId", QFieldType.INTEGER).withIsRequired(true).withPossibleValueSourceName(COMMENT))
+         .withField(new QFieldMetaData("body", QFieldType.TEXT))
+         .withField(new QFieldMetaData("editedAt", QFieldType.DATE_TIME).withIsRequired(true))
+         .withField(string("editedByUserId", "Edited By", 255));
+      QTableMetaData mentions = referenced(config, MENTION, "Mentions", "alternate_email")
+         .withField(new QFieldMetaData("commentId", QFieldType.INTEGER).withIsRequired(true).withPossibleValueSourceName(COMMENT))
+         .withField(string("mentionedUserId", "Mentioned User", 255).withIsRequired(true))
+         .withField(new QFieldMetaData("visible", QFieldType.BOOLEAN).withIsRequired(true))
+         .withField(new QFieldMetaData("readAt", QFieldType.DATE_TIME))
+         .withField(new QFieldMetaData("notifiedAt", QFieldType.DATE_TIME))
+         .withUniqueKey(new UniqueKey("commentId", "mentionedUserId"));
+      QTableMetaData follows = referenced(config, FOLLOW, "Followers", "notifications")
+         .withField(string("userId", "User", 255).withIsRequired(true))
+         .withField(string("reason", "Reason", 32).withIsRequired(true))
+         .withField(new QFieldMetaData("notifyOnChange", QFieldType.BOOLEAN).withIsRequired(true))
+         .withField(new QFieldMetaData("notifyOnComment", QFieldType.BOOLEAN).withIsRequired(true))
+         .withField(new QFieldMetaData("mutedUntil", QFieldType.DATE_TIME))
+         .withUniqueKey(new UniqueKey("tableName", "recordId", "userId"));
+      QTableMetaData activity = referenced(config, ACTIVITY, "Activity", "history")
+         .withoutCapabilities(com.kingsrook.qqq.backend.core.model.metadata.tables.Capability.TABLE_INSERT,
+            com.kingsrook.qqq.backend.core.model.metadata.tables.Capability.TABLE_UPDATE, com.kingsrook.qqq.backend.core.model.metadata.tables.Capability.TABLE_DELETE)
+         .withField(new QFieldMetaData("at", QFieldType.DATE_TIME).withIsRequired(true))
+         .withField(string("actorUserId", "Actor", 255))
+         .withField(string("type", "Type", 64).withIsRequired(true))
+         .withField(new QFieldMetaData("summary", QFieldType.TEXT))
+         .withField(string("refTableName", "Reference Table", 128))
+         .withField(string("refId", "Reference ID", 64));
+      QTableMetaData digests = referenced(config, FOLLOW_DIGEST, "Follow Digests", "notifications")
+         .withField(string("userId", "Recipient", 255).withIsRequired(true))
+         .withField(new QFieldMetaData("dueAt", QFieldType.DATE_TIME).withIsRequired(true))
+         .withField(new QFieldMetaData("changes", QFieldType.TEXT))
+         .withUniqueKey(new UniqueKey("tableName", "recordId", "userId"));
+      List<QTableMetaData> tables = List.of(comments, revisions, mentions, follows, activity, digests);
+      for(QTableMetaData table : tables)
+      {
+         table.withSection(new QFieldSection("details", new QIcon("info"), Tier.T1,
+            table.getFields().keySet().stream().filter(name -> !List.of("createDate", "modifyDate", "tableName", "recordId", "parentDeleted").contains(name)).toList()).withLabel("Details"));
+         for(QFieldMetaData field : table.getFields().values())
+         {
+            field.setIsEditable(false);
+         }
+      }
+      return (tables);
+   }
+
+   /*******************************************************************************
+    ** Denormalized references on children permit the same pre-query security.
+    *******************************************************************************/
+   private static QTableMetaData referenced(CollaborationQBitConfig config, String name, String label, String icon)
+   {
+      return (base(config, name, label, icon)
+         .withAuditRules(new QAuditRules().withAuditLevel(AuditLevel.NONE))
+         .withPermissionRules(CollaborationPermissions.permissionRules()
+            .withDenyBehavior(com.kingsrook.qqq.backend.core.model.metadata.permissions.DenyBehavior.HIDDEN)
+            .withCustomPermissionChecker(new QCodeReference(com.kingsrook.qbits.collaboration.security.CollaborationRowSecurity.class)))
+         .withCustomizer(TableCustomizers.POST_QUERY_RECORD, new QCodeReference(com.kingsrook.qbits.collaboration.security.ParentRowCustomizer.class))
+         .withField(string("tableName", "Table", 128).withIsRequired(true))
+         .withField(string("recordId", "Record ID", 64).withIsRequired(true))
+         .withField(new QFieldMetaData("parentDeleted", QFieldType.BOOLEAN).withIsRequired(true).withDefaultValue(false))
+         .withRecordLabelFormatAndFields("%s", "id")
+         .withSection(new QFieldSection("parent", new QIcon("link"), Tier.T2, List.of("tableName", "recordId", "parentDeleted")).withLabel("Parent")));
+   }
+
+   /*******************************************************************************
+    ** Vocabulary is visible; assignments inherit parent restrictions and locks.
+    *******************************************************************************/
+   private static List<QTableMetaData> tagTables(CollaborationQBitConfig config)
+   {
+      QTableMetaData tags = base(config, TAG, "Tags", "label")
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.NOT_PROTECTED)
+            .withCustomPermissionChecker(new QCodeReference(com.kingsrook.qbits.collaboration.tags.TagSecurity.class)))
+         .withAuditRules(new QAuditRules().withAuditLevel(AuditLevel.FIELD))
+         .withSearchFields(List.of("label"))
+         .withRecordLabelFormatAndFields("%s", "label")
+         .withField(string("name", "Name", 60).withIsRequired(true))
+         .withField(string("label", "Label", 255).withIsRequired(true))
+         .withField(string("color", "Color", 64))
+         .withField(string("tableName", "Table", 128))
+         .withField(new QFieldMetaData("approved", QFieldType.BOOLEAN).withIsRequired(true))
+         .withField(new QFieldMetaData("description", QFieldType.TEXT))
+         .withField(string("createdByUserId", "Created By", 255).withIsRequired(true))
+         .withField(new QFieldMetaData("usageCount", QFieldType.INTEGER).withIsRequired(true).withDefaultValue(0))
+         .withField(new QFieldMetaData("mergedIntoTagId", QFieldType.INTEGER).withPossibleValueSourceName(TAG))
+         .withUniqueKey(new UniqueKey("tableName", "name"))
+         .withSection(new QFieldSection("details", new QIcon("label"), Tier.T1,
+            List.of("id", "name", "label", "color", "tableName", "approved", "description", "createdByUserId", "usageCount", "mergedIntoTagId")).withLabel("Details"));
+      QTableMetaData links = referenced(config, RECORD_TAG, "Record Tags", "label")
+         .withField(new QFieldMetaData("tagId", QFieldType.INTEGER).withIsRequired(true).withPossibleValueSourceName(TAG))
+         .withField(string("createdByUserId", "Created By", 255).withIsRequired(true))
+         .withUniqueKey(new UniqueKey("tableName", "recordId", "tagId"))
+         .withSection(new QFieldSection("details", new QIcon("label"), Tier.T1, List.of("id", "tagId", "createdByUserId")).withLabel("Details"));
+      for(QTableMetaData table : List.of(tags, links))
+      {
+         table.getFields().values().forEach(field -> field.setIsEditable(false));
+      }
+      return (List.of(tags, links));
+   }
+
+   /*******************************************************************************
+    ** Sharing and work tables remain visible, audited and service-managed.
+    *******************************************************************************/
+   private static List<QTableMetaData> workTables(CollaborationQBitConfig config)
+   {
+      QTableMetaData shares = referenced(config, SHARE, "Shares", "share")
+         .withField(string("fromUserId", "From", 255).withIsRequired(true))
+         .withField(string("toUserId", "To", 255).withIsRequired(true))
+         .withField(new QFieldMetaData("message", QFieldType.TEXT).withMaxLength(2000))
+         .withField(new QFieldMetaData("recipientCouldRead", QFieldType.BOOLEAN))
+         .withField(new QFieldMetaData("sentAt", QFieldType.DATE_TIME).withIsRequired(true))
+         .withField(new QFieldMetaData("openedAt", QFieldType.DATE_TIME));
+      QTableMetaData requests = base(config, ACCESS_REQUEST, "Access Requests", "lock_open")
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.NOT_PROTECTED)
+            .withCustomPermissionChecker(new QCodeReference(com.kingsrook.qbits.collaboration.sharing.AccessRequestSecurity.class)))
+         .withRecordSecurityLock(CollaborationSecurity.ownerLock("requesterUserId"))
+         .withCustomizer(TableCustomizers.POST_QUERY_RECORD, new QCodeReference(com.kingsrook.qbits.collaboration.sharing.AccessRequestSecurity.class))
+         .withRecordLabelFormatAndFields("Access request %s", "id")
+         .withField(string("tableName", "Table", 128).withIsRequired(true))
+         .withField(string("recordId", "Record ID", 64).withIsRequired(true))
+         .withField(string("requesterUserId", "Requester", 255).withIsRequired(true))
+         .withField(new QFieldMetaData("shareId", QFieldType.INTEGER))
+         .withField(new QFieldMetaData("message", QFieldType.TEXT).withMaxLength(2000))
+         .withField(string("status", "Status", 20).withIsRequired(true).withPossibleValueSourceName("collaboration_access_request_status"))
+         .withField(string("handledByUserId", "Handled By", 255))
+         .withField(new QFieldMetaData("handledAt", QFieldType.DATE_TIME))
+         .withField(new QFieldMetaData("note", QFieldType.TEXT).withMaxLength(2000));
+      QTableMetaData tasks = referenced(config, TASK, "Tasks", "task_alt")
+         .withRecordLabelFormatAndFields("%s", "title").withSearchFields(List.of("title"))
+         .withField(string("title", "Title", 200).withIsRequired(true))
+         .withField(new QFieldMetaData("notes", QFieldType.TEXT))
+         .withField(string("assigneeUserId", "Assignee", 255))
+         .withField(new QFieldMetaData("dueAt", QFieldType.DATE_TIME))
+         .withField(new QFieldMetaData("remindAt", QFieldType.DATE_TIME))
+         .withField(new QFieldMetaData("remindedAt", QFieldType.DATE_TIME))
+         .withField(new QFieldMetaData("overdueNotifiedAt", QFieldType.DATE_TIME))
+         .withField(string("status", "Status", 20).withIsRequired(true).withPossibleValueSourceName("collaboration_task_status"))
+         .withField(new QFieldMetaData("completedAt", QFieldType.DATE_TIME))
+         .withField(string("completedByUserId", "Completed By", 255))
+         .withField(string("createdByUserId", "Created By", 255).withIsRequired(true));
+      QTableMetaData assignments = referenced(config, RECORD_ASSIGNMENT, "Record Owners", "assignment_ind")
+         .withField(string("ownerUserId", "Owner", 255))
+         .withField(string("assigneeUserId", "Assignee", 255))
+         .withUniqueKey(new UniqueKey("tableName", "recordId"));
+      List<QTableMetaData> tables = List.of(shares, requests, tasks, assignments);
+      for(QTableMetaData table : tables)
+      {
+         table.withAuditRules(new QAuditRules().withAuditLevel(AuditLevel.FIELD))
+            .withSection(new QFieldSection("details", new QIcon("info"), Tier.T1,
+               table.getFields().keySet().stream().filter(name -> !List.of("createDate", "modifyDate", "parentDeleted").contains(name)
+                  && (table.getName().equals(ACCESS_REQUEST) || !List.of("tableName", "recordId").contains(name))).toList()).withLabel("Details"));
+         table.getFields().values().forEach(field -> field.setIsEditable(false));
+      }
+      return (tables);
+   }
 }

src/main/java/com/kingsrook/qbits/collaboration/model/ConversationChildren.java

@@ -0,0 +1,73 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.model;
+
+import java.util.List;
+import com.kingsrook.qqq.backend.core.actions.dashboard.widgets.ChildRecordListRenderer;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.joins.JoinOn;
+import com.kingsrook.qqq.backend.core.model.metadata.joins.JoinType;
+import com.kingsrook.qqq.backend.core.model.metadata.joins.QJoinMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QFieldSection;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.Tier;
+
+/*******************************************************************************
+ ** Standard child lists keep revision, mention and follower tables out of navigation.
+ *******************************************************************************/
+public final class ConversationChildren
+{
+   /*******************************************************************************
+    ** Static metadata helper.
+    *******************************************************************************/
+   private ConversationChildren()
+   {
+   }
+
+   /*******************************************************************************
+    ** Install after tables have been registered.
+    *******************************************************************************/
+   public static void install(QInstance instance)
+   {
+      QJoinMetaData tagJoin = new QJoinMetaData().withLeftTable(CollaborationTables.TAG).withRightTable(CollaborationTables.RECORD_TAG)
+         .withInferredName().withType(JoinType.ONE_TO_MANY).withJoinOns(List.of(new JoinOn("id", "tagId")));
+      instance.addJoin(tagJoin);
+      instance.addWidget(ChildRecordListRenderer.widgetMetaDataBuilder(tagJoin).withLabel("Record Tags").withCanAddChildRecord(false).getWidgetMetaData());
+      instance.getTable(CollaborationTables.TAG).withSection(new QFieldSection("recordTags", new QIcon("list"), Tier.T2)
+         .withLabel("Record Tags").withWidgetName(tagJoin.getName()));
+      child(instance, CollaborationTables.COMMENT_REVISION, "Comment History", List.of(new JoinOn("id", "commentId")));
+      child(instance, CollaborationTables.MENTION, "Mentions", List.of(new JoinOn("id", "commentId")));
+      child(instance, CollaborationTables.FOLLOW, "Followers", List.of(new JoinOn("tableName", "tableName"), new JoinOn("recordId", "recordId")));
+   }
+
+   /*******************************************************************************
+    ** Child records are managed by services, so the add button is disabled.
+    *******************************************************************************/
+   private static void child(QInstance instance, String table, String label, List<JoinOn> conditions)
+   {
+      QJoinMetaData join = new QJoinMetaData().withLeftTable(CollaborationTables.COMMENT).withRightTable(table)
+         .withInferredName().withType(JoinType.ONE_TO_MANY).withJoinOns(conditions);
+      instance.addJoin(join);
+      instance.addWidget(ChildRecordListRenderer.widgetMetaDataBuilder(join).withLabel(label).withCanAddChildRecord(false).getWidgetMetaData());
+      instance.getTable(CollaborationTables.COMMENT).withSection(new QFieldSection(table, new QIcon("list"), Tier.T2).withLabel(label).withWidgetName(join.getName()));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/mywork/MyWorkService.java

@@ -0,0 +1,104 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.mywork;
+
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.assignment.AssignmentService;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qbits.collaboration.tasks.TasksService;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Caller-scoped work summary; parent-invisible rows never contribute counts.
+ *******************************************************************************/
+public class MyWorkService
+{
+   /*******************************************************************************
+    ** Open task count and first ten, assigned record counts, and unread mentions.
+    *******************************************************************************/
+   public Summary summary() throws QException
+   {
+      List<QRecord> tasks = new TasksService().mineRows("OPEN");
+      Map<String, Long> assignments = new LinkedHashMap<>();
+      for(QRecord row : new AssignmentService().mineRows(null, true))
+      {
+         assignments.merge(row.getValueString("tableName"), 1L, Long::sum);
+      }
+      return (new Summary((long) tasks.size(), tasks.stream().limit(10).toList(), assignments, (long) unread().size()));
+   }
+
+   /*******************************************************************************
+    ** Only delivered, unread mentions of currently visible records are actionable.
+    *******************************************************************************/
+   private List<QRecord> unread() throws QException
+   {
+      List<QRecord> result = new ArrayList<>();
+      for(QRecord row : CollaborationRecords.query(CollaborationTables.MENTION, new QQueryFilter()
+         .withCriteria("mentionedUserId", QCriteriaOperator.EQUALS, PersonalRecords.currentUserId())
+         .withCriteria("notifiedAt", QCriteriaOperator.IS_NOT_BLANK).withCriteria("readAt", QCriteriaOperator.IS_BLANK)
+         .withCriteria("parentDeleted", QCriteriaOperator.EQUALS, false)))
+      {
+         try
+         {
+            ParentRecordAccess.requireVisibleParent(row.getValueString("tableName"), row.getValueString("recordId"));
+            result.add(row);
+         }
+         catch(QNotFoundException expected)
+         {
+            // Do not reveal the existence of mentions on revoked parents.
+         }
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Null selects all visible unread mentions; supplied IDs remain owner-scoped.
+    *******************************************************************************/
+   public void markMentionsRead(List<Integer> mentionIds) throws QException
+   {
+      for(QRecord row : unread())
+      {
+         if(mentionIds == null || mentionIds.contains(row.getValueInteger("id")))
+         {
+            CollaborationRecords.update(CollaborationTables.MENTION, new QRecord().withValue("id", row.getValue("id")).withValue("readAt", Instant.now()));
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Stable service contract for the subsequent UI API PR.
+    *******************************************************************************/
+   public record Summary(Long openTaskCount, List<QRecord> tasks, Map<String, Long> assignedRecordsByTable, Long unreadMentionCount)
+   {
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/notify/CollaborationNotification.java

@@ -0,0 +1,38 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.notify;
+
+
+/*******************************************************************************
+ ** Transport-neutral notification. Body is markdown; link is a record href.
+ *******************************************************************************/
+public record CollaborationNotification(String recipientUserId, String title, String body, Category category,
+   String sourceTableName, String sourceRecordId, String link)
+{
+   /*******************************************************************************
+    ** Categories supported by the collaboration notification boundary.
+    *******************************************************************************/
+   public enum Category
+   {
+      MENTION, SHARE, FOLLOW, TASK
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/notify/CollaborationNotifier.java

@@ -0,0 +1,34 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.notify;
+
+
+/*******************************************************************************
+ ** replace with a QAlerts.notify adapter when QRun-IO/qqq#1125 is released
+ *******************************************************************************/
+public interface CollaborationNotifier
+{
+   /*******************************************************************************
+    ** Deliver a recipient-authorized notification.
+    *******************************************************************************/
+   void notify(CollaborationNotification n);
+}

src/main/java/com/kingsrook/qbits/collaboration/notify/NoOpNotifier.java

@@ -0,0 +1,37 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.notify;
+
+
+/*******************************************************************************
+ ** Default when no notification transport is installed.
+ *******************************************************************************/
+public class NoOpNotifier implements CollaborationNotifier
+{
+   /*******************************************************************************
+    ** Activity remains available in the timeline without a delivery transport.
+    *******************************************************************************/
+   @Override
+   public void notify(CollaborationNotification n)
+   {
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/notify/Notifications.java

@@ -0,0 +1,118 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.notify;
+
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.security.OtherUserAccess;
+import com.kingsrook.qqq.backend.core.actions.customizers.QCodeLoader;
+import com.kingsrook.qqq.backend.core.context.CapturedContext;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.utils.lambdas.UnsafeVoidVoidMethod;
+
+/*******************************************************************************
+ ** Notification delivery uses RC.5 after-commit callbacks and fresh recipient access.
+ ** replace with a QAlerts.notify adapter when QRun-IO/qqq#1125 is released
+ *******************************************************************************/
+public final class Notifications
+{
+   /*******************************************************************************
+    ** Static transport boundary.
+    *******************************************************************************/
+   private Notifications()
+   {
+   }
+
+   /*******************************************************************************
+    ** Capture instance/session, but never carry a completed transaction into delivery.
+    *******************************************************************************/
+   public static void send(CollaborationNotification notification) throws QException
+   {
+      send(notification, null);
+   }
+
+   /*******************************************************************************
+    ** Optional receipt runs only after actual transport delivery, never on rollback.
+    *******************************************************************************/
+   public static void send(CollaborationNotification notification, UnsafeVoidVoidMethod<QException> receipt) throws QException
+   {
+      send(notification, receipt, true);
+   }
+
+   /*******************************************************************************
+    ** Only for access-request notices containing no parent data or sender message.
+    *******************************************************************************/
+   public static void sendAccessNotice(CollaborationNotification notification) throws QException
+   {
+      send(notification, null, false);
+   }
+
+   /*******************************************************************************
+    ** Both safe notices and parent-data delivery respect transaction completion.
+    *******************************************************************************/
+   private static void send(CollaborationNotification notification, UnsafeVoidVoidMethod<QException> receipt, boolean checkParent) throws QException
+   {
+      CapturedContext context = new CapturedContext(QContext.getQInstance(), QContext.getQSession());
+      if(QContext.getQBackendTransaction() != null)
+      {
+         QContext.getQBackendTransaction().addAfterCommitCallback(() ->
+         {
+            try
+            {
+               QContext.withTemporaryContext(context, () -> deliver(notification, receipt, checkParent));
+            }
+            catch(QException e)
+            {
+               throw (new IllegalStateException("Collaboration notification failed after commit", e));
+            }
+         });
+      }
+      else
+      {
+         deliver(notification, receipt, checkParent);
+      }
+   }
+
+   /*******************************************************************************
+    ** Re-check immediately before exposing record data to the transport.
+    *******************************************************************************/
+   private static void deliver(CollaborationNotification notification, UnsafeVoidVoidMethod<QException> receipt, boolean checkParent) throws QException
+   {
+      if(!checkParent || new OtherUserAccess().canRead(notification.recipientUserId(), notification.sourceTableName(), notification.sourceRecordId()).orElse(false))
+      {
+         CollaborationNotifier notifier = QCodeLoader.getAdHoc(CollaborationNotifier.class, CollaborationRecords.config().getNotifier());
+         notifier.notify(notification);
+         if(receipt != null && !(notifier instanceof NoOpNotifier))
+         {
+            receipt.run();
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Relative canonical frontend link with separately encoded path segments.
+    *******************************************************************************/
+   public static String link(String table, String id)
+   {
+      return (com.kingsrook.qbits.collaboration.TargetResolver.recordHref(table, id));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/notify/RecordingNotifier.java

@@ -0,0 +1,50 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.notify;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/*******************************************************************************
+ ** In-memory transport for tests; each instance owns its recorded notifications.
+ *******************************************************************************/
+public class RecordingNotifier implements CollaborationNotifier
+{
+   private final List<CollaborationNotification> notifications = new ArrayList<>();
+
+   /*******************************************************************************
+    ** Record delivery for assertions.
+    *******************************************************************************/
+   @Override
+   public synchronized void notify(CollaborationNotification n)
+   {
+      notifications.add(n);
+   }
+
+   /*******************************************************************************
+    ** Immutable snapshot of delivered notifications.
+    *******************************************************************************/
+   public synchronized List<CollaborationNotification> notifications()
+   {
+      return (List.copyOf(notifications));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/people/PeopleService.java

@@ -0,0 +1,162 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.people;
+
+import java.time.Clock;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.CriteriaOption;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterCriteria;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Lazy, service-managed directory. Persisted timestamps make throttling survive
+ ** service recreation and avoid a cache claiming success after rollback.
+ *******************************************************************************/
+public class PeopleService
+{
+   private final Clock clock;
+
+   /*******************************************************************************
+    ** Production clock.
+    *******************************************************************************/
+   public PeopleService()
+   {
+      this(Clock.systemUTC());
+   }
+
+   /*******************************************************************************
+    ** Deterministic clock for directory maintenance tests.
+    *******************************************************************************/
+   public PeopleService(Clock clock)
+   {
+      this.clock = clock;
+   }
+
+   /*******************************************************************************
+    ** Upsert only the caller, at most once every ten minutes.
+    *******************************************************************************/
+   public void touch() throws QException
+   {
+      String user = PersonalRecords.currentUserId();
+      List<QRecord> rows = CollaborationRecords.query(CollaborationTables.USER, new QQueryFilter().withCriteria("userId", QCriteriaOperator.EQUALS, user));
+      Instant now = clock.instant();
+      if(!rows.isEmpty() && rows.getFirst().getValueInstant("lastSeenAt") != null
+         && rows.getFirst().getValueInstant("lastSeenAt").plusSeconds(600).isAfter(now))
+      {
+         return;
+      }
+      String name = QContext.getQSession().getUser().getFullName();
+      QRecord row = new QRecord().withValue("userId", user).withValue("displayName", name == null || name.isBlank() ? user : name).withValue("lastSeenAt", now);
+      if(rows.isEmpty())
+      {
+         try
+         {
+            CollaborationRecords.insert(CollaborationTables.USER, row.withValue("active", true));
+         }
+         catch(QException e)
+         {
+            if(CollaborationRecords.query(CollaborationTables.USER, new QQueryFilter().withCriteria("userId", QCriteriaOperator.EQUALS, user)).isEmpty())
+            {
+               throw (e);
+            }
+            // A concurrent first call populated the same directory identity.
+         }
+      }
+      else
+      {
+         CollaborationRecords.update(CollaborationTables.USER, row.withValue("id", rows.getFirst().getValue("id")));
+      }
+   }
+
+   /*******************************************************************************
+    ** Directory search requires a signed-in caller and excludes inactive people.
+    *******************************************************************************/
+   public List<PersonEntry> search(String q, Integer limit) throws QException
+   {
+      return (search(q, limit, Set.of()));
+   }
+
+   /*******************************************************************************
+    ** Rank participants before limiting, with bounded backend queries for both groups.
+    *******************************************************************************/
+   public List<PersonEntry> search(String q, Integer limit, Set<String> preferredUserIds) throws QException
+   {
+      PersonalRecords.currentUserId();
+      if(limit == null || limit < 1 || limit > 50)
+      {
+         throw (new QException("Limit must be between 1 and 50"));
+      }
+      List<QRecord> rows = new ArrayList<>();
+      if(!preferredUserIds.isEmpty())
+      {
+         rows.addAll(CollaborationRecords.query(CollaborationTables.USER, searchFilter(q, limit)
+            .withCriteria("userId", QCriteriaOperator.IN, new ArrayList<>(preferredUserIds))));
+      }
+      if(rows.size() < limit)
+      {
+         QQueryFilter other = searchFilter(q, limit - rows.size());
+         if(!preferredUserIds.isEmpty())
+         {
+            other.withCriteria("userId", QCriteriaOperator.NOT_IN, new ArrayList<>(preferredUserIds));
+         }
+         rows.addAll(CollaborationRecords.query(CollaborationTables.USER, other));
+      }
+      return (rows.stream().map(row -> new PersonEntry(row.getValueString("userId"), row.getValueString("displayName"),
+         row.getValueString("email"), row.getValueInstant("lastSeenAt"))).toList());
+   }
+
+   /*******************************************************************************
+    ** Keep active and group restrictions outside the display-name/email OR.
+    *******************************************************************************/
+   private QQueryFilter searchFilter(String q, Integer limit)
+   {
+      QQueryFilter filter = new QQueryFilter().withCriteria("active", QCriteriaOperator.EQUALS, true)
+         .withOrderBy(new QFilterOrderBy("displayName")).withOrderBy(new QFilterOrderBy("userId")).withLimit(limit);
+      if(q != null && !q.isBlank())
+      {
+         filter.withSubFilter(new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR)
+            .withCriteria(new QFilterCriteria("displayName", QCriteriaOperator.CONTAINS, q).withOption(CriteriaOption.CASE_INSENSITIVE))
+            .withCriteria(new QFilterCriteria("email", QCriteriaOperator.CONTAINS, q).withOption(CriteriaOption.CASE_INSENSITIVE)));
+      }
+      return (filter);
+   }
+
+   /*******************************************************************************
+    ** Resolve display names without publishing the raw directory table.
+    *******************************************************************************/
+   public String displayName(String userId) throws QException
+   {
+      List<QRecord> rows = CollaborationRecords.query(CollaborationTables.USER, new QQueryFilter().withCriteria("userId", QCriteriaOperator.EQUALS, userId));
+      return (rows.isEmpty() || rows.getFirst().getValueString("displayName") == null ? userId : rows.getFirst().getValueString("displayName"));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/people/PersonEntry.java

@@ -0,0 +1,31 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.people;
+
+import java.time.Instant;
+
+/*******************************************************************************
+ ** Safe directory fields returned to mention autocomplete.
+ *******************************************************************************/
+public record PersonEntry(String userId, String displayName, String email, Instant lastSeenAt)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/permissions/CollaborationPermissions.java

@@ -29,7 +29,7 @@ import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRule
 
 
 /*******************************************************************************
- ** Full permission names; fields and tags management are reserved for later phases.
+ ** Full permission names; fields management is reserved for a later phase.
  *******************************************************************************/
 public final class CollaborationPermissions
 {

src/main/java/com/kingsrook/qbits/collaboration/recents/RecentsService.java

@@ -0,0 +1,132 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.recents;
+
+
+import java.io.Serializable;
+import java.time.Clock;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.TargetResolver;
+import com.kingsrook.qbits.collaboration.favorites.FavoriteEntry;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+
+/*******************************************************************************
+ ** Current-user recent targets, with persisted one-minute throttling. No process
+ ** cache or unreleased core contracts are needed. Lists drop unavailable targets.
+ *******************************************************************************/
+public final class RecentsService
+{
+   static Clock clock = Clock.systemUTC();
+
+
+
+   /*******************************************************************************
+    ** Static service.
+    *******************************************************************************/
+   private RecentsService()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Validate visibility, then insert or refresh at most once per minute.
+    *******************************************************************************/
+   public static void recordView(String targetType, String targetName, Serializable recordId) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      String userId = PersonalRecords.currentUserId();
+      FavoriteEntry target = TargetResolver.require(targetType, targetName, recordId);
+      QQueryFilter filter = PersonalRecords.targetFilter(targetType, targetName, target.recordId());
+      List<QRecord> existing = PersonalRecords.query(CollaborationTables.RECENT, filter);
+      Instant now = clock.instant();
+      if(existing.isEmpty())
+      {
+         QRecord row = new QRecord().withValue("userId", userId).withValue("targetType", targetType).withValue("targetName", targetName)
+            .withValue("recordId", target.recordId()).withValue("label", target.label()).withValue("lastViewedAt", now).withValue("viewCount", 1);
+         try
+         {
+            PersonalRecords.insert(CollaborationTables.RECENT, row);
+            return;
+         }
+         catch(QException e)
+         {
+            existing = PersonalRecords.query(CollaborationTables.RECENT, filter);
+            if(existing.isEmpty())
+            {
+               throw (e);
+            }
+            // A concurrent first view inserted this target. Apply normal throttling.
+         }
+      }
+      QRecord row = existing.getFirst();
+      if(row.getValueInstant("lastViewedAt").plusSeconds(60).isAfter(now))
+      {
+         return;
+      }
+      PersonalRecords.update(CollaborationTables.RECENT, List.of(new QRecord().withValue("id", row.getValue("id"))
+         .withValue("lastViewedAt", now).withValue("viewCount", Math.addExact(row.getValueInteger("viewCount"), 1)).withValue("label", target.label())));
+   }
+
+
+
+   /*******************************************************************************
+    ** Return at most 50 visible entries, newest first. Page until enough visible
+    ** targets are found, rather than letting unavailable rows consume the limit.
+    *******************************************************************************/
+   public static List<FavoriteEntry> list(Integer limit) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      if(limit == null || limit < 1 || limit > 50)
+      {
+         throw (new QException("Limit must be between 1 and 50"));
+      }
+      List<FavoriteEntry> result = new ArrayList<>();
+      int skip = 0;
+      while(result.size() < limit)
+      {
+         List<QRecord> rows = PersonalRecords.query(CollaborationTables.RECENT, PersonalRecords.ownFilter()
+            .withOrderBy(new QFilterOrderBy("lastViewedAt", false)).withOrderBy(new QFilterOrderBy("id", false)).withSkip(skip).withLimit(50));
+         for(FavoriteEntry entry : TargetResolver.refresh(rows))
+         {
+            if(entry.available() && result.size() < limit)
+            {
+               result.add(entry);
+            }
+         }
+         if(rows.size() < 50)
+         {
+            break;
+         }
+         skip += rows.size();
+      }
+      return (result);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/recents/TrimRecentsProcess.java

@@ -0,0 +1,140 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.recents;
+
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.actions.processes.BackendStep;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QBackendStepMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.scheduleing.QScheduleMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
+
+
+/*******************************************************************************
+ ** Hidden daily retention job. Runs with its caller's session, which must be a
+ ** scheduler system session or collaboration admin; never elevates a user.
+ *******************************************************************************/
+public class TrimRecentsProcess implements BackendStep, CustomPermissionChecker
+{
+   public static final String NAME = "collaborationTrimRecents";
+
+
+
+   /*******************************************************************************
+    ** Always register the backend-only process; scheduling is opt-in.
+    *******************************************************************************/
+   public static QProcessMetaData metadata(CollaborationQBitConfig config)
+   {
+      QProcessMetaData process = new QProcessMetaData().withName(NAME).withLabel("Trim recents").withIsHidden(true).withIcon(new QIcon("history"))
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.HAS_ACCESS_PERMISSION)
+            .withPermissionBaseName("collaboration").withCustomPermissionChecker(new QCodeReference(TrimRecentsProcess.class)))
+         .withStep(new QBackendStepMetaData().withName("run").withCode(new QCodeReference(TrimRecentsProcess.class)));
+      if(config.getSchedulerName() != null)
+      {
+         process.withSchedule(new QScheduleMetaData().withSchedulerName(config.getSchedulerName()).withRepeatSeconds(86400).withInitialDelaySeconds(86400));
+      }
+      return (process);
+   }
+
+
+
+   /*******************************************************************************
+    ** Hidden is a presentation setting, so explicitly guard execution as well.
+    *******************************************************************************/
+   @Override
+   public void checkPermissionsThrowing(AbstractActionInput input, MetaDataWithPermissionRules metadata) throws QPermissionDeniedException
+   {
+      QSession session = QContext.getQSession();
+      if(!(session instanceof QSystemUserSession) && (session == null || !session.hasPermission(CollaborationPermissions.ADMIN)))
+      {
+         throw (new QPermissionDeniedException("This needs the collaboration.admin permission."));
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Keyset-page users, then delete overflow in bounded batches. Re-query each
+    ** user's newest N before every batch, avoiding offsets over deleted rows.
+    *******************************************************************************/
+   @Override
+   public void run(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+   {
+      checkPermissionsThrowing(input, null);
+      CollaborationSecurity.ensureSessionKeys(QContext.getQInstance(), QContext.getQSession());
+      CollaborationQBitConfig config = (CollaborationQBitConfig) QContext.getQInstance().getQBits().values().stream()
+         .filter(qbit -> qbit.getConfig() instanceof CollaborationQBitConfig).findFirst().orElseThrow().getConfig();
+      String previousUser = null;
+      while(true)
+      {
+         QQueryFilter nextUser = new QQueryFilter().withOrderBy(new QFilterOrderBy("userId")).withLimit(1);
+         if(previousUser != null)
+         {
+            nextUser.withCriteria("userId", QCriteriaOperator.GREATER_THAN, previousUser);
+         }
+         List<QRecord> next = PersonalRecords.query(CollaborationTables.RECENT, nextUser);
+         if(next.isEmpty())
+         {
+            break;
+         }
+         previousUser = next.getFirst().getValueString("userId");
+         while(true)
+         {
+            List<QRecord> overflow = PersonalRecords.query(CollaborationTables.RECENT, new QQueryFilter()
+               .withCriteria("userId", QCriteriaOperator.EQUALS, previousUser)
+               .withOrderBy(new QFilterOrderBy("lastViewedAt", false)).withOrderBy(new QFilterOrderBy("id", false))
+               .withSkip(config.getRecentsPerUser()).withLimit(500));
+            if(overflow.isEmpty())
+            {
+               break;
+            }
+            List<Serializable> ids = new ArrayList<>(overflow.stream().map(row -> row.getValue("id")).toList());
+            PersonalRecords.delete(CollaborationTables.RECENT, ids);
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/security/CollaborationRowSecurity.java

@@ -0,0 +1,65 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.security;
+
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissionChecker;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrCountInputInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Standard table/API access is read-only; service calls authorize separately.
+ *******************************************************************************/
+public class CollaborationRowSecurity implements CustomPermissionChecker
+{
+   /*******************************************************************************
+    ** Apply parent-table restrictions before count, query and aggregate execution.
+    *******************************************************************************/
+   @Override
+   public void checkPermissionsThrowing(AbstractActionInput input, MetaDataWithPermissionRules metadata) throws QPermissionDeniedException
+   {
+      if(input instanceof InsertInput || input instanceof UpdateInput || input instanceof DeleteInput)
+      {
+         throw (new QPermissionDeniedException("Use the collaboration service actions."));
+      }
+      new CollaborationPermissionChecker().checkPermissionsThrowing(input, metadata);
+      if(metadata instanceof QTableMetaData table
+         && (table.getName().equals(CollaborationTables.RECORD_ASSIGNMENT) || table.getName().equals(CollaborationTables.FOLLOW) || table.getName().equals(CollaborationTables.ACTIVITY) || table.getName().equals(CollaborationTables.FOLLOW_DIGEST))
+         && !QContext.getQSession().hasPermission(CollaborationPermissions.ADMIN))
+      {
+         throw (new QPermissionDeniedException("This needs collaboration.admin."));
+      }
+      if(input instanceof QueryOrCountInputInterface query)
+      {
+         ParentTableRestriction.restrict(query);
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/security/OtherUserAccess.java

@@ -0,0 +1,76 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.security;
+
+import java.io.Serializable;
+import java.util.Optional;
+import java.util.concurrent.atomic.AtomicReference;
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qqq.backend.core.actions.customizers.QCodeLoader;
+import com.kingsrook.qqq.backend.core.context.CapturedContext;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+
+/*******************************************************************************
+ ** Stand-in for core RecordAccessCheckerInterface. Unknown is never a grant.
+ *******************************************************************************/
+public class OtherUserAccess
+{
+   /*******************************************************************************
+    ** The temporary context has no inherited permission bypass or caller transaction.
+    *******************************************************************************/
+   public Optional<Boolean> canRead(String userId, String table, Serializable recordId) throws QException
+   {
+      CollaborationQBitConfig config = CollaborationRecords.config();
+      if(config.getUserSessionSupplier() == null)
+      {
+         return (Optional.empty());
+      }
+      UserSessionSupplier supplier = QCodeLoader.getAdHoc(UserSessionSupplier.class, config.getUserSessionSupplier());
+      Optional<QSession> session = supplier.sessionFor(userId);
+      if(session.isEmpty())
+      {
+         return (Optional.empty());
+      }
+      if(session.get().getUser() == null || !userId.equals(session.get().getUser().getIdReference()))
+      {
+         return (Optional.empty());
+      }
+      AtomicReference<Boolean> result = new AtomicReference<>(false);
+      QContext.withTemporaryContext(new CapturedContext(QContext.getQInstance(), session.get()), () ->
+      {
+         try
+         {
+            ParentRecordAccess.requireVisibleParent(table, recordId);
+            result.set(true);
+         }
+         catch(QNotFoundException expected)
+         {
+            result.set(false);
+         }
+      });
+      return (Optional.of(result.get()));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/security/ParentRecordAccess.java

@@ -0,0 +1,118 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.security;
+
+import java.io.Serializable;
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionsHelper;
+import com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType;
+import com.kingsrook.qqq.backend.core.actions.tables.GetAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.exceptions.QValueException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.utils.ValueUtils;
+
+/*******************************************************************************
+ ** Stand-in for QQQ core RecordReferenceSecurityHelper (QRun-IO/qqq collaboration phase a); replace when released
+ *******************************************************************************/
+public final class ParentRecordAccess
+{
+   /*******************************************************************************
+    ** Static operations only.
+    *******************************************************************************/
+   private ParentRecordAccess()
+   {
+   }
+
+   /*******************************************************************************
+    ** Exclude collaboration tables to avoid recursive references.
+    *******************************************************************************/
+   public static boolean canReadTable(String tableName)
+   {
+      QTableMetaData table = tableName == null ? null : QContext.getQInstance().getTable(tableName);
+      return (table != null && table.getPrimaryKeyField() != null && !tableName.startsWith(CollaborationQBitConfig.TABLE_NAME_PREFIX)
+         && PermissionsHelper.hasTablePermission(new AbstractActionInput(), tableName, TablePermissionSubType.READ));
+   }
+
+   /*******************************************************************************
+    ** Get as the caller, enforcing table permissions and the parent's read locks.
+    *******************************************************************************/
+   public static QRecord requireVisibleParent(String tableName, Serializable recordId) throws QException
+   {
+      if(!canReadTable(tableName) || recordId == null)
+      {
+         throw (new QNotFoundException("Not found"));
+      }
+      QTableMetaData table = QContext.getQInstance().getTable(tableName);
+      try
+      {
+         Serializable key = ValueUtils.getValueAsFieldType(table.getField(table.getPrimaryKeyField()).getType(), recordId);
+         GetInput input = new GetInput(tableName).withPrimaryKey(key);
+         input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+         QRecord parent = new GetAction().execute(input).getRecord();
+         if(parent == null)
+         {
+            throw (new QNotFoundException("Not found"));
+         }
+         return (parent);
+      }
+      catch(QPermissionDeniedException | QValueException expected)
+      {
+         throw (new QNotFoundException("Not found"));
+      }
+   }
+
+   /*******************************************************************************
+    ** Temporary approximation: EDIT plus a visible parent, not WRITE lock checks.
+    *******************************************************************************/
+   public static void requireFeature(String tableName, Serializable recordId, String feature) throws QException
+   {
+      requireVisibleParent(tableName, recordId);
+      requireTableFeature(tableName, feature);
+   }
+
+   /*******************************************************************************
+    ** Authorize vocabulary creation without requiring an arbitrary parent record.
+    *******************************************************************************/
+   public static void requireTableFeature(String tableName, String feature) throws QException
+   {
+      if(!canReadTable(tableName))
+      {
+         throw (new QNotFoundException("Not found"));
+      }
+      QTableMetaData table = QContext.getQInstance().getTable(tableName);
+      String base = table.getPermissionRules() == null ? null : table.getPermissionRules().getPermissionBaseName();
+      base = base == null || base.isBlank() ? tableName : base;
+      if(!QContext.getQSession().hasPermission(tableName + "." + feature) && !QContext.getQSession().hasPermission(base + "." + feature)
+         && !PermissionsHelper.hasTablePermission(new AbstractActionInput(), tableName, TablePermissionSubType.EDIT))
+      {
+         throw (new QPermissionDeniedException("This needs the " + base + "." + feature + " permission or table EDIT."));
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/security/ParentRowCustomizer.java

@@ -0,0 +1,72 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.security;
+
+import java.util.ArrayList;
+import java.util.List;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizerInterface;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrGetInputInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Parent read locks also protect direct GetAction and unpinned table browsing.
+ ** Until core mirrors locks, aggregate counts are approximate and pages may be short.
+ *******************************************************************************/
+public class ParentRowCustomizer implements TableCustomizerInterface
+{
+   /*******************************************************************************
+    ** Children store the parent's reference so the same filter protects them.
+    *******************************************************************************/
+   @Override
+   public List<QRecord> postQuery(QueryOrGetInputInterface input, List<QRecord> records) throws QException
+   {
+      List<QRecord> visible = new ArrayList<>();
+      for(QRecord record : records)
+      {
+         try
+         {
+            if(Boolean.TRUE.equals(record.getValueBoolean("parentDeleted")))
+            {
+               throw (new QNotFoundException("Not found"));
+            }
+            ParentRecordAccess.requireVisibleParent(record.getValueString("tableName"), record.getValueString("recordId"));
+            QRecord row = new QRecord(record);
+            if(row.getValue("deletedAt") != null)
+            {
+               row.setValue("body", null);
+            }
+            visible.add(row);
+         }
+         catch(QNotFoundException expected)
+         {
+            if(input instanceof GetInput)
+            {
+               throw (expected);
+            }
+         }
+      }
+      return (visible);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/security/ParentTableRestriction.java

@@ -0,0 +1,58 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.security;
+
+import java.util.List;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrCountInputInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+/*******************************************************************************
+ ** Shared pre-query parent-table restriction. Record locks require post-filtering.
+ *******************************************************************************/
+public final class ParentTableRestriction
+{
+   /*******************************************************************************
+    ** Static helper.
+    *******************************************************************************/
+   private ParentTableRestriction()
+   {
+   }
+
+   /*******************************************************************************
+    ** AND outside caller OR clauses while retaining paging and sort order.
+    *******************************************************************************/
+   public static void restrict(QueryOrCountInputInterface input)
+   {
+      List<String> readable = QContext.getQInstance().getTables().keySet().stream().filter(ParentRecordAccess::canReadTable).toList();
+      QQueryFilter original = input.getFilter();
+      QQueryFilter filter = new QQueryFilter().withCriteria("tableName", QCriteriaOperator.IN, readable)
+         .withCriteria("parentDeleted", QCriteriaOperator.EQUALS, false);
+      if(original != null)
+      {
+         filter.withSubFilter(original).withLimit(original.getLimit()).withSkip(original.getSkip());
+         filter.setOrderBys(original.getOrderBys());
+      }
+      input.setFilter(filter);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/security/UserSessionSupplier.java

@@ -0,0 +1,37 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.security;
+
+import java.util.Optional;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+
+/*******************************************************************************
+ ** Stand-in for the unreleased core UserSessionProviderInterface.
+ *******************************************************************************/
+public interface UserSessionSupplier
+{
+   /*******************************************************************************
+    ** Return a freshly authorized session, or unknown when identity is unavailable.
+    *******************************************************************************/
+   Optional<QSession> sessionFor(String userId) throws QException;
+}

src/main/java/com/kingsrook/qbits/collaboration/sharing/AccessRequestSecurity.java

@@ -0,0 +1,70 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.sharing;
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizerInterface;
+import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrGetInputInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
+
+/*******************************************************************************
+ ** Requester/admin visibility is independent of parent visibility and existence.
+ *******************************************************************************/
+public class AccessRequestSecurity implements CustomPermissionChecker, TableCustomizerInterface
+{
+   /*******************************************************************************
+    ** Service-only writes prevent forging requester IDs and outcomes.
+    *******************************************************************************/
+   @Override
+   public void checkPermissionsThrowing(AbstractActionInput input, MetaDataWithPermissionRules metadata) throws QPermissionDeniedException
+   {
+      new CollaborationSecurity().checkPermissionsThrowing(input, metadata);
+      if(input instanceof InsertInput || input instanceof UpdateInput || input instanceof DeleteInput)
+      {
+         throw (new QPermissionDeniedException("Use the access request service actions."));
+      }
+   }
+
+   /*******************************************************************************
+    ** Only metadata labels are resolved; never read the referenced parent.
+    *******************************************************************************/
+   @Override
+   public List<QRecord> postQuery(QueryOrGetInputInterface input, List<QRecord> records) throws QException
+   {
+      for(QRecord row : records)
+      {
+         var table = QContext.getQInstance().getTable(row.getValueString("tableName"));
+         row.setDisplayValue("tableName", table == null ? row.getValueString("tableName") : table.getLabel());
+      }
+      return (records);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/sharing/AccessRequestService.java

@@ -0,0 +1,237 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.sharing;
+
+import java.io.Serializable;
+import java.time.Instant;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.atomic.AtomicBoolean;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.TargetResolver;
+import com.kingsrook.qbits.collaboration.WorkSupport;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.notify.CollaborationNotification;
+import com.kingsrook.qbits.collaboration.notify.Notifications;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.customizers.QCodeLoader;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.logging.QLogger;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+
+/*******************************************************************************
+ ** Requests never inspect the parent. Their public result reveals no existence data.
+ *******************************************************************************/
+public class AccessRequestService
+{
+   private static final QLogger LOG = QLogger.getLogger(AccessRequestService.class);
+   private static final AtomicBoolean DIRECTORY_WARNING = new AtomicBoolean();
+
+   /*******************************************************************************
+    ** Persist once per open natural key; repeated submissions return the same row.
+    *******************************************************************************/
+   public QRecord request(String table, Serializable recordId, String message, Integer shareId) throws QException
+   {
+      String user = PersonalRecords.currentUserId();
+      WorkSupport.text(table, 128, true);
+      WorkSupport.text(recordId == null ? null : recordId.toString(), 64, true);
+      WorkSupport.text(message, 2000, false);
+      String id = TargetResolver.recordId("RECORD", table, recordId);
+      synchronized(CollaborationRecords.config())
+      {
+         QQueryFilter filter = new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, table)
+            .withCriteria("recordId", QCriteriaOperator.EQUALS, id).withCriteria("requesterUserId", QCriteriaOperator.EQUALS, user)
+            .withCriteria("status", QCriteriaOperator.EQUALS, "OPEN");
+         List<QRecord> existing = CollaborationRecords.query(CollaborationTables.ACCESS_REQUEST, filter);
+         if(!existing.isEmpty())
+         {
+            return (existing.getFirst());
+         }
+         if(shareId != null)
+         {
+            QRecord share = WorkSupport.row(CollaborationTables.SHARE, shareId);
+            if(!user.equals(share.getValueString("toUserId")) || !table.equals(share.getValueString("tableName")) || !id.equals(share.getValueString("recordId")))
+            {
+               throw (new QNotFoundException("Not found"));
+            }
+         }
+         QRecord row;
+         try
+         {
+            row = CollaborationRecords.insert(CollaborationTables.ACCESS_REQUEST, new QRecord().withValue("tableName", table).withValue("recordId", id)
+               .withValue("requesterUserId", user).withValue("message", message).withValue("shareId", shareId).withValue("status", "OPEN"));
+         }
+         catch(QException e)
+         {
+            existing = CollaborationRecords.query(CollaborationTables.ACCESS_REQUEST, filter);
+            if(existing.isEmpty())
+            {
+               throw (e);
+            }
+            return (existing.getFirst());
+         }
+         notifyApprovers(row);
+         return (row);
+      }
+   }
+
+   /*******************************************************************************
+    ** Resolve table sharing policy without touching any parent row.
+    *******************************************************************************/
+   public String approverPermission(String table) throws QException
+   {
+      for(QRecord setting : CollaborationRecords.query(CollaborationTables.FEATURE_SETTING, new QQueryFilter()
+         .withCriteria("scopeType", QCriteriaOperator.EQUALS, "TABLE").withCriteria("scopeName", QCriteriaOperator.EQUALS, table)
+         .withCriteria("feature", QCriteriaOperator.EQUALS, "SHARING")))
+      {
+         String json = setting.getValueString("settings");
+         if(json != null && !json.isBlank())
+         {
+            try
+            {
+               Object permission = JsonUtils.toObject(json, Map.class).get("accessApproverPermission");
+               if(permission != null && !permission.toString().isBlank())
+               {
+                  return (permission.toString());
+               }
+            }
+            catch(Exception e)
+            {
+               throw (new QException("Invalid SHARING settings JSON", e));
+            }
+         }
+      }
+      return (CollaborationPermissions.ADMIN);
+   }
+
+   /*******************************************************************************
+    ** Owner lookup uses only the assignment directory, never a parent existence check.
+    *******************************************************************************/
+   private void notifyApprovers(QRecord row) throws QException
+   {
+      Set<String> users = new LinkedHashSet<>();
+      var reference = CollaborationRecords.config().getPermissionHolderDirectory();
+      if(reference == null)
+      {
+         if(DIRECTORY_WARNING.compareAndSet(false, true))
+         {
+            LOG.warn("Access approvers cannot be resolved without PermissionHolderDirectory; only configured record owners will be notified.");
+         }
+      }
+      else
+      {
+         PermissionHolderDirectory directory = QCodeLoader.getAdHoc(PermissionHolderDirectory.class, reference);
+         users.addAll(directory.userIdsWithPermission(CollaborationPermissions.ADMIN));
+         users.addAll(directory.userIdsWithPermission(approverPermission(row.getValueString("tableName"))));
+      }
+      for(QRecord assignment : CollaborationRecords.query(CollaborationTables.RECORD_ASSIGNMENT,
+         CollaborationRecords.parent(row.getValueString("tableName"), row.getValueString("recordId"))))
+      {
+         if(assignment.getValueString("ownerUserId") != null)
+         {
+            users.add(assignment.getValueString("ownerUserId"));
+         }
+      }
+      for(String user : users)
+      {
+         notice(user, "Record access requested", row.getValueInteger("id"));
+      }
+   }
+
+   /*******************************************************************************
+    ** Requesters can only withdraw their own still-open request.
+    *******************************************************************************/
+   public void withdraw(Integer requestId) throws QException
+   {
+      QRecord row = WorkSupport.row(CollaborationTables.ACCESS_REQUEST, requestId);
+      if(!PersonalRecords.currentUserId().equals(row.getValueString("requesterUserId")))
+      {
+         throw (new QNotFoundException("Not found"));
+      }
+      requireOpen(row);
+      CollaborationRecords.update(CollaborationTables.ACCESS_REQUEST, new QRecord().withValue("id", requestId).withValue("status", "WITHDRAWN"));
+   }
+
+   /*******************************************************************************
+    ** Approver permissions authorize only recording an outcome, never an access grant.
+    *******************************************************************************/
+   public QRecord requireApprover(Integer requestId) throws QException
+   {
+      PersonalRecords.currentUserId();
+      QRecord row = WorkSupport.row(CollaborationTables.ACCESS_REQUEST, requestId);
+      if(!QContext.getQSession().hasPermission(CollaborationPermissions.ADMIN)
+         && !QContext.getQSession().hasPermission(approverPermission(row.getValueString("tableName"))))
+      {
+         throw (new QPermissionDeniedException("This needs the access approver permission."));
+      }
+      requireOpen(row);
+      return (row);
+   }
+
+   /*******************************************************************************
+    ** The host identity system is responsible for any actual permission change.
+    *******************************************************************************/
+   public void handle(Integer requestId, String status, String note) throws QException
+   {
+      WorkSupport.text(note, 2000, false);
+      if(!List.of("GRANTED", "DECLINED").contains(status))
+      {
+         throw (new QException("Choose GRANTED or DECLINED."));
+      }
+      synchronized(CollaborationRecords.config())
+      {
+         QRecord row = requireApprover(requestId);
+         CollaborationRecords.update(CollaborationTables.ACCESS_REQUEST, new QRecord().withValue("id", requestId).withValue("status", status)
+            .withValue("note", note).withValue("handledAt", Instant.now()).withValue("handledByUserId", PersonalRecords.currentUserId()));
+         notice(row.getValueString("requesterUserId"), "Access request " + status.toLowerCase(java.util.Locale.ROOT), requestId);
+      }
+   }
+
+   /*******************************************************************************
+    ** Terminal outcomes cannot be overwritten accidentally.
+    *******************************************************************************/
+   private void requireOpen(QRecord row) throws QException
+   {
+      if(!"OPEN".equals(row.getValueString("status")))
+      {
+         throw (new QException("This access request is no longer open."));
+      }
+   }
+
+   /*******************************************************************************
+    ** Notices contain no record label, request message or approver note.
+    *******************************************************************************/
+   private void notice(String user, String title, Integer id) throws QException
+   {
+      Notifications.sendAccessNotice(new CollaborationNotification(user, title, "Review the access request.",
+         CollaborationNotification.Category.SHARE, null, null, "/app/collaboration_access_request/" + id));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/sharing/PermissionHolderDirectory.java

@@ -0,0 +1,36 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.sharing;
+
+import java.util.Set;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+
+/*******************************************************************************
+ ** Optional host directory; membership resolution never grants record access.
+ *******************************************************************************/
+public interface PermissionHolderDirectory
+{
+   /*******************************************************************************
+    ** Return stable user IDs holding this permission.
+    *******************************************************************************/
+   Set<String> userIdsWithPermission(String permission) throws QException;
+}

src/main/java/com/kingsrook/qbits/collaboration/sharing/SharingService.java

@@ -0,0 +1,147 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.sharing;
+
+import java.io.Serializable;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Optional;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.TargetResolver;
+import com.kingsrook.qbits.collaboration.WorkSupport;
+import com.kingsrook.qbits.collaboration.activity.ActivityWriter;
+import com.kingsrook.qbits.collaboration.follow.FollowService;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.notify.CollaborationNotification;
+import com.kingsrook.qbits.collaboration.notify.Notifications;
+import com.kingsrook.qbits.collaboration.people.PeopleService;
+import com.kingsrook.qbits.collaboration.security.OtherUserAccess;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Shares communicate intent; they never change permissions.
+ *******************************************************************************/
+public class SharingService
+{
+   /*******************************************************************************
+    ** Canonical link and a fresh label resolved as the caller.
+    *******************************************************************************/
+   public Link link(String table, Serializable recordId) throws QException
+   {
+      ParentRecordAccess.requireVisibleParent(table, recordId);
+      var target = TargetResolver.require("RECORD", table, recordId);
+      return (new Link(TargetResolver.recordHref(table, target.recordId()), target.label()));
+   }
+
+   /*******************************************************************************
+    ** Unknown recipient access is represented by null, never converted to true.
+    *******************************************************************************/
+   public List<Recipient> preview(String table, Serializable recordId, List<String> toUserIds) throws QException
+   {
+      new PeopleService().touch();
+      ParentRecordAccess.requireFeature(table, recordId, "share");
+      if(toUserIds == null || toUserIds.isEmpty() || toUserIds.size() > 25 || toUserIds.stream().anyMatch(user -> user == null || user.isBlank()))
+      {
+         throw (new QException("Choose 1 to 25 recipients."));
+      }
+      List<Recipient> recipients = new ArrayList<>();
+      for(String user : toUserIds.stream().distinct().toList())
+      {
+         Optional<Boolean> access = user.equals(PersonalRecords.currentUserId()) ? Optional.of(true) : new OtherUserAccess().canRead(user, table, recordId);
+         recipients.add(new Recipient(user, new PeopleService().displayName(user), access.orElse(null)));
+      }
+      return (recipients);
+   }
+
+   /*******************************************************************************
+    ** Nonreaders get neither the record label nor the sender's untrusted message.
+    *******************************************************************************/
+   public List<QRecord> share(String table, Serializable recordId, List<String> toUserIds, String message) throws QException
+   {
+      WorkSupport.text(message, 2000, false);
+      List<Recipient> recipients = preview(table, recordId, toUserIds);
+      String id = FollowService.canonicalId(table, recordId);
+      Link link = link(table, id);
+      String from = PersonalRecords.currentUserId();
+      String name = new PeopleService().displayName(from);
+      List<QRecord> result = new ArrayList<>();
+      for(Recipient recipient : recipients)
+      {
+         QRecord row = CollaborationRecords.insert(CollaborationTables.SHARE, new QRecord().withValue("tableName", table).withValue("recordId", id)
+            .withValue("fromUserId", from).withValue("toUserId", recipient.userId()).withValue("message", message)
+            .withValue("recipientCouldRead", recipient.canRead()).withValue("sentAt", Instant.now()).withValue("parentDeleted", false));
+         if(Boolean.TRUE.equals(recipient.canRead()))
+         {
+            Notifications.send(new CollaborationNotification(recipient.userId(), name + " shared " + link.label() + " with you", message,
+               CollaborationNotification.Category.SHARE, table, id, link.url()));
+            new FollowService().ensureFollower(recipient.userId(), table, id, "SHARED");
+         }
+         else
+         {
+            Notifications.sendAccessNotice(new CollaborationNotification(recipient.userId(), name + " wants to share a record in "
+               + QContext.getQInstance().getTable(table).getLabel() + " with you", "Request access to open this record.",
+               CollaborationNotification.Category.SHARE, null, null, "/app/collaboration_access_request/create?tableName="
+                  + TargetResolver.encode(table) + "&recordId=" + TargetResolver.encode(id) + "&shareId=" + row.getValueString("id")));
+         }
+         ActivityWriter.write(table, id, "SHARED", "Record shared", CollaborationTables.SHARE, row.getValueString("id"));
+         result.add(row);
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** The intended recipient may acknowledge even a share of an invisible parent.
+    *******************************************************************************/
+   public void markOpened(Integer shareId) throws QException
+   {
+      String user = PersonalRecords.currentUserId();
+      QRecord row = WorkSupport.row(CollaborationTables.SHARE, shareId);
+      if(!user.equals(row.getValueString("toUserId")))
+      {
+         throw (new QNotFoundException("Not found"));
+      }
+      if(row.getValueInstant("openedAt") == null)
+      {
+         CollaborationRecords.update(CollaborationTables.SHARE, new QRecord().withValue("id", shareId).withValue("openedAt", Instant.now()));
+      }
+   }
+
+   /*******************************************************************************
+    ** Link payload for the later UI API adapter.
+    *******************************************************************************/
+   public record Link(String url, String label)
+   {
+   }
+
+   /*******************************************************************************
+    ** A nullable Boolean distinguishes unavailable access knowledge from denial.
+    *******************************************************************************/
+   public record Recipient(String userId, String displayName, Boolean canRead)
+   {
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/tags/TagEntry.java

@@ -0,0 +1,29 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.tags;
+
+/*******************************************************************************
+ ** A vocabulary entry or record chip, without exposing assignment rows.
+ *******************************************************************************/
+public record TagEntry(Integer id, String name, String label, String color, String tableName, Boolean approved, Integer usageCount)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/tags/TagFilterTranslator.java

@@ -0,0 +1,126 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.tags;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Materialized tag filter logic independent of the unreleased core hooks in #1140.
+ ** Every operator returns matching caller-visible parent ids, including complements.
+ *******************************************************************************/
+public class TagFilterTranslator
+{
+   public static final int MAX_RECORD_IDS = 10000;
+
+   /*******************************************************************************
+    ** IN means any tag, CONTAINS_ALL means every requested tag, NOT_IN means none.
+    ** Empty IN matches none; empty CONTAINS_ALL and NOT_IN match all visible rows.
+    *******************************************************************************/
+   public List<String> recordIds(String table, String op, Collection<? extends Serializable> tags) throws QException
+   {
+      TagsService.requireTable(table);
+      if(!List.of("IN", "CONTAINS_ALL", "NOT_IN", "IS_BLANK", "IS_NOT_BLANK").contains(op))
+      {
+         throw (new QException("Unsupported tag operator: " + op));
+      }
+      Set<Integer> requested = new HashSet<>();
+      boolean missing = false;
+      if(!op.equals("IS_BLANK") && !op.equals("IS_NOT_BLANK"))
+      {
+         for(Serializable tag : tags == null ? List.<Serializable>of() : tags)
+         {
+            QQueryFilter filter = TagsService.vocabularyFilter(table).withCriteria("approved", QCriteriaOperator.EQUALS, true);
+            filter.withCriteria(tag instanceof Number ? "id" : "name", QCriteriaOperator.EQUALS,
+               tag instanceof Number ? tag : TagsService.normalize(tag == null ? null : tag.toString()));
+            List<QRecord> matches = CollaborationRecords.query(CollaborationTables.TAG, filter.withOrderBy(new QFilterOrderBy("id")));
+            if(matches.isEmpty())
+            {
+               missing = true;
+            }
+            else
+            {
+               QRecord match = matches.stream().filter(row -> row.getValue("tableName") == null).findFirst().orElse(matches.getFirst());
+               requested.add(match.getValueInteger("id"));
+            }
+         }
+      }
+      Map<String, Set<Integer>> assignments = new HashMap<>();
+      for(QRecord row : CollaborationRecords.query(CollaborationTables.RECORD_TAG, new QQueryFilter()
+         .withCriteria("tableName", QCriteriaOperator.EQUALS, table).withCriteria("parentDeleted", QCriteriaOperator.EQUALS, false)))
+      {
+         assignments.computeIfAbsent(row.getValueString("recordId"), ignored -> new HashSet<>()).add(row.getValueInteger("tagId"));
+      }
+      List<String> result = new ArrayList<>();
+      String key = QContext.getQInstance().getTable(table).getPrimaryKeyField();
+      for(int skip = 0; ; skip += 500)
+      {
+         QueryInput input = new QueryInput(table).withFilter(new QQueryFilter().withOrderBy(new QFilterOrderBy(key)).withSkip(skip).withLimit(500))
+            .withTransaction(QContext.getQBackendTransaction());
+         input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+         List<QRecord> parents = new QueryAction().execute(input).getRecords();
+         for(QRecord parent : parents)
+         {
+            String id = parent.getValueString(key);
+            Set<Integer> applied = assignments.getOrDefault(id, Set.of());
+            boolean any = requested.stream().anyMatch(applied::contains);
+            boolean match = switch(op)
+            {
+               case "IN" -> any;
+               case "NOT_IN" -> !any;
+               case "CONTAINS_ALL" -> !missing && applied.containsAll(requested);
+               case "IS_BLANK" -> applied.isEmpty();
+               default -> !applied.isEmpty();
+            };
+            if(match)
+            {
+               result.add(id);
+               if(result.size() > MAX_RECORD_IDS)
+               {
+                  throw (new QException("Tag filter exceeds 10,000 matching record ids."));
+               }
+            }
+         }
+         if(parents.size() < 500)
+         {
+            return (result);
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/tags/TagProcesses.java

@@ -0,0 +1,316 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.tags;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType;
+import com.kingsrook.qqq.backend.core.actions.permissions.UseTablePermissionCustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLine;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLineInterface;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.Status;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QComponentType;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QFrontendComponentMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QFrontendStepMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.AbstractLoadStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.AbstractTransformStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.ExtractViaQueryStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.ProcessSummaryProviderInterface;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.StreamedETLWithFrontendProcess;
+
+/*******************************************************************************
+ ** Managed vocabulary and host bulk actions using the standard streamed ETL flow.
+ *******************************************************************************/
+public final class TagProcesses
+{
+   public static final String TAGS = "tags";
+   public static final String TARGET = "targetTagId";
+
+   /*******************************************************************************
+    ** Metadata factory.
+    *******************************************************************************/
+   private TagProcesses()
+   {
+   }
+
+   /*******************************************************************************
+    ** Vocabulary record actions, never navigation entries.
+    *******************************************************************************/
+   public static List<QProcessMetaData> management()
+   {
+      return (List.of(process(CollaborationTables.TAG, "Approve"), process(CollaborationTables.TAG, "Merge"), process(CollaborationTables.TAG, "Delete")));
+   }
+
+   /*******************************************************************************
+    ** Host record actions configured by tagActionTables.
+    *******************************************************************************/
+   public static List<QProcessMetaData> processesFor(String table)
+   {
+      return (List.of(process(table, "Add"), process(table, "Remove")));
+   }
+
+   /*******************************************************************************
+    ** Approved scoped PVS inputs and explicit selection cardinality for clients.
+    *******************************************************************************/
+   private static QProcessMetaData process(String table, String operation)
+   {
+      boolean bulk = !table.equals(CollaborationTables.TAG);
+      Map<String, Serializable> values = new HashMap<>();
+      values.put(StreamedETLWithFrontendProcess.FIELD_SOURCE_TABLE, table);
+      values.put(StreamedETLWithFrontendProcess.FIELD_DESTINATION_TABLE, table);
+      values.put(StreamedETLWithFrontendProcess.FIELD_SUPPORTS_FULL_VALIDATION, true);
+      values.put(StreamedETLWithFrontendProcess.FIELD_DO_FULL_VALIDATION, true);
+      values.put(StreamedETLWithFrontendProcess.FIELD_PREVIEW_MESSAGE, operation + " tags on the selected records.");
+      QProcessMetaData process = StreamedETLWithFrontendProcess.defineProcessMetaData(ExtractViaQueryStep.class, Review.class, Apply.class, values)
+         .withName("collaboration" + operation + "Tags" + (bulk ? "_" + table : "")).withLabel(operation + " tags").withTableName(table).withIcon(new QIcon("label"))
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.NOT_PROTECTED).withCustomPermissionChecker(bulk
+            ? UseTablePermissionCustomPermissionChecker.build(table, TablePermissionSubType.READ) : new QCodeReference(TagSecurity.class)));
+      if(bulk || operation.equals("Merge"))
+      {
+         QQueryFilter filter = bulk ? TagsService.vocabularyFilter(table) : new QQueryFilter().withCriteria("mergedIntoTagId", QCriteriaOperator.IS_BLANK);
+         filter.withCriteria("approved", QCriteriaOperator.EQUALS, true).withOrderBy(new QFilterOrderBy("usageCount", false)).withOrderBy(new QFilterOrderBy("label"));
+         QFieldMetaData field = new QFieldMetaData(bulk ? TAGS : TARGET, QFieldType.INTEGER).withLabel(bulk ? "Tags" : "Target tag")
+            .withIsRequired(true).withPossibleValueSourceName(CollaborationTables.TAG).withPossibleValueSourceFilter(filter);
+         process.withStep(0, new QFrontendStepMetaData().withName("tags").withLabel(operation + " tags").withFormField(field)
+            .withComponent(new QFrontendComponentMetaData().withType(QComponentType.EDIT_FORM)
+               .withValue("multiSelectFields", new ArrayList<>(bulk ? List.of(TAGS) : List.of()))));
+      }
+      return (process);
+   }
+
+   /*******************************************************************************
+    ** Operation comes from installed metadata, never caller-supplied values.
+    *******************************************************************************/
+   private static String operation(RunBackendStepInput input)
+   {
+      return (input.getProcess().getName().substring("collaboration".length()).split("Tags")[0]);
+   }
+
+   /*******************************************************************************
+    ** PVS submissions are ids; accept serialized comma lists as well as arrays.
+    *******************************************************************************/
+   private static List<Integer> tagIds(RunBackendStepInput input) throws QException
+   {
+      Serializable value = input.getValue(TAGS);
+      Collection<?> values = value instanceof Collection<?> collection ? collection : java.util.Arrays.asList(value == null ? new String[0] : value.toString().split(","));
+      List<Integer> ids = new ArrayList<>();
+      try
+      {
+         for(Object id : values)
+         {
+            ids.add(Integer.valueOf(id.toString().strip()));
+         }
+      }
+      catch(NumberFormatException expected)
+      {
+         throw (new QException("Pick at least one approved tag."));
+      }
+      if(ids.isEmpty())
+      {
+         throw (new QException("Pick at least one approved tag."));
+      }
+      return (ids.stream().distinct().toList());
+   }
+
+   /*******************************************************************************
+    ** Shared renderer for Review and Result language.
+    *******************************************************************************/
+   private static ProcessSummaryLine line(Status status, String future, String past)
+   {
+      ProcessSummaryLine line = new ProcessSummaryLine(status, 0, null);
+      line.setSingularFutureMessage(future);
+      line.setPluralFutureMessage(future);
+      line.setSingularPastMessage(past);
+      line.setPluralPastMessage(past);
+      return (line);
+   }
+
+   /*******************************************************************************
+    ** Validate each record without mutation, reporting affected and unchanged rows.
+    *******************************************************************************/
+   public static class Review extends AbstractTransformStep implements ProcessSummaryProviderInterface
+   {
+      private ProcessSummaryLine selected;
+      private final ProcessSummaryLine skipped = line(Status.WARNING, "records cannot be processed (skipped)", "records skipped");
+      private final ProcessSummaryLine unchanged = line(Status.INFO, "records already in the requested tag state", "records already in the requested tag state");
+      private final ProcessSummaryLine affected = line(Status.INFO, "records will lose tag assignments", "records affected by tag deletion");
+      private final Set<String> affectedParents = new HashSet<>();
+
+      /*******************************************************************************
+       ** Parent and feature checks are made independently for every selected row.
+       *******************************************************************************/
+      @Override
+      public void runOnePage(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         String table = input.getProcess().getTableName();
+         String op = operation(input);
+         boolean bulk = !table.equals(CollaborationTables.TAG);
+         List<Integer> ids = bulk ? tagIds(input) : List.of();
+         if(selected == null)
+         {
+            selected = line(Status.OK, "records: " + op + " " + (bulk ? ids.size() + " " : "") + "tags", "records: " + op + " tags completed");
+         }
+         String key = QContext.getQInstance().getTable(table).getPrimaryKeyField();
+         TagsService service = new TagsService();
+         for(QRecord row : input.getRecords())
+         {
+            Serializable id = row.getValue(key);
+            try
+            {
+               if(bulk)
+               {
+                  ParentRecordAccess.requireFeature(table, id, "tag");
+                  service.resolve(table, ids, false);
+                  Set<Integer> present = new HashSet<>(service.tagsFor(table, id).stream().map(TagEntry::id).toList());
+                  if(op.equals("Add") ? present.containsAll(ids) : ids.stream().noneMatch(present::contains))
+                  {
+                     unchanged.incrementCountAndAddPrimaryKey(id);
+                  }
+               }
+               else
+               {
+                  TagsService.requireManage();
+                  TagsService.requireTag(id);
+                  if(op.equals("Merge"))
+                  {
+                     service.mergeTarget(id, input.getValue(TARGET));
+                  }
+                  if(op.equals("Delete"))
+                  {
+                     for(QRecord link : TagsService.links(id))
+                     {
+                        String parent = link.getValueString("tableName") + ":" + link.getValueString("recordId");
+                        if(affectedParents.add(parent))
+                        {
+                           affected.incrementCountAndAddPrimaryKey(parent);
+                        }
+                     }
+                  }
+               }
+               output.getRecords().add(row);
+               selected.incrementCountAndAddPrimaryKey(id);
+            }
+            catch(QException expected)
+            {
+               skipped.incrementCountAndAddPrimaryKey(id);
+            }
+         }
+      }
+
+      /*******************************************************************************
+       ** Review totals are cumulative over streamed pages.
+       *******************************************************************************/
+      @Override
+      public ArrayList<ProcessSummaryLineInterface> getProcessSummary(RunBackendStepOutput output, boolean isForResultScreen)
+      {
+         ArrayList<ProcessSummaryLineInterface> lines = new ArrayList<>();
+         if(selected != null)
+         {
+            selected.addSelfToListIfAnyCount(lines);
+         }
+         skipped.addSelfToListIfAnyCount(lines);
+         unchanged.addSelfToListIfAnyCount(lines);
+         affected.addSelfToListIfAnyCount(lines);
+         return (lines);
+      }
+   }
+
+   /*******************************************************************************
+    ** Execute with fresh authorization; report actual successes and failures.
+    *******************************************************************************/
+   public static class Apply extends AbstractLoadStep implements ProcessSummaryProviderInterface
+   {
+      private final ProcessSummaryLine done = line(Status.OK, "records will be processed", "records processed");
+      private final ProcessSummaryLine failed = line(Status.ERROR, "records cannot be processed", "records failed (retry required)");
+
+      /*******************************************************************************
+       ** The management service and parent service both recheck access at load time.
+       *******************************************************************************/
+      @Override
+      public void runOnePage(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         String table = input.getProcess().getTableName();
+         String key = QContext.getQInstance().getTable(table).getPrimaryKeyField();
+         TagsService service = new TagsService();
+         for(QRecord row : input.getRecords())
+         {
+            Serializable id = row.getValue(key);
+            try
+            {
+               switch(operation(input))
+               {
+                  case "Approve" -> service.approve(id);
+                  case "Merge" -> service.merge(id, input.getValue(TARGET));
+                  case "Delete" -> service.delete(id);
+                  case "Add" -> service.apply(table, id, tagIds(input), List.of());
+                  case "Remove" -> service.apply(table, id, List.of(), tagIds(input));
+                  default -> throw new QException("Unknown tag action.");
+               }
+               done.incrementCountAndAddPrimaryKey(id);
+            }
+            catch(QException expected)
+            {
+               failed.incrementCountAndAddPrimaryKey(id);
+            }
+         }
+      }
+
+      /*******************************************************************************
+       ** Result retains review skips and reports load failures separately.
+       *******************************************************************************/
+      @Override
+      public ArrayList<ProcessSummaryLineInterface> getProcessSummary(RunBackendStepOutput output, boolean isForResultScreen)
+      {
+         ArrayList<ProcessSummaryLineInterface> lines = new ArrayList<>();
+         done.addSelfToListIfAnyCount(lines);
+         failed.addSelfToListIfAnyCount(lines);
+         if(getTransformStep() instanceof Review review)
+         {
+            review.skipped.addSelfToListIfAnyCount(lines);
+         }
+         return (lines);
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/tags/TagSecurity.java

@@ -0,0 +1,104 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.tags;
+
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrCountInputInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+
+/*******************************************************************************
+ ** Vocabulary reads support pickers without collaboration.view. Management actions
+ ** require the explicit manage permission; direct writes must use the services.
+ *******************************************************************************/
+public class TagSecurity implements CustomPermissionChecker
+{
+   /*******************************************************************************
+    ** Restrict before query/count/aggregate and protect direct gets as well.
+    *******************************************************************************/
+   @Override
+   public void checkPermissionsThrowing(AbstractActionInput input, MetaDataWithPermissionRules metadata) throws QPermissionDeniedException
+   {
+      if(metadata instanceof QProcessMetaData)
+      {
+         TagsService.requireManage();
+         return;
+      }
+      if(input instanceof InsertInput || input instanceof UpdateInput || input instanceof DeleteInput)
+      {
+         throw (new QPermissionDeniedException("Use the tag service actions."));
+      }
+      if(TagsService.canManage())
+      {
+         return;
+      }
+      String user = CollaborationSecurity.userId(QContext.getQSession());
+      if(user == null)
+      {
+         throw (new QPermissionDeniedException("Sign in to view tags."));
+      }
+      if(input instanceof QueryOrCountInputInterface query)
+      {
+         QQueryFilter original = query.getFilter();
+         QQueryFilter filter = new QQueryFilter().withCriteria("mergedIntoTagId", QCriteriaOperator.IS_BLANK)
+            .withSubFilter(new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR).withCriteria("tableName", QCriteriaOperator.IS_BLANK)
+               .withCriteria("tableName", QCriteriaOperator.IN, QContext.getQInstance().getTables().keySet().stream().filter(ParentRecordAccess::canReadTable).toList()))
+            .withSubFilter(new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR).withCriteria("approved", QCriteriaOperator.EQUALS, true)
+               .withCriteria("createdByUserId", QCriteriaOperator.EQUALS, user));
+         if(original != null)
+         {
+            filter.withSubFilter(original).withLimit(original.getLimit()).withSkip(original.getSkip());
+            filter.setOrderBys(original.getOrderBys());
+         }
+         query.setFilter(filter);
+      }
+      if(input instanceof GetInput get)
+      {
+         try
+         {
+            QRecord row = TagsService.requireTag(get.getPrimaryKey());
+            if((row.getValue("tableName") != null && !ParentRecordAccess.canReadTable(row.getValueString("tableName")))
+               || (!Boolean.TRUE.equals(row.getValueBoolean("approved")) && !user.equals(row.getValueString("createdByUserId"))))
+            {
+               throw (new QPermissionDeniedException("Tag not available."));
+            }
+         }
+         catch(QException expected)
+         {
+            throw (new QPermissionDeniedException("Tag not available."));
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/tags/TagsService.java

@@ -0,0 +1,463 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.tags;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Objects;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.activity.ActivityWriter;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.context.CapturedContext;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+
+/*******************************************************************************
+ ** Tag vocabulary and assignments. Parent authorization precedes trusted storage.
+ ** Mutations join the caller's backend transaction; the config lock serializes
+ ** service calls within this instance, as in the existing collaboration services.
+ *******************************************************************************/
+public class TagsService
+{
+   public static final String MANAGE = com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions.TAGS_MANAGE;
+
+   /*******************************************************************************
+    ** Case-independent natural key; labels retain the user's capitalization.
+    *******************************************************************************/
+   public static String normalize(String label) throws QException
+   {
+      String name = label == null ? "" : label.strip().toLowerCase(Locale.ROOT).replaceAll("(?U)\\s+", " ").strip();
+      if(name.isEmpty() || name.length() > 60)
+      {
+         throw (new QException("Tag names must contain 1 to 60 characters."));
+      }
+      return (name);
+   }
+
+   /*******************************************************************************
+    ** Global and table vocabulary; pending suggestions are private to their author.
+    *******************************************************************************/
+   public List<TagEntry> vocabulary(String table, String q, Integer limit) throws QException
+   {
+      requireTable(table);
+      QQueryFilter filter = vocabularyFilter(table).withSubFilter(new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR)
+         .withCriteria("approved", QCriteriaOperator.EQUALS, true)
+         .withCriteria("createdByUserId", QCriteriaOperator.EQUALS, PersonalRecords.currentUserId()));
+      if(q != null && !q.isBlank())
+      {
+         filter.withCriteria("name", QCriteriaOperator.CONTAINS, q.strip().toLowerCase(Locale.ROOT));
+      }
+      filter.withOrderBy(new QFilterOrderBy("usageCount", false)).withOrderBy(new QFilterOrderBy("label")).withLimit(limit == null ? 20 : Math.max(1, Math.min(100, limit)));
+      return (CollaborationRecords.query(CollaborationTables.TAG, filter).stream().map(TagsService::entry).toList());
+   }
+
+   /*******************************************************************************
+    ** Shared picker filter, also enforced when submitted values reach the service.
+    *******************************************************************************/
+   public static QQueryFilter vocabularyFilter(String table)
+   {
+      QQueryFilter scope = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR).withCriteria("tableName", QCriteriaOperator.IS_BLANK);
+      if(table != null)
+      {
+         scope.withCriteria("tableName", QCriteriaOperator.EQUALS, table);
+      }
+      return (new QQueryFilter().withCriteria("mergedIntoTagId", QCriteriaOperator.IS_BLANK).withSubFilter(scope));
+   }
+
+   /*******************************************************************************
+    ** Resolve persisted policy as system, preserving the caller and transaction.
+    ** The preferred app path supplies the APP scope when a table has several apps.
+    *******************************************************************************/
+   public String mode(String table) throws QException
+   {
+      List<String> resolved = new ArrayList<>();
+      QContext.withTemporaryContext(new CapturedContext(QContext.getQInstance(), new QSystemUserSession(), QContext.getQBackendTransaction(), null), () ->
+      {
+         String path = QContext.getQInstance().getTablePath(table);
+         String[] parts = path == null ? new String[0] : path.split("/");
+         String app = parts.length > 2 ? parts[parts.length - 2] : null;
+         for(String scope : List.of("TABLE", "APP", "INSTANCE"))
+         {
+            if(scope.equals("APP") && app == null)
+            {
+               continue;
+            }
+            QQueryFilter filter = new QQueryFilter().withCriteria("feature", QCriteriaOperator.EQUALS, "TAGS")
+               .withCriteria("scopeType", QCriteriaOperator.EQUALS, scope);
+            if(!scope.equals("INSTANCE"))
+            {
+               filter.withCriteria("scopeName", QCriteriaOperator.EQUALS, scope.equals("TABLE") ? table : app);
+            }
+            for(QRecord row : CollaborationRecords.query(CollaborationTables.FEATURE_SETTING, filter))
+            {
+               String json = row.getValueString("settings");
+               if(json != null && !json.isBlank())
+               {
+                  Object value = settingMode(json);
+                  if(value != null)
+                  {
+                     String mode = value.toString();
+                     if(!List.of("FREE", "APPROVED_ONLY").contains(mode))
+                     {
+                        throw (new QException("Invalid TAGS mode: " + mode));
+                     }
+                     resolved.add(mode);
+                     return;
+                  }
+               }
+            }
+         }
+      });
+      return (resolved.isEmpty() ? CollaborationRecords.config().getDefaultTagMode() : resolved.getFirst());
+   }
+
+   /*******************************************************************************
+    ** Invalid JSON fails closed instead of silently relaxing an approval policy.
+    *******************************************************************************/
+   private Object settingMode(String json) throws QException
+   {
+      try
+      {
+         return (JsonUtils.toObject(json, Map.class).get("mode"));
+      }
+      catch(Exception e)
+      {
+         throw (new QException("Invalid TAGS settings JSON", e));
+      }
+   }
+
+   /*******************************************************************************
+    ** Create an approved free tag or a pending suggestion. Globals require manage.
+    *******************************************************************************/
+   public TagEntry create(String table, String label, String color) throws QException
+   {
+      if(table == null)
+      {
+         requireManage();
+      }
+      else
+      {
+         ParentRecordAccess.requireTableFeature(table, "tag");
+      }
+      synchronized(CollaborationRecords.config())
+      {
+         String name = normalize(label);
+         QQueryFilter filter = new QQueryFilter().withCriteria("name", QCriteriaOperator.EQUALS, name);
+         filter.withCriteria("tableName", table == null ? QCriteriaOperator.IS_BLANK : QCriteriaOperator.EQUALS, table);
+         List<QRecord> existing = CollaborationRecords.query(CollaborationTables.TAG, filter);
+         if(!existing.isEmpty())
+         {
+            QRecord row = existing.getFirst();
+            if(row.getValue("mergedIntoTagId") != null || (!Boolean.TRUE.equals(row.getValueBoolean("approved"))
+               && !PersonalRecords.currentUserId().equals(row.getValueString("createdByUserId")) && !canManage()))
+            {
+               throw (new QException("Tag name is already reserved."));
+            }
+            return (entry(row));
+         }
+         boolean approved = table == null || canManage() || mode(table).equals("FREE");
+         return (entry(CollaborationRecords.insert(CollaborationTables.TAG, new QRecord().withValue("name", name)
+            .withValue("label", label.strip()).withValue("color", color).withValue("tableName", table).withValue("approved", approved)
+            .withValue("createdByUserId", PersonalRecords.currentUserId()).withValue("usageCount", 0))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Read chips only after resolving the canonical, visible parent key.
+    *******************************************************************************/
+   public List<TagEntry> tagsFor(String table, Serializable recordId) throws QException
+   {
+      String id = parentId(table, recordId);
+      List<Integer> ids = assignments(table, id).stream().map(row -> row.getValueInteger("tagId")).toList();
+      if(ids.isEmpty())
+      {
+         return (List.of());
+      }
+      return (CollaborationRecords.query(CollaborationTables.TAG, vocabularyFilter(table).withCriteria("id", QCriteriaOperator.IN, ids)
+         .withCriteria("approved", QCriteriaOperator.EQUALS, true).withOrderBy(new QFilterOrderBy("label"))).stream().map(TagsService::entry).toList());
+   }
+
+   /*******************************************************************************
+    ** Resolve and validate all inputs before changing assignments. Numbers are ids;
+    ** strings are labels (including numeric labels), with global matches preferred.
+    *******************************************************************************/
+   List<QRecord> resolve(String table, Collection<? extends Serializable> values, boolean createMissing) throws QException
+   {
+      Map<Integer, QRecord> result = new LinkedHashMap<>();
+      for(Serializable value : values == null ? List.<Serializable>of() : values)
+      {
+         QQueryFilter filter = vocabularyFilter(table);
+         if(value instanceof Number)
+         {
+            filter.withCriteria("id", QCriteriaOperator.EQUALS, value);
+         }
+         else
+         {
+            filter.withCriteria("name", QCriteriaOperator.EQUALS, normalize(Objects.toString(value, null)));
+         }
+         List<QRecord> matches = CollaborationRecords.query(CollaborationTables.TAG, filter.withOrderBy(new QFilterOrderBy("id")));
+         QRecord row;
+         if(matches.isEmpty())
+         {
+            if(!createMissing || value instanceof Number || !mode(table).equals("FREE"))
+            {
+               throw (new QException("Pick an approved tag (or suggest one)"));
+            }
+            row = requireTag(create(table, value.toString(), null).id());
+         }
+         else
+         {
+            row = matches.stream().filter(tag -> tag.getValue("tableName") == null).findFirst().orElse(matches.getFirst());
+         }
+         if(!Boolean.TRUE.equals(row.getValueBoolean("approved")))
+         {
+            throw (new QException("Pick an approved tag (or suggest one)"));
+         }
+         result.put(row.getValueInteger("id"), row);
+      }
+      return (new ArrayList<>(result.values()));
+   }
+
+   /*******************************************************************************
+    ** Idempotent assignment changes, with activity only for actual changes.
+    ** Tags intentionally do not notify followers.
+    *******************************************************************************/
+   public void apply(String table, Serializable recordId, Collection<? extends Serializable> add, Collection<? extends Serializable> remove) throws QException
+   {
+      ParentRecordAccess.requireFeature(table, recordId, "tag");
+      String id = parentId(table, recordId);
+      synchronized(CollaborationRecords.config())
+      {
+         List<QRecord> removals = resolve(table, remove, false);
+         List<QRecord> additions = resolve(table, add, true);
+         for(QRecord tag : removals)
+         {
+            List<QRecord> links = assignments(table, id).stream().filter(row -> Objects.equals(row.getValue("tagId"), tag.getValue("id"))).toList();
+            for(QRecord link : links)
+            {
+               CollaborationRecords.delete(CollaborationTables.RECORD_TAG, link.getValue("id"));
+               ActivityWriter.write(table, id, "UNTAGGED", "Tag removed", CollaborationTables.TAG, tag.getValueString("id"));
+            }
+            recompute(tag.getValueInteger("id"));
+         }
+         for(QRecord tag : additions)
+         {
+            if(assignments(table, id).stream().noneMatch(row -> Objects.equals(row.getValue("tagId"), tag.getValue("id"))))
+            {
+               CollaborationRecords.insert(CollaborationTables.RECORD_TAG, new QRecord().withValue("tableName", table).withValue("recordId", id)
+                  .withValue("tagId", tag.getValue("id")).withValue("createdByUserId", PersonalRecords.currentUserId()).withValue("parentDeleted", false));
+               ActivityWriter.write(table, id, "TAGGED", "Tag added", CollaborationTables.TAG, tag.getValueString("id"));
+            }
+            recompute(tag.getValueInteger("id"));
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Approval never changes an already merged alias.
+    *******************************************************************************/
+   public void approve(Serializable id) throws QException
+   {
+      requireManage();
+      synchronized(CollaborationRecords.config())
+      {
+         requireTag(id);
+         CollaborationRecords.update(CollaborationTables.TAG, new QRecord().withValue("id", id).withValue("approved", true));
+      }
+   }
+
+   /*******************************************************************************
+    ** Validate a merge before review and again before load; prevent scope loss.
+    *******************************************************************************/
+   public QRecord mergeTarget(Serializable sourceId, Serializable targetId) throws QException
+   {
+      requireManage();
+      QRecord source = requireTag(sourceId);
+      QRecord target = requireTag(targetId);
+      if(Objects.equals(source.getValue("id"), target.getValue("id")) || !Boolean.TRUE.equals(target.getValueBoolean("approved"))
+         || (target.getValue("tableName") != null && !Objects.equals(source.getValue("tableName"), target.getValue("tableName"))))
+      {
+         throw (new QException("Choose a different approved tag in the same scope or global vocabulary."));
+      }
+      return (target);
+   }
+
+   /*******************************************************************************
+    ** Move references with deduplication and retain the source as an audited alias.
+    *******************************************************************************/
+   public void merge(Serializable sourceId, Serializable targetId) throws QException
+   {
+      requireManage();
+      synchronized(CollaborationRecords.config())
+      {
+         QRecord target = mergeTarget(sourceId, targetId);
+         for(QRecord link : links(sourceId))
+         {
+            boolean duplicate = assignments(link.getValueString("tableName"), link.getValueString("recordId")).stream()
+               .anyMatch(row -> Objects.equals(row.getValue("tagId"), target.getValue("id")));
+            if(duplicate)
+            {
+               CollaborationRecords.delete(CollaborationTables.RECORD_TAG, link.getValue("id"));
+            }
+            else
+            {
+               CollaborationRecords.update(CollaborationTables.RECORD_TAG, new QRecord().withValue("id", link.getValue("id")).withValue("tagId", target.getValue("id")));
+            }
+         }
+         CollaborationRecords.update(CollaborationTables.TAG, new QRecord().withValue("id", sourceId).withValue("mergedIntoTagId", target.getValue("id")));
+         recompute(sourceId);
+         recompute(targetId);
+      }
+   }
+
+   /*******************************************************************************
+    ** Delete the vocabulary entry and its assignments through the managed action.
+    *******************************************************************************/
+   public void delete(Serializable id) throws QException
+   {
+      requireManage();
+      synchronized(CollaborationRecords.config())
+      {
+         for(QRecord link : links(id))
+         {
+            CollaborationRecords.delete(CollaborationTables.RECORD_TAG, link.getValue("id"));
+         }
+         CollaborationRecords.delete(CollaborationTables.TAG, id);
+      }
+   }
+
+   /*******************************************************************************
+    ** Trusted parent cleanup callback; the parent no longer exists to authorize.
+    *******************************************************************************/
+   public void onParentsDeleted(String table, List<? extends Serializable> ids) throws QException
+   {
+      synchronized(CollaborationRecords.config())
+      {
+         for(QRecord link : CollaborationRecords.query(CollaborationTables.RECORD_TAG, new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, table)
+            .withCriteria("recordId", QCriteriaOperator.IN, ids.stream().map(Object::toString).toList())))
+         {
+            CollaborationRecords.delete(CollaborationTables.RECORD_TAG, link.getValue("id"));
+            recompute(link.getValue("tagId"));
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Recount instead of incrementing a potentially stale denormalized value.
+    *******************************************************************************/
+   private void recompute(Serializable id) throws QException
+   {
+      CollaborationRecords.update(CollaborationTables.TAG, new QRecord().withValue("id", id).withValue("usageCount", links(id).size()));
+   }
+
+   /*******************************************************************************
+    ** Internal references used by management actions after checking manage.
+    *******************************************************************************/
+   static List<QRecord> links(Serializable id) throws QException
+   {
+      return (CollaborationRecords.query(CollaborationTables.RECORD_TAG, new QQueryFilter().withCriteria("tagId", QCriteriaOperator.EQUALS, id)));
+   }
+
+   /*******************************************************************************
+    ** Canonical assignment list for an authorized parent.
+    *******************************************************************************/
+   private List<QRecord> assignments(String table, String id) throws QException
+   {
+      return (CollaborationRecords.query(CollaborationTables.RECORD_TAG, CollaborationRecords.parent(table, id)));
+   }
+
+   /*******************************************************************************
+    ** Reject missing and merged vocabulary ids.
+    *******************************************************************************/
+   static QRecord requireTag(Serializable id) throws QException
+   {
+      List<QRecord> rows = CollaborationRecords.query(CollaborationTables.TAG, new QQueryFilter().withCriteria("id", QCriteriaOperator.EQUALS, id)
+         .withCriteria("mergedIntoTagId", QCriteriaOperator.IS_BLANK));
+      if(rows.isEmpty())
+      {
+         throw (new QNotFoundException("Tag not found"));
+      }
+      return (rows.getFirst());
+   }
+
+   /*******************************************************************************
+    ** Table reads guard vocabulary calls without needing a particular record.
+    *******************************************************************************/
+   static void requireTable(String table) throws QException
+   {
+      if(!ParentRecordAccess.canReadTable(table))
+      {
+         throw (new QNotFoundException("Not found"));
+      }
+   }
+
+   /*******************************************************************************
+    ** Canonical keys prevent aliases such as 01 from creating duplicate assignments.
+    *******************************************************************************/
+   private String parentId(String table, Serializable id) throws QException
+   {
+      return (ParentRecordAccess.requireVisibleParent(table, id).getValueString(QContext.getQInstance().getTable(table).getPrimaryKeyField()));
+   }
+
+   /*******************************************************************************
+    ** Management is an explicit permission independent of collaboration.admin.
+    *******************************************************************************/
+   static boolean canManage()
+   {
+      return (QContext.getQSession().hasPermission(MANAGE));
+   }
+
+   /*******************************************************************************
+    ** Shared action and service permission check.
+    *******************************************************************************/
+   public static void requireManage() throws QPermissionDeniedException
+   {
+      if(!canManage())
+      {
+         throw (new QPermissionDeniedException("This needs " + MANAGE + "."));
+      }
+   }
+
+   /*******************************************************************************
+    ** Public vocabulary projection.
+    *******************************************************************************/
+   private static TagEntry entry(QRecord row)
+   {
+      return (new TagEntry(row.getValueInteger("id"), row.getValueString("name"), row.getValueString("label"), row.getValueString("color"),
+         row.getValueString("tableName"), row.getValueBoolean("approved"), row.getValueInteger("usageCount")));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/tasks/SendTaskRemindersProcess.java

@@ -0,0 +1,99 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.tasks;
+
+
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.actions.processes.BackendStep;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QBackendStepMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.scheduleing.QScheduleMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
+
+
+/*******************************************************************************
+ ** Hidden minute-by-minute task reminder job. Runs with its caller's session, which must be a
+ ** scheduler system session or collaboration admin; never elevates a user.
+ *******************************************************************************/
+public class SendTaskRemindersProcess implements BackendStep, CustomPermissionChecker
+{
+   public static final String NAME = "collaborationSendTaskReminders";
+
+
+
+   /*******************************************************************************
+    ** Always register the backend-only process; scheduling is opt-in.
+    *******************************************************************************/
+   public static QProcessMetaData metadata(CollaborationQBitConfig config)
+   {
+      QProcessMetaData process = new QProcessMetaData().withName(NAME).withLabel("Send task reminders").withIsHidden(true).withIcon(new QIcon("history"))
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.HAS_ACCESS_PERMISSION)
+            .withPermissionBaseName("collaboration").withCustomPermissionChecker(new QCodeReference(SendTaskRemindersProcess.class)))
+         .withStep(new QBackendStepMetaData().withName("run").withCode(new QCodeReference(SendTaskRemindersProcess.class)));
+      if(config.getSchedulerName() != null)
+      {
+         process.withSchedule(new QScheduleMetaData().withSchedulerName(config.getSchedulerName()).withRepeatSeconds(60).withInitialDelaySeconds(60));
+      }
+      return (process);
+   }
+
+
+
+   /*******************************************************************************
+    ** Hidden is a presentation setting, so explicitly guard execution as well.
+    *******************************************************************************/
+   @Override
+   public void checkPermissionsThrowing(AbstractActionInput input, MetaDataWithPermissionRules metadata) throws QPermissionDeniedException
+   {
+      QSession session = QContext.getQSession();
+      if(!(session instanceof QSystemUserSession) && (session == null || !session.hasPermission(CollaborationPermissions.ADMIN)))
+      {
+         throw (new QPermissionDeniedException("This needs the collaboration.admin permission."));
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Deliver due reminders using fresh recipient permissions.
+    *******************************************************************************/
+   @Override
+   public void run(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+   {
+      checkPermissionsThrowing(input, null);
+      new TaskReminders().sendDue();
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/tasks/TaskReminders.java

@@ -0,0 +1,92 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.tasks;
+
+import java.time.Clock;
+import java.time.Instant;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.notify.CollaborationNotification;
+import com.kingsrook.qbits.collaboration.notify.Notifications;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** One scheduler per installation; receipts follow successful delivery only.
+ *******************************************************************************/
+public class TaskReminders
+{
+   private final Clock clock;
+
+   /*******************************************************************************
+    ** Production clock.
+    *******************************************************************************/
+   public TaskReminders()
+   {
+      this(Clock.systemUTC());
+   }
+
+   /*******************************************************************************
+    ** Clock shared by due selection and successful-delivery receipts.
+    *******************************************************************************/
+   public TaskReminders(Clock clock)
+   {
+      this.clock = clock;
+   }
+
+   /*******************************************************************************
+    ** No open transaction may defer receipts past the scheduler's serialization lock.
+    *******************************************************************************/
+   public void sendDue() throws QException
+   {
+      new SendTaskRemindersProcess().checkPermissionsThrowing(null, null);
+      if(QContext.getQBackendTransaction() != null)
+      {
+         throw (new QException("Send task reminders outside a transaction."));
+      }
+      synchronized(CollaborationRecords.config())
+      {
+         Instant now = clock.instant();
+         for(String dueField : List.of("remindAt", "dueAt"))
+         {
+            String receipt = dueField.equals("remindAt") ? "remindedAt" : "overdueNotifiedAt";
+            QQueryFilter filter = new QQueryFilter().withCriteria("status", QCriteriaOperator.EQUALS, "OPEN")
+               .withCriteria("parentDeleted", QCriteriaOperator.EQUALS, false).withCriteria("assigneeUserId", QCriteriaOperator.IS_NOT_BLANK)
+               .withCriteria(receipt, QCriteriaOperator.IS_BLANK).withCriteria(dueField, QCriteriaOperator.IS_NOT_BLANK)
+               .withCriteria(dueField, dueField.equals("dueAt") ? QCriteriaOperator.LESS_THAN : QCriteriaOperator.LESS_THAN_OR_EQUALS, now);
+            for(QRecord row : CollaborationRecords.query(CollaborationTables.TASK, filter))
+            {
+               String table = row.getValueString("tableName");
+               String id = row.getValueString("recordId");
+               Notifications.send(new CollaborationNotification(row.getValueString("assigneeUserId"),
+                  (dueField.equals("remindAt") ? "Task reminder: " : "Task overdue: ") + row.getValueString("title"), row.getValueString("notes"),
+                  CollaborationNotification.Category.TASK, table, id, Notifications.link(table, id)),
+                  () -> CollaborationRecords.update(CollaborationTables.TASK, new QRecord().withValue("id", row.getValue("id")).withValue(receipt, now)));
+            }
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/tasks/TasksService.java

@@ -0,0 +1,319 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.tasks;
+
+import java.io.Serializable;
+import java.nio.charset.StandardCharsets;
+import java.time.Clock;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Objects;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.WorkSupport;
+import com.kingsrook.qbits.collaboration.activity.ActivityWriter;
+import com.kingsrook.qbits.collaboration.follow.FollowChangeBatcher;
+import com.kingsrook.qbits.collaboration.follow.FollowService;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.notify.CollaborationNotification;
+import com.kingsrook.qbits.collaboration.notify.Notifications;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Record tasks, authorized as the caller and timed through an injectable clock.
+ *******************************************************************************/
+public class TasksService
+{
+   private final Clock clock;
+   private static final Comparator<QRecord> ORDER = Comparator.comparing((QRecord row) -> row.getValueInstant("dueAt"), Comparator.nullsLast(Comparator.naturalOrder()))
+      .thenComparing(row -> row.getValueInteger("id"));
+
+   /*******************************************************************************
+    ** Production time source.
+    *******************************************************************************/
+   public TasksService()
+   {
+      this(Clock.systemUTC());
+   }
+
+   /*******************************************************************************
+    ** Deterministic reminder and completion times.
+    *******************************************************************************/
+   public TasksService(Clock clock)
+   {
+      this.clock = clock;
+   }
+
+   /*******************************************************************************
+    ** An omitted assignee defaults to the creator.
+    *******************************************************************************/
+   public QRecord create(String table, Serializable recordId, String title, String notes, String assigneeUserId, Instant dueAt, Instant remindAt) throws QException
+   {
+      ParentRecordAccess.requireFeature(table, recordId, "task");
+      String id = FollowService.canonicalId(table, recordId);
+      String user = PersonalRecords.currentUserId();
+      String assignee = assigneeUserId == null ? user : assigneeUserId;
+      WorkSupport.text(title, 200, true);
+      WorkSupport.requireReader(assignee, table, id);
+      QRecord row = CollaborationRecords.insert(CollaborationTables.TASK, new QRecord().withValue("tableName", table).withValue("recordId", id)
+         .withValue("title", title).withValue("notes", notes).withValue("assigneeUserId", assignee).withValue("dueAt", dueAt)
+         .withValue("remindAt", reminder(dueAt, remindAt)).withValue("status", "OPEN").withValue("createdByUserId", user).withValue("parentDeleted", false));
+      activity(row, "TASK_CREATED", "Task created");
+      assigned(row);
+      return (row);
+   }
+
+   /*******************************************************************************
+    ** Full editable-field replacement; null dates clear them, null assignee unassigns.
+    *******************************************************************************/
+   public QRecord update(Integer taskId, String title, String notes, String assigneeUserId, Instant dueAt, Instant remindAt) throws QException
+   {
+      QRecord old = requireManager(taskId);
+      WorkSupport.text(title, 200, true);
+      WorkSupport.requireReader(assigneeUserId, old.getValueString("tableName"), old.getValueString("recordId"));
+      QRecord change = new QRecord().withValue("id", taskId).withValue("title", title).withValue("notes", notes)
+         .withValue("assigneeUserId", assigneeUserId).withValue("dueAt", dueAt).withValue("remindAt", reminder(dueAt, remindAt));
+      if(!Objects.equals(old.getValueInstant("remindAt"), change.getValueInstant("remindAt")) || !Objects.equals(old.getValueString("assigneeUserId"), assigneeUserId))
+      {
+         change.withValue("remindedAt", null);
+      }
+      if(!Objects.equals(old.getValueInstant("dueAt"), dueAt) || !Objects.equals(old.getValueString("assigneeUserId"), assigneeUserId))
+      {
+         change.withValue("overdueNotifiedAt", null);
+      }
+      CollaborationRecords.update(CollaborationTables.TASK, change);
+      QRecord row = WorkSupport.visible(CollaborationTables.TASK, taskId);
+      if(!Objects.equals(old.getValueString("assigneeUserId"), assigneeUserId))
+      {
+         assigned(row);
+      }
+      return (row);
+   }
+
+   /*******************************************************************************
+    ** Creator, assignee and admins still need current parent and task permission.
+    *******************************************************************************/
+   public QRecord requireManager(Integer taskId) throws QException
+   {
+      QRecord row = WorkSupport.visible(CollaborationTables.TASK, taskId);
+      String user = PersonalRecords.currentUserId();
+      ParentRecordAccess.requireFeature(row.getValueString("tableName"), row.getValueString("recordId"), "task");
+      if(!user.equals(row.getValueString("createdByUserId")) && !user.equals(row.getValueString("assigneeUserId"))
+         && !QContext.getQSession().hasPermission(CollaborationPermissions.ADMIN))
+      {
+         throw (new QPermissionDeniedException("Only the task creator, assignee or collaboration.admin can change this task."));
+      }
+      return (row);
+   }
+
+   /*******************************************************************************
+    ** Idempotent completion emits one activity for the transition.
+    *******************************************************************************/
+   public QRecord complete(Integer taskId) throws QException
+   {
+      return (transition(taskId, "DONE"));
+   }
+
+   /*******************************************************************************
+    ** Reopening clears completion fields, retaining delivery history.
+    *******************************************************************************/
+   public QRecord reopen(Integer taskId) throws QException
+   {
+      return (transition(taskId, "OPEN"));
+   }
+
+   /*******************************************************************************
+    ** Cancellation stops scheduled notifications.
+    *******************************************************************************/
+   public QRecord cancel(Integer taskId) throws QException
+   {
+      return (transition(taskId, "CANCELLED"));
+   }
+
+   /*******************************************************************************
+    ** Serialize transitions within the installation, like existing follow services.
+    *******************************************************************************/
+   private QRecord transition(Integer taskId, String status) throws QException
+   {
+      synchronized(CollaborationRecords.config())
+      {
+         QRecord row = requireManager(taskId);
+         if(!status.equals(row.getValueString("status")))
+         {
+            CollaborationRecords.update(CollaborationTables.TASK, new QRecord().withValue("id", taskId).withValue("status", status)
+               .withValue("completedAt", status.equals("DONE") ? clock.instant() : null)
+               .withValue("completedByUserId", status.equals("DONE") ? PersonalRecords.currentUserId() : null));
+            if(status.equals("DONE"))
+            {
+               activity(row, "TASK_DONE", "Task completed");
+            }
+         }
+         return (WorkSupport.visible(CollaborationTables.TASK, taskId));
+      }
+   }
+
+   /*******************************************************************************
+    ** Parent readers can list open tasks, optionally including terminal tasks.
+    *******************************************************************************/
+   public List<QRecord> list(String table, Serializable recordId, Boolean includeDone) throws QException
+   {
+      QQueryFilter filter = CollaborationRecords.parent(table, FollowService.canonicalId(table, recordId));
+      if(!Boolean.TRUE.equals(includeDone))
+      {
+         filter.withCriteria("status", QCriteriaOperator.EQUALS, "OPEN");
+      }
+      return (CollaborationRecords.query(CollaborationTables.TASK, filter).stream().sorted(ORDER).toList());
+   }
+
+   /*******************************************************************************
+    ** Due-date keyset paging, null dates last, with stable ID tie-breaking.
+    *******************************************************************************/
+   public Page mine(String status, Integer limit, String cursor) throws QException
+   {
+      int size = limit == null ? 20 : limit;
+      if(size < 1 || size > 100)
+      {
+         throw (new QException("Limit must be between 1 and 100."));
+      }
+      List<QRecord> rows = mineRows(status);
+      if(cursor != null)
+      {
+         QRecord after = decode(cursor);
+         rows = rows.stream().filter(row -> ORDER.compare(row, after) > 0).toList();
+      }
+      List<QRecord> page = rows.stream().limit(size).toList();
+      return (new Page(page, rows.size() > size ? encode(page.getLast()) : null));
+   }
+
+   /*******************************************************************************
+    ** Also supplies exact visible counts for My work; no aggregate lock leakage.
+    *******************************************************************************/
+   public List<QRecord> mineRows(String status) throws QException
+   {
+      String selected = status == null ? "OPEN" : status;
+      if(!List.of("OPEN", "DONE", "CANCELLED").contains(selected))
+      {
+         throw (new QException("Unknown task status."));
+      }
+      List<QRecord> visible = new ArrayList<>();
+      for(QRecord row : CollaborationRecords.query(CollaborationTables.TASK, new QQueryFilter()
+         .withCriteria("assigneeUserId", QCriteriaOperator.EQUALS, PersonalRecords.currentUserId()).withCriteria("status", QCriteriaOperator.EQUALS, selected)
+         .withCriteria("parentDeleted", QCriteriaOperator.EQUALS, false)))
+      {
+         try
+         {
+            ParentRecordAccess.requireVisibleParent(row.getValueString("tableName"), row.getValueString("recordId"));
+            visible.add(row);
+         }
+         catch(QNotFoundException expected)
+         {
+            // Removed access removes the task from personal results.
+         }
+      }
+      return (visible.stream().sorted(ORDER).toList());
+   }
+
+   /*******************************************************************************
+    ** The default never schedules a reminder in the past for a future due date.
+    *******************************************************************************/
+   private Instant reminder(Instant due, Instant supplied)
+   {
+      return (supplied != null ? supplied : due == null ? null : due.minusSeconds(86400).isAfter(clock.instant()) ? due.minusSeconds(86400) : due);
+   }
+
+   /*******************************************************************************
+    ** Assignees become followers; self-assignment avoids an immediate notification.
+    *******************************************************************************/
+   private void assigned(QRecord row) throws QException
+   {
+      String user = row.getValueString("assigneeUserId");
+      if(user != null)
+      {
+         String table = row.getValueString("tableName");
+         String id = row.getValueString("recordId");
+         new FollowService().ensureFollower(user, table, id, "ASSIGNED");
+         if(!user.equals(PersonalRecords.currentUserId()))
+         {
+            Notifications.send(new CollaborationNotification(user, "Task assigned: " + row.getValueString("title"), row.getValueString("notes"),
+               CollaborationNotification.Category.TASK, table, id, Notifications.link(table, id)));
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Task events also enter the existing notify-on-change follower digest.
+    *******************************************************************************/
+   private void activity(QRecord row, String type, String summary) throws QException
+   {
+      String table = row.getValueString("tableName");
+      String id = row.getValueString("recordId");
+      ActivityWriter.write(table, id, type, summary, CollaborationTables.TASK, row.getValueString("id"));
+      new FollowChangeBatcher(clock).recordChange(table, id, PersonalRecords.currentUserId(), Set.of(summary));
+   }
+
+   /*******************************************************************************
+    ** Versioned cursor includes only the sort tuple.
+    *******************************************************************************/
+   private String encode(QRecord row)
+   {
+      return (Base64.getUrlEncoder().withoutPadding().encodeToString(("1\n" + row.getValueInstant("dueAt") + "\n" + row.getValueInteger("id")).getBytes(StandardCharsets.UTF_8)));
+   }
+
+   /*******************************************************************************
+    ** Reject malformed cursor input before interpreting the sort tuple.
+    *******************************************************************************/
+   private QRecord decode(String cursor) throws QException
+   {
+      try
+      {
+         String[] parts = new String(Base64.getUrlDecoder().decode(cursor), StandardCharsets.UTF_8).split("\n");
+         if(parts.length != 3 || !parts[0].equals("1"))
+         {
+            throw (new IllegalArgumentException("Invalid cursor"));
+         }
+         return (new QRecord().withValue("dueAt", parts[1].equals("null") ? null : Instant.parse(parts[1])).withValue("id", Integer.valueOf(parts[2])));
+      }
+      catch(RuntimeException e)
+      {
+         throw (new QException("Invalid cursor", e));
+      }
+   }
+
+   /*******************************************************************************
+    ** Service page consumed by the future endpoint adapter.
+    *******************************************************************************/
+   public record Page(List<QRecord> tasks, String nextCursor)
+   {
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/timeline/TimelineDetail.java

@@ -0,0 +1,30 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.timeline;
+
+
+/*******************************************************************************
+ ** Field-level audit change, omitted entirely when the field is hidden.
+ *******************************************************************************/
+public record TimelineDetail(String fieldName, String oldValue, String newValue, String message)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/timeline/TimelineItem.java

@@ -0,0 +1,32 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.timeline;
+
+import java.time.Instant;
+import java.util.List;
+
+/*******************************************************************************
+ ** A typed timeline event; core audits do not store a stable session user ID.
+ *******************************************************************************/
+public record TimelineItem(String kind, Long id, Instant at, String actorUserId, String actorName, String summary, List<TimelineDetail> details, String refTable, String refId)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/timeline/TimelinePage.java

@@ -0,0 +1,31 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.timeline;
+
+import java.util.List;
+
+/*******************************************************************************
+ ** Merged events and opaque descending tuple cursor.
+ *******************************************************************************/
+public record TimelinePage(List<TimelineItem> items, String nextCursor)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/timeline/TimelineService.java

@@ -0,0 +1,184 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.timeline;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.RecordCursor;
+import com.kingsrook.qbits.collaboration.follow.FollowService;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.people.PeopleService;
+import com.kingsrook.qqq.backend.core.actions.metadata.personalization.TableMetaDataPersonalizerAction;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.metadata.personalization.TableMetaDataPersonalizerInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QInputSource;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.audits.AuditsMetaDataProvider;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Merge core audit and collaboration activity using each source's read permissions.
+ ** Audit details use the same personalized host fields as core's audit screen.
+ *******************************************************************************/
+public class TimelineService
+{
+   /*******************************************************************************
+    ** Types accepts AUDIT/ACTIVITY or individual collaboration activity type names.
+    *******************************************************************************/
+   public TimelinePage timeline(String table, Serializable recordId, String beforeCursor, Integer limit, Set<String> types) throws QException
+   {
+      String id = FollowService.canonicalId(table, recordId);
+      if(limit == null || limit < 1 || limit > 50)
+      {
+         throw (new QException("Limit must be between 1 and 50"));
+      }
+      RecordCursor before = beforeCursor == null ? null : RecordCursor.decode(beforeCursor);
+      if(before != null && before.kind().equals("COMMENT"))
+      {
+         throw (new QException("Invalid timeline cursor"));
+      }
+      List<TimelineItem> items = new ArrayList<>();
+      boolean all = types == null || types.isEmpty();
+      if(all || types.contains("ACTIVITY") || types.stream().anyMatch(type -> !type.equals("AUDIT")))
+      {
+         QQueryFilter filter = CollaborationRecords.parent(table, id).withOrderBy(new QFilterOrderBy("at", false))
+            .withOrderBy(new QFilterOrderBy("id", false)).withLimit(limit + 1);
+         if(before != null)
+         {
+            filter.withSubFilter(before.beforeFilter("at", "ACTIVITY"));
+         }
+         if(!all && !types.contains("ACTIVITY"))
+         {
+            filter.withCriteria("type", QCriteriaOperator.IN, new ArrayList<>(types));
+         }
+         for(QRecord row : CollaborationRecords.query(CollaborationTables.ACTIVITY, filter))
+         {
+            items.add(new TimelineItem("ACTIVITY", row.getValueLong("id"), row.getValueInstant("at"), row.getValueString("actorUserId"),
+               new PeopleService().displayName(row.getValueString("actorUserId")), row.getValueString("summary"), List.of(), row.getValueString("refTableName"), row.getValueString("refId")));
+         }
+      }
+      if(all || types.contains("AUDIT"))
+      {
+         items.addAll(audits(table, id, before, limit + 1));
+      }
+      items.sort(Comparator.comparing(TimelineItem::at).thenComparing(TimelineItem::kind).thenComparing(TimelineItem::id).reversed());
+      List<TimelineItem> page = items.stream().limit(limit).toList();
+      String next = items.size() > limit ? key(page.getLast()).encode() : null;
+      return (new TimelinePage(page, next));
+   }
+
+   /*******************************************************************************
+    ** Missing audit installation or denied audit permission quietly omits the stream.
+    ** Read audit headers separately so a many-detail join never truncates an event.
+    *******************************************************************************/
+   private List<TimelineItem> audits(String table, String id, RecordCursor before, Integer limit) throws QException
+   {
+      if(QContext.getQInstance().getTable(AuditsMetaDataProvider.TABLE_NAME_AUDIT) == null)
+      {
+         return (List.of());
+      }
+      try
+      {
+         List<QRecord> tables = query(AuditsMetaDataProvider.TABLE_NAME_AUDIT_TABLE, new QQueryFilter().withCriteria("name", QCriteriaOperator.EQUALS, table));
+         if(tables.isEmpty())
+         {
+            return (List.of());
+         }
+         QQueryFilter filter = new QQueryFilter().withCriteria("auditTableId", QCriteriaOperator.EQUALS, tables.getFirst().getValue("id"))
+            .withCriteria("recordId", QCriteriaOperator.EQUALS, id).withOrderBy(new QFilterOrderBy("timestamp", false))
+            .withOrderBy(new QFilterOrderBy("id", false)).withLimit(limit);
+         if(before != null)
+         {
+            filter.withSubFilter(before.beforeFilter("timestamp", "AUDIT"));
+         }
+         List<QRecord> headers = query(AuditsMetaDataProvider.TABLE_NAME_AUDIT, filter);
+         if(headers.isEmpty())
+         {
+            return (List.of());
+         }
+         TableMetaDataPersonalizerInput personalization = new TableMetaDataPersonalizerInput().withTableName(table).withInputSource(QInputSource.USER);
+         personalization.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+         QTableMetaData personalized = TableMetaDataPersonalizerAction.execute(personalization);
+         Map<Long, List<TimelineDetail>> details = new HashMap<>();
+         for(QRecord detail : query(AuditsMetaDataProvider.TABLE_NAME_AUDIT_DETAIL, new QQueryFilter()
+            .withCriteria("auditId", QCriteriaOperator.IN, headers.stream().map(row -> row.getValue("id")).toList())
+            .withOrderBy(new QFilterOrderBy("id"))))
+         {
+            String field = detail.getValueString("fieldName");
+            if(field == null || field.isBlank() || (personalized != null && personalized.getFields().containsKey(field)))
+            {
+               details.computeIfAbsent(detail.getValueLong("auditId"), ignored -> new ArrayList<>())
+                  .add(new TimelineDetail(field, detail.getValueString("oldValue"), detail.getValueString("newValue"), detail.getValueString("message")));
+            }
+         }
+         Map<Integer, String> actors = new HashMap<>();
+         for(QRecord actor : query(AuditsMetaDataProvider.TABLE_NAME_AUDIT_USER, new QQueryFilter().withCriteria("id", QCriteriaOperator.IN,
+            headers.stream().map(row -> row.getValue("auditUserId")).filter(java.util.Objects::nonNull).distinct().toList())))
+         {
+            actors.put(actor.getValueInteger("id"), actor.getValueString("name"));
+         }
+         List<TimelineItem> result = new ArrayList<>();
+         for(QRecord row : headers)
+         {
+            result.add(new TimelineItem("AUDIT", row.getValueLong("id"), row.getValueInstant("timestamp"), null, actors.get(row.getValueInteger("auditUserId")),
+               row.getValueString("message"), List.copyOf(details.getOrDefault(row.getValueLong("id"), List.of())), AuditsMetaDataProvider.TABLE_NAME_AUDIT, row.getValueString("id")));
+         }
+         return (result);
+      }
+      catch(QPermissionDeniedException expected)
+      {
+         return (List.of());
+      }
+   }
+
+   /*******************************************************************************
+    ** Explicit enforcement applies to every audit table, independent of host defaults.
+    *******************************************************************************/
+   private List<QRecord> query(String table, QQueryFilter filter) throws QException
+   {
+      QueryInput input = new QueryInput(table).withFilter(filter);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      return (new QueryAction().execute(input).getRecords());
+   }
+
+   /*******************************************************************************
+    ** Stable descending key, including equal timestamps across both streams.
+    *******************************************************************************/
+   private RecordCursor key(TimelineItem item)
+   {
+      return (new RecordCursor(item.at(), item.kind(), item.id()));
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/CollaborationTest.java

@@ -85,7 +85,7 @@ class CollaborationTest
       instance.setEnforcePermissionsInCoreActions(true);
       config = new CollaborationQBitConfig().withBackendName("memory");
       new CollaborationQBitProducer().withQBitConfig(config).produce(instance);
-      QContext.init(instance, new QSession().withPermissions(CollaborationPermissions.ADMIN));
+      QContext.init(instance, new QSession().withUser(new com.kingsrook.qqq.backend.core.model.session.QUser().withIdReference("admin")).withPermissions(CollaborationPermissions.ADMIN));
    }
 
 
@@ -114,7 +114,7 @@ class CollaborationTest
          CollaborationTables.SCOPE_TYPE, CollaborationTables.FEATURE, CollaborationTables.PERMISSION_MODE);
       assertThat(instance.getPossibleValueSource(CollaborationTables.FEATURE).getEnumValues()).hasSize(12);
       assertThat(instance.getApp("collaboration").getChildren()).extracting(child -> child.getName())
-         .containsExactlyInAnyOrder(CollaborationTables.FEATURE_SETTING, CollaborationTables.USER);
+         .containsExactlyInAnyOrder(CollaborationTables.COMMENT, CollaborationTables.ATTACHMENT, CollaborationTables.TAG, CollaborationTables.TASK, CollaborationTables.SHARE, CollaborationTables.ACCESS_REQUEST, CollaborationTables.RECORD_ASSIGNMENT, CollaborationTables.ACTIVITY, CollaborationTables.FEATURE_SETTING, CollaborationTables.USER);
       assertThat(instance.getApp("collaboration").getWidgets()).containsExactly(CollaborationHome.HOME_WIDGET);
       assertThat(instance.getWidget(CollaborationHome.HOME_WIDGET)).isNotNull();
       assertThat(instance.getTable(CollaborationTables.FEATURE_SETTING).getAuditRules().getAuditLevel()).isEqualTo(AuditLevel.FIELD);
@@ -177,9 +177,9 @@ class CollaborationTest
       QInstance headless = new QInstance();
       headless.addBackend(new QBackendMetaData().withName("memory").withBackendType(MemoryBackendModule.class));
       new CollaborationQBitProducer().withQBitConfig(config.withAdminApp(false)).produce(headless);
-      assertThat(headless.getTables()).hasSize(2);
+      assertThat(headless.getTables()).hasSize(17);
       assertThat(headless.getApps()).isEmpty();
-      assertThat(headless.getWidgets()).isEmpty();
+      assertThat(headless.getWidgets()).hasSize(4);
    }
 
 
@@ -255,7 +255,7 @@ class CollaborationTest
       seed(CollaborationTables.USER, person("visible", now), person("hidden", now));
       instance.addSecurityKeyType(new QSecurityKeyType().withName("person").withAllAccessKeyName("allPeople"));
       instance.getTable(CollaborationTables.USER).withRecordSecurityLock(new RecordSecurityLock().withSecurityKeyType("person").withFieldName("userId"));
-      QContext.init(instance, new QSession().withPermissions(CollaborationPermissions.VIEW).withSecurityKeyValue("person", "visible"));
+      QContext.init(instance, new QSession().withUser(new com.kingsrook.qqq.backend.core.model.session.QUser().withIdReference("viewer")).withPermissions(CollaborationPermissions.VIEW).withSecurityKeyValue("person", "visible"));
       assertThat(CollaborationHome.render(now)).contains("People known: 1", "Active in the last 7 days: 1");
       instance.setEnforcePermissionsInCoreActions(false);
       QContext.getQSession().setPermissions(new java.util.HashSet<>());

src/test/java/com/kingsrook/qbits/collaboration/ConversationServicesTest.java

@@ -0,0 +1,532 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.time.Clock;
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.comments.CommentEntry;
+import com.kingsrook.qbits.collaboration.comments.CommentPage;
+import com.kingsrook.qbits.collaboration.comments.CommentsService;
+import com.kingsrook.qbits.collaboration.comments.MentionEntry;
+import com.kingsrook.qbits.collaboration.follow.FollowChangeBatcher;
+import com.kingsrook.qbits.collaboration.follow.FollowProcesses;
+import com.kingsrook.qbits.collaboration.follow.FollowService;
+import com.kingsrook.qbits.collaboration.follow.SendFollowDigestsProcess;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.notify.CollaborationNotification;
+import com.kingsrook.qbits.collaboration.notify.CollaborationNotifier;
+import com.kingsrook.qbits.collaboration.notify.NoOpNotifier;
+import com.kingsrook.qbits.collaboration.notify.RecordingNotifier;
+import com.kingsrook.qbits.collaboration.people.PeopleService;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qbits.collaboration.security.OtherUserAccess;
+import com.kingsrook.qbits.collaboration.security.UserSessionSupplier;
+import com.kingsrook.qqq.backend.core.actions.QBackendTransaction;
+import com.kingsrook.qqq.backend.core.actions.processes.RunProcessAction;
+import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
+import com.kingsrook.qqq.backend.core.actions.tables.GetAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.actions.tables.listeners.RecordChangeEvent;
+import com.kingsrook.qqq.backend.core.actions.tables.listeners.RecordChangeType;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.instances.QInstanceValidator;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLine;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessOutput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QUser;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.StreamedETLWithFrontendProcess;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/*******************************************************************************
+ ** Memory-backed acceptance tests exercise real permissions, actions and callbacks.
+ *******************************************************************************/
+public class ConversationServicesTest extends PersonalServiceFixture
+{
+   private static RecordingNotifier recorder;
+   private static final Map<String, QSession> sessions = new HashMap<>();
+   private final CommentsService comments = new CommentsService();
+   private final FollowService follows = new FollowService();
+
+   /*******************************************************************************
+    ** Isolated transport/session provider for each test.
+    *******************************************************************************/
+   @BeforeEach
+   void configure() throws Exception
+   {
+      recorder = new RecordingNotifier();
+      sessions.clear();
+      sessions.put("bob", session("bob", "a"));
+      sessions.put("eve", session("eve", "b"));
+      sessions.put("alice", session("alice", "a"));
+      config.withNotifier(new QCodeReference(TestNotifier.class)).withUserSessionSupplier(new QCodeReference(TestSessions.class));
+      QContext.getQSession().getUser().setFullName("Alice Example");
+      new QInstanceValidator().validate(instance);
+   }
+
+   /*******************************************************************************
+    ** Test transport configured through the actual QCodeReference loader.
+    *******************************************************************************/
+   public static class TestNotifier implements CollaborationNotifier
+   {
+      @Override
+      public void notify(CollaborationNotification n)
+      {
+         recorder.notify(n);
+      }
+   }
+
+   /*******************************************************************************
+    ** The provider returns explicit test identities with real record locks.
+    *******************************************************************************/
+   public static class TestSessions implements UserSessionSupplier
+   {
+      @Override
+      public Optional<QSession> sessionFor(String userId)
+      {
+         return (Optional.ofNullable(sessions.get(userId)));
+      }
+   }
+
+   /*******************************************************************************
+    ** Explicit read-only recipient permissions.
+    *******************************************************************************/
+   private static QSession session(String user, String tenant)
+   {
+      return (new QSession().withUser(new QUser().withIdReference(user)).withPermissions("document.read").withSecurityKeyValue("tenant", tenant));
+   }
+
+   /*******************************************************************************
+    ** Mentions are recipient safe and deduplicated.
+    *******************************************************************************/
+   @Test
+   void mentionsAreRecipientSafeAndDeduplicated() throws Exception
+   {
+      CommentEntry entry = comments.post("document", "01", "Hi @[Bob](user:bob) @[Again](user:bob) @[Eve](user:eve) @[Unknown](user:missing)", null, "title");
+      assertThat(entry.authorDisplayName()).isEqualTo("Alice Example");
+      assertThat(entry.canEdit()).isTrue();
+      assertThat(entry.canDelete()).isTrue();
+      assertThat(entry.mentions()).containsExactly(new MentionEntry("bob", true), new MentionEntry("eve", false), new MentionEntry("missing", false));
+      assertThat(recorder.notifications()).singleElement().satisfies(n ->
+      {
+         assertThat(n.recipientUserId()).isEqualTo("bob");
+         assertThat(n.category()).isEqualTo(CollaborationNotification.Category.MENTION);
+         assertThat(n.link()).isEqualTo("/app/document/1");
+         assertThat(n.sourceRecordId()).isEqualTo("1");
+      });
+      assertThat(CollaborationRecords.query(CollaborationTables.MENTION, new QQueryFilter().withCriteria("mentionedUserId", QCriteriaOperator.EQUALS, "bob")))
+         .singleElement().satisfies(mention -> assertThat(mention.getValueInstant("notifiedAt")).isNotNull());
+      assertThat(follows.followers("document", 1)).extracting(f -> f.userId()).containsExactlyInAnyOrder("alice", "bob");
+      assertThat(follows.followers("document", 1)).allSatisfy(f ->
+      {
+         assertThat(f.notifyOnComment()).isTrue();
+         assertThat(f.notifyOnChange()).isFalse();
+      });
+      comments.edit(entry.id(), "Again @[Bob](user:bob)");
+      assertThat(recorder.notifications()).hasSize(1);
+      config.withUserSessionSupplier(null);
+      CommentEntry unknown = comments.post("document", 2, "@[Bob](user:bob)", null, null);
+      assertThat(unknown.mentions()).containsExactly(new MentionEntry("bob", false));
+      assertThat(recorder.notifications()).hasSize(1);
+      assertThat(new OtherUserAccess().canRead("bob", "document", 1)).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Transactions defer delivery and recheck access.
+    *******************************************************************************/
+   @Test
+   void transactionsDeferDeliveryAndRecheckAccess() throws Exception
+   {
+      QBackendTransaction tx = new QBackendTransaction();
+      QContext.setTransaction(tx);
+      comments.post("document", 1, "@[Bob](user:bob)", null, null);
+      assertThat(recorder.notifications()).isEmpty();
+      assertThat(CollaborationRecords.query(CollaborationTables.MENTION, new QQueryFilter()).getFirst().getValueInstant("notifiedAt")).isNull();
+      tx.commit();
+      assertThat(recorder.notifications()).hasSize(1);
+      assertThat(QContext.getQSession().getUser().getIdReference()).isEqualTo("alice");
+      assertThat(QContext.getQBackendTransaction()).isSameAs(tx);
+      comments.post("document", 1, "Another @[Bob](user:bob)", null, null);
+      tx.rollback();
+      assertThat(recorder.notifications()).hasSize(1);
+      comments.post("document", 1, "Revoked @[Bob](user:bob)", null, null);
+      sessions.put("bob", session("bob", "b"));
+      tx.commit();
+      assertThat(recorder.notifications()).hasSize(1);
+      QContext.clearTransaction();
+      sessions.put("bob", session("wrong-user", "a"));
+      assertThat(new OtherUserAccess().canRead("bob", "document", 1)).isEmpty();
+      new NoOpNotifier().notify(recorder.notifications().getFirst());
+   }
+
+   /*******************************************************************************
+    ** Replies history and resolution.
+    *******************************************************************************/
+   @Test
+   void repliesHistoryAndResolution() throws Exception
+   {
+      CommentEntry root = comments.post("document", 1, "Root", null, null);
+      CommentEntry reply = comments.post("document", 1, "Reply", root.id(), null);
+      CommentEntry nested = comments.post("document", 1, "Flattened", reply.id(), null);
+      assertThat(nested.threadId()).isEqualTo(root.id());
+      assertThat(nested.parentCommentId()).isEqualTo(root.id());
+      CommentEntry edited = comments.edit(reply.id(), "Changed @[Bob](user:bob)");
+      assertThat(edited.editedAt()).isNotNull();
+      assertThat(comments.history(reply.id())).singleElement().satisfies(revision ->
+      {
+         assertThat(revision.body()).isEqualTo("Reply");
+         assertThat(revision.editedByUserId()).isEqualTo("alice");
+      });
+      comments.resolve(root.id());
+      assertThat(comments.list("document", 1, null, 20).threads().getFirst().resolved()).isTrue();
+      comments.reopen(root.id());
+      CommentEntry thread = comments.list("document", 1, null, 20).threads().getFirst();
+      assertThat(thread.resolved()).isFalse();
+      assertThat(thread.replies()).extracting(CommentEntry::id).containsExactly(reply.id(), nested.id());
+      assertThatThrownBy(() -> comments.resolve(reply.id())).hasMessageContaining("root");
+      assertThatThrownBy(() -> comments.post("document", 2, "Wrong parent", root.id(), null)).isInstanceOf(QNotFoundException.class);
+   }
+
+   /*******************************************************************************
+    ** Own delete others and moderation.
+    *******************************************************************************/
+   @Test
+   void ownDeleteOthersAndModeration() throws Exception
+   {
+      CommentEntry row = comments.post("document", 1, "Delete me", null, null);
+      login("bob");
+      assertThat(comments.history(row.id())).isEmpty();
+      assertThatThrownBy(() -> comments.delete(row.id())).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> comments.edit(row.id(), "rewrite")).isInstanceOf(QPermissionDeniedException.class);
+      admin();
+      assertThatThrownBy(() -> comments.edit(row.id(), "moderated rewrite")).isInstanceOf(QPermissionDeniedException.class);
+      comments.delete(row.id());
+      assertThat(comments.list("document", 1, null, 20).threads()).singleElement().satisfies(deleted ->
+      {
+         assertThat(deleted.body()).isNull();
+         assertThat(deleted.deleted()).isTrue();
+         assertThat(deleted.canEdit()).isFalse();
+      });
+      login("alice");
+      CommentEntry mine = comments.post("document", 1, "Own", null, null);
+      comments.delete(mine.id());
+      assertThatThrownBy(() -> comments.edit(mine.id(), "undelete")).isInstanceOf(QPermissionDeniedException.class);
+   }
+
+   /*******************************************************************************
+    ** Parent and feature permissions.
+    *******************************************************************************/
+   @Test
+   void parentAndFeaturePermissions() throws Exception
+   {
+      assertThatThrownBy(() -> comments.post("document", 3, "secret", null, null)).hasMessage("Not found");
+      assertThatThrownBy(() -> comments.list("document", 3, null, 20)).hasMessage("Not found");
+      QContext.getQSession().getPermissions().remove("document.write");
+      assertThatThrownBy(() -> comments.post("document", 1, "read only", null, null)).isInstanceOf(QPermissionDeniedException.class);
+      QContext.getQSession().withPermissions("document.comment");
+      CommentEntry row = comments.post("document", 1, "explicit grant", null, null);
+      QContext.getQSession().getPermissions().remove("document.comment");
+      assertThat(comments.list("document", 1, null, 20).threads().getFirst().canEdit()).isFalse();
+      assertThatThrownBy(() -> comments.edit(row.id(), "denied")).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> comments.resolve(row.id())).isInstanceOf(QPermissionDeniedException.class);
+      assertThat(follows.follow("document", 1, null, null).notifyOnChange()).isFalse();
+      assertThatThrownBy(() -> follows.follow("document", 3, null, null)).hasMessage("Not found");
+   }
+
+   /*******************************************************************************
+    ** Thread keyset paging uses latest activity.
+    *******************************************************************************/
+   @Test
+   void threadKeysetPagingUsesLatestActivity() throws Exception
+   {
+      CommentEntry first = comments.post("document", 1, "first", null, null);
+      CommentEntry second = comments.post("document", 1, "second", null, null);
+      Instant tie = Instant.parse("2026-01-01T00:00:00Z");
+      for(CommentEntry row : List.of(first, second))
+      {
+         CollaborationRecords.update(CollaborationTables.COMMENT, new QRecord().withValue("id", row.id()).withValue("lastActivityAt", tie));
+      }
+      CommentPage page = comments.list("document", 1, null, 1);
+      assertThat(page.threads()).extracting(CommentEntry::id).containsExactly(second.id());
+      CommentPage next = comments.list("document", 1, page.nextCursor(), 1);
+      assertThat(next.threads()).extracting(CommentEntry::id).containsExactly(first.id());
+      assertThat(next.nextCursor()).isNull();
+      comments.post("document", 1, "new reply", first.id(), null);
+      assertThat(comments.list("document", 1, null, 1).threads().getFirst().id()).isEqualTo(first.id());
+      assertThatThrownBy(() -> comments.list("document", 1, "bad!", 20)).hasMessage("Invalid cursor");
+      assertThatThrownBy(() -> comments.list("document", 1, null, 51)).hasMessageContaining("Limit");
+      assertThatThrownBy(() -> comments.post("document", 1, " ", null, null)).hasMessageContaining("body");
+      assertThatThrownBy(() -> comments.post("document", 1, "a".repeat(20001), null, null)).hasMessageContaining("body");
+      assertThatThrownBy(() -> comments.post("document", 1, "ok", null, "missing")).hasMessage("Unknown field");
+      String mentions = java.util.stream.IntStream.range(0, 51).mapToObj(i -> "@[P](user:u" + i + ")").collect(java.util.stream.Collectors.joining());
+      assertThatThrownBy(() -> comments.post("document", 1, mentions, null, null)).hasMessageContaining("50 users");
+   }
+
+   /*******************************************************************************
+    ** Follow defaults mute and unfollow.
+    *******************************************************************************/
+   @Test
+   void followDefaultsMuteAndUnfollow() throws Exception
+   {
+      assertThat(follows.state("document", 1)).isEmpty();
+      assertThat(follows.follow("document", 1, null, null)).satisfies(f ->
+      {
+         assertThat(f.reason()).isEqualTo("MANUAL");
+         assertThat(f.notifyOnChange()).isTrue();
+         assertThat(f.notifyOnComment()).isTrue();
+      });
+      follows.follow("document", 1, false, false);
+      assertThat(follows.state("document", 1).orElseThrow().notifyOnChange()).isFalse();
+      follows.ensureFollower("bob", "document", 1, "ASSIGNED");
+      assertThat(follows.followers("document", 1)).anySatisfy(f ->
+      {
+         assertThat(f.userId()).isEqualTo("bob");
+         assertThat(f.notifyOnChange()).isTrue();
+      });
+      QRecord bob = CollaborationRecords.query(CollaborationTables.FOLLOW, new QQueryFilter().withCriteria("userId", QCriteriaOperator.EQUALS, "bob")).getFirst();
+      CollaborationRecords.update(CollaborationTables.FOLLOW, new QRecord().withValue("id", bob.getValue("id")).withValue("mutedUntil", Instant.now().plusSeconds(600)));
+      comments.post("document", 1, "Muted", null, null);
+      assertThat(recorder.notifications()).isEmpty();
+      CollaborationRecords.update(CollaborationTables.FOLLOW, new QRecord().withValue("id", bob.getValue("id")).withValue("mutedUntil", Instant.EPOCH));
+      comments.post("document", 1, "Unmuted", null, null);
+      assertThat(recorder.notifications()).singleElement().satisfies(n -> assertThat(n.category()).isEqualTo(CollaborationNotification.Category.FOLLOW));
+      follows.unfollow("document", 1);
+      assertThat(follows.state("document", 1)).isEmpty();
+      follows.unfollow("document", 1);
+   }
+
+   /*******************************************************************************
+    ** People throttle search and mention ranking.
+    *******************************************************************************/
+   @Test
+   void peopleThrottleSearchAndMentionRanking() throws Exception
+   {
+      Instant at = Instant.parse("2026-01-01T00:00:00Z");
+      new PeopleService(Clock.fixed(at, ZoneOffset.UTC)).touch();
+      QContext.getQSession().getUser().setFullName("Changed Alice");
+      new PeopleService(Clock.fixed(at.plusSeconds(599), ZoneOffset.UTC)).touch();
+      assertThat(new PeopleService().search("Alice", 5)).singleElement().satisfies(p -> assertThat(p.displayName()).isEqualTo("Alice Example"));
+      new PeopleService(Clock.fixed(at.plusSeconds(600), ZoneOffset.UTC)).touch();
+      assertThat(new PeopleService().search("changed", 5)).hasSize(1);
+      login("bob");
+      new PeopleService().touch();
+      follows.follow("document", 1, null, null);
+      login("eve");
+      new PeopleService().touch();
+      login("alice");
+      QRecord eve = CollaborationRecords.query(CollaborationTables.USER, new QQueryFilter().withCriteria("userId", QCriteriaOperator.EQUALS, "eve")).getFirst();
+      CollaborationRecords.update(CollaborationTables.USER, new QRecord().withValue("id", eve.getValue("id")).withValue("email", "search@example.invalid"));
+      assertThat(new PeopleService().search("EXAMPLE.INVALID", 50)).singleElement().satisfies(p -> assertThat(p.userId()).isEqualTo("eve"));
+      assertThat(comments.mentionCandidates("document", 1, "").getFirst().person().userId()).isEqualTo("bob");
+      assertThat(comments.mentionCandidates("document", 1, "eve").getFirst().canRead()).contains(false);
+      CollaborationRecords.update(CollaborationTables.USER, new QRecord().withValue("id", eve.getValue("id")).withValue("active", false));
+      assertThat(new PeopleService().search("eve", 50)).isEmpty();
+      assertThatThrownBy(() -> new PeopleService().search("", 51)).hasMessageContaining("Limit");
+   }
+
+   /*******************************************************************************
+    ** Direct writes and parent read restrictions.
+    *******************************************************************************/
+   @Test
+   void directWritesAndParentReadRestrictions() throws Exception
+   {
+      CommentEntry row = comments.post("document", 1, "body", null, null);
+      for(String table : List.of(CollaborationTables.COMMENT, CollaborationTables.COMMENT_REVISION, CollaborationTables.MENTION, CollaborationTables.FOLLOW, CollaborationTables.ACTIVITY))
+      {
+         assertThatThrownBy(() -> new InsertAction().execute(new InsertInput(table).withRecords(List.of(new QRecord())))).isInstanceOf(QPermissionDeniedException.class);
+         assertThatThrownBy(() -> new UpdateAction().execute(new UpdateInput(table).withRecords(List.of(new QRecord().withValue("id", 1))))).isInstanceOf(QPermissionDeniedException.class);
+         assertThatThrownBy(() -> new DeleteAction().execute(new DeleteInput(table).withPrimaryKeys(List.of(1)))).isInstanceOf(QPermissionDeniedException.class);
+      }
+      login("viewer", CollaborationPermissions.VIEW);
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.COMMENT)).getRecords()).hasSize(1);
+      QContext.getQSession().getSecurityKeyValues().clear();
+      QContext.getQSession().withSecurityKeyValue("tenant", "b");
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.COMMENT)).getRecords()).isEmpty();
+      assertThat(new GetAction().execute(new GetInput(CollaborationTables.COMMENT).withPrimaryKey(row.id())).getRecord()).isNull();
+      assertThatThrownBy(() -> new QueryAction().execute(new QueryInput(CollaborationTables.FOLLOW))).isInstanceOf(QPermissionDeniedException.class);
+      QContext.getQSession().getPermissions().remove("document.read");
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.COMMENT)).getRecords()).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Batcher sends one window skips actor and rechecks access.
+    *******************************************************************************/
+   @Test
+   void batcherSendsOneWindowSkipsActorAndRechecksAccess() throws Exception
+   {
+      follows.follow("document", 1, true, true);
+      follows.ensureFollower("bob", "document", 1, "ASSIGNED");
+      Instant at = Instant.parse("2026-01-01T00:00:00Z");
+      FollowChangeBatcher batcher = new FollowChangeBatcher(Clock.fixed(at, ZoneOffset.UTC));
+      batcher.recordChange("document", "1", "alice", Set.of("title"));
+      batcher.recordChange("document", "1", "alice", Set.of("tenant"));
+      assertThat(CollaborationRecords.query(CollaborationTables.FOLLOW_DIGEST, new QQueryFilter())).hasSize(1);
+      admin();
+      new FollowChangeBatcher(Clock.fixed(at.plusSeconds(299), ZoneOffset.UTC)).sendDue();
+      assertThat(recorder.notifications()).isEmpty();
+      new FollowChangeBatcher(Clock.fixed(at.plusSeconds(300), ZoneOffset.UTC)).sendDue();
+      assertThat(recorder.notifications()).singleElement().satisfies(n ->
+      {
+         assertThat(n.recipientUserId()).isEqualTo("bob");
+         assertThat(n.body()).contains("title", "tenant");
+      });
+      new FollowChangeBatcher(Clock.fixed(at.plusSeconds(301), ZoneOffset.UTC)).sendDue();
+      assertThat(recorder.notifications()).hasSize(1);
+      batcher.recordChange("document", "1", "alice", Set.of("title"));
+      sessions.put("bob", session("bob", "b"));
+      new FollowChangeBatcher(Clock.fixed(at.plusSeconds(600), ZoneOffset.UTC)).sendDue();
+      assertThat(recorder.notifications()).hasSize(1);
+      assertThat(CollaborationRecords.query(CollaborationTables.FOLLOW_DIGEST, new QQueryFilter())).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Released listener defers until commit.
+    *******************************************************************************/
+   @Test
+   void releasedListenerDefersUntilCommit() throws Exception
+   {
+      config.withFollowChangeTables(List.of("document"));
+      instance.withRecordChangeListener(new QCodeReference(FollowChangeBatcher.class));
+      follows.ensureFollower("bob", "document", 1, "ASSIGNED");
+      QBackendTransaction tx = new QBackendTransaction();
+      new UpdateAction().execute(new UpdateInput("document").withTransaction(tx).withRecords(List.of(new QRecord().withValue("id", 1).withValue("title", "Updated"))));
+      assertThat(CollaborationRecords.query(CollaborationTables.FOLLOW_DIGEST, new QQueryFilter())).isEmpty();
+      tx.commit();
+      assertThat(CollaborationRecords.query(CollaborationTables.FOLLOW_DIGEST, new QQueryFilter())).hasSize(1);
+      assertThat(new FollowChangeBatcher().appliesTo("document", RecordChangeType.DELETE)).isFalse();
+      assertThat(new FollowChangeBatcher().appliesTo("other", RecordChangeType.UPDATE)).isFalse();
+      assertThatThrownBy(() -> new SendFollowDigestsProcess().run(null, null)).isInstanceOf(QPermissionDeniedException.class);
+      admin();
+      new SendFollowDigestsProcess().run(null, null);
+   }
+
+   /*******************************************************************************
+    ** Bulk follow review and result.
+    *******************************************************************************/
+   @Test
+   @SuppressWarnings("unchecked")
+   void bulkFollowReviewAndResult() throws Exception
+   {
+      FollowProcesses.processesFor("document").forEach(instance::addProcess);
+      new QInstanceValidator().validate(instance);
+      for(String name : List.of("collaborationFollow_document", "collaborationUnfollow_document"))
+      {
+         RunProcessInput input = new RunProcessInput();
+         input.setProcessName(name);
+         input.setFrontendStepBehavior(RunProcessInput.FrontendStepBehavior.BREAK);
+         input.addValue(StreamedETLWithFrontendProcess.FIELD_SOURCE_TABLE, "document");
+         input.addValue(StreamedETLWithFrontendProcess.FIELD_DESTINATION_TABLE, "document");
+         input.addValue(StreamedETLWithFrontendProcess.FIELD_DO_FULL_VALIDATION, true);
+         input.addValue("recordsParam", "recordIds");
+         input.addValue("recordIds", "1,2");
+         RunProcessOutput review = new RunProcessAction().execute(input);
+         assertThat(review.getException()).isEmpty();
+         List<ProcessSummaryLine> lines = (List<ProcessSummaryLine>) review.getValues().get(StreamedETLWithFrontendProcess.FIELD_VALIDATION_SUMMARY);
+         assertThat(lines).anySatisfy(line -> assertThat(line.getCount()).isEqualTo(2));
+         RunProcessInput go = new RunProcessInput();
+         go.setProcessName(name);
+         go.setProcessUUID(review.getProcessUUID());
+         go.setStartAfterStep(StreamedETLWithFrontendProcess.STEP_NAME_REVIEW);
+         go.setFrontendStepBehavior(RunProcessInput.FrontendStepBehavior.SKIP);
+         RunProcessOutput result = new RunProcessAction().execute(go);
+         assertThat((List<ProcessSummaryLine>) result.getValues().get(StreamedETLWithFrontendProcess.FIELD_PROCESS_SUMMARY)).anySatisfy(line -> assertThat(line.getCount()).isEqualTo(2));
+         assertThat(follows.state("document", 1).isPresent()).isEqualTo(name.contains("Follow_"));
+      }
+   }
+
+   /*******************************************************************************
+    ** Metadata schema and real home counts.
+    *******************************************************************************/
+   @Test
+   void metadataSchemaAndRealHomeCounts() throws Exception
+   {
+      var installed = new com.kingsrook.qqq.backend.core.model.metadata.QInstance()
+         .withInstanceDefaultAuthentication(new com.kingsrook.qqq.backend.core.model.metadata.authentication.QAuthenticationMetaData().withName("anonymous").withType(com.kingsrook.qqq.backend.core.model.metadata.QAuthenticationType.FULLY_ANONYMOUS));
+      installed.addBackend(instance.getBackend("memory"));
+      installed.addTable(instance.getTable("document").clone());
+      installed.addSecurityKeyType(instance.getSecurityKeyType("tenant"));
+      installed.addScheduler(new com.kingsrook.qqq.backend.core.model.metadata.scheduleing.simple.SimpleSchedulerMetaData().withName("minute"));
+      CollaborationQBitConfig configured = new CollaborationQBitConfig().withBackendName("memory").withFollowActionTables(List.of("document"))
+         .withFollowChangeTables(List.of("document")).withTagActionTables(List.of("document")).withSchedulerName("minute");
+      new CollaborationQBitProducer().withQBitConfig(configured).produce(installed);
+      assertThat(installed.getProcess("collaborationFollow_document").getLabel()).isEqualTo("Follow");
+      assertThat(installed.getProcess("collaborationUnfollow_document").getLabel()).isEqualTo("Unfollow");
+      assertThat(installed.getRecordChangeListeners()).hasSize(2);
+      assertThat(installed.getProcess("collaborationAddTags_document").getLabel()).isEqualTo("Add tags");
+      assertThat(installed.getProcess("collaborationRemoveTags_document").getLabel()).isEqualTo("Remove tags");
+      assertThat(installed.getProcess(SendFollowDigestsProcess.NAME).getSchedule().getRepeatSeconds()).isEqualTo(60);
+      assertThat(installed.getProcess(SendFollowDigestsProcess.NAME).getIsHidden()).isTrue();
+      String sql = CollaborationSchema.postgresScript(config);
+      for(String table : List.of(CollaborationTables.COMMENT, CollaborationTables.COMMENT_REVISION, CollaborationTables.MENTION,
+         CollaborationTables.FOLLOW, CollaborationTables.ACTIVITY, CollaborationTables.FOLLOW_DIGEST))
+      {
+         assertThat(sql).contains("CREATE TABLE IF NOT EXISTS " + table);
+      }
+      assertThat(sql).contains("ON collaboration_comment (table_name, record_id, create_date)", "ON collaboration_follow_digest (due_at)");
+      comments.post("document", 1, "home", null, null);
+      admin();
+      String html = com.kingsrook.qbits.collaboration.app.CollaborationHome.render(Instant.now().plusSeconds(1));
+      assertThat(html).contains("Comments this week</h3><p>1", "Open threads</h3><p>1", "Followers</h3><p>1");
+      assertThatThrownBy(() -> config.withFollowActionTables(List.of("missing")).validate(instance)).hasMessageContaining("host table");
+   }
+
+   /*******************************************************************************
+    ** Participant ranking precedes the search limit.
+    *******************************************************************************/
+   @Test
+   void participantRankingPrecedesTheSearchLimit() throws Exception
+   {
+      for(int i = 0; i < 55; i++)
+      {
+         CollaborationRecords.insert(CollaborationTables.USER, new QRecord().withValue("userId", "directory" + i)
+            .withValue("displayName", "A Person " + i).withValue("active", true));
+      }
+      login("bob");
+      QContext.getQSession().getUser().setFullName("Z Bob");
+      follows.follow("document", 1, null, null);
+      login("alice");
+      assertThat(comments.mentionCandidates("document", 1, "")).hasSize(50).first().satisfies(candidate -> assertThat(candidate.person().userId()).isEqualTo("bob"));
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/FavoritesServiceTest.java

@@ -0,0 +1,347 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.collaboration.favorites.FavoriteEntry;
+import com.kingsrook.qbits.collaboration.favorites.FavoritesService;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizerInterface;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizers;
+import com.kingsrook.qqq.backend.core.actions.tables.CountAction;
+import com.kingsrook.qqq.backend.core.actions.tables.GetAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrGetInputInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QAppMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.reporting.QReportMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+
+/*******************************************************************************
+ ** Behavioral and security acceptance for favorites, including label batching.
+ *******************************************************************************/
+class FavoritesServiceTest extends PersonalServiceFixture
+{
+   /*******************************************************************************
+    ** Both record and null-record-id targets are idempotent and append in order.
+    *******************************************************************************/
+   @Test
+   void starAndUnstarAreIdempotent() throws Exception
+   {
+      FavoritesService.star("RECORD", "document", "1");
+      FavoritesService.star("RECORD", "document", "1");
+      FavoritesService.star("TABLE", "document", null);
+      FavoritesService.star("TABLE", "document", null);
+      assertThat(FavoritesService.list()).extracting(FavoriteEntry::label).containsExactly("First document", "Documents");
+      assertThat(FavoritesService.list()).extracting(FavoriteEntry::sortOrder).containsExactly(0, 1);
+      assertThat(FavoritesService.list()).extracting(FavoriteEntry::href).containsExactly("/app/document/1/", "/app/document/");
+      FavoritesService.unstar("RECORD", "document", "1");
+      FavoritesService.unstar("RECORD", "document", "1");
+      FavoritesService.unstar("TABLE", "document", null);
+      FavoritesService.unstar("TABLE", "document", null);
+      assertThat(FavoritesService.list()).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** Missing, locked and table-denied records expose exactly the same error.
+    *******************************************************************************/
+   @Test
+   void invisibleAndMissingAreIndistinguishable() throws Exception
+   {
+      for(String id : List.of("3", "999"))
+      {
+         assertThatThrownBy(() -> FavoritesService.star("RECORD", "document", id)).isInstanceOf(QException.class).hasMessage("Not found");
+      }
+      assertThatThrownBy(() -> FavoritesService.star("TABLE", "missing", null)).hasMessage("Not found");
+      instance.setEnforcePermissionsInCoreActions(false);
+      QContext.getQSession().getPermissions().remove("document.read");
+      assertThatThrownBy(() -> FavoritesService.star("RECORD", "document", "1")).hasMessage("Not found");
+      assertThatThrownBy(() -> FavoritesService.star("TABLE", "document", null)).hasMessage("Not found");
+      assertThat(FavoritesService.list()).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** Refresh uses one query, no gets; lock changes redact both label and href.
+    *******************************************************************************/
+   @Test
+   void refreshesLabelsInOneQueryAndRedactsRevokedRecords() throws Exception
+   {
+      FavoritesService.star("RECORD", "document", "1");
+      FavoritesService.star("RECORD", "document", "2");
+      new UpdateAction().execute(new UpdateInput("document").withRecords(List.of(new QRecord().withValue("id", 1).withValue("title", "Renamed"))));
+      ReadCounter.queries = 0;
+      ReadCounter.gets = 0;
+      instance.getTable("document").withCustomizer(TableCustomizers.POST_QUERY_RECORD, new QCodeReference(ReadCounter.class));
+      assertThat(FavoritesService.list()).extracting(FavoriteEntry::label).containsExactly("Renamed", "Second document");
+      assertThat(ReadCounter.queries).isEqualTo(1);
+      assertThat(ReadCounter.gets).isZero();
+      QContext.getQSession().getSecurityKeyValues().put("tenant", List.of("b"));
+      assertThat(FavoritesService.list()).allSatisfy(entry ->
+      {
+         assertThat(entry.available()).isFalse();
+         assertThat(entry.label()).isEqualTo("Unavailable");
+         assertThat(entry.href()).isNull();
+      });
+      FavoritesService.unstar("RECORD", "document", "1");
+      assertThat(FavoritesService.list()).hasSize(1);
+   }
+
+
+
+   /*******************************************************************************
+    ** Direct table reads/writes initialize keys and enforce both sides of a lock.
+    *******************************************************************************/
+   @Test
+   void ownershipAndAdminAccess() throws Exception
+   {
+      FavoritesService.star("TABLE", "document", null);
+      Integer aliceId = FavoritesService.list().getFirst().id();
+      login("bob");
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.FAVORITE)).getRecords()).isEmpty();
+      assertThat(new GetAction().execute(new GetInput(CollaborationTables.FAVORITE).withPrimaryKey(aliceId)).getRecord()).isNull();
+      assertThat(new CountAction().execute(new CountInput(CollaborationTables.FAVORITE)).getCount()).isZero();
+      FavoritesService.star("TABLE", "document", null);
+      QRecord spoof = new QRecord().withValue("userId", "alice").withValue("targetType", "TABLE").withValue("targetName", "other").withValue("sortOrder", 0);
+      assertThat(new InsertAction().execute(new InsertInput(CollaborationTables.FAVORITE).withRecords(List.of(spoof))).getRecords().getFirst().getErrors()).isNotEmpty();
+      Integer bobId = FavoritesService.list().getFirst().id();
+      assertThat(new UpdateAction().execute(new UpdateInput(CollaborationTables.FAVORITE).withRecords(List.of(new QRecord().withValue("id", bobId).withValue("userId", "alice"))))
+         .getRecords().getFirst().getErrors()).isNotEmpty();
+      admin();
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.FAVORITE)).getRecords()).hasSize(2);
+      assertThat(FavoritesService.list()).isEmpty();
+      QContext.getQSession().getPermissions().remove(CollaborationPermissions.ADMIN);
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.FAVORITE)).getRecords()).isEmpty();
+      assertThat(QContext.getQSession().getSecurityKeyValues()).doesNotContainKey(CollaborationSecurity.KEY_USER_ALL_ACCESS);
+   }
+
+
+
+   /*******************************************************************************
+    ** Reordering validates all ownership before writing and can clear a folder.
+    *******************************************************************************/
+   @Test
+   void reorderAndFolders() throws Exception
+   {
+      FavoritesService.star("RECORD", "document", "1");
+      FavoritesService.star("RECORD", "document", "2");
+      List<Integer> ids = FavoritesService.list().stream().map(FavoriteEntry::id).toList();
+      FavoritesService.reorder(List.of(ids.get(1)), Map.of(ids.get(1), "Work"));
+      assertThat(FavoritesService.list()).extracting(FavoriteEntry::id).containsExactly(ids.get(1), ids.get(0));
+      assertThat(FavoritesService.list().getFirst().folder()).isEqualTo("Work");
+      Map<Integer, String> clear = new HashMap<>();
+      clear.put(ids.get(1), null);
+      FavoritesService.reorder(List.of(), clear);
+      assertThat(FavoritesService.list().getFirst().folder()).isNull();
+      assertThatThrownBy(() -> FavoritesService.reorder(List.of(ids.get(0), ids.get(0)), Map.of())).hasMessage("Invalid favorite ids");
+      assertThatThrownBy(() -> FavoritesService.reorder(List.of(), Map.of(ids.get(0), "x".repeat(256)))).hasMessage("Folder is too long");
+      login("bob");
+      assertThatThrownBy(() -> FavoritesService.reorder(ids, Map.of())).hasMessage("Invalid favorite ids");
+      assertThatThrownBy(() -> FavoritesService.reorder(List.of(), Map.of(ids.get(0), "stolen"))).hasMessage("Invalid favorite ids");
+   }
+
+
+
+   /*******************************************************************************
+    ** All metadata types use their core permissions, refresh labels and redact.
+    *******************************************************************************/
+   @Test
+   void metadataTargetsAndRevocation() throws Exception
+   {
+      QPermissionRules rules = new QPermissionRules().withLevel(PermissionLevel.HAS_ACCESS_PERMISSION).withPermissionBaseName("targets");
+      instance.addApp(new QAppMetaData().withName("work").withLabel("Work").withPermissionRules(rules));
+      instance.addProcess(new QProcessMetaData().withName("document.export").withLabel("Export").withPermissionRules(rules));
+      instance.addReport(new QReportMetaData().withName("report").withLabel("Report").withPermissionRules(rules));
+      for(String type : List.of("APP", "PROCESS", "REPORT"))
+      {
+         String name = type.equals("APP") ? "work" : type.equals("PROCESS") ? "document.export" : "report";
+         assertThatThrownBy(() -> FavoritesService.star(type, name, null)).hasMessage("Not found");
+         assertThatThrownBy(() -> FavoritesService.star(type, "missing", null)).hasMessage("Not found");
+      }
+      QContext.getQSession().withPermissions("targets.hasAccess");
+      FavoritesService.star("APP", "work", null);
+      FavoritesService.star("PROCESS", "document.export", null);
+      FavoritesService.star("REPORT", "report", null);
+      FavoritesService.star("TABLE", "document", null);
+      assertThat(FavoritesService.list()).extracting(FavoriteEntry::label).containsExactly("Work", "Export", "Report", "Documents");
+      assertThat(FavoritesService.list().get(1).href()).isEqualTo("/app/document.export/");
+      instance.getApp("work").setLabel("Renamed app");
+      assertThat(FavoritesService.list().getFirst().label()).isEqualTo("Renamed app");
+      QContext.getQSession().getPermissions().clear();
+      assertThat(FavoritesService.list()).allSatisfy(entry -> assertThat(entry.label()).isEqualTo("Unavailable"));
+   }
+
+
+
+   /*******************************************************************************
+    ** Saved views are conditional on the core table and respect its row locks.
+    *******************************************************************************/
+   @Test
+   void savedViews() throws Exception
+   {
+      assertThatThrownBy(() -> FavoritesService.star("SAVED_VIEW", "7", null)).hasMessage("Not found");
+      instance.addTable(new QTableMetaData().withName("savedView").withBackendName("memory").withPrimaryKeyField("id")
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.NOT_PROTECTED))
+         .withField(new QFieldMetaData("id", QFieldType.INTEGER)).withField(new QFieldMetaData("label", QFieldType.STRING))
+         .withField(new QFieldMetaData("tableName", QFieldType.STRING)).withField(new QFieldMetaData("userId", QFieldType.STRING))
+         .withRecordLabelFormatAndFields("%s", "label").withRecordSecurityLock(CollaborationSecurity.ownerLock("userId")));
+      CollaborationSecurity.ensureSessionKeys(instance, QContext.getQSession());
+      new InsertAction().execute(new InsertInput("savedView").withRecords(List.of(new QRecord().withValue("id", 7).withValue("label", "My view")
+         .withValue("tableName", "document").withValue("userId", "alice"))));
+      FavoritesService.star("SAVED_VIEW", "7", null);
+      assertThat(FavoritesService.list().getFirst().label()).isEqualTo("My view");
+      assertThat(FavoritesService.list().getFirst().href()).isEqualTo("/app/document/savedView/7/");
+      login("bob");
+      assertThatThrownBy(() -> FavoritesService.star("SAVED_VIEW", "7", null)).hasMessage("Not found");
+      login("alice");
+      QContext.getQSession().getPermissions().remove("document.read");
+      assertThat(FavoritesService.list().getFirst().label()).isEqualTo("Unavailable");
+   }
+
+
+
+   /*******************************************************************************
+    ** Integer aliases refer to one target; arbitrary string keys are URL-encoded.
+    *******************************************************************************/
+   @Test
+   void canonicalRecordIdsAndEncodedPaths() throws Exception
+   {
+      FavoritesService.star("RECORD", "document", "01");
+      FavoritesService.star("RECORD", "document", 1);
+      assertThat(FavoritesService.list()).extracting(FavoriteEntry::recordId).containsExactly("1");
+      assertThat(FavoritesService.list().getFirst().available()).isTrue();
+      FavoritesService.unstar("RECORD", "document", "001");
+      assertThat(FavoritesService.list()).isEmpty();
+      assertThatThrownBy(() -> FavoritesService.star("RECORD", "document", "invalid")).hasMessage("Not found");
+      instance.addTable(new QTableMetaData().withName("named").withLabel("Named").withBackendName("memory").withPrimaryKeyField("id")
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.NOT_PROTECTED))
+         .withField(new QFieldMetaData("id", QFieldType.STRING)).withRecordLabelFormatAndFields("%s", "id"));
+      new InsertAction().execute(new InsertInput("named").withRecords(List.of(new QRecord().withValue("id", "a/b #?"))));
+      FavoritesService.star("RECORD", "named", "a/b #?");
+      assertThat(FavoritesService.list().getFirst().href()).isEqualTo("/app/named/a%2Fb%20%23%3F/");
+   }
+
+
+
+   /*******************************************************************************
+    ** Deletion has the same unavailable presentation as losing access.
+    *******************************************************************************/
+   @Test
+   void deletedTargetsAndCrossUserWrites() throws Exception
+   {
+      FavoritesService.star("RECORD", "document", "1");
+      FavoritesService.star("TABLE", "document", null);
+      Integer favoriteId = FavoritesService.list().getFirst().id();
+      login("bob");
+      assertThat(new UpdateAction().execute(new UpdateInput(CollaborationTables.FAVORITE)
+         .withRecords(List.of(new QRecord().withValue("id", favoriteId).withValue("folder", "stolen"))))
+         .getRecords().getFirst().getErrors()).isNotEmpty();
+      assertThat(new com.kingsrook.qqq.backend.core.actions.tables.DeleteAction().execute(
+         new com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput(CollaborationTables.FAVORITE).withPrimaryKeys(List.of(favoriteId))).getDeletedRecordCount()).isZero();
+      admin();
+      assertThatThrownBy(() -> FavoritesService.star("RECORD", "document", "3")).hasMessage("Not found");
+      login("alice");
+      PersonalRecords.delete("document", List.of(1));
+      assertThat(FavoritesService.list().getFirst().label()).isEqualTo("Unavailable");
+      instance.getTables().remove("document");
+      assertThat(FavoritesService.list()).allSatisfy(entry ->
+      {
+         assertThat(entry.available()).isFalse();
+         assertThat(entry.label()).isEqualTo("Unavailable");
+         assertThat(entry.href()).isNull();
+      });
+   }
+
+
+
+   /*******************************************************************************
+    ** Bad target shapes and anonymous callers fail before storing data.
+    *******************************************************************************/
+   @Test
+   void rejectsInvalidTargetsAndAnonymousSessions()
+   {
+      assertThatThrownBy(() -> FavoritesService.star("OTHER", "document", null)).hasMessage("Invalid target");
+      assertThatThrownBy(() -> FavoritesService.star("RECORD", "document", null)).hasMessage("Invalid target");
+      assertThatThrownBy(() -> FavoritesService.star("TABLE", "document", "1")).hasMessage("Invalid target");
+      assertThatThrownBy(() -> FavoritesService.star("TABLE", " ", null)).hasMessage("Invalid target");
+      QContext.init(instance, new QSession());
+      assertThatThrownBy(() -> FavoritesService.list()).hasMessageContaining("Sign in");
+      assertThatThrownBy(() -> new QueryAction().execute(new QueryInput(CollaborationTables.FAVORITE))).hasMessageContaining("Sign in");
+   }
+
+
+
+   /*******************************************************************************
+    ** Count actual core reads rather than assuming an implementation batches.
+    *******************************************************************************/
+   public static class ReadCounter implements TableCustomizerInterface
+   {
+      static int queries;
+      static int gets;
+
+
+
+      /*******************************************************************************
+       ** Core calls this for both get and query, after enforcing record locks.
+       *******************************************************************************/
+      @Override
+      public List<QRecord> postQuery(QueryOrGetInputInterface input, List<QRecord> rows)
+      {
+         if(input instanceof QueryInput)
+         {
+            queries++;
+         }
+         else
+         {
+            gets++;
+         }
+         return (rows);
+      }
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/PersonalServiceFixture.java

@@ -0,0 +1,124 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.QAuthenticationType;
+import com.kingsrook.qqq.backend.core.model.metadata.QBackendMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.authentication.QAuthenticationMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.security.QSecurityKeyType;
+import com.kingsrook.qqq.backend.core.model.metadata.security.RecordSecurityLock;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QUser;
+import com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryBackendModule;
+import com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryRecordStore;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import static org.assertj.core.api.Assertions.assertThat;
+
+
+/*******************************************************************************
+ ** Memory-backed personal services with a real, independently locked host table.
+ *******************************************************************************/
+public abstract class PersonalServiceFixture
+{
+   protected QInstance instance;
+   protected CollaborationQBitConfig config;
+
+
+
+   /*******************************************************************************
+    ** Every test starts with two visible records and one invisible record.
+    *******************************************************************************/
+   @BeforeEach
+   public void setUp() throws Exception
+   {
+      MemoryRecordStore.getInstance().reset();
+      instance = new QInstance().withInstanceDefaultAuthentication(new QAuthenticationMetaData().withName("anonymous").withType(QAuthenticationType.FULLY_ANONYMOUS));
+      instance.addBackend(new QBackendMetaData().withName("memory").withBackendType(MemoryBackendModule.class));
+      instance.setEnforcePermissionsInCoreActions(true);
+      config = new CollaborationQBitConfig().withBackendName("memory");
+      new CollaborationQBitProducer().withQBitConfig(config).produce(instance);
+      instance.addSecurityKeyType(new QSecurityKeyType().withName("tenant").withAllAccessKeyName("allTenants"));
+      instance.addTable(new QTableMetaData().withName("document").withLabel("Documents").withBackendName("memory").withPrimaryKeyField("id")
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.READ_WRITE_PERMISSIONS))
+         .withField(new QFieldMetaData("id", QFieldType.INTEGER))
+         .withField(new QFieldMetaData("title", QFieldType.STRING))
+         .withField(new QFieldMetaData("tenant", QFieldType.STRING))
+         .withRecordLabelFormatAndFields("%s", "title")
+         .withRecordSecurityLock(new RecordSecurityLock().withFieldName("tenant").withSecurityKeyType("tenant")
+            .withLockScope(RecordSecurityLock.LockScope.READ_AND_WRITE)));
+      login("alice");
+      QContext.getQSession().withSecurityKeyValue("allTenants", true);
+      InsertInput insert = new InsertInput("document").withRecords(List.of(
+         new QRecord().withValue("id", 1).withValue("title", "First document").withValue("tenant", "a"),
+         new QRecord().withValue("id", 2).withValue("title", "Second document").withValue("tenant", "a"),
+         new QRecord().withValue("id", 3).withValue("title", "Secret document").withValue("tenant", "b")));
+      assertThat(new InsertAction().execute(insert).getRecords()).allSatisfy(row -> assertThat(row.getErrors()).isNullOrEmpty());
+      login("alice");
+   }
+
+
+
+   /*******************************************************************************
+    ** No collaboration.view grant: personal services must still work.
+    *******************************************************************************/
+   protected void login(String id, String... extraPermissions)
+   {
+      QContext.init(instance, new QSession().withUser(new QUser().withIdReference(id)).withPermissions("document.read", "document.write")
+         .withPermissions(extraPermissions).withSecurityKeyValue("tenant", "a"));
+   }
+
+
+
+   /*******************************************************************************
+    ** Admin access is independent of ordinary host-table access.
+    *******************************************************************************/
+   protected void admin()
+   {
+      login("admin", CollaborationPermissions.ADMIN);
+   }
+
+
+
+   /*******************************************************************************
+    ** No static context or memory records survive a test.
+    *******************************************************************************/
+   @AfterEach
+   public void tearDown()
+   {
+      QContext.clear();
+      MemoryRecordStore.getInstance().reset();
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/SharingWorkTest.java

@@ -0,0 +1,626 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.io.Serializable;
+import java.time.Clock;
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.app.CollaborationHome;
+import com.kingsrook.qbits.collaboration.assignment.AssignmentService;
+import com.kingsrook.qbits.collaboration.comments.CommentsService;
+import com.kingsrook.qbits.collaboration.follow.FollowService;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.mywork.MyWorkService;
+import com.kingsrook.qbits.collaboration.notify.CollaborationNotification;
+import com.kingsrook.qbits.collaboration.notify.CollaborationNotifier;
+import com.kingsrook.qbits.collaboration.notify.RecordingNotifier;
+import com.kingsrook.qbits.collaboration.security.UserSessionSupplier;
+import com.kingsrook.qbits.collaboration.sharing.AccessRequestService;
+import com.kingsrook.qbits.collaboration.sharing.PermissionHolderDirectory;
+import com.kingsrook.qbits.collaboration.sharing.SharingService;
+import com.kingsrook.qbits.collaboration.tasks.SendTaskRemindersProcess;
+import com.kingsrook.qbits.collaboration.tasks.TaskReminders;
+import com.kingsrook.qbits.collaboration.tasks.TasksService;
+import com.kingsrook.qqq.backend.core.actions.QBackendTransaction;
+import com.kingsrook.qqq.backend.core.actions.processes.RunProcessAction;
+import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
+import com.kingsrook.qqq.backend.core.actions.tables.GetAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.instances.QInstanceValidator;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLine;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessOutput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.audits.AuditLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.DenyBehavior;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QUser;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.StreamedETLWithFrontendProcess;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/*******************************************************************************
+ ** Service and streamed-process acceptance with real parent locks and notifications.
+ *******************************************************************************/
+public class SharingWorkTest extends PersonalServiceFixture
+{
+   private static RecordingNotifier recorder;
+   private static final Map<String, QSession> sessions = new HashMap<>();
+   private static final Instant NOW = Instant.parse("2026-10-13T12:00:00Z");
+   private static final Clock CLOCK = Clock.fixed(NOW, ZoneOffset.UTC);
+   private final SharingService sharing = new SharingService();
+   private final AccessRequestService access = new AccessRequestService();
+   private final TasksService tasks = new TasksService(CLOCK);
+   private final AssignmentService assignments = new AssignmentService();
+
+   /*******************************************************************************
+    ** Configure.
+    *******************************************************************************/
+   @BeforeEach
+   void configure() throws Exception
+   {
+      recorder = new RecordingNotifier();
+      sessions.clear();
+      sessions.put("alice", session("alice", "a"));
+      sessions.put("bob", session("bob", "a"));
+      sessions.put("eve", session("eve", "b"));
+      config.withNotifier(new QCodeReference(TestNotifier.class)).withUserSessionSupplier(new QCodeReference(TestSessions.class));
+      QContext.getQSession().getUser().setFullName("Alice");
+      CollaborationRecords.insert(CollaborationTables.USER, new QRecord().withValue("userId", "eve").withValue("displayName", "Sam"));
+      WorkProcesses.assignments("document").forEach(instance::addProcess);
+      new QInstanceValidator().validate(instance);
+   }
+
+   /*******************************************************************************
+    ** Test Notifier.
+    *******************************************************************************/
+   public static class TestNotifier implements CollaborationNotifier
+   {
+      /*******************************************************************************
+       ** Use the configured test boundary.
+       *******************************************************************************/
+      @Override
+      public void notify(CollaborationNotification notification)
+      {
+         recorder.notify(notification);
+      }
+   }
+
+   /*******************************************************************************
+    ** Test Sessions.
+    *******************************************************************************/
+   public static class TestSessions implements UserSessionSupplier
+   {
+      /*******************************************************************************
+       ** Use the configured test boundary.
+       *******************************************************************************/
+      @Override
+      public Optional<QSession> sessionFor(String user)
+      {
+         return (Optional.ofNullable(sessions.get(user)));
+      }
+   }
+
+   /*******************************************************************************
+    ** Directory.
+    *******************************************************************************/
+   public static class Directory implements PermissionHolderDirectory
+   {
+      /*******************************************************************************
+       ** Use the configured test boundary.
+       *******************************************************************************/
+      @Override
+      public Set<String> userIdsWithPermission(String permission)
+      {
+         return (permission.equals("collaboration.admin") ? Set.of("admin") : Set.of("approver", "admin"));
+      }
+   }
+
+   /*******************************************************************************
+    ** Session.
+    *******************************************************************************/
+   private static QSession session(String user, String tenant)
+   {
+      return (new QSession().withUser(new QUser().withIdReference(user)).withPermissions("document.read", "document.task").withSecurityKeyValue("tenant", tenant));
+   }
+
+   /*******************************************************************************
+    ** Links Preview And Recipient Safe Shares.
+    *******************************************************************************/
+   @Test
+   void linksPreviewAndRecipientSafeShares() throws Exception
+   {
+      assertThat(sharing.link("document", "01")).isEqualTo(new SharingService.Link("/app/document/1", "First document"));
+      config.withFrontendBaseUrl("https://example.test/");
+      assertThat(sharing.link("document", 1).url()).isEqualTo("https://example.test/app/document/1");
+      assertThat(TargetResolver.recordHref("a b", "a/b?#")).isEqualTo("https://example.test/app/a%20b/a%2Fb%3F%23");
+      assertThat(sharing.preview("document", 1, List.of("bob", "eve", "missing")))
+         .containsExactly(new SharingService.Recipient("bob", "bob", true), new SharingService.Recipient("eve", "Sam", false), new SharingService.Recipient("missing", "missing", null));
+      List<QRecord> shares = sharing.share("document", 1, List.of("bob", "eve", "missing"), "First document confidential contents");
+      assertThat(shares).hasSize(3);
+      assertThat(recorder.notifications()).hasSize(3);
+      assertThat(recorder.notifications().getFirst().title()).contains("Alice shared First document with you");
+      for(CollaborationNotification notification : recorder.notifications().subList(1, 3))
+      {
+         assertThat(notification.title() + notification.body()).doesNotContain("First document", "confidential contents");
+         assertThat(notification.title()).contains("Documents");
+         assertThat(notification.link()).startsWith("/app/collaboration_access_request/create?tableName=document&recordId=1&shareId=");
+         assertThat(notification.sourceTableName()).isNull();
+      }
+      assertThat(new FollowService().followers("document", 1)).singleElement().satisfies(row ->
+      {
+         assertThat(row.userId()).isEqualTo("bob");
+         assertThat(row.reason()).isEqualTo("SHARED");
+      });
+      assertThat(rows(CollaborationTables.ACTIVITY).stream().filter(row -> "SHARED".equals(row.getValueString("type")))).hasSize(3);
+      assertThatThrownBy(() -> sharing.markOpened(shares.getFirst().getValueInteger("id"))).hasMessage("Not found");
+      login("bob");
+      sharing.markOpened(shares.getFirst().getValueInteger("id"));
+      Instant opened = rows(CollaborationTables.SHARE).getFirst().getValueInstant("openedAt");
+      sharing.markOpened(shares.getFirst().getValueInteger("id"));
+      assertThat(rows(CollaborationTables.SHARE).getFirst().getValueInstant("openedAt")).isEqualTo(opened);
+   }
+
+   /*******************************************************************************
+    ** Sharing Validation And After Commit Checks.
+    *******************************************************************************/
+   @Test
+   void sharingValidationAndAfterCommitChecks() throws Exception
+   {
+      assertThatThrownBy(() -> sharing.preview("document", 1, List.of())).hasMessageContaining("1 to 25");
+      assertThatThrownBy(() -> sharing.preview("document", 1, java.util.Collections.nCopies(26, "bob"))).hasMessageContaining("1 to 25");
+      assertThatThrownBy(() -> sharing.share("document", 1, List.of("bob"), "x".repeat(2001))).hasMessageContaining("2000");
+      assertThatThrownBy(() -> sharing.link("document", 3)).hasMessage("Not found");
+      QBackendTransaction tx = new QBackendTransaction();
+      QContext.setTransaction(tx);
+      sharing.share("document", 1, List.of("bob", "eve"), "First document");
+      assertThat(recorder.notifications()).isEmpty();
+      sessions.put("bob", session("bob", "b"));
+      tx.commit();
+      QContext.clearTransaction();
+      assertThat(recorder.notifications()).singleElement().satisfies(n -> assertThat(n.recipientUserId()).isEqualTo("eve"));
+      QContext.getQSession().setPermissions(Set.of("document.read"));
+      assertThatThrownBy(() -> sharing.preview("document", 1, List.of("bob"))).hasMessageContaining("share");
+      QContext.getQSession().setPermissions(Set.of("document.read", "document.share"));
+      assertThat(sharing.preview("document", 1, List.of("alice"))).singleElement().satisfies(r -> assertThat(r.canRead()).isTrue());
+   }
+
+   /*******************************************************************************
+    ** Requests Do Not Reveal Existence And Remain Owner Locked.
+    *******************************************************************************/
+   @Test
+   void requestsDoNotRevealExistenceAndRemainOwnerLocked() throws Exception
+   {
+      QContext.getQSession().setPermissions(Set.of());
+      QRecord existing = access.request("document", 3, "Please", null);
+      QRecord missing = access.request("document", 999, "Please", null);
+      assertThat(existing.getValues().keySet()).isEqualTo(missing.getValues().keySet());
+      for(String field : existing.getValues().keySet())
+      {
+         if(!List.of("id", "recordId", "createDate", "modifyDate").contains(field))
+         {
+            assertThat(existing.getValue(field)).isEqualTo(missing.getValue(field));
+         }
+      }
+      assertThat(existing.getValues()).doesNotContainKeys("label", "recordLabel", "title");
+      assertThat(access.request("document", "03", "Changed", null).getValue("id")).isEqualTo(existing.getValue("id"));
+      assertThat(visibleRequests()).hasSize(2);
+      assertThat(visibleRequests().getFirst().getDisplayValue("tableName")).isEqualTo("Documents");
+      login("bob");
+      assertThat(visibleRequests()).isEmpty();
+      assertThatThrownBy(() -> access.withdraw(existing.getValueInteger("id"))).hasMessage("Not found");
+      admin();
+      assertThat(visibleRequests()).hasSize(2);
+      login("alice");
+      access.withdraw(existing.getValueInteger("id"));
+      assertThatThrownBy(() -> access.withdraw(existing.getValueInteger("id"))).hasMessageContaining("no longer open");
+      assertThat(access.request("document", 3, null, null).getValue("id")).isNotEqualTo(existing.getValue("id"));
+      assertThatThrownBy(() -> new InsertAction().execute(new InsertInput(CollaborationTables.ACCESS_REQUEST).withRecords(List.of(new QRecord()))))
+         .hasMessageContaining("service actions");
+   }
+
+   /*******************************************************************************
+    ** Requests Resolve Directory And Owners And Record Outcomes.
+    *******************************************************************************/
+   @Test
+   void requestsResolveDirectoryAndOwnersAndRecordOutcomes() throws Exception
+   {
+      config.withPermissionHolderDirectory(new QCodeReference(Directory.class));
+      CollaborationRecords.insert(CollaborationTables.FEATURE_SETTING, new QRecord().withValue("scopeType", "TABLE").withValue("scopeName", "document")
+         .withValue("feature", "SHARING").withValue("enabled", true).withValue("settings", "{\"accessApproverPermission\":\"document.approve\"}"));
+      assignments.assign("document", 1, "bob", null);
+      QRecord request = access.request("document", 1, "First document", null);
+      assertThat(recorder.notifications()).extracting(CollaborationNotification::recipientUserId).containsExactlyInAnyOrder("admin", "approver", "bob");
+      assertThat(recorder.notifications()).allSatisfy(n -> assertThat(n.title() + n.body()).doesNotContain("First document"));
+      assertThatThrownBy(() -> access.handle(request.getValueInteger("id"), "GRANTED", null)).hasMessageContaining("approver permission");
+      login("approver", "document.approve");
+      assertThat(visibleRequests()).isEmpty();
+      access.handle(request.getValueInteger("id"), "GRANTED", "Changed in identity system");
+      assertThat(rows(CollaborationTables.ACCESS_REQUEST).getFirst().getValueString("status")).isEqualTo("GRANTED");
+      assertThat(recorder.notifications().getLast().recipientUserId()).isEqualTo("alice");
+      assertThat(recorder.notifications().getLast().body()).doesNotContain("Changed in identity system");
+      assertThat(QContext.getQSession().hasPermission("document.approve")).isTrue();
+   }
+
+   /*******************************************************************************
+    ** Share References Cannot Be Forged.
+    *******************************************************************************/
+   @Test
+   void shareReferencesCannotBeForged() throws Exception
+   {
+      Integer share = sharing.share("document", 1, List.of("eve"), "secret").getFirst().getValueInteger("id");
+      assertThatThrownBy(() -> access.request("document", 1, null, share)).hasMessage("Not found");
+      login("eve");
+      assertThatThrownBy(() -> access.request("document", 2, null, share)).hasMessage("Not found");
+      assertThat(access.request("document", 1, null, share).getValueInteger("shareId")).isEqualTo(share);
+      sharing.markOpened(share);
+   }
+
+   /*******************************************************************************
+    ** Tasks Refuse Unknown Assignees And Use Spec Reminder Defaults.
+    *******************************************************************************/
+   @Test
+   void tasksRefuseUnknownAssigneesAndUseSpecReminderDefaults() throws Exception
+   {
+      assertThatThrownBy(() -> tasks.create("document", 1, "Work", null, "eve", null, null)).hasMessage("Sam can't open this record.");
+      assertThatThrownBy(() -> tasks.create("document", 1, "Work", null, "missing", null, null)).hasMessageContaining("can't open");
+      assertThatThrownBy(() -> tasks.create("document", 1, "x".repeat(201), null, null, null, null)).hasMessageContaining("200");
+      QRecord future = tasks.create("document", 1, "Future", "Notes", "bob", NOW.plusSeconds(172800), null);
+      assertThat(future.getValueInstant("remindAt")).isEqualTo(NOW.plusSeconds(86400));
+      assertThat(recorder.notifications()).singleElement().satisfies(n -> assertThat(n.title()).contains("Future"));
+      assertThat(new FollowService().followers("document", 1)).singleElement().satisfies(f -> assertThat(f.reason()).isEqualTo("ASSIGNED"));
+      QRecord soon = tasks.create("document", 1, "Soon", null, null, NOW.plusSeconds(3600), null);
+      assertThat(soon.getValueInstant("remindAt")).isEqualTo(soon.getValueInstant("dueAt"));
+      assertThat(soon.getValueString("assigneeUserId")).isEqualTo("alice");
+      config.withUserSessionSupplier(null);
+      assertThat(tasks.create("document", 1, "Self", null, null, null, null).getValueInstant("remindAt")).isNull();
+   }
+
+   /*******************************************************************************
+    ** Task Transitions Updates And Mine Ordering.
+    *******************************************************************************/
+   @Test
+   void taskTransitionsUpdatesAndMineOrdering() throws Exception
+   {
+      QRecord undated = tasks.create("document", 1, "Undated", null, null, null, null);
+      QRecord later = tasks.create("document", 1, "Later", null, null, NOW.plusSeconds(200), null);
+      QRecord first = tasks.create("document", 2, "First", null, null, NOW.plusSeconds(100), null);
+      QRecord tie = tasks.create("document", 2, "Tie", null, null, NOW.plusSeconds(100), null);
+      TasksService.Page page = tasks.mine(null, 2, null);
+      assertThat(page.tasks()).extracting(r -> r.getValueString("title")).containsExactly("First", "Tie");
+      assertThat(tasks.mine("OPEN", 2, page.nextCursor()).tasks()).extracting(r -> r.getValueString("title")).containsExactly("Later", "Undated");
+      assertThatThrownBy(() -> tasks.mine(null, 0, null)).hasMessageContaining("Limit");
+      assertThatThrownBy(() -> tasks.mine(null, 20, "bad")).hasMessageContaining("cursor");
+      assertThatThrownBy(() -> tasks.mine("NOPE", 20, null)).hasMessageContaining("status");
+      tasks.complete(first.getValueInteger("id"));
+      tasks.complete(first.getValueInteger("id"));
+      assertThat(tasks.mine("DONE", 10, null).tasks()).singleElement().satisfies(r -> assertThat(r.getValueInstant("completedAt")).isEqualTo(NOW));
+      assertThat(rows(CollaborationTables.ACTIVITY).stream().filter(r -> "TASK_DONE".equals(r.getValueString("type")))).hasSize(1);
+      tasks.reopen(first.getValueInteger("id"));
+      assertThat(tasks.list("document", 2, false)).allSatisfy(r -> assertThat(r.getValueInstant("completedAt")).isNull());
+      tasks.cancel(tie.getValueInteger("id"));
+      assertThat(tasks.list("document", 2, false)).hasSize(1);
+      assertThat(tasks.list("document", 2, true)).hasSize(2);
+      tasks.update(later.getValueInteger("id"), "Updated", "notes", "bob", NOW, NOW.minusSeconds(10));
+      login("bob");
+      tasks.complete(later.getValueInteger("id"));
+      assertThatThrownBy(() -> tasks.complete(undated.getValueInteger("id"))).hasMessageContaining("creator, assignee");
+      admin();
+      tasks.complete(undated.getValueInteger("id"));
+   }
+
+   /*******************************************************************************
+    ** Reminders And Overdue Are Delivered Once With Fresh Access.
+    *******************************************************************************/
+   @Test
+   void remindersAndOverdueAreDeliveredOnceWithFreshAccess() throws Exception
+   {
+      QRecord task = tasks.create("document", 1, "Scheduled", null, "bob", NOW.plusSeconds(100), NOW);
+      recorder = new RecordingNotifier();
+      assertThatThrownBy(() -> new TaskReminders(CLOCK).sendDue()).hasMessageContaining("admin");
+      admin();
+      TaskReminders reminders = new TaskReminders(CLOCK);
+      reminders.sendDue();
+      reminders.sendDue();
+      assertThat(recorder.notifications()).hasSize(1);
+      assertThat(WorkSupport.row(CollaborationTables.TASK, task.getValueInteger("id")).getValueInstant("remindedAt")).isEqualTo(NOW);
+      new TaskReminders(Clock.fixed(NOW.plusSeconds(101), ZoneOffset.UTC)).sendDue();
+      new TaskReminders(Clock.fixed(NOW.plusSeconds(102), ZoneOffset.UTC)).sendDue();
+      assertThat(recorder.notifications()).hasSize(2);
+      assertThat(recorder.notifications().getLast().title()).contains("overdue");
+      tasks.update(task.getValueInteger("id"), "Changed", null, "bob", NOW.minusSeconds(1), NOW.minusSeconds(1));
+      sessions.put("bob", session("bob", "b"));
+      reminders.sendDue();
+      assertThat(recorder.notifications()).hasSize(2);
+      assertThat(WorkSupport.row(CollaborationTables.TASK, task.getValueInteger("id")).getValueInstant("remindedAt")).isNull();
+      sessions.put("bob", session("bob", "a"));
+      reminders.sendDue();
+      assertThat(recorder.notifications()).hasSize(4);
+      tasks.cancel(task.getValueInteger("id"));
+      reminders.sendDue();
+      assertThat(recorder.notifications()).hasSize(4);
+      QContext.setTransaction(new QBackendTransaction());
+      assertThatThrownBy(reminders::sendDue).hasMessageContaining("outside a transaction");
+      QContext.clearTransaction();
+      new TaskReminders().sendDue();
+      new SendTaskRemindersProcess().run(null, null);
+   }
+
+   /*******************************************************************************
+    ** Assignments Upsert And My Records Respect Parent Locks.
+    *******************************************************************************/
+   @Test
+   void assignmentsUpsertAndMyRecordsRespectParentLocks() throws Exception
+   {
+      assertThatThrownBy(() -> assignments.assign("document", 1, "eve", null)).hasMessageContaining("can't open");
+      QRecord first = assignments.assign("document", 1, "alice", "bob");
+      QRecord again = assignments.assign("document", "01", "alice", "bob");
+      assertThat(again.getValue("id")).isEqualTo(first.getValue("id"));
+      assertThat(recorder.notifications()).hasSize(1);
+      assignments.assign("document", 2, null, "alice");
+      assertThat(assignments.myRecords(null, 1).get("document").count()).isEqualTo(2);
+      assertThat(assignments.myRecords("document", 1).get("document").records()).hasSize(1);
+      assertThatThrownBy(() -> assignments.myRecords(null, 101)).hasMessageContaining("Limit");
+      assertThatThrownBy(() -> new QueryAction().execute(new QueryInput(CollaborationTables.RECORD_ASSIGNMENT))).hasMessageContaining("collaboration");
+      QContext.getQSession().getSecurityKeyValues().put("tenant", new ArrayList<>(List.of("b")));
+      assertThat(assignments.myRecords(null, 10)).isEmpty();
+      assertThat(instance.getTable(CollaborationTables.RECORD_ASSIGNMENT).getPermissionRules().getDenyBehavior()).isEqualTo(DenyBehavior.HIDDEN);
+   }
+
+   /*******************************************************************************
+    ** My Work Summarizes Only Visible Work And Read Mentions.
+    *******************************************************************************/
+   @Test
+   void myWorkSummarizesOnlyVisibleWorkAndReadMentions() throws Exception
+   {
+      for(int i = 0; i < 12; i++)
+      {
+         tasks.create("document", 1, "Task " + i, null, "bob", null, null);
+      }
+      assignments.assign("document", 1, "alice", "bob");
+      new CommentsService().post("document", 1, "@[Bob](user:bob)", null, null);
+      login("bob");
+      MyWorkService service = new MyWorkService();
+      MyWorkService.Summary summary = service.summary();
+      assertThat(summary.openTaskCount()).isEqualTo(12);
+      assertThat(summary.tasks()).hasSize(10);
+      assertThat(summary.assignedRecordsByTable()).containsEntry("document", 1L);
+      assertThat(summary.unreadMentionCount()).isEqualTo(1);
+      service.markMentionsRead(List.of(-1));
+      assertThat(service.summary().unreadMentionCount()).isEqualTo(1);
+      service.markMentionsRead(null);
+      assertThat(service.summary().unreadMentionCount()).isZero();
+      QContext.getQSession().getSecurityKeyValues().put("tenant", new ArrayList<>(List.of("b")));
+      assertThat(service.summary().openTaskCount()).isZero();
+      assertThat(service.summary().assignedRecordsByTable()).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Actual Streamed Actions Have Review And Result.
+    *******************************************************************************/
+   @Test
+   void actualStreamedActionsHaveReviewAndResult() throws Exception
+   {
+      login("alice", "collaboration.view");
+      QRecord task = tasks.create("document", 1, "Action", null, null, null, null);
+      RunProcessOutput review = review("collaborationDone_collaboration_task", task.getValueString("id"), Map.of());
+      assertThat(lines(review, false)).anySatisfy(line -> assertThat(line.getPluralFutureMessage()).contains("will be processed"));
+      assertThat(lines(finish(review), true)).anySatisfy(line -> assertThat(line.getPluralPastMessage()).contains("processed"));
+      assertThat(tasks.list("document", 1, false)).isEmpty();
+      finish(review("collaborationReopen_collaboration_task", task.getValueString("id"), Map.of()));
+      assertThat(tasks.list("document", 1, false)).hasSize(1);
+      finish(review("collaborationAssign_document", "1,2", Map.of("assigneeUserId", "bob")));
+      finish(review("collaborationOwn_document", "1,2", Map.of()));
+      assertThat(assignments.myRecords(null, 10).get("document").count()).isEqualTo(2);
+      assertThat(assignments.get("document", 1).orElseThrow().getValueString("assigneeUserId")).isEqualTo("bob");
+   }
+
+   /*******************************************************************************
+    ** Access Actions Work For Admin And Configured Approver.
+    *******************************************************************************/
+   @Test
+   void accessActionsWorkForAdminAndConfiguredApprover() throws Exception
+   {
+      QRecord granted = access.request("document", 999, null, null);
+      QRecord declined = access.request("document", 998, null, null);
+      admin();
+      RunProcessOutput grant = review("collaborationGrant_collaboration_access_request", granted.getValueString("id"), Map.of("note", "Identity system updated"));
+      assertThat(grant.getValues().get(StreamedETLWithFrontendProcess.FIELD_PREVIEW_MESSAGE)).isEqualTo("Record the outcome; grant access in your identity system first.");
+      finish(grant);
+      CollaborationRecords.insert(CollaborationTables.FEATURE_SETTING, new QRecord().withValue("scopeType", "TABLE").withValue("scopeName", "document")
+         .withValue("feature", "SHARING").withValue("enabled", true).withValue("settings", "{\"accessApproverPermission\":\"document.approve\"}"));
+      login("approver", "document.approve");
+      finish(review("collaborationDecline_collaboration_access_request", declined.getValueString("id"), Map.of()));
+      assertThat(rows(CollaborationTables.ACCESS_REQUEST)).extracting(r -> r.getValueString("status")).containsExactly("GRANTED", "DECLINED");
+      assertThat(recorder.notifications()).extracting(CollaborationNotification::title).contains("Access request granted", "Access request declined");
+   }
+
+   /*******************************************************************************
+    ** Cleanup Preserves Requests And Schema Includes Work Indexes.
+    *******************************************************************************/
+   @Test
+   void cleanupPreservesRequestsAndSchemaIncludesWorkIndexes() throws Exception
+   {
+      tasks.create("document", 1, "Deleted", null, null, null, null);
+      assignments.assign("document", 1, "alice", null);
+      sharing.share("document", 1, List.of("bob"), null);
+      access.request("document", 1, null, null);
+      new DeleteAction().execute(new DeleteInput("document").withPrimaryKeys(List.of(1)));
+      assertThat(rows(CollaborationTables.TASK)).isEmpty();
+      assertThat(rows(CollaborationTables.RECORD_ASSIGNMENT)).isEmpty();
+      assertThat(rows(CollaborationTables.SHARE)).isEmpty();
+      assertThat(rows(CollaborationTables.ACCESS_REQUEST)).hasSize(1);
+      new WorkCleanup().onParentsDeleted("document", List.of(1));
+      new WorkCleanup().onParentsDeleted("document", List.of());
+      String sql = CollaborationSchema.postgresScript(config);
+      assertThat(sql).contains("collaboration_share", "collaboration_access_request", "collaboration_task", "collaboration_record_assignment", "overdue_notified_at",
+         "read_at", "WHERE status = 'OPEN'", "assignee_user_id, status, due_at", "requester_user_id", "owner_user_id");
+      for(String table : List.of(CollaborationTables.SHARE, CollaborationTables.ACCESS_REQUEST, CollaborationTables.TASK, CollaborationTables.RECORD_ASSIGNMENT))
+      {
+         assertThat(instance.getTable(table).getAuditRules().getAuditLevel()).isEqualTo(AuditLevel.FIELD);
+      }
+      assertThat(instance.getTable(CollaborationTables.TASK).getSearchFields()).containsExactly("title");
+   }
+
+   /*******************************************************************************
+    ** Home Shows Real Counts.
+    *******************************************************************************/
+   @Test
+   void homeShowsRealCounts() throws Exception
+   {
+      tasks.create("document", 1, "Overdue", null, null, NOW.minusSeconds(60), null);
+      sharing.share("document", 1, List.of("bob"), null);
+      access.request("document", 999, null, null);
+      admin();
+      String html = CollaborationHome.render(Instant.now().plusSeconds(5));
+      assertThat(html).contains("Open access requests</h3><p>1", "Open tasks</h3><p>1", "Overdue tasks</h3><p>1", "Shares this week</h3><p>1");
+      assertThat(SendTaskRemindersProcess.metadata(config).getIsHidden()).isTrue();
+      assertThat(SendTaskRemindersProcess.metadata(config).getSchedule()).isNull();
+      assertThat(SendTaskRemindersProcess.metadata(config.withSchedulerName("clock")).getSchedule().getRepeatSeconds()).isEqualTo(60);
+   }
+
+   /*******************************************************************************
+    ** Undated Tasks And No Op Delivery Never Receive Receipts.
+    *******************************************************************************/
+   @Test
+   void undatedTasksAndNoOpDeliveryNeverReceiveReceipts() throws Exception
+   {
+      tasks.create("document", 1, "No deadline", null, "bob", null, null);
+      QRecord due = tasks.create("document", 2, "Due", null, "bob", NOW.minusSeconds(1), NOW);
+      recorder = new RecordingNotifier();
+      admin();
+      config.withNotifier(new QCodeReference(com.kingsrook.qbits.collaboration.notify.NoOpNotifier.class));
+      new TaskReminders(CLOCK).sendDue();
+      assertThat(WorkSupport.row(CollaborationTables.TASK, due.getValueInteger("id")).getValueInstant("remindedAt")).isNull();
+      assertThat(WorkSupport.row(CollaborationTables.TASK, due.getValueInteger("id")).getValueInstant("overdueNotifiedAt")).isNull();
+      config.withNotifier(new QCodeReference(TestNotifier.class));
+      new TaskReminders(CLOCK).sendDue();
+      assertThat(recorder.notifications()).hasSize(2).allSatisfy(n -> assertThat(n.title()).doesNotContain("No deadline"));
+   }
+
+   /*******************************************************************************
+    ** Cleanup Waits For Commit And Request Get Remains Owner Locked.
+    *******************************************************************************/
+   @Test
+   void cleanupWaitsForCommitAndRequestGetRemainsOwnerLocked() throws Exception
+   {
+      tasks.create("document", 1, "Cleanup", null, null, null, null);
+      QRecord request = access.request("document", 1, null, null);
+      QBackendTransaction tx = new QBackendTransaction();
+      QContext.setTransaction(tx);
+      new DeleteAction().execute(new DeleteInput("document").withPrimaryKeys(List.of(1)).withTransaction(tx));
+      assertThat(rows(CollaborationTables.TASK)).hasSize(1);
+      tx.commit();
+      QContext.clearTransaction();
+      assertThat(rows(CollaborationTables.TASK)).isEmpty();
+      login("bob");
+      assertThat(new GetAction().execute(new GetInput(CollaborationTables.ACCESS_REQUEST).withPrimaryKey(request.getValue("id"))).getRecord()).isNull();
+      admin();
+      assertThat(new GetAction().execute(new GetInput(CollaborationTables.ACCESS_REQUEST).withPrimaryKey(request.getValue("id"))).getRecord()).isNotNull();
+      login("alice");
+      assertThat(new GetAction().execute(new GetInput(CollaborationTables.ACCESS_REQUEST).withPrimaryKey(request.getValue("id"))).getRecord()).isNotNull();
+   }
+
+   /*******************************************************************************
+    ** Rows.
+    *******************************************************************************/
+   private List<QRecord> rows(String table) throws Exception
+   {
+      return (CollaborationRecords.query(table, new QQueryFilter()));
+   }
+
+   /*******************************************************************************
+    ** Visible Requests.
+    *******************************************************************************/
+   private List<QRecord> visibleRequests() throws Exception
+   {
+      return (new QueryAction().execute(new QueryInput(CollaborationTables.ACCESS_REQUEST).withShouldGenerateDisplayValues(true)).getRecords());
+   }
+
+   /*******************************************************************************
+    ** Review.
+    *******************************************************************************/
+   private RunProcessOutput review(String name, String records, Map<String, Serializable> values) throws Exception
+   {
+      RunProcessInput input = new RunProcessInput();
+      input.setProcessName(name);
+      input.addValue("testProcessName", name);
+      input.setFrontendStepBehavior(RunProcessInput.FrontendStepBehavior.BREAK);
+      input.addValue(StreamedETLWithFrontendProcess.FIELD_DO_FULL_VALIDATION, true);
+      input.addValue("recordsParam", "recordIds");
+      input.addValue("recordIds", records);
+      values.forEach(input::addValue);
+      if(instance.getProcess(name).getStep("details") != null)
+      {
+         RunProcessOutput picker = new RunProcessAction().execute(input);
+         assertThat(picker.getException()).isEmpty();
+         input.setProcessUUID(picker.getProcessUUID());
+         input.setStartAfterStep("details");
+      }
+      RunProcessOutput output = new RunProcessAction().execute(input);
+      assertThat(output.getException()).isEmpty();
+      return (output);
+   }
+
+   /*******************************************************************************
+    ** Finish.
+    *******************************************************************************/
+   private RunProcessOutput finish(RunProcessOutput review) throws Exception
+   {
+      RunProcessInput go = new RunProcessInput();
+      go.setProcessName((String) review.getValues().get("testProcessName"));
+      go.setProcessUUID(review.getProcessUUID());
+      go.setStartAfterStep(StreamedETLWithFrontendProcess.STEP_NAME_REVIEW);
+      go.setFrontendStepBehavior(RunProcessInput.FrontendStepBehavior.SKIP);
+      RunProcessOutput result = new RunProcessAction().execute(go);
+      assertThat(result.getException()).isEmpty();
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Read the standard streamed process summary.
+    *******************************************************************************/
+   @SuppressWarnings("unchecked")
+   private List<ProcessSummaryLine> lines(RunProcessOutput output, boolean result)
+   {
+      return ((List<ProcessSummaryLine>) output.getValues().get(result ? StreamedETLWithFrontendProcess.FIELD_PROCESS_SUMMARY : StreamedETLWithFrontendProcess.FIELD_VALIDATION_SUMMARY));
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/TagsServiceTest.java

@@ -0,0 +1,448 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.io.Serializable;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.collaboration.app.CollaborationHome;
+import com.kingsrook.qbits.collaboration.attachments.AttachmentCleanup;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.tags.TagEntry;
+import com.kingsrook.qbits.collaboration.tags.TagFilterTranslator;
+import com.kingsrook.qbits.collaboration.tags.TagProcesses;
+import com.kingsrook.qbits.collaboration.tags.TagsService;
+import com.kingsrook.qqq.backend.core.actions.processes.RunProcessAction;
+import com.kingsrook.qqq.backend.core.actions.tables.CountAction;
+import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
+import com.kingsrook.qqq.backend.core.actions.tables.GetAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.instances.QInstanceValidator;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLine;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessOutput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QAppMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QAppSection;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QFrontendStepMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QUser;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.StreamedETLWithFrontendProcess;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/*******************************************************************************
+ ** Real QQQ actions exercise tag permissions, persistence, processes and metadata.
+ *******************************************************************************/
+public class TagsServiceTest extends PersonalServiceFixture
+{
+   private final TagsService tags = new TagsService();
+   private final TagFilterTranslator filters = new TagFilterTranslator();
+
+   /*******************************************************************************
+    ** Natural keys are locale-independent and validate after collapsing whitespace.
+    *******************************************************************************/
+   @Test
+   void normalizationAndFreeCreate() throws Exception
+   {
+      assertThat(TagsService.normalize("  Priority:HIGH   today  ")).isEqualTo("priority:high today");
+      assertThat(TagsService.normalize("a".repeat(60))).hasSize(60);
+      assertThatThrownBy(() -> TagsService.normalize("a".repeat(61))).hasMessageContaining("60");
+      assertThatThrownBy(() -> TagsService.normalize(null)).hasMessageContaining("60");
+      assertThatThrownBy(() -> TagsService.normalize("   ")).hasMessageContaining("60");
+      TagEntry tag = tags.create("document", "Urgent", "red");
+      assertThat(tag.name()).isEqualTo("urgent");
+      assertThat(tag.label()).isEqualTo("Urgent");
+      assertThat(tag.color()).isEqualTo("red");
+      assertThat(tag.tableName()).isEqualTo("document");
+      assertThat(tag.approved()).isTrue();
+      assertThat(tag.usageCount()).isZero();
+      assertThat(tags.create("document", " urgent ", null).id()).isEqualTo(tag.id());
+   }
+
+   /*******************************************************************************
+    ** Approval-only never permits applying a pending tag, including its author.
+    *******************************************************************************/
+   @Test
+   void suggestionsAndUnknownLabels() throws Exception
+   {
+      config.withDefaultTagMode("APPROVED_ONLY");
+      TagEntry pending = tags.create("document", "Suggested", null);
+      assertThat(pending.approved()).isFalse();
+      assertThatThrownBy(() -> tags.apply("document", 1, List.of(pending.id()), List.of())).hasMessageContaining("Pick an approved tag");
+      assertThatThrownBy(() -> tags.apply("document", 1, List.of("Unknown"), List.of())).hasMessageContaining("Pick an approved tag");
+      assertThat(rows(CollaborationTables.TAG)).hasSize(1);
+      login("bob");
+      assertThat(tags.vocabulary("document", null, 20)).isEmpty();
+      assertThatThrownBy(() -> tags.create("document", "Suggested", null)).hasMessageContaining("reserved");
+      login("alice", TagsService.MANAGE);
+      assertThat(tags.create("document", "Managed", null).approved()).isTrue();
+      tags.approve(pending.id());
+      tags.apply("document", 1, List.of(pending.id()), List.of());
+      assertThat(tags.tagsFor("document", 1)).extracting(TagEntry::id).containsExactly(pending.id());
+      config.withDefaultTagMode("FREE");
+      tags.apply("document", 2, List.of("New on the fly"), List.of());
+      assertThat(tags.tagsFor("document", 2)).extracting(TagEntry::name).containsExactly("new on the fly");
+   }
+
+   /*******************************************************************************
+    ** Global vocabulary and management demand the explicit permission.
+    *******************************************************************************/
+   @Test
+   void globalsAndManagementPermissions() throws Exception
+   {
+      assertThatThrownBy(() -> tags.create(null, "Global", null)).isInstanceOf(QPermissionDeniedException.class);
+      TagEntry own = tags.create("document", "Local", null);
+      assertThatThrownBy(() -> tags.approve(own.id())).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> tags.delete(own.id())).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> tags.merge(own.id(), own.id())).isInstanceOf(QPermissionDeniedException.class);
+      login("manager", TagsService.MANAGE);
+      TagEntry global = tags.create(null, "Global", null);
+      assertThat(global.tableName()).isNull();
+      assertThat(global.approved()).isTrue();
+      assertThat(tags.vocabulary("document", "glo", null)).extracting(TagEntry::id).containsExactly(global.id());
+   }
+
+   /*******************************************************************************
+    ** Invisible parents return Not found; read-only users need an explicit grant.
+    *******************************************************************************/
+   @Test
+   void parentAndFeatureSecurity() throws Exception
+   {
+      TagEntry tag = tags.create("document", "A", null);
+      assertThatThrownBy(() -> tags.tagsFor("document", 3)).isInstanceOf(QNotFoundException.class).hasMessage("Not found");
+      assertThatThrownBy(() -> tags.apply("document", 3, List.of(tag.id()), List.of())).isInstanceOf(QNotFoundException.class);
+      QContext.init(instance, new QSession().withUser(new QUser().withIdReference("reader")).withPermissions("document.read").withSecurityKeyValue("tenant", "a"));
+      assertThatThrownBy(() -> tags.create("document", "No", null)).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> tags.apply("document", 1, List.of(tag.id()), List.of())).isInstanceOf(QPermissionDeniedException.class);
+      QContext.getQSession().withPermissions("document.tag");
+      tags.create("document", "Granted", null);
+      tags.apply("document", 1, List.of(tag.id()), List.of());
+      assertThat(tags.tagsFor("document", 1)).hasSize(1);
+      assertThatThrownBy(() -> tags.vocabulary("missing", null, 1)).isInstanceOf(QNotFoundException.class);
+      assertThatThrownBy(() -> tags.create("missing", "No", null)).isInstanceOf(QNotFoundException.class);
+   }
+
+   /*******************************************************************************
+    ** Repeated add/remove does not inflate counts or produce duplicate activity.
+    *******************************************************************************/
+   @Test
+   void idempotentAssignmentsCountsAndActivity() throws Exception
+   {
+      TagEntry tag = tags.create("document", "A", null);
+      tags.apply("document", "01", List.of(tag.id(), tag.id()), List.of());
+      tags.apply("document", 1, List.of("A"), null);
+      tags.apply("document", 2, List.of(tag.id()), List.of());
+      assertThat(rows(CollaborationTables.RECORD_TAG)).hasSize(2);
+      assertThat(tags.vocabulary("document", null, 20).getFirst().usageCount()).isEqualTo(2);
+      assertThat(rows(CollaborationTables.ACTIVITY)).extracting(row -> row.getValueString("type")).containsExactly("TAGGED", "TAGGED");
+      assertThat(rows(CollaborationTables.FOLLOW_DIGEST)).isEmpty();
+      tags.apply("document", 1, null, List.of(tag.id()));
+      tags.apply("document", 1, List.of(), List.of("A"));
+      assertThat(tags.tagsFor("document", 1)).isEmpty();
+      assertThat(tags.vocabulary("document", null, 20).getFirst().usageCount()).isEqualTo(1);
+      assertThat(rows(CollaborationTables.ACTIVITY)).hasSize(3);
+   }
+
+   /*******************************************************************************
+    ** TABLE wins over APP then INSTANCE then the code default, with caller restored.
+    *******************************************************************************/
+   @Test
+   void settingsHierarchyReadAsSystem() throws Exception
+   {
+      instance.addApp(new QAppMetaData().withName("work").withLabel("Work").withChild(instance.getTable("document")).withSection(new QAppSection().withName("main").withTables(List.of("document"))));
+      assertThat(tags.mode("document")).isEqualTo("FREE");
+      setting("INSTANCE", "*", "APPROVED_ONLY");
+      assertThat(tags.mode("document")).isEqualTo("APPROVED_ONLY");
+      setting("APP", "work", "FREE");
+      assertThat(tags.mode("document")).isEqualTo("FREE");
+      setting("TABLE", "document", "APPROVED_ONLY");
+      assertThat(tags.create("document", "Pending", null).approved()).isFalse();
+      assertThat(QContext.getQSession().getUser().getIdReference()).isEqualTo("alice");
+      assertThat(QContext.getQSession().hasPermission("collaboration.admin")).isFalse();
+   }
+
+   /*******************************************************************************
+    ** Vocabulary ordering, scope, limits and private suggestions are stable.
+    *******************************************************************************/
+   @Test
+   void vocabularyOrderingScopeAndSuggestions() throws Exception
+   {
+      TagEntry z = tags.create("document", "Zulu", null);
+      TagEntry b = tags.create("document", "Beta", null);
+      TagEntry a = tags.create("document", "Alpha", null);
+      tags.apply("document", 1, List.of(z.id()), List.of());
+      config.withDefaultTagMode("APPROVED_ONLY");
+      TagEntry pending = tags.create("document", "Mine", null);
+      login("bob");
+      tags.create("document", "Other", null);
+      login("alice");
+      assertThat(tags.vocabulary("document", null, 1000)).extracting(TagEntry::id).containsExactly(z.id(), a.id(), b.id(), pending.id());
+      assertThat(tags.vocabulary("document", " ALP ", 10)).extracting(TagEntry::id).containsExactly(a.id());
+      assertThat(tags.vocabulary("document", null, 0)).hasSize(1);
+      assertThat(tags.vocabulary("document", null, 2)).hasSize(2);
+   }
+
+   /*******************************************************************************
+    ** Merge deduplicates assignments, preserves aliases and rejects invalid scope.
+    *******************************************************************************/
+   @Test
+   void mergeDeleteAndParentCleanup() throws Exception
+   {
+      TagEntry source = tags.create("document", "Source", null);
+      TagEntry target = tags.create("document", "Target", null);
+      tags.apply("document", 1, List.of(source.id(), target.id()), List.of());
+      tags.apply("document", 2, List.of(source.id()), List.of());
+      login("manager", TagsService.MANAGE);
+      assertThatThrownBy(() -> tags.merge(source.id(), source.id())).hasMessageContaining("different");
+      TagEntry global = tags.create(null, "Global", null);
+      assertThatThrownBy(() -> tags.merge(global.id(), target.id())).hasMessageContaining("scope");
+      tags.merge(source.id(), target.id());
+      assertThat(tags.tagsFor("document", 1)).extracting(TagEntry::id).containsExactly(target.id());
+      assertThat(tags.tagsFor("document", 2)).extracting(TagEntry::id).containsExactly(target.id());
+      assertThat(tags.vocabulary("document", null, 20)).extracting(TagEntry::id).doesNotContain(source.id());
+      assertThat(rows(CollaborationTables.TAG)).filteredOn(row -> row.getValueInteger("id").equals(source.id()))
+         .singleElement().satisfies(row -> { assertThat(row.getValueInteger("usageCount")).isZero(); assertThat(row.getValueInteger("mergedIntoTagId")).isEqualTo(target.id()); });
+      assertThatThrownBy(() -> tags.create("document", "Source", null)).hasMessageContaining("reserved");
+      new DeleteAction().execute(new DeleteInput("document").withPrimaryKeys(List.of(1)));
+      new AttachmentCleanup().onParentsDeleted("document", List.of(1));
+      new AttachmentCleanup().onParentsDeleted("document", List.of(1));
+      assertThat(tags.vocabulary("document", null, 20).getFirst().usageCount()).isEqualTo(1);
+      tags.delete(target.id());
+      assertThat(rows(CollaborationTables.RECORD_TAG)).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** All translator operators use visible parent ids, with set semantics.
+    *******************************************************************************/
+   @Test
+   void translatorOperators() throws Exception
+   {
+      TagEntry a = tags.create("document", "A", null);
+      TagEntry b = tags.create("document", "B", null);
+      tags.apply("document", 1, List.of(a.id(), b.id()), List.of());
+      tags.apply("document", 2, List.of(a.id()), List.of());
+      assertThat(filters.recordIds("document", "IN", List.of("A"))).containsExactly("1", "2");
+      assertThat(filters.recordIds("document", "IN", List.of(b.id()))).containsExactly("1");
+      assertThat(filters.recordIds("document", "CONTAINS_ALL", List.of(a.id(), b.id(), a.id()))).containsExactly("1");
+      assertThat(filters.recordIds("document", "CONTAINS_ALL", List.of(a.id(), "unknown"))).isEmpty();
+      assertThat(filters.recordIds("document", "NOT_IN", List.of(b.id()))).containsExactly("2");
+      assertThat(filters.recordIds("document", "IS_NOT_BLANK", null)).containsExactly("1", "2");
+      assertThat(filters.recordIds("document", "IS_BLANK", null)).isEmpty();
+      tags.apply("document", 2, List.of(), List.of(a.id()));
+      assertThat(filters.recordIds("document", "IS_BLANK", List.of())).containsExactly("2");
+      assertThat(filters.recordIds("document", "IN", List.of())).isEmpty();
+      assertThat(filters.recordIds("document", "NOT_IN", List.of("unknown"))).containsExactly("1", "2");
+      assertThat(filters.recordIds("document", "CONTAINS_ALL", List.of())).containsExactly("1", "2");
+      assertThatThrownBy(() -> filters.recordIds("document", "LIKE", List.of())).hasMessageContaining("Unsupported");
+   }
+
+   /*******************************************************************************
+    ** Exactly 10,000 is allowed; the next matching id fails instead of truncating.
+    *******************************************************************************/
+   @Test
+   void translatorCap() throws Exception
+   {
+      List<QRecord> parents = new ArrayList<>();
+      for(int id = 4; id <= 10001; id++)
+      {
+         parents.add(new QRecord().withValue("id", id).withValue("tenant", "a"));
+      }
+      new InsertAction().execute(new InsertInput("document").withRecords(parents));
+      assertThat(filters.recordIds("document", "IS_BLANK", null)).hasSize(10000);
+      new InsertAction().execute(new InsertInput("document").withRecords(List.of(new QRecord().withValue("id", 10002).withValue("tenant", "a"))));
+      assertThatThrownBy(() -> filters.recordIds("document", "IS_BLANK", null)).hasMessageContaining("10,000");
+   }
+
+   /*******************************************************************************
+    ** Direct access cannot bypass vocabulary approval or parent lock restrictions.
+    *******************************************************************************/
+   @Test
+   void tableSecurityAndHome() throws Exception
+   {
+      TagEntry tag = tags.create("document", "<Urgent>", null);
+      tags.apply("document", 1, List.of(tag.id()), List.of());
+      config.withDefaultTagMode("APPROVED_ONLY");
+      TagEntry pending = tags.create("document", "Pending", null);
+      login("bob", "collaboration.view");
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.TAG)).getRecords()).hasSize(1);
+      assertThat(new CountAction().execute(new CountInput(CollaborationTables.TAG)).getCount()).isEqualTo(1);
+      assertThatThrownBy(() -> new GetAction().execute(new GetInput(CollaborationTables.TAG).withPrimaryKey(pending.id()))).isInstanceOf(QPermissionDeniedException.class);
+      assertThat(new GetAction().execute(new GetInput(CollaborationTables.TAG).withPrimaryKey(tag.id())).getRecord()).isNotNull();
+      assertThatThrownBy(() -> new InsertAction().execute(new InsertInput(CollaborationTables.TAG).withRecords(List.of(new QRecord())))).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> new UpdateAction().execute(new UpdateInput(CollaborationTables.TAG).withRecords(List.of(new QRecord().withValue("id", tag.id()))))).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> new DeleteAction().execute(new DeleteInput(CollaborationTables.TAG).withPrimaryKeys(List.of(tag.id())))).isInstanceOf(QPermissionDeniedException.class);
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.RECORD_TAG)).getRecords()).hasSize(1);
+      QContext.getQSession().getSecurityKeyValues().put("tenant", List.of("b"));
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.RECORD_TAG)).getRecords()).isEmpty();
+      login("manager", "collaboration.admin", TagsService.MANAGE);
+      String html = CollaborationHome.render(Instant.now());
+      assertThat(html).contains("Vocabulary size: 2", "Pending suggestions: 1", "&lt;Urgent&gt;: 1");
+      assertThat(html).doesNotContain("<Urgent>");
+   }
+
+   /*******************************************************************************
+    ** Metadata, nullable uniqueness and scoped PVS are validated together.
+    *******************************************************************************/
+   @Test
+   void schemaAndMetadata() throws Exception
+   {
+      TagProcesses.processesFor("document").forEach(instance::addProcess);
+      new QInstanceValidator().validate(instance);
+      assertThat(instance.getTable(CollaborationTables.TAG).getSearchFields()).containsExactly("label");
+      assertThat(instance.getTable(CollaborationTables.TAG).getSections()).anySatisfy(section -> assertThat(section.getLabel()).isEqualTo("Record Tags"));
+      assertThat(instance.getPossibleValueSource(CollaborationTables.TAG).getTableName()).isEqualTo(CollaborationTables.TAG);
+      QFrontendStepMetaData pick = (QFrontendStepMetaData) instance.getProcess("collaborationAddTags_document").getStep("tags");
+      assertThat(pick.getFormFields().getFirst().getPossibleValueSourceName()).isEqualTo(CollaborationTables.TAG);
+      assertThat(pick.getComponents().getFirst().getValues().get("multiSelectFields")).isEqualTo(List.of("tags"));
+      assertThat(CollaborationSchema.postgresScript(config)).contains("ON collaboration_tag (table_name, name) NULLS NOT DISTINCT", "ON collaboration_record_tag (table_name, record_id, tag_id)", "usage_count INTEGER NOT NULL", "approved BOOLEAN NOT NULL");
+      assertThatThrownBy(() -> config.withDefaultTagMode("INVALID").validate(instance)).hasMessageContaining("defaultTagMode");
+      config.withDefaultTagMode("FREE").withTagActionTables(List.of("missing"));
+      assertThatThrownBy(() -> config.validate(instance)).hasMessageContaining("host table");
+   }
+
+   /*******************************************************************************
+    ** Bulk actions execute genuine Review and Result steps with idempotent counts.
+    *******************************************************************************/
+   @Test
+   void bulkActionsReviewAndResult() throws Exception
+   {
+      TagProcesses.processesFor("document").forEach(instance::addProcess);
+      TagEntry a = tags.create("document", "A", null);
+      TagEntry b = tags.create("document", "B", null);
+      tags.apply("document", 1, List.of(a.id(), b.id()), List.of());
+      RunProcessOutput review = review("collaborationAddTags_document", "1,2", Map.of(TagProcesses.TAGS, new ArrayList<>(List.of(a.id(), b.id()))));
+      assertThat(lines(review, false)).anySatisfy(line -> { assertThat(line.getCount()).isEqualTo(2); assertThat(line.getPluralFutureMessage()).contains("Add 2 tags"); });
+      assertThat(lines(review, false)).anySatisfy(line -> { assertThat(line.getCount()).isEqualTo(1); assertThat(line.getPluralFutureMessage()).contains("already"); });
+      assertThat(tags.tagsFor("document", 2)).isEmpty();
+      assertThat(lines(finish(review), true)).anySatisfy(line -> assertThat(line.getCount()).isEqualTo(2));
+      assertThat(tags.tagsFor("document", 2)).hasSize(2);
+      finish(review("collaborationRemoveTags_document", "1,2", Map.of(TagProcesses.TAGS, a.id() + "," + b.id())));
+      assertThat(rows(CollaborationTables.RECORD_TAG)).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Management Review counts affected records; Result performs each operation.
+    *******************************************************************************/
+   @Test
+   void managementActionsReviewAndResult() throws Exception
+   {
+      config.withDefaultTagMode("APPROVED_ONLY");
+      TagEntry pending = tags.create("document", "Pending", null);
+      login("manager", TagsService.MANAGE);
+      RunProcessOutput approve = review("collaborationApproveTags", pending.id().toString(), Map.of());
+      assertThat(lines(approve, false)).anySatisfy(line -> assertThat(line.getPluralFutureMessage()).contains("Approve"));
+      finish(approve);
+      tags.apply("document", 1, List.of(pending.id()), List.of());
+      TagEntry target = tags.create("document", "Target", null);
+      RunProcessOutput merge = review("collaborationMergeTags", pending.id().toString(), Map.of(TagProcesses.TARGET, target.id()));
+      finish(merge);
+      assertThat(tags.tagsFor("document", 1)).extracting(TagEntry::id).containsExactly(target.id());
+      RunProcessOutput delete = review("collaborationDeleteTags", target.id().toString(), Map.of());
+      assertThat(lines(delete, false)).anySatisfy(line -> { assertThat(line.getCount()).isEqualTo(1); assertThat(line.getPluralFutureMessage()).contains("lose tag assignments"); });
+      assertThat(lines(finish(delete), true)).anySatisfy(line -> assertThat(line.getPluralPastMessage()).contains("processed"));
+      assertThat(tags.tagsFor("document", 1)).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Persist one scoped feature policy as a trusted fixture setup.
+    *******************************************************************************/
+   private void setting(String scope, String name, String mode) throws Exception
+   {
+      CollaborationRecords.insert(CollaborationTables.FEATURE_SETTING, new QRecord().withValue("scopeType", scope).withValue("scopeName", name)
+         .withValue("feature", "TAGS").withValue("enabled", true).withValue("settings", "{\"mode\":\"" + mode + "\"}"));
+   }
+
+   /*******************************************************************************
+    ** Inspect persistence to assert no hidden writes or duplicate activity.
+    *******************************************************************************/
+   private List<QRecord> rows(String table) throws Exception
+   {
+      return (CollaborationRecords.query(table, new QQueryFilter()));
+   }
+
+   /*******************************************************************************
+    ** Supply picker values and stop at the genuine standard Review screen.
+    *******************************************************************************/
+   private RunProcessOutput review(String name, String records, Map<String, Serializable> values) throws Exception
+   {
+      new QInstanceValidator().validate(instance);
+      RunProcessInput input = new RunProcessInput();
+      input.setProcessName(name);
+      input.addValue("testProcessName", name);
+      input.setFrontendStepBehavior(RunProcessInput.FrontendStepBehavior.BREAK);
+      input.addValue(StreamedETLWithFrontendProcess.FIELD_DO_FULL_VALIDATION, true);
+      input.addValue("recordsParam", "recordIds");
+      input.addValue("recordIds", records);
+      values.forEach(input::addValue);
+      if(instance.getProcess(name).getStep("tags") != null)
+      {
+         RunProcessOutput picker = new RunProcessAction().execute(input);
+         assertThat(picker.getException()).isEmpty();
+         input.setProcessUUID(picker.getProcessUUID());
+         input.setStartAfterStep("tags");
+      }
+      RunProcessOutput output = new RunProcessAction().execute(input);
+      assertThat(output.getException()).isEmpty();
+      return (output);
+   }
+
+   /*******************************************************************************
+    ** Resume the stored process state after Review.
+    *******************************************************************************/
+   private RunProcessOutput finish(RunProcessOutput review) throws Exception
+   {
+      RunProcessInput go = new RunProcessInput();
+      go.setProcessName((String) review.getValues().get("testProcessName"));
+      go.setProcessUUID(review.getProcessUUID());
+      go.setStartAfterStep(StreamedETLWithFrontendProcess.STEP_NAME_REVIEW);
+      go.setFrontendStepBehavior(RunProcessInput.FrontendStepBehavior.SKIP);
+      RunProcessOutput result = new RunProcessAction().execute(go);
+      assertThat(result.getException()).isEmpty();
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Summary values are supplied by the streamed process engine.
+    *******************************************************************************/
+   @SuppressWarnings("unchecked")
+   private List<ProcessSummaryLine> lines(RunProcessOutput output, boolean result)
+   {
+      return ((List<ProcessSummaryLine>) output.getValues().get(result ? StreamedETLWithFrontendProcess.FIELD_PROCESS_SUMMARY : StreamedETLWithFrontendProcess.FIELD_VALIDATION_SUMMARY));
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/TimelineServiceTest.java

@@ -0,0 +1,158 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.timeline.TimelineItem;
+import com.kingsrook.qbits.collaboration.timeline.TimelinePage;
+import com.kingsrook.qbits.collaboration.timeline.TimelineService;
+import com.kingsrook.qqq.backend.core.actions.metadata.personalization.TableMetaDataPersonalizerInterface;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.instances.QInstanceValidator;
+import com.kingsrook.qqq.backend.core.model.actions.metadata.personalization.TableMetaDataPersonalizerInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.audits.AuditsMetaDataProvider;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryRecordStore;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/*******************************************************************************
+ ** Core audit schemas from RC.5, merged with real activity and permission checks.
+ *******************************************************************************/
+public class TimelineServiceTest extends PersonalServiceFixture
+{
+   private final TimelineService timeline = new TimelineService();
+   private final Instant at = Instant.parse("2026-01-01T00:00:00Z");
+
+   /*******************************************************************************
+    ** Audits.
+    *******************************************************************************/
+   @BeforeEach
+   void audits() throws Exception
+   {
+      new AuditsMetaDataProvider().withRecordIdType(QFieldType.STRING).defineAll(instance, "memory", table ->
+         table.withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.READ_WRITE_PERMISSIONS)));
+      new QInstanceValidator().validate(instance);
+      seed("auditTable", new QRecord().withValue("id", 1).withValue("name", "document").withValue("label", "Documents"));
+      seed("auditUser", new QRecord().withValue("id", 1).withValue("name", "Audit Actor"));
+      for(long id = 1; id <= 3; id++)
+      {
+         seed("audit", new QRecord().withValue("id", id).withValue("auditTableId", 1).withValue("auditUserId", 1)
+            .withValue("recordId", "1").withValue("timestamp", id == 3 ? at.plusSeconds(10) : at).withValue("message", "Record changed"));
+      }
+      seed("auditDetail", new QRecord().withValue("id", 1L).withValue("auditId", 2L).withValue("fieldName", "title").withValue("oldValue", "Old").withValue("newValue", "New"));
+      seed("auditDetail", new QRecord().withValue("id", 2L).withValue("auditId", 2L).withValue("fieldName", "tenant").withValue("oldValue", "sensitive old").withValue("newValue", "sensitive new"));
+      for(int id = 1; id <= 3; id++)
+      {
+         CollaborationRecords.insert(CollaborationTables.ACTIVITY, new QRecord().withValue("id", id).withValue("tableName", "document").withValue("recordId", "1")
+            .withValue("at", id == 3 ? at.minusSeconds(10) : at).withValue("actorUserId", "alice").withValue("type", "COMMENTED")
+            .withValue("summary", "Comment added").withValue("refTableName", CollaborationTables.COMMENT).withValue("refId", "1").withValue("parentDeleted", false));
+      }
+      QContext.getQSession().withPermissions("audit.read", "auditTable.read", "auditDetail.read", "auditUser.read");
+   }
+
+   /*******************************************************************************
+    ** Seed audit-only fixture data through the memory backend, which core owns.
+    *******************************************************************************/
+   private void seed(String table, QRecord record) throws Exception
+   {
+      MemoryRecordStore.getInstance().insert(new InsertInput(table).withRecords(List.of(record)), true);
+   }
+
+   /*******************************************************************************
+    ** Merges ties and keyset pages without gaps or duplicates.
+    *******************************************************************************/
+   @Test
+   void mergesTiesAndKeysetPagesWithoutGapsOrDuplicates() throws Exception
+   {
+      TimelinePage first = timeline.timeline("document", 1, null, 2, null);
+      assertThat(first.items()).extracting(TimelineItem::kind).containsExactly("AUDIT", "AUDIT");
+      assertThat(first.items().get(1).details()).hasSize(2);
+      assertThat(first.items().get(1).actorName()).isEqualTo("Audit Actor");
+      assertThat(first.items().get(1).actorUserId()).isNull();
+      List<String> seen = new ArrayList<>();
+      String cursor = null;
+      do
+      {
+         TimelinePage page = timeline.timeline("document", 1, cursor, 1, Set.of());
+         page.items().forEach(item -> seen.add(item.kind() + ":" + item.id()));
+         cursor = page.nextCursor();
+      }
+      while(cursor != null && seen.size() < 10);
+      assertThat(seen).containsExactly("AUDIT:3", "AUDIT:2", "AUDIT:1", "ACTIVITY:2", "ACTIVITY:1", "ACTIVITY:3");
+      assertThat(timeline.timeline("document", 1, null, 50, Set.of("COMMENTED")).items()).hasSize(3);
+      assertThat(timeline.timeline("document", 1, null, 50, Set.of("AUDIT")).items()).hasSize(3);
+      assertThat(timeline.timeline("document", 2, null, 50, null).items()).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Audit read permission and hidden fields apply.
+    *******************************************************************************/
+   @Test
+   void auditReadPermissionAndHiddenFieldsApply() throws Exception
+   {
+      instance.addSupplementalCustomizer(TableMetaDataPersonalizerInterface.CUSTOMIZER_TYPE, new QCodeReference(HideTenant.class));
+      TimelinePage page = timeline.timeline("document", 1, null, 50, null);
+      assertThat(page.items().stream().flatMap(item -> item.details().stream())).singleElement().satisfies(detail ->
+      {
+         assertThat(detail.fieldName()).isEqualTo("title");
+         assertThat(detail.oldValue()).isEqualTo("Old");
+      });
+      QContext.getQSession().getPermissions().remove("audit.read");
+      instance.setEnforcePermissionsInCoreActions(false);
+      assertThat(timeline.timeline("document", 1, null, 50, null).items()).hasSize(3).allSatisfy(item -> assertThat(item.kind()).isEqualTo("ACTIVITY"));
+      assertThatThrownBy(() -> timeline.timeline("document", 3, null, 50, null)).hasMessage("Not found");
+      assertThatThrownBy(() -> timeline.timeline("document", 1, "invalid", 50, null)).hasMessage("Invalid cursor");
+      assertThatThrownBy(() -> timeline.timeline("document", 1, null, 51, null)).hasMessageContaining("Limit");
+      instance.getTables().remove("audit");
+      assertThat(timeline.timeline("document", 1, null, 50, Set.of("AUDIT")).items()).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Real personalizer boundary, like core's audit screen.
+    *******************************************************************************/
+   public static class HideTenant implements TableMetaDataPersonalizerInterface
+   {
+      @Override
+      public QTableMetaData execute(TableMetaDataPersonalizerInput input)
+      {
+         QTableMetaData result = input.getTable().clone();
+         if(result.getName().equals("document"))
+         {
+            result.getFields().remove("tenant");
+         }
+         return (result);
+      }
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/attachments/AttachmentsServiceTest.java

@@ -0,0 +1,529 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.net.URI;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.CollaborationSchema;
+import com.kingsrook.qbits.collaboration.PersonalServiceFixture;
+import com.kingsrook.qbits.collaboration.app.CollaborationHome;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qbits.objectstorage.api.PresignGet;
+import com.kingsrook.qbits.objectstorage.api.PutRequest;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizerInterface;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizers;
+import com.kingsrook.qqq.backend.core.actions.processes.RunProcessAction;
+import com.kingsrook.qqq.backend.core.actions.tables.CountAction;
+import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
+import com.kingsrook.qqq.backend.core.actions.tables.GetAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLine;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessOutput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.model.statusmessages.BadInputStatusMessage;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.StreamedETLWithFrontendProcess;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/*******************************************************************************
+ ** Real QQQ memory actions and parent locks, with an in-memory storage boundary.
+ *******************************************************************************/
+public class AttachmentsServiceTest extends PersonalServiceFixture
+{
+   private static AttachmentsService processService;
+   private FakeStorage storage;
+   private AttachmentsService service;
+
+   /*******************************************************************************
+    ** No Docker, network, object-storage grants or collaboration.view needed.
+    *******************************************************************************/
+   @BeforeEach
+   void attachments()
+   {
+      storage = new FakeStorage();
+      service = new AttachmentsService(config, storage);
+   }
+
+   /*******************************************************************************
+    ** Upload, metadata, newest-first list, signed download and deletion round trip.
+    *******************************************************************************/
+   @Test
+   void roundTrip() throws Exception
+   {
+      AttachmentEntry first = upload("../hello.txt", "hello");
+      AttachmentEntry second = upload("C:\\fakepath\\other.txt", "other");
+      assertThat(first.fileName()).isEqualTo("hello.txt");
+      assertThat(first.sizeBytes()).isEqualTo(5L);
+      assertThat(first.sha256()).isEqualTo("2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824");
+      assertThat(first.createdByUserId()).isEqualTo("alice");
+      assertThat(first.canDelete()).isTrue();
+      assertThat(service.list("document", "01")).extracting(AttachmentEntry::id).containsExactly(second.id(), first.id());
+      assertThat(storage.objects.values()).anySatisfy(bytes -> assertThat(new String(bytes, StandardCharsets.UTF_8)).isEqualTo("hello"));
+      assertThat(storage.lastPut.getContentType()).isEqualTo("text/plain");
+      assertThat(storage.lastPut.getContentDisposition()).isEqualTo("inline");
+      assertThat(storage.objects.keySet()).allMatch(key -> key.startsWith("collaboration/attachments/document/1/"));
+      assertThat(service.downloadUrl(first.id(), false).toString()).contains("signed.example");
+      assertThat(storage.lastGet.getTtl()).isEqualTo(Duration.ofMinutes(5));
+      assertThat(storage.lastGet.getDownloadAs()).isEqualTo("hello.txt");
+      service.downloadUrl(first.id(), true);
+      assertThat(storage.lastGet.getDownloadAs()).isNull();
+      assertThat(raw(first.id()).getValue("previewUrl")).isNull();
+      service.delete(List.of(first.id(), first.id()));
+      assertThat(storage.objects).hasSize(1);
+      assertThat(service.list("document", 1)).extracting(AttachmentEntry::id).containsExactly(second.id());
+   }
+
+   /*******************************************************************************
+    ** Both collaboration and bucket size limits are enforced while streaming.
+    *******************************************************************************/
+   @Test
+   void limitsAndExtensions() throws Exception
+   {
+      config.withDefaultMaxBytes(4L);
+      assertThatThrownBy(() -> upload("large.txt", "hello")).hasMessageContaining("size limit");
+      assertThat(storage.objects).isEmpty();
+      assertThat(service.list("document", 1)).isEmpty();
+      upload("exact.txt", "four");
+      config.withDefaultMaxBytes(100L);
+      storage.limit = 2;
+      assertThatThrownBy(() -> upload("bucket.txt", "abc")).hasMessageContaining("size limit of 2");
+      config.withBlockedExtensions(List.of(".EXE"));
+      assertThatThrownBy(() -> upload("bad.exe", "x")).hasMessageContaining("blocked");
+      assertThatThrownBy(() -> upload("..", "x")).hasMessageContaining("Invalid file name");
+      assertThatThrownBy(() -> upload(" ", "x")).hasMessageContaining("file name is required");
+      assertThatThrownBy(() -> service.upload("document", 1, "x", "x".repeat(256), stream("x"), null)).hasMessageContaining("field lengths");
+   }
+
+   /*******************************************************************************
+    ** A locked, missing or table-denied parent always gives the same Not found.
+    *******************************************************************************/
+   @Test
+   void invisibleParents() throws Exception
+   {
+      AttachmentEntry row = upload("visible.txt", "hello");
+      for(String id : List.of("3", "999", "invalid"))
+      {
+         assertThatThrownBy(() -> service.upload("document", id, "a.txt", null, stream("x"), null))
+            .isInstanceOf(QNotFoundException.class).hasMessage("Not found");
+         assertThatThrownBy(() -> service.list("document", id)).hasMessage("Not found");
+      }
+      QContext.getQSession().getSecurityKeyValues().remove("tenant");
+      assertThatThrownBy(() -> service.downloadUrl(row.id(), false)).hasMessage("Not found");
+      assertThatThrownBy(() -> service.delete(List.of(row.id()))).hasMessage("Not found");
+      QContext.getQSession().getPermissions().remove("document.read");
+      assertThatThrownBy(() -> service.list("document", 1)).hasMessage("Not found");
+      assertThatThrownBy(() -> ParentRecordAccess.requireVisibleParent("missing", 1)).hasMessage("Not found");
+      assertThatThrownBy(() -> ParentRecordAccess.requireVisibleParent(CollaborationTables.ATTACHMENT, row.id())).hasMessage("Not found");
+   }
+
+   /*******************************************************************************
+    ** Explicit attach uses the table's permission base and does not require EDIT.
+    *******************************************************************************/
+   @Test
+   void explicitAttachWithoutEdit() throws Exception
+   {
+      QContext.getQSession().getPermissions().remove("document.write");
+      assertThatThrownBy(() -> upload("denied.txt", "x")).isInstanceOf(QPermissionDeniedException.class);
+      QContext.getQSession().withPermissions("document.attach");
+      AttachmentEntry row = upload("allowed.txt", "x");
+      service.delete(List.of(row.id()));
+      instance.getTable("document").getPermissionRules().setPermissionBaseName("documents");
+      QContext.getQSession().withPermissions("documents.read", "documents.attach");
+      upload("custom-base.txt", "x");
+   }
+
+   /*******************************************************************************
+    ** Ownership, moderation, and feature revocation are independent checks.
+    *******************************************************************************/
+   @Test
+   void ownOtherAndAdmin() throws Exception
+   {
+      AttachmentEntry alice = upload("alice.txt", "a");
+      login("bob");
+      AttachmentEntry bob = upload("bob.txt", "b");
+      assertThat(service.list("document", 1)).filteredOn(row -> row.id().equals(alice.id())).extracting(AttachmentEntry::canDelete).containsExactly(false);
+      assertThatThrownBy(() -> service.delete(List.of(bob.id(), alice.id()))).isInstanceOf(QPermissionDeniedException.class);
+      assertThat(storage.objects).hasSize(2);
+      assertThatThrownBy(() -> service.rename(alice.id(), "stolen.txt", null)).isInstanceOf(QPermissionDeniedException.class);
+      QContext.getQSession().getPermissions().remove("document.write");
+      assertThatThrownBy(() -> service.delete(List.of(bob.id()))).isInstanceOf(QPermissionDeniedException.class);
+      admin();
+      QContext.getQSession().getPermissions().remove("document.write");
+      assertThat(service.rename(alice.id(), "renamed.txt", "new description").fileName()).isEqualTo("renamed.txt");
+      assertThat(service.describe(alice.id(), "").description()).isEmpty();
+      service.downloadUrl(alice.id(), false);
+      assertThat(storage.lastGet.getDownloadAs()).isEqualTo("renamed.txt");
+      service.delete(List.of(alice.id(), bob.id()));
+      assertThat(storage.objects).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Direct table writes cannot bypass authorization or the storage lifecycle.
+    *******************************************************************************/
+   @Test
+   void directWritesDeniedAndPanelBypassesBrowseGrant() throws Exception
+   {
+      AttachmentEntry row = upload("ok.txt", "x");
+      assertThatThrownBy(() -> new QueryAction().execute(new QueryInput(CollaborationTables.ATTACHMENT))).isInstanceOf(QPermissionDeniedException.class);
+      assertThat(service.list("document", 1)).hasSize(1);
+      admin();
+      assertThatThrownBy(() -> new InsertAction().execute(new InsertInput(CollaborationTables.ATTACHMENT).withRecords(List.of(new QRecord()))))
+         .isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> new UpdateAction().execute(new UpdateInput(CollaborationTables.ATTACHMENT)
+         .withRecords(List.of(new QRecord().withValue("id", row.id()).withValue("createdByUserId", "admin")))))
+         .isInstanceOf(QPermissionDeniedException.class);
+   }
+
+   /*******************************************************************************
+    ** The real pre-query hook restricts query and count, including an empty IN.
+    *******************************************************************************/
+   @Test
+   void tableReadRestrictionAndPostFiltering() throws Exception
+   {
+      AttachmentEntry visible = upload("visible.txt", "x");
+      QContext.getQSession().withSecurityKeyValue("allTenants", true);
+      service.upload("document", 3, "secret.txt", "text/plain", stream("secret"), null);
+      login("alice", CollaborationPermissions.VIEW);
+      QueryInput query = new QueryInput(CollaborationTables.ATTACHMENT);
+      assertThat(new QueryAction().execute(query).getRecords()).extracting(row -> row.getValueInteger("id")).containsExactly(visible.id());
+      assertThat(query.getFilter().toString()).contains("tableName", "document");
+      assertThat(new CountAction().execute(new CountInput(CollaborationTables.ATTACHMENT)).getCount()).isEqualTo(2);
+      int hiddenId = AttachmentRecords.query(new QQueryFilter().withCriteria("recordId", QCriteriaOperator.EQUALS, "3")).getFirst().getValueInteger("id");
+      assertThat(new GetAction().execute(new GetInput(CollaborationTables.ATTACHMENT).withPrimaryKey(hiddenId)).getRecord()).isNull();
+      QContext.getQSession().getPermissions().remove("document.read");
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.ATTACHMENT)).getRecords()).isEmpty();
+      assertThat(new CountAction().execute(new CountInput(CollaborationTables.ATTACHMENT)).getCount()).isZero();
+   }
+
+   /*******************************************************************************
+    ** Signed previews are generated only after checking visibility and stay virtual.
+    *******************************************************************************/
+   @Test
+   void previews() throws Exception
+   {
+      AttachmentEntry row = upload("photo.png", "image");
+      QRecord visible = raw(row.id());
+      QRecord hidden = new QRecord(visible).withValue("recordId", "3");
+      AttachmentPreviewCustomizer customizer = new AttachmentPreviewCustomizer();
+      List<QRecord> results = customizer.filter(List.of(visible, hidden), false, service);
+      assertThat(results).hasSize(1);
+      assertThat(storage.signatures).hasSize(2);
+      assertThat(results.getFirst().getValueString("previewUrl")).contains("signed.example");
+      assertThat(results.getFirst().getValueString("downloadUrl")).contains("signed.example");
+      assertThat(results.getFirst().getDisplayValue("downloadUrl")).isEqualTo("photo.png");
+      assertThat(results.getFirst().getDisplayValue("downloadUrl:downloadUrlDynamic")).isEqualTo(results.getFirst().getValueString("downloadUrl"));
+      assertThat(visible.getValue("previewUrl")).isNull();
+      assertThat(raw(row.id()).getValue("previewUrl")).isNull();
+      assertThatThrownBy(() -> customizer.filter(List.of(hidden), true, service)).hasMessage("Not found");
+   }
+
+   /*******************************************************************************
+    ** Review is dry, Result is actual, and authority is checked again after Review.
+    *******************************************************************************/
+   @Test
+   void deleteProcessReviewAndResult() throws Exception
+   {
+      AttachmentEntry alice = upload("alice.txt", "a");
+      login("bob");
+      AttachmentEntry bob = upload("bob.txt", "b");
+      DeleteAttachmentsProcess.Review review = new DeleteAttachmentsProcess.Review(service);
+      RunBackendStepOutput reviewed = new RunBackendStepOutput();
+      review.runOnePage(new RunBackendStepInput().withRecords(List.of(raw(alice.id()), raw(bob.id()))), reviewed);
+      assertThat(reviewed.getRecords()).extracting(row -> row.getValueInteger("id")).containsExactly(bob.id());
+      assertThat(storage.objects).hasSize(2);
+      assertThat(review.getProcessSummary(reviewed, false)).hasSize(2);
+      ProcessSummaryLine planned = (ProcessSummaryLine) review.getProcessSummary(reviewed, false).getFirst();
+      assertThat(planned.getCount()).isEqualTo(1);
+      assertThat(planned.getSingularFutureMessage()).contains("will be deleted");
+      DeleteAttachmentsProcess.Delete delete = new DeleteAttachmentsProcess.Delete(service);
+      delete.setTransformStep(review);
+      delete.runOnePage(new RunBackendStepInput().withRecords(reviewed.getRecords()), new RunBackendStepOutput());
+      assertThat(delete.getProcessSummary(new RunBackendStepOutput(), true)).hasSize(2);
+      ProcessSummaryLine result = (ProcessSummaryLine) delete.getProcessSummary(new RunBackendStepOutput(), true).getFirst();
+      assertThat(result.getSingularPastMessage()).isEqualTo("attachment deleted");
+      assertThat(result.getCount()).isEqualTo(1);
+      assertThat(storage.objects).hasSize(1);
+      delete.runOnePage(new RunBackendStepInput().withRecords(List.of(raw(alice.id()))), new RunBackendStepOutput());
+      assertThat(delete.getProcessSummary(new RunBackendStepOutput(), true)).hasSize(3);
+      assertThat(instance.getProcess(DeleteAttachmentsProcess.NAME).getLabel()).isEqualTo("Delete attachments");
+   }
+
+   /*******************************************************************************
+    ** Run the actual streamed ETL through its frontend break and resume boundary.
+    *******************************************************************************/
+   @Test
+   @SuppressWarnings("unchecked")
+   void streamedProcess() throws Exception
+   {
+      login("alice", CollaborationPermissions.VIEW);
+      AttachmentEntry row = upload("streamed.txt", "x");
+      processService = service;
+      instance.getProcess(DeleteAttachmentsProcess.NAME).getBackendStep(StreamedETLWithFrontendProcess.STEP_NAME_EXECUTE)
+         .getInputMetaData().getFieldThrowing(StreamedETLWithFrontendProcess.FIELD_LOAD_CODE).setDefaultValue(new QCodeReference(FakeDelete.class));
+      try
+      {
+         RunProcessInput start = new RunProcessInput();
+         start.setProcessName(DeleteAttachmentsProcess.NAME);
+         start.addValue("recordsParam", "recordIds");
+         start.addValue("recordIds", row.id().toString());
+         start.setFrontendStepBehavior(RunProcessInput.FrontendStepBehavior.BREAK);
+         RunProcessOutput review = new RunProcessAction().execute(start);
+         List<ProcessSummaryLine> reviewLines = (List<ProcessSummaryLine>) review.getValues().get(StreamedETLWithFrontendProcess.FIELD_VALIDATION_SUMMARY);
+         assertThat(reviewLines).anySatisfy(line ->
+         {
+            line.pickMessage(false);
+            assertThat(line.getMessage()).contains("will be deleted");
+            assertThat(line.getCount()).isEqualTo(1);
+         });
+         assertThat(storage.objects).hasSize(1);
+         RunProcessInput go = new RunProcessInput();
+         go.setProcessName(DeleteAttachmentsProcess.NAME);
+         go.setProcessUUID(review.getProcessUUID());
+         go.setStartAfterStep(StreamedETLWithFrontendProcess.STEP_NAME_REVIEW);
+         go.setFrontendStepBehavior(RunProcessInput.FrontendStepBehavior.SKIP);
+         RunProcessOutput result = new RunProcessAction().execute(go);
+         List<ProcessSummaryLine> resultLines = (List<ProcessSummaryLine>) result.getValues().get(StreamedETLWithFrontendProcess.FIELD_PROCESS_SUMMARY);
+         assertThat(resultLines).anySatisfy(line ->
+         {
+            line.pickMessage(true);
+            assertThat(line.getMessage()).isEqualTo("attachment deleted");
+            assertThat(line.getCount()).isEqualTo(1);
+         });
+         assertThat(storage.objects).isEmpty();
+         assertThat(service.list("document", 1)).isEmpty();
+      }
+      finally
+      {
+         processService = null;
+      }
+   }
+
+   /*******************************************************************************
+    ** Only storage changes in the end-to-end process test, via the normal service.
+    *******************************************************************************/
+   public static class FakeDelete extends DeleteAttachmentsProcess.Delete
+   {
+      /*******************************************************************************
+       ** Instantiated by the real process loader.
+       *******************************************************************************/
+      public FakeDelete()
+      {
+         super(processService);
+      }
+   }
+
+   /*******************************************************************************
+    ** Storage failures leave rows for retries; trusted cleanup works after parent deletion.
+    *******************************************************************************/
+   @Test
+   void failuresAndCleanup() throws Exception
+   {
+      AttachmentEntry row = upload("file.txt", "x");
+      storage.failDelete = true;
+      assertThatThrownBy(() -> service.delete(List.of(row.id()))).hasMessage("Storage unavailable");
+      assertThat(service.list("document", 1)).hasSize(1);
+      storage.failDelete = false;
+      new DeleteAction().execute(new DeleteInput("document").withPrimaryKeys(List.of(1)));
+      assertThatThrownBy(() -> service.list("document", 1)).hasMessage("Not found");
+      QContext.getQSession().getPermissions().clear();
+      AttachmentCleanup cleanup = new AttachmentCleanup(service);
+      cleanup.onParentsDeleted("document", List.of());
+      cleanup.onParentsDeleted("document", List.of(1));
+      cleanup.onParentsDeleted("document", List.of(1));
+      assertThat(storage.objects).isEmpty();
+      assertThat(AttachmentRecords.query(new QQueryFilter())).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** A rejected row compensates the put; a broken upload never creates a row.
+    *******************************************************************************/
+   @Test
+   void failedInsertAndInputStream() throws Exception
+   {
+      instance.getTable(CollaborationTables.ATTACHMENT).withCustomizer(TableCustomizers.PRE_INSERT_RECORD, new QCodeReference(RejectInsert.class));
+      assertThatThrownBy(() -> upload("long.txt", "x")).isInstanceOf(QException.class).hasMessageContaining("Could not save attachment");
+      assertThat(storage.objects).isEmpty();
+      assertThat(AttachmentRecords.query(new QQueryFilter())).isEmpty();
+      assertThatThrownBy(() -> service.upload("document", 1, "x", null, new java.io.InputStream()
+      {
+         @Override
+         public int read() throws IOException
+         {
+            throw (new IOException("broken source"));
+         }
+      }, null)).isInstanceOf(QException.class).hasMessageContaining("Could not read attachment");
+      assertThat(storage.objects).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Exercise the real QQQ per-record validation failure/compensation path.
+    *******************************************************************************/
+   public static class RejectInsert implements TableCustomizerInterface
+   {
+      @Override
+      public List<QRecord> preInsert(InsertInput input, List<QRecord> records, boolean isPreview)
+      {
+         records.forEach(row -> row.withError(new BadInputStatusMessage("Rejected by host validation")));
+         return (records);
+      }
+   }
+
+   /*******************************************************************************
+    ** Real counts and bytes on the home, with explicit approximation and empty state.
+    *******************************************************************************/
+   @Test
+   void homeAndSchema() throws Exception
+   {
+      admin();
+      assertThat(CollaborationHome.render(Instant.now())).contains("Attachments: 0", "No attachments yet.", "Total size (bytes): 0");
+      upload("a.txt", "12345");
+      upload("b.txt", "123");
+      assertThat(CollaborationHome.render(Instant.now())).contains("Attachments: 2", "Total size (bytes): 8", "Approximate totals").doesNotContain("No attachments yet.");
+      String ddl = CollaborationSchema.postgresScript(config);
+      assertThat(ddl).contains("CREATE TABLE IF NOT EXISTS collaboration_attachment", "size_bytes BIGINT", "parent_deleted BOOLEAN DEFAULT FALSE NOT NULL",
+         "ON collaboration_attachment (table_name, record_id)").doesNotContain("preview_url", "download_url");
+      QTableMetaData table = instance.getTable(CollaborationTables.ATTACHMENT);
+      assertThat(table.getField("sizeBytes").getType()).isEqualTo(QFieldType.LONG);
+      assertThat(table.getVirtualField("previewUrl")).isNotNull();
+      assertThat(config.getDefaultMaxBytes()).isEqualTo(104857600L);
+      assertThat(config.getAttachmentsBucketName()).isEqualTo("collaboration");
+      assertThat(config.getBlockedExtensions()).isEmpty();
+      assertThatThrownBy(() -> config.withDefaultMaxBytes(0L).validate(instance)).hasMessageContaining("defaultMaxBytes");
+   }
+
+   /*******************************************************************************
+    ** Short upload helper using the first visible parent.
+    *******************************************************************************/
+   private AttachmentEntry upload(String name, String value) throws QException
+   {
+      return (service.upload("document", 1, name, "text/plain", stream(value), "description"));
+   }
+
+   /*******************************************************************************
+    ** UTF-8 payload.
+    *******************************************************************************/
+   private ByteArrayInputStream stream(String value)
+   {
+      return (new ByteArrayInputStream(value.getBytes(StandardCharsets.UTF_8)));
+   }
+
+   /*******************************************************************************
+    ** Inspect persistence without producing URLs.
+    *******************************************************************************/
+   private QRecord raw(Integer id) throws QException
+   {
+      return (AttachmentRecords.query(new QQueryFilter().withCriteria("id", QCriteriaOperator.EQUALS, id)).getFirst());
+   }
+
+   /*******************************************************************************
+    ** Fake bucket preserving bytes and capturing API requests. No provider emulation.
+    *******************************************************************************/
+   private static class FakeStorage extends AttachmentStorage
+   {
+      private final Map<String, byte[]> objects = new HashMap<>();
+      private final List<PresignGet> signatures = new ArrayList<>();
+      private long limit = Long.MAX_VALUE;
+      private PutRequest lastPut;
+      private PresignGet lastGet;
+      private boolean failDelete;
+
+      @Override
+      public long maxBytes(String name)
+      {
+         return (limit);
+      }
+
+      @Override
+      public void put(String name, PutRequest request)
+      {
+         lastPut = request;
+         try
+         {
+            objects.put(name + "/" + request.getKey(), request.getStream().readAllBytes());
+         }
+         catch(IOException e)
+         {
+            throw (new IllegalStateException(e));
+         }
+      }
+
+      @Override
+      public void delete(String name, String key)
+      {
+         if(failDelete)
+         {
+            throw (new IllegalStateException("Storage unavailable"));
+         }
+         objects.remove(name + "/" + key);
+      }
+
+      @Override
+      public URL presign(String name, PresignGet request)
+      {
+         lastGet = request;
+         signatures.add(request);
+         try
+         {
+            return (URI.create("https://signed.example/" + request.getKey()).toURL());
+         }
+         catch(Exception e)
+         {
+            throw (new IllegalStateException(e));
+         }
+      }
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/recents/RecentsServiceTest.java

@@ -0,0 +1,298 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.recents;
+
+
+import java.time.Clock;
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.util.HashMap;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.CollaborationQBitProducer;
+import com.kingsrook.qbits.collaboration.CollaborationSchema;
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.PersonalServiceFixture;
+import com.kingsrook.qbits.collaboration.app.CollaborationHome;
+import com.kingsrook.qbits.collaboration.favorites.FavoriteEntry;
+import com.kingsrook.qbits.collaboration.favorites.FavoritesService;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.processes.RunProcessAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.instances.QInstanceValidator;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.QBackendMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.audits.AuditLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.scheduleing.simple.SimpleSchedulerMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
+import com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryBackendModule;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+
+/*******************************************************************************
+ ** Persisted throttling, visible ordering, bounded retention and summary counts.
+ *******************************************************************************/
+class RecentsServiceTest extends PersonalServiceFixture
+{
+   private static final Instant START = Instant.parse("2026-10-13T12:00:00Z");
+
+
+
+   /*******************************************************************************
+    ** Do not leak an injected clock to another test.
+    *******************************************************************************/
+   @AfterEach
+   void resetClock()
+   {
+      RecentsService.clock = Clock.systemUTC();
+   }
+
+
+
+   /*******************************************************************************
+    ** The exact 60-second boundary updates; 59 seconds does not write anything.
+    *******************************************************************************/
+   @Test
+   void throttlesPerTargetAndUser() throws Exception
+   {
+      at(START);
+      RecentsService.recordView("RECORD", "document", "1");
+      QRecord initial = rows().getFirst();
+      at(START.plusSeconds(59));
+      RecentsService.recordView("RECORD", "document", "1");
+      assertThat(rows().getFirst().getValues()).isEqualTo(initial.getValues());
+      at(START.plusSeconds(60));
+      RecentsService.recordView("RECORD", "document", "1");
+      assertThat(rows()).hasSize(1);
+      assertThat(rows().getFirst().getValueInteger("viewCount")).isEqualTo(2);
+      assertThat(rows().getFirst().getValueInstant("lastViewedAt")).isEqualTo(START.plusSeconds(60));
+      RecentsService.recordView("RECORD", "document", "2");
+      assertThat(rows()).hasSize(2);
+      login("bob");
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.RECENT)).getRecords()).isEmpty();
+      RecentsService.recordView("RECORD", "document", "1");
+      assertThat(rows()).hasSize(1);
+      assertThat(rows().getFirst().getValueInteger("viewCount")).isEqualTo(1);
+      admin();
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.RECENT)).getRecords()).hasSize(3);
+      assertThat(RecentsService.list(50)).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** Null ids also upsert; visibility is checked even inside the throttle window.
+    *******************************************************************************/
+   @Test
+   void tableUpsertAndInvisibleViews() throws Exception
+   {
+      at(START);
+      RecentsService.recordView("TABLE", "document", null);
+      RecentsService.recordView("TABLE", "document", null);
+      assertThat(rows()).hasSize(1);
+      at(START.plusSeconds(61));
+      RecentsService.recordView("TABLE", "document", null);
+      assertThat(rows().getFirst().getValueInteger("viewCount")).isEqualTo(2);
+      assertThatThrownBy(() -> RecentsService.recordView("RECORD", "document", "3")).hasMessage("Not found");
+      RecentsService.recordView("RECORD", "document", "1");
+      QContext.getQSession().getPermissions().remove("document.read");
+      assertThatThrownBy(() -> RecentsService.recordView("RECORD", "document", "1")).hasMessage("Not found");
+      assertThat(RecentsService.list(50)).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** Newest-first ordering is stable; locked rows are dropped before the limit.
+    *******************************************************************************/
+   @Test
+   void limitOrderAndVisibility() throws Exception
+   {
+      at(START);
+      RecentsService.recordView("TABLE", "document", null);
+      at(START.plusSeconds(1));
+      RecentsService.recordView("RECORD", "document", "1");
+      at(START.plusSeconds(2));
+      RecentsService.recordView("RECORD", "document", "2");
+      assertThat(RecentsService.list(2)).extracting(FavoriteEntry::recordId).containsExactly("2", "1");
+      assertThat(RecentsService.list(50)).hasSize(3);
+      QContext.getQSession().getSecurityKeyValues().put("tenant", List.of("b"));
+      assertThat(RecentsService.list(1)).extracting(FavoriteEntry::targetType).containsExactly("TABLE");
+      assertThatThrownBy(() -> RecentsService.list(51)).hasMessage("Limit must be between 1 and 50");
+      assertThatThrownBy(() -> RecentsService.list(0)).hasMessage("Limit must be between 1 and 50");
+      assertThatThrownBy(() -> RecentsService.list(null)).hasMessage("Limit must be between 1 and 50");
+   }
+
+
+
+   /*******************************************************************************
+    ** A page full of unavailable rows must not hide older, accessible targets.
+    *******************************************************************************/
+   @Test
+   void refillsAfterUnavailablePage() throws Exception
+   {
+      at(START);
+      RecentsService.recordView("TABLE", "document", null);
+      for(int i = 0; i < 51; i++)
+      {
+         PersonalRecords.insert(CollaborationTables.RECENT, new QRecord().withValue("userId", "alice").withValue("targetType", "TABLE")
+            .withValue("targetName", "removed" + i).withValue("label", "Old private label").withValue("lastViewedAt", START.plusSeconds(i + 1)).withValue("viewCount", 1));
+      }
+      assertThat(RecentsService.list(50)).extracting(FavoriteEntry::label).containsExactly("Documents");
+   }
+
+
+
+   /*******************************************************************************
+    ** A real backend process keeps newest N independently for each owner.
+    *******************************************************************************/
+   @Test
+   void trimProcessAndExecutionPermission() throws Exception
+   {
+      config.setRecentsPerUser(2);
+      for(String user : List.of("alice", "bob"))
+      {
+         login(user);
+         at(START);
+         RecentsService.recordView("RECORD", "document", "1");
+         at(START.plusSeconds(1));
+         RecentsService.recordView("RECORD", "document", "2");
+         at(START.plusSeconds(2));
+         RecentsService.recordView("TABLE", "document", null);
+      }
+      assertThatThrownBy(() -> new TrimRecentsProcess().run(new RunBackendStepInput(), new RunBackendStepOutput())).hasMessageContaining("collaboration.admin");
+      assertThatThrownBy(() -> new RunProcessAction().execute(new RunProcessInput().withProcessName(TrimRecentsProcess.NAME))).hasMessageContaining("collaboration.admin");
+      admin();
+      new RunProcessAction().execute(new RunProcessInput().withProcessName(TrimRecentsProcess.NAME));
+      assertThat(PersonalRecords.query(CollaborationTables.RECENT, new QQueryFilter())).hasSize(4);
+      for(String user : List.of("alice", "bob"))
+      {
+         login(user);
+         assertThat(RecentsService.list(50)).extracting(FavoriteEntry::recordId).containsExactly(null, "2");
+      }
+      QSystemUserSession system = new QSystemUserSession();
+      QContext.init(instance, system);
+      var before = new HashMap<>(system.getSecurityKeyValues());
+      CollaborationSecurity.applyToSession(instance, system);
+      CollaborationSecurity.ensureSessionKeys(instance, system);
+      assertThat(system.getSecurityKeyValues()).isEqualTo(before);
+      config.setRecentsPerUser(1);
+      new RunProcessAction().execute(new RunProcessInput().withProcessName(TrimRecentsProcess.NAME));
+      assertThat(PersonalRecords.query(CollaborationTables.RECENT, new QQueryFilter())).hasSize(2);
+      assertThat(QContext.getQSession()).isSameAs(system);
+   }
+
+
+
+   /*******************************************************************************
+    ** The daily schedule and metadata remain valid without adding nav processes.
+    *******************************************************************************/
+   @Test
+   void metadataSchemaAndConfiguration() throws Exception
+   {
+      assertThat(new CollaborationQBitConfig().getRecentsPerUser()).isEqualTo(200);
+      assertThat(instance.getProcess(TrimRecentsProcess.NAME).getIsHidden()).isTrue();
+      assertThat(instance.getProcess(TrimRecentsProcess.NAME).getSchedule()).isNull();
+      assertThatThrownBy(() -> config.withRecentsPerUser(0).validate(instance)).hasMessageContaining("recentsPerUser");
+      assertThatThrownBy(() -> config.withRecentsPerUser(null).validate(instance)).hasMessageContaining("recentsPerUser");
+      config.withRecentsPerUser(200);
+      assertThatThrownBy(() -> config.withSchedulerName("missing").validate(instance)).hasMessageContaining("scheduler");
+      instance.addScheduler(new SimpleSchedulerMetaData().withName("daily"));
+      config.withSchedulerName("daily");
+      config.validate(instance);
+      QProcessMetaData scheduled = TrimRecentsProcess.metadata(config);
+      assertThat(scheduled.getSchedule().getSchedulerName()).isEqualTo("daily");
+      assertThat(scheduled.getSchedule().getRepeatSeconds()).isEqualTo(86400);
+      instance.getProcess(TrimRecentsProcess.NAME).setSchedule(scheduled.getSchedule());
+      new QInstanceValidator().validate(instance);
+      for(String table : List.of(CollaborationTables.FAVORITE, CollaborationTables.RECENT))
+      {
+         assertThat(instance.getTable(table).getAuditRules().getAuditLevel()).isEqualTo(AuditLevel.NONE);
+         assertThat(instance.getTable(table).getPermissionRules().getLevel()).isEqualTo(PermissionLevel.NOT_PROTECTED);
+         assertThat(instance.getTable(table).getUniqueKeys().getFirst().getFieldNames()).containsExactly("userId", "targetType", "targetName", "recordId");
+         assertThat(instance.getTable(table).getSections()).extracting(section -> section.getName()).containsExactly("identity", "details", "dates");
+      }
+      assertThat(instance.getApp("collaboration").getChildren()).extracting(child -> child.getName()).doesNotContain(CollaborationTables.FAVORITE, CollaborationTables.RECENT, TrimRecentsProcess.NAME);
+      assertThat(instance.getPossibleValueSource(CollaborationTables.TARGET_TYPE).getEnumValues()).hasSize(6);
+      assertThat(CollaborationSchema.postgresScript(config)).contains("CREATE TABLE IF NOT EXISTS collaboration_favorite", "CREATE TABLE IF NOT EXISTS collaboration_recent",
+         "(user_id, target_type, target_name, record_id) NULLS NOT DISTINCT", "last_viewed_at TIMESTAMPTZ NOT NULL", "view_count INTEGER NOT NULL");
+   }
+
+
+
+   /*******************************************************************************
+    ** Counts use the current user's owner lock and admins see real distinct users.
+    *******************************************************************************/
+   @Test
+   void homeSummaryCounts() throws Exception
+   {
+      at(START);
+      login("alice", CollaborationPermissions.VIEW);
+      FavoritesService.star("TABLE", "document", null);
+      FavoritesService.star("RECORD", "document", "1");
+      RecentsService.recordView("TABLE", "document", null);
+      login("bob", CollaborationPermissions.VIEW);
+      FavoritesService.star("TABLE", "document", null);
+      RecentsService.recordView("TABLE", "document", null);
+      assertThat(CollaborationHome.render(START)).contains("<h3>Favorites</h3><p>Rows: 1</p><p>Distinct users: 1", "<h3>Recently viewed</h3><p>Rows: 1</p><p>Distinct users: 1");
+      admin();
+      assertThat(CollaborationHome.render(START)).contains("<h3>Favorites</h3><p>Rows: 3</p><p>Distinct users: 2", "<h3>Recently viewed</h3><p>Rows: 2</p><p>Distinct users: 2");
+   }
+
+
+
+   /*******************************************************************************
+    ** Freeze the service clock, including exact boundary cases.
+    *******************************************************************************/
+   private void at(Instant instant)
+   {
+      RecentsService.clock = Clock.fixed(instant, ZoneOffset.UTC);
+   }
+
+
+
+   /*******************************************************************************
+    ** Inspect persisted rows for the current owner without altering their values.
+    *******************************************************************************/
+   private List<QRecord> rows() throws Exception
+   {
+      return (PersonalRecords.query(CollaborationTables.RECENT, PersonalRecords.ownFilter()));
+   }
+}