feat: tags with per-table vocabularies, approval modes and bulk tag actions

collaboration_tag and collaboration_record_tag; FREE or APPROVED_ONLY per
table from feature settings; normalized names, suggestions, usage counts;
Approve, Merge and Delete tags record actions; Add tags / Remove tags bulk
actions for configured host tables; TagFilterTranslator for the filter
operators, to be wrapped in core's criteria expander once QRun-IO/qqq#1140
is released; tag activity on the timeline; the home Tags card.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.circleci/config.yml

@@ -1,14 +1,60 @@
 version: 2.1
-setup: true
+
 orbs:
-  qqq-orb: kingsrook/qqq-orb@0.8
+   qqq-orb: kingsrook/qqq-orb@0.6.8
+
+commands:
+   configure-package-install:
+      steps:
+         - run:
+              name: Keep package installation unattended
+              command: |
+                 # These build machines are discarded after the job.
+                 sudo install -d /etc/needrestart/conf.d
+                 printf '%s\n' '$nrconf{restart} = "l";' | sudo tee /etc/needrestart/conf.d/99-qqq-ci.conf >/dev/null
+
 workflows:
-  setup:
-    jobs:
-    - qqq-orb/generate_pipeline:
-        orb_version: '0.8'
-        filters:
-          branches:
-            ignore: automation/qbit-rc-pending
-          tags:
-            ignore: /.*/
+   test_only:
+      jobs:
+         - qqq-orb/mvn_test_only:
+              pre-steps:
+                 - configure-package-install
+              context: [qqq-maven-registry-credentials]
+              filters:
+                 branches:
+                    ignore: /(develop|release\/.*)/
+
+   publish_snapshot:
+      jobs:
+         - qqq-orb/mvn_publish:
+              pre-steps:
+                 - configure-package-install
+              context: [qqq-maven-registry-credentials]
+              branch_type: snapshot
+              filters:
+                 branches:
+                    only: [develop]
+
+   publish_release_candidate:
+      jobs:
+         - qqq-orb/mvn_publish:
+              pre-steps:
+                 - configure-package-install
+              context: [qqq-maven-registry-credentials]
+              branch_type: release_candidate
+              filters:
+                 branches:
+                    only: [/release\/.*/]
+
+   publish_release:
+      jobs:
+         - qqq-orb/mvn_publish:
+              pre-steps:
+                 - configure-package-install
+              context: [qqq-maven-registry-credentials]
+              branch_type: release
+              filters:
+                 branches:
+                    ignore: /.*/
+                 tags:
+                    only: [/^v\d+\.\d+\.\d+$/]

.editorconfig

@@ -0,0 +1,20 @@
+# QRun-IO qbit .editorconfig: the Kingsrook layout (3-space indentation, never tabs).
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 3
+tab_width = 3
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[*.{cmd,bat}]
+end_of_line = crlf

.gitattributes

@@ -0,0 +1,3 @@
+* text=auto eol=lf
+*.cmd text eol=crlf
+mvnw text eol=lf

.gitea/workflows/qrun-release.yaml

@@ -1,24 +0,0 @@
-# Standard QRun release caller (v2, thin contract): every push and manual dispatch delegates to the protected qrun-release-v1 channel. Do not edit per repository.
-name: qrun-release
-on:
-  push: {}
-  workflow_dispatch: {}
-permissions:
-  contents: read
-  actions: read
-jobs:
-  release:
-    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/java-maven.yaml@qrun-release-v1
-    with:
-      runner: linux-small
-      browsers: true
-      browser-runner: browser-build
-  postpublish:
-    if: ${{ needs.release.outputs.capture == 'true' }}
-    needs: release
-    permissions:
-      contents: write
-      actions: write
-    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/qrun-source-version.yaml@qrun-release-v1
-    with:
-      runner: linux-small

.github/dependabot.yml

@@ -0,0 +1,25 @@
+# Weekly, grouped dependency updates. Minor and patch updates arrive as one PR per ecosystem;
+# major updates stay separate so each gets its own review. At most three version-update PRs per
+# ecosystem are open at once. Security updates are enabled in the repository settings and are
+# not limited by this schedule.
+version: 2
+updates:
+  - package-ecosystem: maven
+    directory: /
+    target-branch: develop
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 3
+    groups:
+      maven-minor-and-patch:
+        update-types: [minor, patch]
+
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: develop
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 3
+    groups:
+      github-actions:
+        patterns: ['*']

.github/workflows/codeql.yml

@@ -1,23 +0,0 @@
-name: CodeQL
-'on':
-  push:
-    branches:
-    - main
-    - develop
-    - release/**
-    - hotfix/**
-  pull_request: {}
-  schedule:
-  - cron: 41 16 * * 0
-  workflow_dispatch: {}
-permissions:
-  contents: read
-  actions: read
-  security-events: write
-  packages: read
-concurrency:
-  group: codeql-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-jobs:
-  analyze:
-    uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22

.github/workflows/release-rc.yml

@@ -0,0 +1,25 @@
+# Cut the next release candidate (QRun-IO/qqq docs/QRUN-QBIT-REPO-STANDARD.md, C6):
+# run this workflow by hand, or merge a develop PR labelled `release:rc`. It merges develop into
+# the release line and the release/* push runs CircleCI publish_release_candidate.
+name: Release candidate
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Print the plan without merging or creating branches
+        type: boolean
+        default: false
+  pull_request:
+    types: [closed]
+    branches: [develop]
+
+permissions:
+  contents: write
+
+jobs:
+  release-rc:
+    if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release:rc'))
+    uses: QRun-IO/.github/.github/workflows/qbit-release-rc.yml@main
+    with:
+      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}

.gitignore

@@ -1,20 +1,21 @@
-# Maven
 target/
+.env
+.idea
+*.iml
+*.class
+*.log
 *.jar
 *.war
+*.nar
 *.ear
-
-# IDE
-.idea/
-*.iml
-.vscode/
-.project
-.classpath
-.settings/
-
-# OS
+*.zip
+*.tar.gz
+*.rar
+hs_err_pid*
 .DS_Store
-Thumbs.db
-
-# Logs
-*.log
+*.sw*
+.flattened-pom.xml
+dependency-reduced-pom.xml
+/.env.local
+/.cache/
+.claude/settings.local.json

.mvn/wrapper/maven-wrapper.properties

@@ -0,0 +1,3 @@
+wrapperVersion=3.3.4
+distributionType=only-script
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.11/apache-maven-3.9.11-bin.zip

.qqq-ci.yml

@@ -1,15 +0,0 @@
-profile: qbit
-orb_version: '0.8'
-default_branch: develop
-java_version: '21'
-browsers: true
-api_checks: false
-docs_only: false
-release_on_main: false
-release_tag_policy: none
-test_branch_policy: all
-publish:
-  snapshot: false
-  release_candidate: false
-  release: false
-  asciidoc: false

AGENTS.md

@@ -0,0 +1,53 @@
+# AGENTS.md
+
+This file provides guidance to Codex when working with code in this repository.
+
+## Project Overview
+
+**QBit Collaboration**: record collaboration for QQQ. Phase a implements feature settings, people tables and the app home. Design: [QRun-IO/qqq#1136](https://github.com/QRun-IO/qqq/pull/1136) (`docs/COLLABORATION.md`). Phases b to i are planned.
+
+## Build Commands
+
+```bash
+./mvnw compile          # Compile (always use the wrapper: Maven 3.10 cannot read the parent POM)
+./mvnw test             # Unit tests
+./mvnw verify           # Unit tests + JaCoCo gate (70% instructions, 90% classes)
+```
+
+## Architecture
+
+**Entry point:** `CollaborationQBitProducer implements QBitMetaDataProducer<CollaborationQBitConfig>` in `com.kingsrook.qbits.collaboration`. The producer registers table metadata, possible values and the optional app home.
+
+## Invariants
+
+- The home reads real data with the current session.
+- People are a service-managed directory; direct user writes are denied.
+- Feature settings are audited at FIELD level; writes require `collaboration.admin`.
+- Runtime override application and record feature services await the core contracts.
+
+## Naming (owner rule)
+
+- Tables are lowercase snake_case prefixed with the full qbit name: `collaboration_<name>`. The QQQ table name and the backend (SQL) name are identical; possible-value sources take the table name.
+- Permissions use the full qbit name: `collaboration.<action>` (for example `collaboration.view`, `collaboration.admin`).
+- Qbit data lives in standard, visible QQQ tables, secured by permissions and record security locks, never hidden.
+- Processes run as table or record actions, never in the nav.
+
+## Code Style
+
+- 3-space indentation, opening braces on the next line, `return (x);`.
+- Javadoc flower-box comments (`/*****` with `**` lines) on every class and method.
+- Fluent setters (`withX()`).
+- Wrapper types (`Integer`, `Boolean`) in config and entities.
+
+## Dependencies
+
+- Java 21.
+- Parent `com.kingsrook:qbit-build-parent:2.0.0` (qqq 4.0.0). The default-active `qqq-snapshot` profile imports `qqq-bom-pom:4.1.0-RC.5` ahead of it, as in qbit-quick-search (ADR-0007). Remove that activation when the parent moves to 4.1.
+- Tests: JUnit 5, AssertJ.
+
+## Release
+
+- CircleCI qqq-orb 0.6.8.
+- `develop` publishes SNAPSHOTs.
+- A `release/*` branch publishes RCs (the orb bumps the version).
+- A `v*` tag publishes the release.

CHANGELOG.md

@@ -0,0 +1,34 @@
+# Changelog
+
+All notable changes are documented here, following [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and semantic versioning.
+
+## [Unreleased]
+
+### Added
+
+- Phase-d tag vocabulary and record assignments on QQQ 4.1.0-RC.5; normalized names, FREE/APPROVED_ONLY policy resolved from system-read scoped feature settings, explicit global/manage permissions, parent-checked idempotent assignment, usage counts and TAGGED/UNTAGGED activity without follower notifications.
+- Tags navigation, secured Record Tags child list, FIELD audit, label search, approved/scoped table PVS, streamed Approve/Merge/Delete and configured host Add/Remove actions, parent cleanup and real Tags home metrics. Bulk multi-select intent is exposed in picker metadata for the separate Next UI implementation.
+- Standalone `TagFilterTranslator` for IN/CONTAINS_ALL/NOT_IN/IS_BLANK/IS_NOT_BLANK with a 10,000 matching-ID cap. Filter/quick-search integration lands after QRun-IO/qqq#1140 is released.
+- Tag service, security, vocabulary, settings, schema, cap and streamed Review/Result tests; existing JaCoCo gates retained.
+
+- Phase-e comments/mentions, one-level threads, edit revisions, author/admin soft deletion, resolve/reopen, ranked mention candidates and keyset pagination on QQQ 4.1.0-RC.5.
+- Comments, Comment History, Mentions, Followers, Activity and durable Follow Digests tables, child-list widgets, service-only writes, shared parent-table query restrictions, schema indexes and real home counts.
+- Lazy people-directory upserts with ten-minute throttling from comments/follow/favorites/recents/attachments entry points; bounded active-name/email search.
+- Configurable notifier and recipient-session stand-ins, default no-op and recording transports, conservative unknown-access handling and RC.5 after-commit delivery with fresh access checks.
+- Follow preferences, generic streamed ETL Follow/Unfollow actions, configured RC.5 change listeners and a hidden minute scheduler for five-minute digests.
+- Timeline merging enforced core audit reads with collaboration activity, field-visibility filtering and tuple cursors. Attachments now record FILE_ADDED/FILE_REMOVED activity.
+- Memory-backed tests for recipient access, transactions, moderation, pagination, real ETL Review/Result, digest batching, directory ranking, schema and audit timeline security. Existing JaCoCo gates retained; endpoint publication deferred to #1128.
+
+- Phase-c attachments against QQQ 4.1.0-RC.5 and object storage 0.1.0-RC.2: parent-checked upload/list/download/rename/describe/delete service, bounded streaming, SHA-256 and configurable byte/extension limits.
+- Visible `collaboration_attachment` table, FIELD auditing, file-name/description search fields, virtual presigned FILE_PREVIEW/FILE_DOWNLOAD adornments, PostgreSQL BIGINT size and parent index, and an approximate count/bytes home card.
+- Temporary `ParentRecordAccess`, readable-table query restriction through RC.5's permission hook and parent post-filtering. Panel calls do not require the admin browse grant; direct attachment table writes are service-managed.
+- Streamed ETL **Delete attachments** Review/Result record action and retryable `AttachmentCleanup.onParentsDeleted` callback. No Attach files table action; endpoint integration awaits #1128 and cleanup registration awaits core.
+- Memory-backed attachment/security/process tests. Thumbnails use FILE_PREVIEW; `thumbnailKey` remains nullable/unused because object storage has no generator.
+
+- Repository scaffold; feature settings and people tables.
+- Phase-b favorites and recents on QQQ 4.1.0-RC.5: visible `collaboration_favorite` and `collaboration_recent` tables, target-type possible values, unique personal targets and audit disabled for high-volume data.
+- `CollaborationSecurity` owner locks based on the session user's ID reference, with admin all-access keys and automatic initialization before enforced table actions and in services/home. No collaboration permission is required to manage one's own rows.
+- `FavoritesService` and `FavoriteEntry`: idempotent star/unstar, reorder/folders, refreshed labels, batched record visibility checks, unavailable-target redaction and Next UI paths.
+- `RecentsService`: persisted one-minute throttling, visible newest-first lists (up to 50), and hidden daily `collaborationTrimRecents` scheduling with configurable per-user retention (default 200).
+- Home row/distinct-user summaries, PostgreSQL 15+ unique indexes that treat null record IDs as equal, and memory-backend security/service/retention tests.
+- UI API endpoints (§10.2) deferred to a follow-up PR after QQQ's UI API extension point ([QRun-IO/qqq#1128](https://github.com/QRun-IO/qqq/pull/1128)) is released; no unreleased core classes are required.

CLAUDE.md

@@ -1,17 +1,53 @@
-# qbit-template-extension
+# CLAUDE.md
 
-GitHub template repository for scaffolding QQQ "Extension QBits" (infrastructure-level plugins: table customizers, auth, audit, action wrappers). Not a shipping library — consumers click "Use this template" and rename the `com.kingsrook.qbits.example` package.
+This file provides guidance to Claude Code when working with code in this repository.
 
-## QQQ 4.0 baseline — 2026-09-24
+## Project Overview
 
-The historical review below predates the 4.0 migration. This template targets Java 21 and the public QQQ 4.0.0 release from Maven Central. The corrected APIs, license references and actual template commands are in README.md and docs/00-getting-started.md. Preserve the documented multi-instance and scaffold limitations.
+**QBit Collaboration**: record collaboration for QQQ. Phase a implements feature settings, people tables and the app home. Design: [QRun-IO/qqq#1136](https://github.com/QRun-IO/qqq/pull/1136) (`docs/COLLABORATION.md`). Phases b to i are planned.
 
-## Knowledge base
+## Build Commands
 
-Reviewed dossiers for this repo and the wider QQQ platform live in the second-brain vault:
+```bash
+./mvnw compile          # Compile (always use the wrapper: Maven 3.10 cannot read the parent POM)
+./mvnw test             # Unit tests
+./mvnw verify           # Unit tests + JaCoCo gate (70% instructions, 90% classes)
+```
 
-- Hub / entry point: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/qqq-hub.md`
-- This repo's dossier: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/repos/qbit-template-extension.md`
-- QBit mechanics refresher: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/architecture/metadata-model.md`
+## Architecture
 
-Reviewed at commit `e7d4b4d672cc` (branch `main`, 2026-05-21). Known drift as of that review: no `qbit-build-parent` parent pom (org convention), qqq pinned at 0.35.0 on main (0.40.0-SNAPSHOT on develop), README still claims AGPL-3.0 while LICENSE/NOTICE are Apache-2.0, and README references `scripts/customize_template.py` / `actions/ExampleActionCustomizer.java` which do not exist. See the dossier's "Maturity & risks" and "v4.0 impact" sections before modifying the scaffold.
+**Entry point:** `CollaborationQBitProducer implements QBitMetaDataProducer<CollaborationQBitConfig>` in `com.kingsrook.qbits.collaboration`. The producer registers table metadata, possible values and the optional app home.
+
+## Invariants
+
+- The home reads real data with the current session.
+- People are a service-managed directory; direct user writes are denied.
+- Feature settings are audited at FIELD level; writes require `collaboration.admin`.
+- Runtime override application and record feature services await the core contracts.
+
+## Naming (owner rule)
+
+- Tables are lowercase snake_case prefixed with the full qbit name: `collaboration_<name>`. The QQQ table name and the backend (SQL) name are identical; possible-value sources take the table name.
+- Permissions use the full qbit name: `collaboration.<action>` (for example `collaboration.view`, `collaboration.admin`).
+- Qbit data lives in standard, visible QQQ tables, secured by permissions and record security locks, never hidden.
+- Processes run as table or record actions, never in the nav.
+
+## Code Style
+
+- 3-space indentation, opening braces on the next line, `return (x);`.
+- Javadoc flower-box comments (`/*****` with `**` lines) on every class and method.
+- Fluent setters (`withX()`).
+- Wrapper types (`Integer`, `Boolean`) in config and entities.
+
+## Dependencies
+
+- Java 21.
+- Parent `com.kingsrook:qbit-build-parent:2.0.0` (qqq 4.0.0). The default-active `qqq-snapshot` profile imports `qqq-bom-pom:4.1.0-RC.5` ahead of it, as in qbit-quick-search (ADR-0007). Remove that activation when the parent moves to 4.1.
+- Tests: JUnit 5, AssertJ.
+
+## Release
+
+- CircleCI qqq-orb 0.6.8.
+- `develop` publishes SNAPSHOTs.
+- A `release/*` branch publishes RCs (the orb bumps the version).
+- A `v*` tag publishes the release.

CODE_OF_CONDUCT.md

@@ -0,0 +1,3 @@
+# Code of Conduct
+
+See Project level [Code of Conduct](https://github.com/QRun-IO/qqq/blob/develop/CODE_OF_CONDUCT.md)

CODE_STYLE.md

@@ -0,0 +1,3 @@
+# Code Style Guide
+
+* See Project [Code Style Guide](https://github.com/QRun-IO/qqq/blob/develop/CODE_STYLE.md)

CONTRIBUTING.md

@@ -0,0 +1,5 @@
+# Contributing to QBit Collaboration
+
+Follow the [QQQ contribution guide](https://github.com/QRun-IO/qqq/blob/develop/CONTRIBUTING.md).
+
+Use Java 21 and run `./mvnw verify` before proposing a change. Feature branches target `develop`. Design: [Record Collaboration, PR #1136](https://github.com/QRun-IO/qqq/pull/1136) (`docs/COLLABORATION.md`).

LICENSE

@@ -176,7 +176,7 @@
 
    END OF TERMS AND CONDITIONS
 
-   Copyright 2022-2025 QRunIO, LLC
+   Copyright 2024 Kingsrook, LLC
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

NOTICE

@@ -1,6 +1,6 @@
-qBit Template - Extension
-Copyright 2022-2025 QRunIO, LLC
+QBit Collaboration
+Copyright 2026 Kingsrook, LLC
 
-This product includes software developed at QRunIO, LLC (https://qrun.io/).
+This product includes software developed at Kingsrook, LLC (https://kingsrook.com/).
 
 Licensed under the Apache License, Version 2.0.

README.md

@@ -1,42 +1,283 @@
-# QBit Template: Extension
+# QBit Collaboration
 
-Template repository for creating QQQ Extension QBits - infrastructure extensions, customizers, and action handlers.
+Record collaboration for QQQ: attachments, tags, custom fields, comments with mentions, presence, sharing, favorites, follow, timeline and tasks. **Implemented now:** feature settings and people tables, favorites and recents services (phase b), per-user security, daily recents retention, phase-c attachments (upload/list/download/rename/delete, previews and parent cleanup), and the Collaboration app home with real session-scoped counts. Phase e adds comments/mentions, follow actions and digests, the audit/activity timeline, and automatic people-directory updates. Phase d adds tags, vocabulary policies, management and bulk actions, and standalone filter translation. Phases f to i remain planned; general runtime overrides are still deferred. TAGS mode settings are read directly by the service.
 
-## What is an Extension QBit?
+Design: [QRun-IO/qqq PR #1136](https://github.com/QRun-IO/qqq/pull/1136), `docs/COLLABORATION.md`. See [the phase table](docs/DESIGN.md).
 
-Extension QBits extend or enhance how QQQ operates at the infrastructure/framework level. They provide:
-- New backend implementations
-- Authentication mechanisms
-- Audit capabilities
-- Table customizers
-- Action handlers
+## Requirements
 
-## Quick Start
+- Java 21.
+- QQQ 4.1.0-RC.5 or newer compatible 4.1 release. The build pins RC.5.
+- A configured QQQ backend supporting query, get, insert, update, delete, count and aggregate actions. PostgreSQL 15+ is the intended persistent store (the generated personal-target indexes use `NULLS NOT DISTINCT`); tests use the memory backend.
+- Attachments require `qbit-object-storage:0.1.0-RC.2` (a pinned dependency), installed with a PRIVATE bucket alias matching `attachmentsBucketName`. Configure its connection and credentials in the host; this qbit does not provision buckets.
+- Later phases and runtime overrides need the core contracts from the QQQ collaboration PRs. Favorites and recents use only APIs released in RC.5. String enum ids match the spec until the core collaboration enums are released.
 
-Requires **Java 21**, **Maven 3.8+**, and QQQ **4.0.0**. Create your repository, customize its Maven coordinates and Java package/classes, implement the table customizer, then run `mvn clean verify`. See [Getting Started](docs/00-getting-started.md).
+## Install
 
-## Structure
+Add the dependency (the snapshot must first be published by CI, or installed locally):
 
-```
-src/main/java/com/kingsrook/qbits/example/
-├── ExampleExtensionQBitConfig.java    # Configuration
-├── ExampleExtensionQBitProducer.java  # Entry point
-└── customizers/
-    └── ExampleTableCustomizer.java    # Table customization
+```xml
+<dependency>
+   <groupId>com.kingsrook.qbits</groupId>
+   <artifactId>qbit-collaboration</artifactId>
+   <version>0.1.0-SNAPSHOT</version>
+</dependency>
 ```
 
-## Key Characteristics
+After registering your backend and optional parent app, register the producer:
 
-- **No QAppSection** - Pure infrastructure
-- **No user-facing tables** (or minimal operational)
-- **Wraps existing tables/processes** with new behavior
-- **Validates dependencies** on other QQQ components
+```java
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.CollaborationQBitProducer;
 
-## Documentation
+new CollaborationQBitProducer()
+   .withQBitConfig(new CollaborationQBitConfig()
+      .withBackendName("rdbms")
+      .withParentAppName("admin"))
+   .produce(qInstance);
+```
 
-- [Getting Started](docs/00-getting-started.md)
-- [Extension Patterns](docs/01-extension-patterns.md)
+Omit `withParentAppName` for a top-level app. Run normal QQQ instance validation after all producers.
+
+## Tables
+
+| Table | Purpose |
+|---|---|
+| `collaboration_feature_setting` (Feature Settings) | Scope type (INSTANCE, APP, TABLE), scope name, one of the 12 record features, enabled flag, settings JSON stored as TEXT, permission mode. Unique on scope type + scope name + feature; FIELD-level audit. |
+| `collaboration_user` (People) | Unique session user ID, display name, email, avatar URL, last seen timestamp and active flag. Service-managed, read-only to users. |
+| `collaboration_favorite` (Favorites) | `userId`, `targetType`, `targetName`, optional `recordId`, cached `label`, `sortOrder`, optional `folder`. Unique on user + type + name + record ID. Owner-locked, audit off. |
+| `collaboration_recent` (Recently Viewed) | `userId`, `targetType`, `targetName`, optional `recordId`, cached `label`, `lastViewedAt`, `viewCount`. Same unique key and owner lock; audit off. |
+| `collaboration_attachment` (Attachments) | Parent table and record ID, file metadata, SHA-256, bucket/key, optional description/thumbnail key, author and parent-deleted flag. FIELD audit; parent-based security. Preview/download URLs are virtual, never stored. |
+
+| `collaboration_comment` (Comments) | Markdown body, author, root/reply reference, optional field anchor, latest thread activity, edit/resolve/delete timestamps. FIELD audit and body search. |
+| `collaboration_comment_revision` (Comment History) | Prior body, edit timestamp and editor; comment child list. |
+| `collaboration_mention` (Mentions) | Unique comment + mentioned user, recipient visibility and actual delivery timestamp; comment child list. |
+| `collaboration_follow` (Followers) | Unique parent + user, reason, change/comment notification preferences and mute timestamp. Admin browse only; Followers child list on Comments. |
+| `collaboration_activity` (Activity) | Event time, actor, type, summary and reference. Read-only admin main table. |
+| `collaboration_follow_digest` (Follow Digests) | Service-managed pending five-minute batches, unique parent + recipient, due timestamp and changed-field summaries. Admin browse only, outside navigation. |
+
+All eleven include `id`, `createDate` and `modifyDate`, identity/details/dates sections, and table possible-value sources. SQL table names match metadata table names; SQL columns use snake_case. Use a stable nonempty scope name (convention: `instance` for INSTANCE; the metadata app/table name otherwise). JSON validation and override resolution arrive with the provider, not in this scaffold.
+
+The home reports persisted enabled settings by scope type, people known and people seen within the inclusive last seven days, plus Favorites and Recently viewed row counts and distinct user counts, attachment count and total bytes, comments in the last seven days, open root threads, and follower subscriptions (admins). Attachment aggregates are explicitly approximate until core can mirror parent locks. Recent activity is based on `lastSeenAt`, independently of the directory's `active` account flag. Empty states explain missing data. These counts do not represent resolved feature enablement on host tables.
+
+## Permissions
+
+| Permission | Behavior |
+|---|---|
+| `collaboration.view` | Browse Comments, their revisions/mentions and Attachments; read Feature Settings, People, the app and home. Not required for personal favorites or recents. |
+| `collaboration.admin` | Write feature settings, read the app/home, access all users' favorite/recent rows, and run recents retention. Can moderate others' attachments and delete others' comments after the parent check. Browses Followers, Activity and Follow Digests. Does not permit editing another author's comment or bypassing service-only table writes. |
+| `collaboration.fields.manage` | Reserved constant for the later custom-field designer. |
+| `collaboration.tags.manage` | Reserved constant for later tag management. |
+
+These use the reference qbit's custom `QPermissionRules` checker. Extra permissions are constants, not automatically registered catalog entries. Configure permission grants in your host. Home count actions explicitly enforce permissions; attachment totals have the parent-lock approximation described below. Hosts should enable `qInstance.setEnforcePermissionsInCoreActions(true)` for direct model API calls as well as middleware checks.
+
+Personal tables use `PermissionLevel.NOT_PROTECTED` with a `READ_AND_WRITE` owner lock on `userId`. Every signed-in user can manage their own rows. `CollaborationSecurity` derives `collaboration_user` from `QSession.getUser().getIdReference()` and gives `collaboration_user_all_access` to admins. Its custom permission checker initializes keys before enforced table actions; services and the home also call `ensureSessionKeys`. Hosts may call `applyToSession(qInstance, session)` after authentication. Refreshing keys also removes revoked admin access. System sessions are untouched; create scheduler system sessions after the full instance is registered so QQQ includes the all-access key.
+
+Favorites and recents are omitted from app nav sections. They remain normal, addressable QQQ tables, including for admin inspection. The header and palette will use the services through the follow-up API. These two personal tables intentionally skip audit logging. Personal service methods explicitly filter the current owner even when called by an admin; they never elevate the session. Use standard table actions for admin-wide management.
+
+## Favorites and recents services
+
+Call these static methods inside the caller's `QContext`:
+
+```java
+FavoritesService.star("RECORD", "order", "123");
+FavoritesService.star("TABLE", "order", null);
+List<FavoriteEntry> favorites = FavoritesService.list();
+FavoritesService.reorder(List.of(12, 8), Map.of(12, "Work"));
+FavoritesService.unstar("RECORD", "order", "123");
+
+RecentsService.recordView("RECORD", "order", "123");
+List<FavoriteEntry> recents = RecentsService.list(50);
+```
+
+`FavoritesService` and `FavoriteEntry` are in `com.kingsrook.qbits.collaboration.favorites`; `RecentsService` is in `com.kingsrook.qbits.collaboration.recents`. Target types are `TABLE`, `APP`, `RECORD`, `PROCESS`, `REPORT` and `SAVED_VIEW`. Only `RECORD` accepts a non-null record ID. For `SAVED_VIEW`, `targetName` is the saved view ID; the instance must contain a readable core `savedView` table and the view's target table must also be readable.
+
+- Star and unstar are idempotent. New stars append to the existing sort order. Reorder moves the supplied IDs first and preserves the order of omitted favorites; folder entries may be null to clear a folder. All supplied IDs must belong to the current user.
+- Targets are checked using core table/app/process/report permissions; record targets use `GetAction` and the session's record locks. Invisible and missing targets both fail with `Not found`.
+- Lists refresh labels, using one batched record query per target table per batch. Favorites retain unavailable entries as `available=false`, `label="Unavailable"`, `href=null`; the cached label is never returned. Unstar remains possible after access is lost. Recents drop unavailable entries and refill from older rows up to the requested limit (1–50).
+- `FavoriteEntry` contains `id`, `targetType`, `targetName`, `recordId`, `label`, `folder`, `sortOrder`, `available` and `href`. Recents use the same target DTO in newest-first order; their folder and sort order are null. `viewCount` and `lastViewedAt` remain available on the underlying recent table.
+- Hrefs mirror Next's accepted flat routes: `/app/<table>/`, `/app/<table>/<id>/`, `/app/<app-or-process-or-report>/`, and `/app/<table>/savedView/<id>/`. Segments are URL-encoded. This avoids reconstructing nested app paths; trailing slashes support dotted process names.
+- Record views upsert a unique personal target. If its persisted `lastViewedAt` is less than 60 seconds ago, nothing is written; otherwise its timestamp, cached label and count update. The hidden backend-only `collaborationTrimRecents` process retains the newest `recentsPerUser` targets independently for each user, breaking timestamp ties by ID.
+
+The UI API endpoints in spec §10.2 will arrive in a **follow-up PR once QQQ's UI API extension point ([QRun-IO/qqq#1128](https://github.com/QRun-IO/qqq/pull/1128)) is released**. This PR adds no endpoint or unreleased core dependency. Runtime feature overrides and the record-feature summary SPI also await released core contracts; the home counts are implemented now.
+
+## Attachments
+
+Call the service inside the caller's `QContext`; configure object storage before using it:
+
+```java
+AttachmentsService attachments = new AttachmentsService();
+AttachmentEntry added = attachments.upload("order", "123", "invoice.pdf", "application/pdf", stream, "Signed invoice");
+List<AttachmentEntry> files = attachments.list("order", "123");
+URL download = attachments.downloadUrl(added.id(), false);
+attachments.rename(added.id(), "invoice-final.pdf", null); // null leaves a field unchanged
+attachments.describe(added.id(), "");                    // empty clears the description
+attachments.delete(List.of(added.id()));
+```
+
+Uploads check the parent and `attach`, count bytes and compute SHA-256 while streaming to a temporary file, then stream that file through object storage. This keeps memory bounded and rejects oversize files before a put. Temporary files are removed on success and failure; the caller owns the input stream. A failed row insert triggers object cleanup. Storage and SQL are not a distributed transaction: a cleanup failure is attached to the original error and requires operational reconciliation. Deletion removes the object first and retains the row on a storage failure for retry.
+
+File names are reduced to a safe basename (maximum 255 characters). Object keys are `attachments/{table}/{recordId}/{uuid}/{fileName}`; table/id segments are URL-encoded to protect string primary keys containing slashes. Renames change the display name and subsequent download filename, retaining the original storage key. `AttachmentEntry` returns display metadata, creation time and `canDelete` (author or admin); it omits bucket/key and signed URLs. Lists are newest first. Changing or deleting an own row also rechecks `attach`; admins may moderate another author's row but must still see its parent. A batch authorizes all selected rows before deleting its first object.
+
+**Permission model.** The panel service checks the parent with an enforced `GetAction` under the caller's session. Missing, unreadable and locked parents produce `QNotFoundException("Not found")`. Upload requires `<permissionBaseName>.attach` or table EDIT plus a visible parent. This is the explicitly temporary approximation of write-lock checks; distinct WRITE-only parent locks are not enforced until core's record-reference helper is released. Explicit `attach` grants work without EDIT. Collaboration tables cannot themselves be parents.
+
+The admin Attachments table additionally requires `collaboration.view` (or `collaboration.admin`). The panel service bypasses that browse grant only after its own parent/feature/ownership checks. Direct table insert/update/delete is denied; use the service and record action so storage and rows remain coordinated. Storage operations use `ObjectStorage.asSystem("collaboration", runId).bucket(alias)` after these checks, preserving calling-qbit/initiating-user operation logging without requiring users to hold `object_storage.*` grants.
+
+RC.5 has no PRE_QUERY customizer. `AttachmentSecurity` uses its custom permission checker as the pre-query hook, adding `tableName IN (readable parent tables)` to queries, counts and aggregates. Enable core permission enforcement for direct model API use. A POST_QUERY customizer checks each row's parent and removes invisible rows before signing any URLs. This applies to direct get/query as well as browsing. **Counts and aggregate bytes are approximate, and pages may be short** because parent record locks are checked after querying; the home labels the approximation. RC.5 cannot publish an `approximate` flag or refill pages through this hook. Replace this stand-in with core's record-reference security when released. Per-table feature enablement/settings and permission catalog integration also await those contracts.
+
+**Preview and download.** The record view has `FILE_PREVIEW` and `FILE_DOWNLOAD` virtual fields, filled with five-minute presigned GETs only for visible rows (up to 200 rows per query). Downloads use RC.2's `PresignGet.downloadAs(fileName)`. RC.2 has no arbitrary response-header override for explicit inline disposition, so uploads store `Content-Disposition: inline`, and previews leave that header unchanged. URLs are never persisted. Images/PDF use the standard media preview; the host must allow its storage host in the frontend CSP (PDF frames need compatible `frame-src`). `thumbnailKey` is nullable and unused: object storage has no thumbnail generator, so thumbnails use FILE_PREVIEW rather than generated thumbnail files.
+
+**Actions and cleanup.** `Delete attachments` is a standard streamed ETL record action with Review/Result counts, skipped unauthorized rows, permission rechecks at execution and per-row failure summaries. It is not in navigation. Soft deletion follows the bucket's versioning/trash; without either, deletion is permanent. There is deliberately no **Attach files** table action: uploads come through the API/panel. The current browse action requires `collaboration.view`; the panel may call the service without that grant.
+
+After a parent deletion commits, trusted host code can call `new AttachmentCleanup().onParentsDeleted(table, ids)`. It deletes objects and rows in batches and is retryable. It cannot check an already-deleted parent and must never be exposed as a user endpoint. Wiring to core's `RecordReferenceCleanupInterface` waits for its release. UI API endpoints and the panel transport wait for [#1128](https://github.com/QRun-IO/qqq/pull/1128); direct/presigned upload endpoints and realtime events remain future integrations. Upload/delete now write FILE_ADDED/FILE_REMOVED activity. The table declares `fileName`/`description` search fields and uses normal QQQ writes, so host-configured record-change/ESB listeners receive events; this qbit does not install an ESB publication or Quick Search provider.
+
+Tests use real QQQ memory actions and record locks plus an in-memory `AttachmentStorage` adapter. Object storage RC.2 exposes no fake bucket; its provider conformance suite uses MinIO/Testcontainers. This suite requires no Docker and does not claim MinIO/S3 conformance.
+
+## Comments, follow and timeline
+
+Run services in the caller's `QContext`. Register host tables before producing the qbit when using the follow configuration lists:
+
+```java
+config.withNotifier(new QCodeReference(MyCollaborationNotifier.class))
+   .withUserSessionSupplier(new QCodeReference(MyUserSessions.class))
+   .withFollowActionTables(List.of("order"))
+   .withFollowChangeTables(List.of("order"))
+   .withSchedulerName("scheduler");
+
+CommentsService comments = new CommentsService();
+CommentEntry root = comments.post("order", "123", "Please review @[Sam](user:sam)", null, null);
+CommentEntry reply = comments.post("order", "123", "Reply", root.id(), null);
+CommentPage page = comments.list("order", "123", null, 20);
+comments.edit(reply.id(), "Updated reply");
+comments.history(reply.id());
+comments.resolve(root.id());
+comments.reopen(root.id());
+comments.delete(reply.id());
+comments.mentionCandidates("order", "123", "Sam");
+
+FollowService follow = new FollowService();
+follow.follow("order", "123", null, null);
+follow.state("order", "123");
+follow.followers("order", "123");
+follow.unfollow("order", "123");
+TimelinePage timeline = new TimelineService().timeline("order", "123", null, 20, Set.of());
+```
+
+Classes live in the `comments`, `follow`, `timeline`, `people` and `notify` packages under `com.kingsrook.qbits.collaboration`.
+
+- Comments require visible parents and the `comment` feature check (explicit `<table>.comment` or table EDIT). Markdown is nonblank and at most 20,000 characters; clients must sanitize rendered HTML. Replies to replies attach to the root. Roots have null `threadId`; replies store the root ID in both thread/parent fields. Deleted DTO bodies are null. Authors alone edit; authors with comment permission or admins delete. Resolve/reopen applies only to roots. History follows parent READ.
+- Mentions use `@[Name](user:<userId>)`, deduplicate IDs and reject more than 50. `OtherUserAccess.canRead` returns `Optional<Boolean>` using a supplied recipient session and an enforced GetAction in a temporary context. Missing providers/sessions and mismatched identities are unknown. False/unknown recipients get neither record data nor automatic follows. Edits notify only previously unmentioned users. Mention delivery and ordinary follower delivery are deduplicated; authors never receive their own comment notifications.
+- `CommentEntry` includes author display name, capabilities, deleted/resolved state, mentions with visibility, and ordered replies. `CommentPage` pages 1–50 root threads by latest activity then ID, with replies oldest first. Pass `nextCursor` unchanged. Cursors are opaque, versioned Base64 tuple encodings, not authorization tokens.
+- Manual/assigned follow creation defaults change notifications on; other reasons default them off. Comment notifications default on. Existing preferences survive automatic follows and repeated calls; non-null arguments to `follow` change preferences. Follow needs only parent READ. The internal `ensureFollower` helper also verifies other-user access. Muted subscriptions are skipped until `mutedUntil` expires.
+- `FollowProcesses.processesFor(tableName)` returns the same Follow/Unfollow processes for manual host registration. Review performs no writes; Result rechecks permissions and reports successes/failures. They work with the host's actual primary-key field, not just `id`, and are never navigation entries.
+- RC.5 has `RecordChangeListenerInterface` and `QBackendTransaction.addAfterCommitCallback`. The configured UPDATE listener queues changed-field summaries after commit, excluding the actor's own subscription. The trusted `FollowChangeBatcher.recordChange` helper may also be called by host code after its write commits. `collaborationSendFollowDigests` runs every minute and sends batches due five minutes after their first change, rechecking preferences, mute and recipient access. Pending data survives process restarts. Run one digest scheduler per installation; local synchronization is not a distributed lock. A transport crash after delivery but before row deletion can cause a retry; an adapter needing exactly-once delivery must provide idempotency.
+- Notifications carry recipient ID, title, markdown body, MENTION/SHARE/FOLLOW/TASK category, source table/record and `/app/<table>/<id>` href. Without a transport, `NoOpNotifier` sends nothing and activity remains available. With a `QContext` transaction, delivery waits for commit and is discarded on rollback; otherwise it follows the write immediately. Access is checked again at delivery. Mention `notifiedAt` is recorded only after a real transport returns successfully. `RecordingNotifier` provides an in-memory test sink.
+- Timeline merges collaboration activity and RC.5 `audit`/`auditDetail`/`auditTable`/`auditUser` through enforced QueryActions. Missing or denied audit access omits that stream. Audit details exclude fields absent from the caller's personalized table. Core audits have actor names but no session user IDs, so their `actorUserId` is null. Paging uses `(at, kind, id)`; `types` accepts AUDIT, ACTIVITY or individual activity type names. Each source query is bounded before merging.
+- `PeopleService.touch()` upserts the signed-in user's full name and last-seen timestamp at most once per ten minutes, using the persisted timestamp. Comments/follow and existing favorites/recents/attachment entry points call it. `search(q, limit)` matches active users' names/emails case-insensitively. QUser in RC.5 has no email/avatar fields; trusted directory integrations can enrich those columns. Mention candidates rank followers/commenters before applying the 50-result limit.
+
+The main comments/activity tables, revision/mention child joins and Followers child list are ordinary QQQ metadata. Direct API writes are refused; services authorize the actual parent. Shared `ParentTableRestriction` protects attachment and conversation queries/counts/aggregates; parent post-filtering protects row reads. Aggregate counts remain approximate and browse pages can be short for unmirrored parent locks. Raw persistence, activity writing and change-hook helpers are trusted internal boundaries and must not become public endpoints.
+
+UI API endpoints remain deferred to [QRun-IO/qqq#1128](https://github.com/QRun-IO/qqq/pull/1128). Runtime feature enablement, mirrored WRITE locks and core record-access/session contracts remain replacement points; the services do not claim to resolve feature-setting overrides. QAlerts.notify integration waits for #1125. Host-configured ESB listeners receive ordinary QQQ writes; realtime/UI and Quick Search provider registration remain host/later-phase integrations.
+
+## Configuration
+
+| Property | Default | Meaning |
+|---|---|---|
+| `backendName` | Required | Existing QQQ backend used by all eleven tables. |
+| `schedulerName` | None | Existing scheduler for daily recents trimming and minute-by-minute follow digest delivery. Without it, both hidden processes remain available for explicit admin/system execution. |
+| `attachmentsBucketName` | `collaboration` | PRIVATE object-storage bucket alias for new uploads; existing rows retain their bucket alias. |
+| `defaultMaxBytes` | `104857600` (100 MiB) | Positive byte limit, capped by the bucket's `maxUploadBytes`. |
+| `blockedExtensions` | Empty | Case-insensitive extension denylist, with or without leading dots. |
+| `recentsPerUser` | `200` | Positive retention count per user. Enforced by the trim process. |
+| `notifier` | `QCodeReference(NoOpNotifier.class)` | Implements `CollaborationNotifier`; replace with a QAlerts.notify adapter when QRun-IO/qqq#1125 is released. |
+| `userSessionSupplier` | None | `QCodeReference` implementing `UserSessionSupplier`; missing user sessions mean unknown access. |
+| `followActionTables` | Empty | Existing host tables to receive standard Follow and Unfollow Review/Result processes. |
+| `followChangeTables` | Empty | Existing host tables whose UPDATE events should produce five-minute follow digests. |
+| `appName` | `collaboration` | Metadata name of the app. |
+| `parentAppName` | None | Optional existing parent, such as `admin`. |
+| `adminApp` | `true` | Set false to omit the app/home. Record child-list widgets remain available. |
+
+## Adopting in another app
+
+1. Register the host backend and optional Admin app, then invoke the producer above.
+2. For PostgreSQL, generate `CollaborationSchema.postgresScript(config)` and apply it with the host's migration tool. It creates tables and unique indexes, never executes DDL, and does not migrate existing schemas. QQQ owns date/default values on writes.
+3. Grant `collaboration.view` and `collaboration.admin` as appropriate; wire the host's audit persistence for FIELD audit events.
+4. Validate the assembled instance. Navigate to Collaboration for Comments, Attachments, Activity (admins), Feature Settings and People. People populate as signed-in users call collaboration services.
+5. Wait for the released core contracts and later qbit phases before enabling collaboration features on host records. Favorites, recents, attachments, comments, follow and timeline services can be used now. This phase installs no endpoints or host-table overlays; scheduled work is opt-in.
+
+## Build
+
+Always use the Maven 3.9.11 wrapper (Maven 3.10 cannot read the parent POM):
+
+```sh
+./mvnw verify
+```
+
+Offline verification: `./mvnw -o -q verify` (Windows: `./mvnw.cmd -o -q verify`). Verification runs Checkstyle, JUnit tests and JaCoCo gates: 70% instructions and 90% classes.
 
 ## License
 
-See [LICENSE](LICENSE) and [NOTICE](NOTICE).
+[Apache License 2.0](LICENSE). Copyright 2026 Kingsrook, LLC; see [NOTICE](NOTICE).
+
+## Tags
+
+Phase d builds against **QQQ 4.1.0-RC.5**. Register host actions with
+`config.withTagActionTables(List.of("order"))`; `withDefaultTagMode("FREE")` is the
+default. Set `collaboration_feature_setting.feature = TAGS` and JSON
+`{"mode":"APPROVED_ONLY"}` to require approval. The service reads settings as the
+system, in TABLE → preferred APP → INSTANCE order, falling back to config. The
+first scope containing `mode` wins; `enabled` remains part of future general
+feature resolution. Invalid policy JSON or mode fails closed.
+
+`TagsService` provides:
+
+- `vocabulary(table, query, limit)`: global and table vocabulary, approved tags plus
+  the caller's pending suggestions, excluding merged aliases; usage descending,
+  then label. Default limit 20, maximum 100.
+- `create(tableOrNull, label, color)`: trimmed, lowercase, collapsed name of 1–60
+  characters; the label retains its case. Duplicate names reuse the existing tag.
+  Per-table creation requires `<table>.tag` or table EDIT and READ. FREE creates
+  approved tags; APPROVED_ONLY creates suggestions unless the caller holds
+  `collaboration.tags.manage`. Global creation always requires that manage grant.
+- `tagsFor(table, recordId)` and `apply(table, recordId, add, remove)`: parent READ
+  and record locks are checked first. Writes also require the tag feature grant or
+  EDIT. Numeric values are tag IDs; strings are labels. Unknown add labels are
+  created in FREE; in APPROVED_ONLY they fail with
+  “Pick an approved tag (or suggest one)”. Pending tags cannot be applied by anyone.
+  Repeated changes are idempotent; actual changes write TAGGED/UNTAGGED activity,
+  recount usage, and do not notify followers.
+
+Tags is a main navigation table with FIELD auditing and native label search.
+Record Tags is a secured child list. Both use service-managed writes. Standard
+streamed **Approve tags**, **Merge tags**, and **Delete tags** actions require
+`collaboration.tags.manage`; Delete Review counts distinct affected parents.
+Merge deduplicates references and retains the source as an alias. Targets must be
+approved and in the source scope or global; a global source cannot merge into a
+single table's vocabulary.
+
+Host **Add tags** and **Remove tags** actions use the table-type
+`collaboration_tag` PVS, filtered to approved, unmerged global or same-table tags.
+Each record is rechecked during Review and execution. Input `tags` is a list of
+integer IDs (comma-separated IDs are also accepted); `targetTagId` is a scalar.
+The picker step exposes `EDIT_FORM` with `multiSelectFields = ["tags"]`. RC.5 has
+no native multi-valued field type: rendering this component-value contract as a
+multi-select belongs to the separate Next UI phase. The qbit tests exercise the
+submitted arrays and real streamed Review/Result lifecycle.
+
+`AttachmentCleanup.onParentsDeleted` now also removes tag assignments and
+recounts vocabulary usage. Hosts keep using this trusted callback until the core
+cleanup registration contract ships. The home shows session-visible vocabulary
+size, pending suggestions, and the five most-used approved tags.
+
+`TagFilterTranslator.recordIds(table, operatorName, tags)` supports `IN` (any),
+`CONTAINS_ALL`, `NOT_IN` (none), `IS_BLANK`, and `IS_NOT_BLANK`. Every operator
+returns matching visible parent IDs as strings, including complements. Exactly
+10,000 results are allowed; larger results throw. Unknown tags match nothing;
+empty IN matches nothing and empty CONTAINS_ALL/NOT_IN match all visible parents.
+Numeric inputs are IDs, strings are normalized names; if a global and local tag
+share a name, the global tag wins (use IDs to disambiguate).
+
+**Filter/quick-search integration lands after QRun-IO/qqq#1140 is released.** This
+phase does not register a virtual filter field, core expander, `QSubQuery`, tag
+column filler, or `#tag`/host-record quick-search provider. The standalone
+translator deliberately imports none of those unreleased types.

SECURITY.md

@@ -0,0 +1,4 @@
+# Security Policy
+
+ * See Project [Security Policy](https://github.com/QRun-IO/qqq/blob/develop/SECURITY.md)
+ * Report a vulnerability privately through this repository's **Security** tab ("Report a vulnerability").

checkstyle/config.xml

@@ -0,0 +1,246 @@
+<?xml version="1.0"?>
+<!--
+  ~ QQQ - Low-code Application Framework for Engineers.
+  ~ Copyright (C) 2021-2022.  Kingsrook, LLC
+  ~ 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+  ~ contact@kingsrook.com
+  ~ https://github.com/Kingsrook/
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~     https://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<!DOCTYPE module PUBLIC
+        "-//Puppy Crawl//DTD Check Configuration 1.3//EN"
+        "http://checkstyle.sourceforge.net/dtds/configuration_1_3.dtd">
+<!--
+   See reference at https://checkstyle.sourceforge.io/checks.html
+-->
+<module name = "Checker">
+   <property name="charset" value="UTF-8"/>
+
+   <property name="severity" value="warning"/>
+
+   <property name="fileExtensions" value="java, properties, xml"/>
+   <!-- Checks for whitespace                        -->
+   <!-- See http://checkstyle.sf.net/config_whitespace.html -->
+   <module name="FileTabCharacter">
+      <property name="eachLine" value="true"/>
+   </module>
+
+   <!--
+   <module name="LineLength">
+      <property name="max" value="100"/>
+      <property name="ignorePattern" value="^package.*|^import.*|a href|href|http://|https://|ftp://"/>
+   </module>
+   -->
+
+   <module name="TreeWalker">
+      <module name="SuppressWarningsHolder"/>
+      <module name="OuterTypeFilename"/>
+      <module name="IllegalTokenText">
+         <property name="tokens" value="STRING_LITERAL, CHAR_LITERAL"/>
+         <property name="format" value="\\u00(09|0(a|A)|0(c|C)|0(d|D)|22|27|5(C|c))|\\(0(10|11|12|14|15|42|47)|134)"/>
+         <property name="message" value="Consider using special escape sequence instead of octal value or Unicode escaped value."/>
+      </module>
+      <module name="AvoidEscapedUnicodeCharacters">
+         <property name="allowEscapesForControlCharacters" value="true"/>
+         <property name="allowByTailComment" value="true"/>
+         <property name="allowNonPrintableEscapes" value="true"/>
+      </module>
+      <module name="AvoidStarImport"/>
+      <module name="OneTopLevelClass"/>
+      <module name="NoLineWrap"/>
+      <module name="EmptyBlock">
+         <property name="option" value="TEXT"/>
+         <property name="tokens" value="LITERAL_TRY, LITERAL_FINALLY, LITERAL_IF, LITERAL_ELSE, LITERAL_SWITCH"/>
+      </module>
+      <module name="NeedBraces"/>
+      <module name="LeftCurly">
+         <property name="option" value="nl"/>
+      </module>
+      <module name="RightCurly">
+         <property name="option" value="alone"/>
+      </module>
+      <!--
+      <module name="WhitespaceAround">
+         <property name="allowEmptyConstructors" value="true"/>
+         <property name="allowEmptyMethods" value="true"/>
+         <property name="allowEmptyTypes" value="true"/>
+         <property name="allowEmptyLoops" value="true"/>
+         <message key="ws.notFollowed"
+          value="WhitespaceAround: ''{0}'' is not followed by whitespace. Empty blocks may only be represented as '{}' when not part of a multi-block statement (4.1.3)"/>
+          <message key="ws.notPreceded"
+          value="WhitespaceAround: ''{0}'' is not preceded with whitespace."/>
+      </module>
+      -->
+      <module name="OneStatementPerLine"/>
+      <module name="MultipleVariableDeclarations"/>
+      <module name="ArrayTypeStyle"/>
+      <module name="MissingSwitchDefault"/>
+      <module name="FallThrough"/>
+      <module name="UpperEll"/>
+      <module name="ModifierOrder"/>
+      <module name="EmptyLineSeparator">
+         <property name="allowNoEmptyLineBetweenFields" value="true"/>
+      </module>
+      <module name="SeparatorWrap">
+         <property name="id" value="SeparatorWrapDot"/>
+         <property name="tokens" value="DOT"/>
+         <property name="option" value="nl"/>
+      </module>
+      <module name="SeparatorWrap">
+         <property name="id" value="SeparatorWrapComma"/>
+         <property name="tokens" value="COMMA"/>
+         <property name="option" value="EOL"/>
+      </module>
+      <module name="SeparatorWrap">
+         <!-- ELLIPSIS is EOL until https://github.com/google/styleguide/issues/258 -->
+         <property name="id" value="SeparatorWrapEllipsis"/>
+         <property name="tokens" value="ELLIPSIS"/>
+         <property name="option" value="EOL"/>
+      </module>
+      <module name="SeparatorWrap">
+         <!-- ARRAY_DECLARATOR is EOL until https://github.com/google/styleguide/issues/259 -->
+         <property name="id" value="SeparatorWrapArrayDeclarator"/>
+         <property name="tokens" value="ARRAY_DECLARATOR"/>
+         <property name="option" value="EOL"/>
+      </module>
+      <module name="SeparatorWrap">
+         <property name="id" value="SeparatorWrapMethodRef"/>
+         <property name="tokens" value="METHOD_REF"/>
+         <property name="option" value="nl"/>
+      </module>
+      <module name="PackageName">
+         <property name="format" value="^[a-z]+(\.[a-z][a-z0-9]*)*$"/>
+         <message key="name.invalidPattern"
+          value="Package name ''{0}'' must match pattern ''{1}''."/>
+      </module>
+      <module name="TypeName">
+         <message key="name.invalidPattern"
+          value="Type name ''{0}'' must match pattern ''{1}''."/>
+      </module>
+      <module name="MemberName">
+         <property name="format" value="^[_a-zA-Z]([a-z0-9A-Z][a-zA-Z0-9]*)?$"/>
+         <message key="name.invalidPattern" value="Member name ''{0}'' must match pattern ''{1}''."/>
+      </module>
+      <module name="ParameterName">
+         <property name="format" value="^[a-zA-Z]([a-z0-9A-Z][a-zA-Z0-9]*)?$"/>
+         <message key="name.invalidPattern" value="Parameter name ''{0}'' must match pattern ''{1}''."/>
+      </module>
+      <module name="CatchParameterName">
+         <property name="format" value="^[a-zA-Z]([a-z0-9A-Z][a-zA-Z0-9]*)?$"/>
+         <message key="name.invalidPattern" value="Catch parameter name ''{0}'' must match pattern ''{1}''."/>
+      </module>
+      <module name="LocalVariableName">
+         <property name="tokens" value="VARIABLE_DEF"/>
+         <property name="format" value="^[a-zA-Z]([a-z0-9A-Z][a-zA-Z0-9]*)?$"/>
+         <message key="name.invalidPattern" value="Local variable name ''{0}'' must match pattern ''{1}''."/>
+      </module>
+      <module name="ClassTypeParameterName">
+         <property name="format" value="(^[A-Z][0-9]?)$|([A-Z][_A-Z0-9]*$)"/>
+         <message key="name.invalidPattern" value="Class type name ''{0}'' must match pattern ''{1}''."/>
+      </module>
+      <module name="MethodTypeParameterName">
+         <property name="format" value="(^[A-Z][0-9]?)$|([A-Z][_A-Z0-9]*$)"/>
+         <message key="name.invalidPattern" value="Method type name ''{0}'' must match pattern ''{1}''."/>
+      </module>
+      <module name="InterfaceTypeParameterName">
+         <property name="format" value="(^[A-Z][0-9]?)$|([A-Z][_A-Z0-9]*$)"/>
+         <message key="name.invalidPattern" value="Interface type name ''{0}'' must match pattern ''{1}''."/>
+      </module>
+      <module name="NoFinalizer"/>
+      <module name="GenericWhitespace">
+         <message key="ws.followed" value="GenericWhitespace ''{0}'' is followed by whitespace."/>
+         <message key="ws.preceded" value="GenericWhitespace ''{0}'' is preceded with whitespace."/>
+         <message key="ws.illegalFollow" value="GenericWhitespace ''{0}'' should followed by whitespace."/>
+         <message key="ws.notPreceded" value="GenericWhitespace ''{0}'' is not preceded with whitespace."/>
+      </module>
+      <module name="Indentation">
+         <property name="basicOffset" value="3"/>
+         <property name="braceAdjustment" value="0"/>
+         <property name="caseIndent" value="3"/>
+         <property name="throwsIndent" value="6"/>
+         <property name="lineWrappingIndentation" value="3"/>
+         <property name="arrayInitIndent" value="6"/>
+      </module>
+      <!--
+      <module name="AbbreviationAsWordInName">
+         <property name="ignoreFinal" value="false"/>
+         <property name="allowedAbbreviationLength" value="1"/>
+      </module>
+      <module name="OverloadMethodsDeclarationOrder"/>
+      <module name="VariableDeclarationUsageDistance"/>
+      <module name="CustomImportOrder">
+         <property name="sortImportsInGroupAlphabetically" value="true"/>
+         <property name="separateLineBetweenGroups" value="true"/>
+         <property name="customImportOrderRules" value="STATIC###THIRD_PARTY_PACKAGE"/>
+      </module>
+      -->
+      <module name="CustomImportOrder">
+         <property name="customImportOrderRules" value="SPECIAL_IMPORTS###STANDARD_JAVA_PACKAGE###THIRD_PARTY_PACKAGE###STATIC"/>
+         <property name="specialImportsRegExp" value="^javax\."/>
+         <property name="standardPackageRegExp" value="^java\."/>
+         <property name="sortImportsInGroupAlphabetically" value="true"/>
+         <property name="separateLineBetweenGroups" value="false"/>
+      </module>
+      <module name="MethodParamPad"/>
+      <module name="NoWhitespaceBefore">
+         <property name="tokens" value="COMMA, SEMI, POST_INC, POST_DEC, DOT, ELLIPSIS, METHOD_REF"/>
+         <property name="allowLineBreaks" value="true"/>
+      </module>
+      <module name="ParenPad"/>
+      <module name="OperatorWrap">
+         <property name="option" value="NL"/>
+         <property name="tokens" value="BAND, BOR, BSR, BXOR, DIV, EQUAL, GE, GT, LAND, LE, LITERAL_INSTANCEOF, LOR, LT, MINUS, MOD, NOT_EQUAL, PLUS, QUESTION, SL, SR, STAR, METHOD_REF "/>
+      </module>
+      <module name="AnnotationLocation">
+         <property name="id" value="AnnotationLocationMostCases"/>
+         <property name="tokens" value="CLASS_DEF, INTERFACE_DEF, ENUM_DEF, METHOD_DEF, CTOR_DEF"/>
+      </module>
+      <module name="AnnotationLocation">
+         <property name="id" value="AnnotationLocationVariables"/>
+         <property name="tokens" value="VARIABLE_DEF"/>
+         <property name="allowSamelineMultipleAnnotations" value="true"/>
+      </module>
+      <module name="JavadocMethod">
+         <property name="allowMissingParamTags" value="true"/>
+         <property name="allowMissingReturnTag" value="true"/>
+         <property name="allowedAnnotations" value="Override, Test"/>
+      </module>
+      <module name="MissingJavadocMethod">
+         <property name="scope" value="private"/>
+      </module>
+      <module name="MissingJavadocType">
+         <property name="scope" value="private"/>
+      </module>
+      <module name="MethodName">
+         <property name="format" value="^[a-z][a-zA-Z0-9_]*$"/>
+         <message key="name.invalidPattern"
+          value="Method name ''{0}'' must match pattern ''{1}''."/>
+      </module>
+      <module name="EmptyCatchBlock">
+         <property name="exceptionVariableName" value="expected"/>
+      </module>
+      <module name="CommentsIndentation"/>
+
+      <!-- this would be nice, but requires the the @inheritDoc javadoc tag... -->
+      <module name="MissingOverride"/>
+
+   </module>
+   <module name="Header">
+     <property name="headerFile" value="checkstyle/license.txt"/>
+     <property name="fileExtensions" value="java"/>
+     <property name="ignoreLines" value="3"/>
+   </module>
+   <module name="SuppressWarningsFilter"/>
+</module>

checkstyle/license.txt

@@ -0,0 +1,19 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */

docs/00-getting-started.md

@@ -1,28 +0,0 @@
-# Getting Started
-
-Targets Java 21, Maven 3.8 or later, and QQQ 4.0.0. Maven resolves the framework dependencies from Maven Central.
-
-1. Choose **Use this template** on GitHub, then clone the repository you created.
-2. In `pom.xml`, set your own `groupId`, `artifactId`, name, description, and version.
-3. Use your IDE's package refactoring to rename `com.kingsrook.qbits.example` throughout `src/`. Rename the `Example*` classes and update their imports and references with the IDE's rename refactoring.
-4. Update the QBit producer's `GROUP_ID`, `ARTIFACT_ID`, and `VERSION` constants to match your project. Give the metadata names their own stable names before combining the QBit with other examples.
-5. Build the generated project:
-
-```bash
-mvn clean verify
-```
-
-The repository provides example Java sources; customization uses normal package/class refactoring. Keep example coordinates unpublished. After customizing, add tests for your QBit's behavior before setting up its publishing workflow.
-
-## Register with a host application
-
-The following uses the original example names; substitute the names chosen above:
-
-```java
-new ExampleExtensionQBitProducer()
-   .withConfig(new ExampleExtensionQBitConfig()
-      .withTargetTableName("order"))
-   .produce(qInstance, "my-extension");
-```
-
-Register the target table before producing the extension, then implement its customizer. See [Extension Patterns](01-extension-patterns.md).

docs/01-extension-patterns.md

@@ -1,16 +0,0 @@
-# Extension Patterns
-
-[ExampleExtensionQBitProducer](../src/main/java/com/kingsrook/qbits/example/ExampleExtensionQBitProducer.java) registers the QBit identity and calls `applyTableCustomizations` for the configured target. That method is the extension point: look up the table, validate that it exists, and call your customized [ExampleTableCustomizer](../src/main/java/com/kingsrook/qbits/example/customizers/ExampleTableCustomizer.java).
-
-```java
-QTableMetaData table = qInstance.getTable(tableName);
-if(table == null)
-{
-   throw new QException("Target table not found: " + tableName);
-}
-new ExampleTableCustomizer().customize(table);
-```
-
-When implementing this method, add `throws QException` to its declaration. Run the config's `validate(QInstance, List<String>)` before registering metadata, and report validation errors rather than silently ignoring a missing target. The uncustomized template contains placeholders for this behavior.
-
-For record hooks, use QQQ's existing table customizer interfaces or `AbstractPreInsertCustomizer`. Its `apply(List<QRecord>)` method returns the records for the next stage; register the customizer through the table's `TableCustomizers.PRE_INSERT_RECORD` role. Check the actual QQQ interface before adding another hook. Add tests proving that the intended table changes and invalid configurations are handled.

docs/DESIGN.md

@@ -0,0 +1,84 @@
+# Collaboration design
+
+The authoritative design is [QRun-IO/qqq PR #1136](https://github.com/QRun-IO/qqq/pull/1136), `docs/COLLABORATION.md` ([develop document](https://github.com/QRun-IO/qqq/blob/develop/docs/COLLABORATION.md)).
+
+Collaboration adds metadata-driven record features to QQQ: attachments, tags, custom fields, comments and mentions, presence, sharing, favorites, follow, timeline, recents, tasks and assignment. Core owns security, query and runtime metadata contracts; this qbit owns visible `collaboration_*` tables and feature services. Implemented: phase-a configuration, feature settings and people tables, plus phase-b favorites/recents tables, services, owner locks, retention and home counts against QQQ 4.1.0-RC.5. The phase-b UI API endpoints await the released extension point from QRun-IO/qqq#1128. The override and record-feature summary providers await released core contracts; phase-c attachments are implemented on object storage 0.1.0-RC.2; phase e comments/follow/timeline is implemented against released RC.5; phase d and phases f to i remain planned. The table below is the full roadmap from the specification, not a list of shipped functionality.
+
+| Phase | Core | Qbit | Next UI |
+|---|---|---|---|
+| a. Contracts | `RecordFeaturesMetaData` + resolver + frontend publication; `RecordReference`, `RecordReferenceTableMetaData` and the security rules of §3.2 (table filter, mirrored locks, parent check, post-filter, cleanup hook); feature permissions in the catalog; `RecordFeatureSummaryProviderInterface` and `GET /table/{t}/{pk}/features`; `RuntimeMetaDataProviderInterface` and overlay (generation only, no fields yet); `RecordAccessCheckerInterface`, `UserSessionProviderInterface` | repo scaffold, qbit config, `collaboration_feature_setting`, `collaboration_user`, override provider, home skeleton | types for `RecordFeaturesV1` |
+| b. Favorites, recents, palette | | favorites, recents, endpoints, summary provider | star in record and table headers, favorites menu, palette favorites group, server recents |
+| c. Attachments | | attachments with object storage, previews and thumbnails, delete action | Files tab, upload, preview |
+| d. Tags | `QSubQuery`; virtual field criteria expander in query, count, aggregate and search; `CONTAINS_ALL`; `#tag` search | tags, vocabulary modes, bulk actions, filter field | tag chips, Tags filter and column, `#tag` in palette and search |
+| e. Comments, follow, timeline | | comments, revisions, mentions, follows, activity, timeline merge with audit, notifications | Comments and Activity tabs, composer, follow bell |
+| f. User-defined fields | `JsonPathStorage` in RDBMS, memory and MongoDB; overlay field contributions | definitions, designer, publish and archive, index job, EAV fallback | designer preview widget; fields render through normal metadata |
+| g. Realtime and presence | `RealtimeBus` (in-memory, ESB), SSE spec, subscriptions, `record.changed` producer, `RecordVersionCheck` with 409 | presence endpoints and replicated map, events for its features | stream client, presence avatars and field rings, conflict dialog, live panel refresh |
+| h. Sharing | | link, shares with preview, access requests | share dialog, request-access page |
+| i. Tasks, owner/assignee | `CurrentUser` expression, ownership metadata, "My records" view | tasks, reminders, assignment table and virtual fields, assign actions, My work | Tasks tab, My work page, assign actions |
+
+
+## Phase-c implementation choices
+
+- `ParentRecordAccess` is the named replacement point for the unreleased core helper. GetAction enforces parent READ and locks. Attach is an explicit feature grant or EDIT plus visible parent; separate WRITE locks remain an approximation.
+- Admin browsing requires collaboration.view, while panel service calls authorize the parent directly. Direct table writes are denied. Internal persistence uses explicit per-action permission bypasses after service checks, and per-input metadata clones without preview customizers. The caller's session is never elevated or replaced. Cloning also lets delete prefetch find rows after the parent is deleted, while preserving FIELD audits and record-change listeners.
+- RC.5 offers no PRE_QUERY customizer. The attachment permission checker adds a readable-table IN filter before query/count/aggregate; POST_QUERY filters parent locks before presigning. Approximate counts/bytes and short pages are documented. Full mirrored locks, page refill and API approximate flags await core.
+- Uploads spool to bounded temporary disk while hashing; no full-file heap buffer. The bucket cap also applies. Keys contain a UUID and safe basename; renames do not move bytes. Object/row writes are ordered with best-effort compensation, not a distributed transaction.
+- The object-storage adapter uses the calling-qbit system facade only after authorization. Soft deletion follows bucket policy. Object retention failures leave retryable rows. In-memory adapter tests exercise QQQ actions and security; provider conformance stays with object storage's MinIO suite.
+- Previews/downloads are virtual fields in the RECORD_VIEW alternative section (RC.5 disallows virtual fields in base sections). Five-minute URLs are never stored. RC.2 supports attachment filename overrides, but not explicit inline overrides; uploads carry an inline header. There is no thumbnail generator or generated thumbnail file.
+- Delete attachments uses standard streamed ETL. Attach files is omitted for API/panel uploads. Cleanup is a trusted public after-commit callback pending RecordReferenceCleanupInterface. Endpoints await #1128; runtime feature settings and realtime publication are future integrations; attachment services now write activity. Native search fields are present; ESB and Quick Search publication are host integrations.
+
+See [README](../README.md#attachments) for the service contract, permissions and configuration.
+
+
+## Phase-e implementation choices
+
+- **Released core only.** RC.5 includes record-change listeners and transaction after-commit callbacks. The producer registers a listener only when `followChangeTables` is nonempty. Notification delivery uses the context transaction; temporary recipient contexts never inherit the caller's permission-bypass scope. The notifier/access interfaces are explicit stand-ins for #1125 and the unreleased recipient/session contracts.
+- **Security at both boundaries.** Services check the real parent before disclosing any row. Direct table writes are denied even to admins. `ParentTableRestriction` adds a READ-table condition outside caller OR clauses; `ParentRowCustomizer` checks record locks on fetched rows. Revision and mention rows mirror their comment's parent reference to use the same pre-query restriction. Core mirrored locks/page refill and runtime feature resolution remain deferred; counts and unpinned page lengths have the same limits as attachments.
+- **Conversations are persisted relationships.** Roots have null thread IDs; replies flatten to a root. `lastActivityAt` is maintained on roots to support indexed keyset paging. Revisions retain the old body. Mention uniqueness prevents re-notification on subsequent edits. Visible mentions auto-follow; unknown is never a grant. Notifications deduplicate mentions versus followers and recheck access after commit. The default no-op transport does not mark mentions delivered.
+- **Durable follow batches.** The additional standard `collaboration_follow_digest` table stores one pending batch per parent/recipient. Due time is fixed at the first change plus five minutes. Record-change listeners copy event data and queue only after commit; batches contain field/actor summaries, never old/new values. Delivery rechecks current follow preferences and recipient access. One scheduled sender per installation is required; local synchronization and a unique key are not a cross-pod lease. Delivery/delete is at-least-once across a process crash; adapter idempotency is needed for stronger delivery guarantees.
+- **Audit reads preserve the user's authority.** Timeline uses core's released audit table names/fields with ENFORCE on every query, then applies core table personalization to field details. Headers are queried separately from details so a joined-row limit cannot cut an event in half. Denied audits are omitted. Core stores audit actor names without stable session user IDs; the DTO leaves those IDs null. Both streams are bounded and merged by descending `(at, kind, id)`. Cursor IDs are compared as numeric strings because RC.5's memory equality distinguishes Integer and Long values.
+- **Directory throttling is persistent.** Ten-minute last-seen checks survive service recreation and rollback without maintaining an in-memory cache. QUser supplies full name/ID only; email/avatar enrichment stays with trusted host integrations. Mention ranking queries participants first so the limit cannot hide an existing follower behind many other users.
+- **User-facing metadata.** Comments and admin-only Activity are main nav tables. Revisions, mentions and Followers are child lists; digest/follow tables are admin-browsable with HIDDEN deny behavior. Follow actions use generic streamed ETL Review/Result against any host key. The home reads real session-scoped comments/open-thread/follower counts. Standard QQQ writes remain available to host ESB listeners.
+
+The service API and configuration are documented in [README](../README.md#comments-follow-and-timeline). Endpoints remain deferred to QRun-IO/qqq#1128; no unreleased core dependency, runtime overlay, mirrored-lock implementation or realtime/UI delivery is introduced.
+
+## Phase-d implementation choices
+
+- **RC.5 boundary.** `tags/TagFilterTranslator` uses operator names, QQQ queries and
+  string parent IDs. It returns matching rows for all operators, so NOT_IN and
+  IS_BLANK enumerate the visible host-table complement. The 10,000 limit applies
+  to final matching IDs, not assignment count. It pages parent reads under the
+  caller's permissions and locks. Filter/quick-search integration lands after
+  QRun-IO/qqq#1140 is released; no unreleased core types or virtual fields are used.
+- **Vocabulary versus assignments.** Tag names are unique per nullable scope;
+  PostgreSQL DDL emits NULLS NOT DISTINCT for nullable unique-key components.
+  Record Tags inherits `ParentTableRestriction` and the parent row customizer,
+  including the existing approximation for aggregate counts and short pages.
+  Vocabulary pickers need no collaboration.view grant: ordinary users see
+  approved tags and their own suggestions in readable scopes, while manage sees
+  all vocabulary for moderation. Direct writes are denied; services/actions
+  preserve normalization, approval and counts.
+- **Policy lookup.** Settings are read in a temporary system context, retaining
+  the transaction and restoring the caller. TABLE overrides preferred APP (QQQ's
+  app-affinity path), then INSTANCE, then `defaultTagMode`. Missing mode inherits;
+  malformed JSON/invalid mode throws. General enabled/permission-mode runtime
+  overrides remain outside this phase. Name collision resolution prefers global
+  vocabulary; IDs provide an unambiguous selection.
+- **Mutation boundaries.** Like existing services, writes participate in the
+  caller's QQQ transaction and serialize within the installed config's monitor.
+  Unique keys enforce assignment identity. Counts are recomputed from stored
+  links, including merge deduplication, deletion and trusted parent cleanup.
+  This is not a cross-pod lock: concurrent writers in separate instances need
+  host transaction/serialization coordination for exact denormalized counts.
+  Standard ETL runs with its process transaction. Activity is generated only for
+  actual apply/remove changes and never calls follower notification services.
+- **Review and Result.** Actions derive operation and table from installed process
+  metadata. Management requires collaboration.tags.manage at both stages. Bulk
+  actions resolve approved PVS selections and recheck every parent and feature
+  permission at both stages. Review is read-only, counts already-satisfied rows,
+  and Delete reports distinct affected parents. Result reports successful and
+  failed records separately. The picker exposes multiSelectFields on EDIT_FORM
+  for the separate Next client; RC.5 itself has no native multi-value form field.
+- **Presentation.** Tags is in the admin app nav; Record Tags is a child widget.
+  The home queries under the caller session and HTML-escapes labels. Native tag
+  label search metadata is present; host-record tag search awaits #1140.

mvnw

@@ -0,0 +1,295 @@
+#!/bin/sh
+# ----------------------------------------------------------------------------
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+# ----------------------------------------------------------------------------
+
+# ----------------------------------------------------------------------------
+# Apache Maven Wrapper startup batch script, version 3.3.4
+#
+# Optional ENV vars
+# -----------------
+#   JAVA_HOME - location of a JDK home dir, required when download maven via java source
+#   MVNW_REPOURL - repo url base for downloading maven distribution
+#   MVNW_USERNAME/MVNW_PASSWORD - user and password for downloading maven
+#   MVNW_VERBOSE - true: enable verbose log; debug: trace the mvnw script; others: silence the output
+# ----------------------------------------------------------------------------
+
+set -euf
+[ "${MVNW_VERBOSE-}" != debug ] || set -x
+
+# OS specific support.
+native_path() { printf %s\\n "$1"; }
+case "$(uname)" in
+CYGWIN* | MINGW*)
+  [ -z "${JAVA_HOME-}" ] || JAVA_HOME="$(cygpath --unix "$JAVA_HOME")"
+  native_path() { cygpath --path --windows "$1"; }
+  ;;
+esac
+
+# set JAVACMD and JAVACCMD
+set_java_home() {
+  # For Cygwin and MinGW, ensure paths are in Unix format before anything is touched
+  if [ -n "${JAVA_HOME-}" ]; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ]; then
+      # IBM's JDK on AIX uses strange locations for the executables
+      JAVACMD="$JAVA_HOME/jre/sh/java"
+      JAVACCMD="$JAVA_HOME/jre/sh/javac"
+    else
+      JAVACMD="$JAVA_HOME/bin/java"
+      JAVACCMD="$JAVA_HOME/bin/javac"
+
+      if [ ! -x "$JAVACMD" ] || [ ! -x "$JAVACCMD" ]; then
+        echo "The JAVA_HOME environment variable is not defined correctly, so mvnw cannot run." >&2
+        echo "JAVA_HOME is set to \"$JAVA_HOME\", but \"\$JAVA_HOME/bin/java\" or \"\$JAVA_HOME/bin/javac\" does not exist." >&2
+        return 1
+      fi
+    fi
+  else
+    JAVACMD="$(
+      'set' +e
+      'unset' -f command 2>/dev/null
+      'command' -v java
+    )" || :
+    JAVACCMD="$(
+      'set' +e
+      'unset' -f command 2>/dev/null
+      'command' -v javac
+    )" || :
+
+    if [ ! -x "${JAVACMD-}" ] || [ ! -x "${JAVACCMD-}" ]; then
+      echo "The java/javac command does not exist in PATH nor is JAVA_HOME set, so mvnw cannot run." >&2
+      return 1
+    fi
+  fi
+}
+
+# hash string like Java String::hashCode
+hash_string() {
+  str="${1:-}" h=0
+  while [ -n "$str" ]; do
+    char="${str%"${str#?}"}"
+    h=$(((h * 31 + $(LC_CTYPE=C printf %d "'$char")) % 4294967296))
+    str="${str#?}"
+  done
+  printf %x\\n $h
+}
+
+verbose() { :; }
+[ "${MVNW_VERBOSE-}" != true ] || verbose() { printf %s\\n "${1-}"; }
+
+die() {
+  printf %s\\n "$1" >&2
+  exit 1
+}
+
+trim() {
+  # MWRAPPER-139:
+  #   Trims trailing and leading whitespace, carriage returns, tabs, and linefeeds.
+  #   Needed for removing poorly interpreted newline sequences when running in more
+  #   exotic environments such as mingw bash on Windows.
+  printf "%s" "${1}" | tr -d '[:space:]'
+}
+
+scriptDir="$(dirname "$0")"
+scriptName="$(basename "$0")"
+
+# parse distributionUrl and optional distributionSha256Sum, requires .mvn/wrapper/maven-wrapper.properties
+while IFS="=" read -r key value; do
+  case "${key-}" in
+  distributionUrl) distributionUrl=$(trim "${value-}") ;;
+  distributionSha256Sum) distributionSha256Sum=$(trim "${value-}") ;;
+  esac
+done <"$scriptDir/.mvn/wrapper/maven-wrapper.properties"
+[ -n "${distributionUrl-}" ] || die "cannot read distributionUrl property in $scriptDir/.mvn/wrapper/maven-wrapper.properties"
+
+case "${distributionUrl##*/}" in
+maven-mvnd-*bin.*)
+  MVN_CMD=mvnd.sh _MVNW_REPO_PATTERN=/maven/mvnd/
+  case "${PROCESSOR_ARCHITECTURE-}${PROCESSOR_ARCHITEW6432-}:$(uname -a)" in
+  *AMD64:CYGWIN* | *AMD64:MINGW*) distributionPlatform=windows-amd64 ;;
+  :Darwin*x86_64) distributionPlatform=darwin-amd64 ;;
+  :Darwin*arm64) distributionPlatform=darwin-aarch64 ;;
+  :Linux*x86_64*) distributionPlatform=linux-amd64 ;;
+  *)
+    echo "Cannot detect native platform for mvnd on $(uname)-$(uname -m), use pure java version" >&2
+    distributionPlatform=linux-amd64
+    ;;
+  esac
+  distributionUrl="${distributionUrl%-bin.*}-$distributionPlatform.zip"
+  ;;
+maven-mvnd-*) MVN_CMD=mvnd.sh _MVNW_REPO_PATTERN=/maven/mvnd/ ;;
+*) MVN_CMD="mvn${scriptName#mvnw}" _MVNW_REPO_PATTERN=/org/apache/maven/ ;;
+esac
+
+# apply MVNW_REPOURL and calculate MAVEN_HOME
+# maven home pattern: ~/.m2/wrapper/dists/{apache-maven-<version>,maven-mvnd-<version>-<platform>}/<hash>
+[ -z "${MVNW_REPOURL-}" ] || distributionUrl="$MVNW_REPOURL$_MVNW_REPO_PATTERN${distributionUrl#*"$_MVNW_REPO_PATTERN"}"
+distributionUrlName="${distributionUrl##*/}"
+distributionUrlNameMain="${distributionUrlName%.*}"
+distributionUrlNameMain="${distributionUrlNameMain%-bin}"
+MAVEN_USER_HOME="${MAVEN_USER_HOME:-${HOME}/.m2}"
+MAVEN_HOME="${MAVEN_USER_HOME}/wrapper/dists/${distributionUrlNameMain-}/$(hash_string "$distributionUrl")"
+
+exec_maven() {
+  unset MVNW_VERBOSE MVNW_USERNAME MVNW_PASSWORD MVNW_REPOURL || :
+  exec "$MAVEN_HOME/bin/$MVN_CMD" "$@" || die "cannot exec $MAVEN_HOME/bin/$MVN_CMD"
+}
+
+if [ -d "$MAVEN_HOME" ]; then
+  verbose "found existing MAVEN_HOME at $MAVEN_HOME"
+  exec_maven "$@"
+fi
+
+case "${distributionUrl-}" in
+*?-bin.zip | *?maven-mvnd-?*-?*.zip) ;;
+*) die "distributionUrl is not valid, must match *-bin.zip or maven-mvnd-*.zip, but found '${distributionUrl-}'" ;;
+esac
+
+# prepare tmp dir
+if TMP_DOWNLOAD_DIR="$(mktemp -d)" && [ -d "$TMP_DOWNLOAD_DIR" ]; then
+  clean() { rm -rf -- "$TMP_DOWNLOAD_DIR"; }
+  trap clean HUP INT TERM EXIT
+else
+  die "cannot create temp dir"
+fi
+
+mkdir -p -- "${MAVEN_HOME%/*}"
+
+# Download and Install Apache Maven
+verbose "Couldn't find MAVEN_HOME, downloading and installing it ..."
+verbose "Downloading from: $distributionUrl"
+verbose "Downloading to: $TMP_DOWNLOAD_DIR/$distributionUrlName"
+
+# select .zip or .tar.gz
+if ! command -v unzip >/dev/null; then
+  distributionUrl="${distributionUrl%.zip}.tar.gz"
+  distributionUrlName="${distributionUrl##*/}"
+fi
+
+# verbose opt
+__MVNW_QUIET_WGET=--quiet __MVNW_QUIET_CURL=--silent __MVNW_QUIET_UNZIP=-q __MVNW_QUIET_TAR=''
+[ "${MVNW_VERBOSE-}" != true ] || __MVNW_QUIET_WGET='' __MVNW_QUIET_CURL='' __MVNW_QUIET_UNZIP='' __MVNW_QUIET_TAR=v
+
+# normalize http auth
+case "${MVNW_PASSWORD:+has-password}" in
+'') MVNW_USERNAME='' MVNW_PASSWORD='' ;;
+has-password) [ -n "${MVNW_USERNAME-}" ] || MVNW_USERNAME='' MVNW_PASSWORD='' ;;
+esac
+
+if [ -z "${MVNW_USERNAME-}" ] && command -v wget >/dev/null; then
+  verbose "Found wget ... using wget"
+  wget ${__MVNW_QUIET_WGET:+"$__MVNW_QUIET_WGET"} "$distributionUrl" -O "$TMP_DOWNLOAD_DIR/$distributionUrlName" || die "wget: Failed to fetch $distributionUrl"
+elif [ -z "${MVNW_USERNAME-}" ] && command -v curl >/dev/null; then
+  verbose "Found curl ... using curl"
+  curl ${__MVNW_QUIET_CURL:+"$__MVNW_QUIET_CURL"} -f -L -o "$TMP_DOWNLOAD_DIR/$distributionUrlName" "$distributionUrl" || die "curl: Failed to fetch $distributionUrl"
+elif set_java_home; then
+  verbose "Falling back to use Java to download"
+  javaSource="$TMP_DOWNLOAD_DIR/Downloader.java"
+  targetZip="$TMP_DOWNLOAD_DIR/$distributionUrlName"
+  cat >"$javaSource" <<-END
+	public class Downloader extends java.net.Authenticator
+	{
+	  protected java.net.PasswordAuthentication getPasswordAuthentication()
+	  {
+	    return new java.net.PasswordAuthentication( System.getenv( "MVNW_USERNAME" ), System.getenv( "MVNW_PASSWORD" ).toCharArray() );
+	  }
+	  public static void main( String[] args ) throws Exception
+	  {
+	    setDefault( new Downloader() );
+	    java.nio.file.Files.copy( java.net.URI.create( args[0] ).toURL().openStream(), java.nio.file.Paths.get( args[1] ).toAbsolutePath().normalize() );
+	  }
+	}
+	END
+  # For Cygwin/MinGW, switch paths to Windows format before running javac and java
+  verbose " - Compiling Downloader.java ..."
+  "$(native_path "$JAVACCMD")" "$(native_path "$javaSource")" || die "Failed to compile Downloader.java"
+  verbose " - Running Downloader.java ..."
+  "$(native_path "$JAVACMD")" -cp "$(native_path "$TMP_DOWNLOAD_DIR")" Downloader "$distributionUrl" "$(native_path "$targetZip")"
+fi
+
+# If specified, validate the SHA-256 sum of the Maven distribution zip file
+if [ -n "${distributionSha256Sum-}" ]; then
+  distributionSha256Result=false
+  if [ "$MVN_CMD" = mvnd.sh ]; then
+    echo "Checksum validation is not supported for maven-mvnd." >&2
+    echo "Please disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties." >&2
+    exit 1
+  elif command -v sha256sum >/dev/null; then
+    if echo "$distributionSha256Sum  $TMP_DOWNLOAD_DIR/$distributionUrlName" | sha256sum -c - >/dev/null 2>&1; then
+      distributionSha256Result=true
+    fi
+  elif command -v shasum >/dev/null; then
+    if echo "$distributionSha256Sum  $TMP_DOWNLOAD_DIR/$distributionUrlName" | shasum -a 256 -c >/dev/null 2>&1; then
+      distributionSha256Result=true
+    fi
+  else
+    echo "Checksum validation was requested but neither 'sha256sum' or 'shasum' are available." >&2
+    echo "Please install either command, or disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties." >&2
+    exit 1
+  fi
+  if [ $distributionSha256Result = false ]; then
+    echo "Error: Failed to validate Maven distribution SHA-256, your Maven distribution might be compromised." >&2
+    echo "If you updated your Maven version, you need to update the specified distributionSha256Sum property." >&2
+    exit 1
+  fi
+fi
+
+# unzip and move
+if command -v unzip >/dev/null; then
+  unzip ${__MVNW_QUIET_UNZIP:+"$__MVNW_QUIET_UNZIP"} "$TMP_DOWNLOAD_DIR/$distributionUrlName" -d "$TMP_DOWNLOAD_DIR" || die "failed to unzip"
+else
+  tar xzf${__MVNW_QUIET_TAR:+"$__MVNW_QUIET_TAR"} "$TMP_DOWNLOAD_DIR/$distributionUrlName" -C "$TMP_DOWNLOAD_DIR" || die "failed to untar"
+fi
+
+# Find the actual extracted directory name (handles snapshots where filename != directory name)
+actualDistributionDir=""
+
+# First try the expected directory name (for regular distributions)
+if [ -d "$TMP_DOWNLOAD_DIR/$distributionUrlNameMain" ]; then
+  if [ -f "$TMP_DOWNLOAD_DIR/$distributionUrlNameMain/bin/$MVN_CMD" ]; then
+    actualDistributionDir="$distributionUrlNameMain"
+  fi
+fi
+
+# If not found, search for any directory with the Maven executable (for snapshots)
+if [ -z "$actualDistributionDir" ]; then
+  # enable globbing to iterate over items
+  set +f
+  for dir in "$TMP_DOWNLOAD_DIR"/*; do
+    if [ -d "$dir" ]; then
+      if [ -f "$dir/bin/$MVN_CMD" ]; then
+        actualDistributionDir="$(basename "$dir")"
+        break
+      fi
+    fi
+  done
+  set -f
+fi
+
+if [ -z "$actualDistributionDir" ]; then
+  verbose "Contents of $TMP_DOWNLOAD_DIR:"
+  verbose "$(ls -la "$TMP_DOWNLOAD_DIR")"
+  die "Could not find Maven distribution directory in extracted archive"
+fi
+
+verbose "Found extracted Maven distribution directory: $actualDistributionDir"
+printf %s\\n "$distributionUrl" >"$TMP_DOWNLOAD_DIR/$actualDistributionDir/mvnw.url"
+mv -- "$TMP_DOWNLOAD_DIR/$actualDistributionDir" "$MAVEN_HOME" || [ -d "$MAVEN_HOME" ] || die "fail to move MAVEN_HOME"
+
+clean || :
+exec_maven "$@"

mvnw.cmd

@@ -0,0 +1,189 @@
+<# : batch portion
+@REM ----------------------------------------------------------------------------
+@REM Licensed to the Apache Software Foundation (ASF) under one
+@REM or more contributor license agreements.  See the NOTICE file
+@REM distributed with this work for additional information
+@REM regarding copyright ownership.  The ASF licenses this file
+@REM to you under the Apache License, Version 2.0 (the
+@REM "License"); you may not use this file except in compliance
+@REM with the License.  You may obtain a copy of the License at
+@REM
+@REM    http://www.apache.org/licenses/LICENSE-2.0
+@REM
+@REM Unless required by applicable law or agreed to in writing,
+@REM software distributed under the License is distributed on an
+@REM "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+@REM KIND, either express or implied.  See the License for the
+@REM specific language governing permissions and limitations
+@REM under the License.
+@REM ----------------------------------------------------------------------------
+
+@REM ----------------------------------------------------------------------------
+@REM Apache Maven Wrapper startup batch script, version 3.3.4
+@REM
+@REM Optional ENV vars
+@REM   MVNW_REPOURL - repo url base for downloading maven distribution
+@REM   MVNW_USERNAME/MVNW_PASSWORD - user and password for downloading maven
+@REM   MVNW_VERBOSE - true: enable verbose log; others: silence the output
+@REM ----------------------------------------------------------------------------
+
+@IF "%__MVNW_ARG0_NAME__%"=="" (SET __MVNW_ARG0_NAME__=%~nx0)
+@SET __MVNW_CMD__=
+@SET __MVNW_ERROR__=
+@SET __MVNW_PSMODULEP_SAVE=%PSModulePath%
+@SET PSModulePath=
+@FOR /F "usebackq tokens=1* delims==" %%A IN (`powershell -noprofile "& {$scriptDir='%~dp0'; $script='%__MVNW_ARG0_NAME__%'; icm -ScriptBlock ([Scriptblock]::Create((Get-Content -Raw '%~f0'))) -NoNewScope}"`) DO @(
+  IF "%%A"=="MVN_CMD" (set __MVNW_CMD__=%%B) ELSE IF "%%B"=="" (echo %%A) ELSE (echo %%A=%%B)
+)
+@SET PSModulePath=%__MVNW_PSMODULEP_SAVE%
+@SET __MVNW_PSMODULEP_SAVE=
+@SET __MVNW_ARG0_NAME__=
+@SET MVNW_USERNAME=
+@SET MVNW_PASSWORD=
+@IF NOT "%__MVNW_CMD__%"=="" ("%__MVNW_CMD__%" %*)
+@echo Cannot start maven from wrapper >&2 && exit /b 1
+@GOTO :EOF
+: end batch / begin powershell #>
+
+$ErrorActionPreference = "Stop"
+if ($env:MVNW_VERBOSE -eq "true") {
+  $VerbosePreference = "Continue"
+}
+
+# calculate distributionUrl, requires .mvn/wrapper/maven-wrapper.properties
+$distributionUrl = (Get-Content -Raw "$scriptDir/.mvn/wrapper/maven-wrapper.properties" | ConvertFrom-StringData).distributionUrl
+if (!$distributionUrl) {
+  Write-Error "cannot read distributionUrl property in $scriptDir/.mvn/wrapper/maven-wrapper.properties"
+}
+
+switch -wildcard -casesensitive ( $($distributionUrl -replace '^.*/','') ) {
+  "maven-mvnd-*" {
+    $USE_MVND = $true
+    $distributionUrl = $distributionUrl -replace '-bin\.[^.]*$',"-windows-amd64.zip"
+    $MVN_CMD = "mvnd.cmd"
+    break
+  }
+  default {
+    $USE_MVND = $false
+    $MVN_CMD = $script -replace '^mvnw','mvn'
+    break
+  }
+}
+
+# apply MVNW_REPOURL and calculate MAVEN_HOME
+# maven home pattern: ~/.m2/wrapper/dists/{apache-maven-<version>,maven-mvnd-<version>-<platform>}/<hash>
+if ($env:MVNW_REPOURL) {
+  $MVNW_REPO_PATTERN = if ($USE_MVND -eq $False) { "/org/apache/maven/" } else { "/maven/mvnd/" }
+  $distributionUrl = "$env:MVNW_REPOURL$MVNW_REPO_PATTERN$($distributionUrl -replace "^.*$MVNW_REPO_PATTERN",'')"
+}
+$distributionUrlName = $distributionUrl -replace '^.*/',''
+$distributionUrlNameMain = $distributionUrlName -replace '\.[^.]*$','' -replace '-bin$',''
+
+$MAVEN_M2_PATH = "$HOME/.m2"
+if ($env:MAVEN_USER_HOME) {
+  $MAVEN_M2_PATH = "$env:MAVEN_USER_HOME"
+}
+
+if (-not (Test-Path -Path $MAVEN_M2_PATH)) {
+    New-Item -Path $MAVEN_M2_PATH -ItemType Directory | Out-Null
+}
+
+$MAVEN_WRAPPER_DISTS = $null
+if ((Get-Item $MAVEN_M2_PATH).Target[0] -eq $null) {
+  $MAVEN_WRAPPER_DISTS = "$MAVEN_M2_PATH/wrapper/dists"
+} else {
+  $MAVEN_WRAPPER_DISTS = (Get-Item $MAVEN_M2_PATH).Target[0] + "/wrapper/dists"
+}
+
+$MAVEN_HOME_PARENT = "$MAVEN_WRAPPER_DISTS/$distributionUrlNameMain"
+$MAVEN_HOME_NAME = ([System.Security.Cryptography.SHA256]::Create().ComputeHash([byte[]][char[]]$distributionUrl) | ForEach-Object {$_.ToString("x2")}) -join ''
+$MAVEN_HOME = "$MAVEN_HOME_PARENT/$MAVEN_HOME_NAME"
+
+if (Test-Path -Path "$MAVEN_HOME" -PathType Container) {
+  Write-Verbose "found existing MAVEN_HOME at $MAVEN_HOME"
+  Write-Output "MVN_CMD=$MAVEN_HOME/bin/$MVN_CMD"
+  exit $?
+}
+
+if (! $distributionUrlNameMain -or ($distributionUrlName -eq $distributionUrlNameMain)) {
+  Write-Error "distributionUrl is not valid, must end with *-bin.zip, but found $distributionUrl"
+}
+
+# prepare tmp dir
+$TMP_DOWNLOAD_DIR_HOLDER = New-TemporaryFile
+$TMP_DOWNLOAD_DIR = New-Item -Itemtype Directory -Path "$TMP_DOWNLOAD_DIR_HOLDER.dir"
+$TMP_DOWNLOAD_DIR_HOLDER.Delete() | Out-Null
+trap {
+  if ($TMP_DOWNLOAD_DIR.Exists) {
+    try { Remove-Item $TMP_DOWNLOAD_DIR -Recurse -Force | Out-Null }
+    catch { Write-Warning "Cannot remove $TMP_DOWNLOAD_DIR" }
+  }
+}
+
+New-Item -Itemtype Directory -Path "$MAVEN_HOME_PARENT" -Force | Out-Null
+
+# Download and Install Apache Maven
+Write-Verbose "Couldn't find MAVEN_HOME, downloading and installing it ..."
+Write-Verbose "Downloading from: $distributionUrl"
+Write-Verbose "Downloading to: $TMP_DOWNLOAD_DIR/$distributionUrlName"
+
+$webclient = New-Object System.Net.WebClient
+if ($env:MVNW_USERNAME -and $env:MVNW_PASSWORD) {
+  $webclient.Credentials = New-Object System.Net.NetworkCredential($env:MVNW_USERNAME, $env:MVNW_PASSWORD)
+}
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+$webclient.DownloadFile($distributionUrl, "$TMP_DOWNLOAD_DIR/$distributionUrlName") | Out-Null
+
+# If specified, validate the SHA-256 sum of the Maven distribution zip file
+$distributionSha256Sum = (Get-Content -Raw "$scriptDir/.mvn/wrapper/maven-wrapper.properties" | ConvertFrom-StringData).distributionSha256Sum
+if ($distributionSha256Sum) {
+  if ($USE_MVND) {
+    Write-Error "Checksum validation is not supported for maven-mvnd. `nPlease disable validation by removing 'distributionSha256Sum' from your maven-wrapper.properties."
+  }
+  Import-Module $PSHOME\Modules\Microsoft.PowerShell.Utility -Function Get-FileHash
+  if ((Get-FileHash "$TMP_DOWNLOAD_DIR/$distributionUrlName" -Algorithm SHA256).Hash.ToLower() -ne $distributionSha256Sum) {
+    Write-Error "Error: Failed to validate Maven distribution SHA-256, your Maven distribution might be compromised. If you updated your Maven version, you need to update the specified distributionSha256Sum property."
+  }
+}
+
+# unzip and move
+Expand-Archive "$TMP_DOWNLOAD_DIR/$distributionUrlName" -DestinationPath "$TMP_DOWNLOAD_DIR" | Out-Null
+
+# Find the actual extracted directory name (handles snapshots where filename != directory name)
+$actualDistributionDir = ""
+
+# First try the expected directory name (for regular distributions)
+$expectedPath = Join-Path "$TMP_DOWNLOAD_DIR" "$distributionUrlNameMain"
+$expectedMvnPath = Join-Path "$expectedPath" "bin/$MVN_CMD"
+if ((Test-Path -Path $expectedPath -PathType Container) -and (Test-Path -Path $expectedMvnPath -PathType Leaf)) {
+  $actualDistributionDir = $distributionUrlNameMain
+}
+
+# If not found, search for any directory with the Maven executable (for snapshots)
+if (!$actualDistributionDir) {
+  Get-ChildItem -Path "$TMP_DOWNLOAD_DIR" -Directory | ForEach-Object {
+    $testPath = Join-Path $_.FullName "bin/$MVN_CMD"
+    if (Test-Path -Path $testPath -PathType Leaf) {
+      $actualDistributionDir = $_.Name
+    }
+  }
+}
+
+if (!$actualDistributionDir) {
+  Write-Error "Could not find Maven distribution directory in extracted archive"
+}
+
+Write-Verbose "Found extracted Maven distribution directory: $actualDistributionDir"
+Rename-Item -Path "$TMP_DOWNLOAD_DIR/$actualDistributionDir" -NewName $MAVEN_HOME_NAME | Out-Null
+try {
+  Move-Item -Path "$TMP_DOWNLOAD_DIR/$MAVEN_HOME_NAME" -Destination $MAVEN_HOME_PARENT | Out-Null
+} catch {
+  if (! (Test-Path -Path "$MAVEN_HOME" -PathType Container)) {
+    Write-Error "fail to move MAVEN_HOME"
+  }
+} finally {
+  try { Remove-Item $TMP_DOWNLOAD_DIR -Recurse -Force | Out-Null }
+  catch { Write-Warning "Cannot remove $TMP_DOWNLOAD_DIR" }
+}
+
+Write-Output "MVN_CMD=$MAVEN_HOME/bin/$MVN_CMD"

pom.xml

@@ -1,36 +1,84 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
-         http://maven.apache.org/xsd/maven-4.0.0.xsd">
-   <modelVersion>4.0.0</modelVersion>
+<!--
+  ~ Copyright 2026 Kingsrook, LLC
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
 
-   <groupId>com.kingsrook.qbits</groupId>
-   <artifactId>qbit-example-extension</artifactId>
-   <version>0.1.0-SNAPSHOT</version>
-   <packaging>jar</packaging>
-
-   <name>QBit Example Extension</name>
-   <description>Example Extension QBit - rename this for your QBit</description>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
    <properties>
+      <revision>0.1.0-SNAPSHOT</revision>
       <maven.compiler.source>21</maven.compiler.source>
       <maven.compiler.target>21</maven.compiler.target>
-      <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-      <qqq.version>4.0.0</qqq.version>
+      <jacoco.version>0.8.15</jacoco.version>
    </properties>
 
+   <parent>
+      <groupId>com.kingsrook</groupId>
+      <artifactId>qbit-build-parent</artifactId>
+      <version>2.0.0</version>
+   </parent>
+
+   <groupId>com.kingsrook.qbits</groupId>
+   <artifactId>qbit-collaboration</artifactId>
+   <version>${revision}</version>
+   <packaging>jar</packaging>
+
+   <name>QBit Collaboration</name>
+   <description>QQQ QBit: record collaboration: attachments, tags, custom fields, comments with mentions, presence, sharing, favorites, follow, timeline, tasks</description>
+   <url>https://github.com/QRun-IO/qbit-collaboration</url>
+
+   <modelVersion>4.0.0</modelVersion>
+
+   <licenses>
+      <license>
+         <name>Apache License, Version 2.0</name>
+         <url>https://www.apache.org/licenses/LICENSE-2.0</url>
+         <distribution>repo</distribution>
+      </license>
+   </licenses>
+
+   <developers>
+      <developer>
+         <id>kingsrook</id>
+         <name>Kingsrook Team</name>
+         <email>contact@kingsrook.com</email>
+         <organization>Kingsrook, LLC</organization>
+         <organizationUrl>https://kingsrook.com</organizationUrl>
+      </developer>
+   </developers>
+
+   <scm>
+      <connection>scm:git:git://github.com/QRun-IO/qbit-collaboration.git</connection>
+      <developerConnection>scm:git:ssh://github.com:QRun-IO/qbit-collaboration.git</developerConnection>
+      <url>https://github.com/QRun-IO/qbit-collaboration</url>
+      <tag>HEAD</tag>
+   </scm>
+
    <dependencies>
+      <dependency>
+         <groupId>com.kingsrook.qbits</groupId>
+         <artifactId>qbit-object-storage</artifactId>
+         <version>0.1.0-RC.2</version>
+      </dependency>
       <dependency>
          <groupId>com.kingsrook.qqq</groupId>
          <artifactId>qqq-backend-core</artifactId>
-         <version>${qqq.version}</version>
       </dependency>
-
       <dependency>
          <groupId>org.junit.jupiter</groupId>
          <artifactId>junit-jupiter</artifactId>
-         <version>5.10.0</version>
          <scope>test</scope>
       </dependency>
       <dependency>
@@ -45,14 +93,106 @@
       <plugins>
          <plugin>
             <groupId>org.apache.maven.plugins</groupId>
-            <artifactId>maven-compiler-plugin</artifactId>
-            <version>3.11.0</version>
+            <artifactId>maven-checkstyle-plugin</artifactId>
+            <version>3.3.1</version>
+            <dependencies>
+               <dependency>
+                  <groupId>com.puppycrawl.tools</groupId>
+                  <artifactId>checkstyle</artifactId>
+                  <version>10.12.6</version>
+               </dependency>
+            </dependencies>
+            <configuration>
+               <configLocation>checkstyle/config.xml</configLocation>
+               <headerLocation>checkstyle/license.txt</headerLocation>
+               <encoding>UTF-8</encoding>
+               <consoleOutput>true</consoleOutput>
+               <failsOnError>false</failsOnError>
+               <failOnViolation>true</failOnViolation>
+               <violationSeverity>warning</violationSeverity>
+               <includeTestSourceDirectory>false</includeTestSourceDirectory>
+            </configuration>
+            <executions>
+               <execution>
+                  <id>validate</id>
+                  <phase>validate</phase>
+                  <goals>
+                     <goal>check</goal>
+                  </goals>
+               </execution>
+            </executions>
          </plugin>
          <plugin>
-            <groupId>org.apache.maven.plugins</groupId>
-            <artifactId>maven-surefire-plugin</artifactId>
-            <version>3.1.2</version>
+            <groupId>org.jacoco</groupId>
+            <artifactId>jacoco-maven-plugin</artifactId>
+            <version>${jacoco.version}</version>
+            <executions>
+               <execution>
+                  <id>prepare-agent</id>
+                  <goals>
+                     <goal>prepare-agent</goal>
+                  </goals>
+               </execution>
+               <execution>
+                  <id>report</id>
+                  <phase>verify</phase>
+                  <goals>
+                     <goal>report</goal>
+                  </goals>
+               </execution>
+               <execution>
+                  <id>check</id>
+                  <goals>
+                     <goal>check</goal>
+                  </goals>
+                  <configuration>
+                     <rules>
+                        <rule>
+                           <element>BUNDLE</element>
+                           <limits>
+                              <limit>
+                                 <counter>INSTRUCTION</counter>
+                                 <value>COVEREDRATIO</value>
+                                 <minimum>0.70</minimum>
+                              </limit>
+                              <limit>
+                                 <counter>CLASS</counter>
+                                 <value>COVEREDRATIO</value>
+                                 <minimum>0.90</minimum>
+                              </limit>
+                           </limits>
+                        </rule>
+                     </rules>
+                  </configuration>
+               </execution>
+            </executions>
          </plugin>
       </plugins>
    </build>
-</project>
+
+   <profiles>
+      <!-- Built against qqq 4.1 (QBitMetaDataProducer). Until qbit-build-parent  -->
+      <!-- imports the released 4.1 BOM, this profile is active by default and     -->
+      <!-- imports qqq-bom-pom 4.1.0-RC.5 ahead of the parent's 4.0.0 BOM.         -->
+      <profile>
+         <id>qqq-snapshot</id>
+         <activation>
+            <activeByDefault>true</activeByDefault>
+         </activation>
+         <properties>
+            <qqq.snapshot.version>4.1.0-RC.5</qqq.snapshot.version>
+         </properties>
+         <dependencyManagement>
+            <dependencies>
+               <dependency>
+                  <groupId>com.kingsrook.qqq</groupId>
+                  <artifactId>qqq-bom-pom</artifactId>
+                  <version>${qqq.snapshot.version}</version>
+                  <type>pom</type>
+                  <scope>import</scope>
+               </dependency>
+            </dependencies>
+         </dependencyManagement>
+      </profile>
+   </profiles>
+</project>

src/main/java/com/kingsrook/qbits/collaboration/CollaborationQBitConfig.java

@@ -0,0 +1,479 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.notify.NoOpNotifier;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitConfig;
+import com.kingsrook.qqq.backend.core.utils.StringUtils;
+
+
+/*******************************************************************************
+ ** Host configuration for the Collaboration qbit.
+ *******************************************************************************/
+public class CollaborationQBitConfig implements QBitConfig
+{
+   public static final String TABLE_NAME_PREFIX = "collaboration_";
+   public static final String PERMISSION_BASE_NAME = "collaboration";
+
+   private QCodeReference notifier = new QCodeReference(NoOpNotifier.class);
+   private QCodeReference userSessionSupplier = null;
+   private String defaultTagMode = "FREE";
+   private List<String> tagActionTables = List.of();
+   private List<String> followActionTables = List.of();
+   private List<String> followChangeTables = List.of();
+   private String backendName;
+   private String schedulerName;
+   private String appName = "collaboration";
+   private String parentAppName;
+   private Boolean adminApp = true;
+   private Integer recentsPerUser = 200;
+   private String attachmentsBucketName = "collaboration";
+   private Long defaultMaxBytes = 100L * 1024 * 1024;
+   private List<String> blockedExtensions = List.of();
+
+
+
+   /*******************************************************************************
+    ** Getter for backendName.
+    *******************************************************************************/
+   public String getBackendName()
+   {
+      return (backendName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Setter for backendName.
+    *******************************************************************************/
+   public void setBackendName(String backendName)
+   {
+      this.backendName = backendName;
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for backendName.
+    *******************************************************************************/
+   public CollaborationQBitConfig withBackendName(String backendName)
+   {
+      this.backendName = backendName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for schedulerName.
+    *******************************************************************************/
+   public String getSchedulerName()
+   {
+      return (schedulerName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Setter for schedulerName.
+    *******************************************************************************/
+   public void setSchedulerName(String schedulerName)
+   {
+      this.schedulerName = schedulerName;
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for schedulerName.
+    *******************************************************************************/
+   public CollaborationQBitConfig withSchedulerName(String schedulerName)
+   {
+      this.schedulerName = schedulerName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for appName.
+    *******************************************************************************/
+   public String getAppName()
+   {
+      return (appName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Setter for appName.
+    *******************************************************************************/
+   public void setAppName(String appName)
+   {
+      this.appName = appName;
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for appName.
+    *******************************************************************************/
+   public CollaborationQBitConfig withAppName(String appName)
+   {
+      this.appName = appName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for parentAppName.
+    *******************************************************************************/
+   public String getParentAppName()
+   {
+      return (parentAppName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Setter for parentAppName.
+    *******************************************************************************/
+   public void setParentAppName(String parentAppName)
+   {
+      this.parentAppName = parentAppName;
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for parentAppName.
+    *******************************************************************************/
+   public CollaborationQBitConfig withParentAppName(String parentAppName)
+   {
+      this.parentAppName = parentAppName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for adminApp.
+    *******************************************************************************/
+   public Boolean getAdminApp()
+   {
+      return (adminApp);
+   }
+
+
+
+   /*******************************************************************************
+    ** Setter for adminApp.
+    *******************************************************************************/
+   public void setAdminApp(Boolean adminApp)
+   {
+      this.adminApp = adminApp;
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for adminApp.
+    *******************************************************************************/
+   public CollaborationQBitConfig withAdminApp(Boolean adminApp)
+   {
+      this.adminApp = adminApp;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Maximum retained recent targets per user.
+    *******************************************************************************/
+   public Integer getRecentsPerUser()
+   {
+      return (recentsPerUser);
+   }
+
+
+
+   /*******************************************************************************
+    ** Configure retention; validated when the producer is installed.
+    *******************************************************************************/
+   public void setRecentsPerUser(Integer recentsPerUser)
+   {
+      this.recentsPerUser = recentsPerUser;
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent retention configuration.
+    *******************************************************************************/
+   public CollaborationQBitConfig withRecentsPerUser(Integer recentsPerUser)
+   {
+      setRecentsPerUser(recentsPerUser);
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Validate the configured backend and app placement.
+    *******************************************************************************/
+   @Override
+   public void validate(QInstance instance, List<String> errors)
+   {
+      if(assertCondition(StringUtils.hasContent(backendName), "backendName is required for Collaboration", errors))
+      {
+         assertCondition(instance.getBackend(backendName) != null, "Unknown Collaboration backend: " + backendName, errors);
+      }
+      assertCondition(List.of("FREE", "APPROVED_ONLY").contains(defaultTagMode == null ? "" : defaultTagMode), "defaultTagMode must be FREE or APPROVED_ONLY", errors);
+      assertCondition(notifier != null, "notifier is required", errors);
+      for(List<String> tables : List.of(followActionTables, followChangeTables, tagActionTables))
+      {
+         for(String table : tables)
+         {
+            assertCondition(table != null && !table.startsWith(TABLE_NAME_PREFIX) && instance.getTable(table) != null
+               && instance.getTable(table).getPrimaryKeyField() != null, "Follow configuration needs a host table with a primary key: " + table, errors);
+         }
+      }
+      assertCondition(StringUtils.hasContent(attachmentsBucketName), "attachmentsBucketName is required", errors);
+      assertCondition(defaultMaxBytes != null && defaultMaxBytes > 0, "defaultMaxBytes must be positive", errors);
+      assertCondition(blockedExtensions != null && blockedExtensions.stream().allMatch(value -> value != null && !value.isBlank()), "blockedExtensions must contain nonblank extensions", errors);
+      assertCondition(recentsPerUser != null && recentsPerUser > 0, "recentsPerUser must be positive", errors);
+      if(schedulerName != null)
+      {
+         assertCondition(instance.getScheduler(schedulerName) != null, "Unknown Collaboration scheduler: " + schedulerName, errors);
+      }
+      if(Boolean.TRUE.equals(adminApp))
+      {
+         assertCondition(StringUtils.hasContent(appName), "appName is required when adminApp is enabled", errors);
+         if(parentAppName != null)
+         {
+            assertCondition(instance.getApp(parentAppName) != null, "Unknown Collaboration parent app: " + parentAppName, errors);
+         }
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Default backend for the qbit tables.
+    *******************************************************************************/
+   @Override
+   public String getDefaultBackendNameForTables()
+   {
+      return (backendName);
+   }
+
+
+   /*******************************************************************************
+    ** Getter for attachmentsBucketName.
+    *******************************************************************************/
+   public String getAttachmentsBucketName()
+   {
+      return (attachmentsBucketName);
+   }
+
+
+   /*******************************************************************************
+    ** Setter for attachmentsBucketName.
+    *******************************************************************************/
+   public void setAttachmentsBucketName(String attachmentsBucketName)
+   {
+      this.attachmentsBucketName = attachmentsBucketName;
+   }
+
+
+   /*******************************************************************************
+    ** Fluent setter for attachmentsBucketName.
+    *******************************************************************************/
+   public CollaborationQBitConfig withAttachmentsBucketName(String attachmentsBucketName)
+   {
+      setAttachmentsBucketName(attachmentsBucketName);
+      return (this);
+   }
+
+
+   /*******************************************************************************
+    ** Getter for defaultMaxBytes.
+    *******************************************************************************/
+   public Long getDefaultMaxBytes()
+   {
+      return (defaultMaxBytes);
+   }
+
+
+   /*******************************************************************************
+    ** Setter for defaultMaxBytes.
+    *******************************************************************************/
+   public void setDefaultMaxBytes(Long defaultMaxBytes)
+   {
+      this.defaultMaxBytes = defaultMaxBytes;
+   }
+
+
+   /*******************************************************************************
+    ** Fluent setter for defaultMaxBytes.
+    *******************************************************************************/
+   public CollaborationQBitConfig withDefaultMaxBytes(Long defaultMaxBytes)
+   {
+      setDefaultMaxBytes(defaultMaxBytes);
+      return (this);
+   }
+
+
+   /*******************************************************************************
+    ** Getter for blockedExtensions.
+    *******************************************************************************/
+   public List<String> getBlockedExtensions()
+   {
+      return (blockedExtensions);
+   }
+
+
+   /*******************************************************************************
+    ** Setter for blockedExtensions.
+    *******************************************************************************/
+   public void setBlockedExtensions(List<String> blockedExtensions)
+   {
+      this.blockedExtensions = blockedExtensions;
+   }
+
+
+   /*******************************************************************************
+    ** Fluent setter for blockedExtensions.
+    *******************************************************************************/
+   public CollaborationQBitConfig withBlockedExtensions(List<String> blockedExtensions)
+   {
+      setBlockedExtensions(blockedExtensions);
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Get notifier.
+    *******************************************************************************/
+   public QCodeReference getNotifier()
+   {
+      return (notifier);
+   }
+
+   /*******************************************************************************
+    ** Configure notifier.
+    *******************************************************************************/
+   public CollaborationQBitConfig withNotifier(QCodeReference notifier)
+   {
+      this.notifier = notifier;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Get userSessionSupplier.
+    *******************************************************************************/
+   public QCodeReference getUserSessionSupplier()
+   {
+      return (userSessionSupplier);
+   }
+
+   /*******************************************************************************
+    ** Configure userSessionSupplier.
+    *******************************************************************************/
+   public CollaborationQBitConfig withUserSessionSupplier(QCodeReference userSessionSupplier)
+   {
+      this.userSessionSupplier = userSessionSupplier;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Get followActionTables.
+    *******************************************************************************/
+   public List<String> getFollowActionTables()
+   {
+      return (followActionTables);
+   }
+
+   /*******************************************************************************
+    ** Configure followActionTables.
+    *******************************************************************************/
+   public CollaborationQBitConfig withFollowActionTables(List<String> followActionTables)
+   {
+      this.followActionTables = followActionTables;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Get followChangeTables.
+    *******************************************************************************/
+   public List<String> getFollowChangeTables()
+   {
+      return (followChangeTables);
+   }
+
+   /*******************************************************************************
+    ** Configure followChangeTables.
+    *******************************************************************************/
+   public CollaborationQBitConfig withFollowChangeTables(List<String> followChangeTables)
+   {
+      this.followChangeTables = followChangeTables;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Default vocabulary policy when no persisted override supplies a mode.
+    *******************************************************************************/
+   public String getDefaultTagMode()
+   {
+      return (defaultTagMode);
+   }
+
+   /*******************************************************************************
+    ** Configure the default tag policy.
+    *******************************************************************************/
+   public CollaborationQBitConfig withDefaultTagMode(String mode)
+   {
+      this.defaultTagMode = mode;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Host tables receiving Add tags and Remove tags actions.
+    *******************************************************************************/
+   public List<String> getTagActionTables()
+   {
+      return (tagActionTables);
+   }
+
+   /*******************************************************************************
+    ** Configure host tag actions.
+    *******************************************************************************/
+   public CollaborationQBitConfig withTagActionTables(List<String> tables)
+   {
+      this.tagActionTables = tables;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/CollaborationQBitProducer.java

@@ -0,0 +1,169 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+
+import com.kingsrook.qbits.collaboration.app.CollaborationHome;
+import com.kingsrook.qbits.collaboration.attachments.DeleteAttachmentsProcess;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.recents.TrimRecentsProcess;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.metadata.MetaDataProducerMultiOutput;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QAppMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValueSource;
+import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitMetaDataProducer;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+
+/*******************************************************************************
+ ** Registers the Collaboration tables, possible values and optional app home.
+ *******************************************************************************/
+public class CollaborationQBitProducer implements QBitMetaDataProducer<CollaborationQBitConfig>
+{
+   public static final String GROUP_ID = "com.kingsrook.qbits";
+   public static final String ARTIFACT_ID = "qbit-collaboration";
+   public static final String VERSION = "0.1.0";
+
+   private CollaborationQBitConfig qBitConfig;
+   private String namespace;
+
+
+
+   /*******************************************************************************
+    ** Configure the qbit.
+    *******************************************************************************/
+   public CollaborationQBitProducer withQBitConfig(CollaborationQBitConfig config)
+   {
+      qBitConfig = config;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Get the configuration.
+    *******************************************************************************/
+   @Override
+   public CollaborationQBitConfig getQBitConfig()
+   {
+      return (qBitConfig);
+   }
+
+
+
+   /*******************************************************************************
+    ** Set the namespace.
+    *******************************************************************************/
+   public CollaborationQBitProducer withNamespace(String namespace)
+   {
+      this.namespace = namespace;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Get the namespace.
+    *******************************************************************************/
+   @Override
+   public String getNamespace()
+   {
+      return (namespace);
+   }
+
+
+
+   /*******************************************************************************
+    ** Describe this qbit.
+    *******************************************************************************/
+   @Override
+   public QBitMetaData getQBitMetaData()
+   {
+      return (new QBitMetaData().withGroupId(GROUP_ID).withArtifactId(ARTIFACT_ID).withVersion(VERSION).withNamespace(namespace).withConfig(qBitConfig));
+   }
+
+
+
+   /*******************************************************************************
+    ** Package-scanned producers remain disabled until configured.
+    *******************************************************************************/
+   @Override
+   public boolean isEnabled()
+   {
+      return (qBitConfig != null);
+   }
+
+
+
+   /*******************************************************************************
+    ** Validate and register metadata, following the reference qbit convention.
+    *******************************************************************************/
+   @Override
+   public MetaDataProducerMultiOutput produce(QInstance instance) throws QException
+   {
+      qBitConfig.validate(instance);
+      QBitMetaData qBit = getQBitMetaData();
+      instance.addQBit(qBit);
+      MetaDataProducerMultiOutput output = new MetaDataProducerMultiOutput();
+      CollaborationSecurity.buildSecurityKeyTypes().forEach(output::add);
+      output.add(TrimRecentsProcess.metadata(qBitConfig));
+      output.add(com.kingsrook.qbits.collaboration.follow.SendFollowDigestsProcess.metadata(qBitConfig));
+      for(String table : qBitConfig.getFollowActionTables())
+      {
+         com.kingsrook.qbits.collaboration.follow.FollowProcesses.processesFor(table).forEach(output::add);
+      }
+      if(!qBitConfig.getFollowChangeTables().isEmpty())
+      {
+         instance.withRecordChangeListener(new com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference(com.kingsrook.qbits.collaboration.follow.FollowChangeBatcher.class));
+      }
+      com.kingsrook.qbits.collaboration.tags.TagProcesses.management().forEach(output::add);
+      for(String table : qBitConfig.getTagActionTables())
+      {
+         com.kingsrook.qbits.collaboration.tags.TagProcesses.processesFor(table).forEach(output::add);
+      }
+      output.add(DeleteAttachmentsProcess.metadata());
+      for(QPossibleValueSource source : CollaborationTables.possibleValueSources())
+      {
+         output.add(source);
+      }
+      for(QTableMetaData table : CollaborationTables.tables(qBitConfig))
+      {
+         table.setSourceQBitName(qBit.getName());
+         output.add(table);
+      }
+      if(Boolean.TRUE.equals(qBitConfig.getAdminApp()))
+      {
+         output.add(CollaborationHome.widget());
+         output.add(CollaborationHome.app(qBitConfig));
+      }
+      output.addSelfToInstance(instance);
+      com.kingsrook.qbits.collaboration.model.ConversationChildren.install(instance);
+      if(Boolean.TRUE.equals(qBitConfig.getAdminApp()) && qBitConfig.getParentAppName() != null)
+      {
+         QAppMetaData parent = instance.getApp(qBitConfig.getParentAppName());
+         parent.withChild(instance.getApp(qBitConfig.getAppName()));
+      }
+      return (new MetaDataProducerMultiOutput());
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/CollaborationRecords.java

@@ -0,0 +1,132 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.io.Serializable;
+import java.util.List;
+import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Internal persistence for trusted services. Callers must authorize the parent
+ ** before reading or writing. Never expose these methods as API operations.
+ *******************************************************************************/
+public final class CollaborationRecords
+{
+   /*******************************************************************************
+    ** Static persistence boundary.
+    *******************************************************************************/
+   private CollaborationRecords()
+   {
+   }
+
+   /*******************************************************************************
+    ** Resolve the installed qbit configuration.
+    *******************************************************************************/
+   public static CollaborationQBitConfig config()
+   {
+      return ((CollaborationQBitConfig) QContext.getQInstance().getQBits().values().stream()
+         .filter(bit -> bit.getConfig() instanceof CollaborationQBitConfig).findFirst().orElseThrow().getConfig());
+   }
+
+   /*******************************************************************************
+    ** Restrict a service query to one canonical parent.
+    *******************************************************************************/
+   public static QQueryFilter parent(String table, String id)
+   {
+      return (new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, table)
+         .withCriteria("recordId", QCriteriaOperator.EQUALS, id).withCriteria("parentDeleted", QCriteriaOperator.EQUALS, false));
+   }
+
+   /*******************************************************************************
+    ** Raw reads retain transaction visibility but omit presentation customizers.
+    *******************************************************************************/
+   public static List<QRecord> query(String table, QQueryFilter filter) throws QException
+   {
+      QueryInput input = new QueryInput(table).withFilter(filter).withShouldFetchHeavyFields(true).withTransaction(QContext.getQBackendTransaction());
+      input.setTableMetaData(QContext.getQInstance().getTable(table).clone().withCustomizers(null));
+      input.withPermissionBypass("Trusted collaboration service performs parent/ownership authorization.");
+      return (new QueryAction().execute(input).getRecords().stream().map(QRecord::new).toList());
+   }
+
+   /*******************************************************************************
+    ** Persist generated keys and propagate record validation errors.
+    *******************************************************************************/
+   public static QRecord insert(String table, QRecord row) throws QException
+   {
+      InsertInput input = new InsertInput(table).withRecords(List.of(row)).withTransaction(QContext.getQBackendTransaction());
+      input.withPermissionBypass("Trusted collaboration service authorized this write.");
+      List<QRecord> result = new InsertAction().execute(input).getRecords();
+      check(result);
+      return (result.getFirst());
+   }
+
+   /*******************************************************************************
+    ** Only supplied fields are changed; preserve auditing.
+    *******************************************************************************/
+   public static void update(String table, QRecord row) throws QException
+   {
+      UpdateInput input = new UpdateInput(table).withRecords(List.of(row)).withTransaction(QContext.getQBackendTransaction());
+      input.setTableMetaData(QContext.getQInstance().getTable(table).clone().withCustomizers(null));
+      input.withPermissionBypass("Trusted collaboration service authorized this write.");
+      check(new UpdateAction().execute(input).getRecords());
+   }
+
+   /*******************************************************************************
+    ** Delete a service-selected row.
+    *******************************************************************************/
+   public static void delete(String table, Serializable id) throws QException
+   {
+      DeleteInput input = new DeleteInput(table).withPrimaryKeys(List.of(id)).withTransaction(QContext.getQBackendTransaction());
+      input.setTableMetaData(QContext.getQInstance().getTable(table).clone().withCustomizers(null));
+      input.withPermissionBypass("Trusted collaboration service authorized this deletion.");
+      check(new DeleteAction().execute(input).getRecordsWithErrors());
+   }
+
+   /*******************************************************************************
+    ** Core actions can return validation errors instead of throwing.
+    *******************************************************************************/
+   private static void check(List<QRecord> rows) throws QException
+   {
+      if(rows != null)
+      {
+         for(QRecord row : rows)
+         {
+            if(row.getErrors() != null && !row.getErrors().isEmpty())
+            {
+               throw (new QException("Could not save collaboration record: " + row.getErrors()));
+            }
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/CollaborationSchema.java

@@ -0,0 +1,103 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+
+import java.util.ArrayList;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.UniqueKey;
+
+
+/*******************************************************************************
+ ** PostgreSQL DDL generated from the same fields and unique keys as QQQ metadata.
+ ** Hosts apply it through their migration tooling; this class never executes DDL.
+ *******************************************************************************/
+public final class CollaborationSchema
+{
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private CollaborationSchema()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Create tables and unique indexes using QQQ's inferred snake_case columns.
+    *******************************************************************************/
+   public static String postgresScript(CollaborationQBitConfig config)
+   {
+      List<String> statements = new ArrayList<>();
+      for(QTableMetaData table : CollaborationTables.tables(config))
+      {
+         List<String> columns = new ArrayList<>();
+         for(QFieldMetaData field : table.getFields().values())
+         {
+            String type = field.getName().equals(table.getPrimaryKeyField()) ? "INTEGER GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY" : sqlType(field);
+            columns.add("   " + field.getBackendName() + " " + type + (field.getName().equals("parentDeleted") ? " DEFAULT FALSE" : "") + (Boolean.TRUE.equals(field.getIsRequired()) ? " NOT NULL" : ""));
+         }
+         statements.add("CREATE TABLE IF NOT EXISTS " + table.getName() + " (\n" + String.join(",\n", columns) + "\n)");
+         int index = 0;
+         for(UniqueKey key : table.getUniqueKeys() == null ? List.<UniqueKey>of() : table.getUniqueKeys())
+         {
+            index++;
+            List<String> names = key.getFieldNames().stream().map(name -> table.getField(name).getBackendName()).toList();
+            statements.add("CREATE UNIQUE INDEX IF NOT EXISTS uq_" + table.getName() + "_" + index + " ON " + table.getName() + " (" + String.join(", ", names) + ")"
+               + (key.getFieldNames().stream().anyMatch(name -> !Boolean.TRUE.equals(table.getField(name).getIsRequired())) ? " NULLS NOT DISTINCT" : ""));
+         }
+      }
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_record_tag_tag ON collaboration_record_tag (tag_id)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_attachment_parent ON collaboration_attachment (table_name, record_id)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_comment_parent ON collaboration_comment (table_name, record_id, last_activity_at, id)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_comment_created ON collaboration_comment (table_name, record_id, create_date)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_comment_thread ON collaboration_comment (thread_id, create_date, id)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_revision_comment ON collaboration_comment_revision (comment_id, edited_at, id)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_activity_parent ON collaboration_activity (table_name, record_id, at, id)");
+      statements.add("CREATE INDEX IF NOT EXISTS idx_collaboration_digest_due ON collaboration_follow_digest (due_at)");
+      return (String.join(";\n", statements) + ";\n");
+   }
+
+
+
+   /*******************************************************************************
+    ** Supported PostgreSQL types; fail explicitly for unsupported metadata.
+    *******************************************************************************/
+   private static String sqlType(QFieldMetaData field)
+   {
+      return (switch(field.getType())
+      {
+         case STRING -> "VARCHAR(" + (field.getMaxLength() == null ? 255 : field.getMaxLength()) + ")";
+         case TEXT -> "TEXT";
+         case INTEGER -> "INTEGER";
+         case LONG -> "BIGINT";
+         case BOOLEAN -> "BOOLEAN";
+         case DATE_TIME -> "TIMESTAMPTZ";
+         case DATE -> "DATE";
+         case DECIMAL -> "NUMERIC";
+         default -> throw new IllegalArgumentException("Unsupported schema type: " + field.getType());
+      });
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/CollaborationSecurity.java

@@ -0,0 +1,135 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.security.QSecurityKeyType;
+import com.kingsrook.qqq.backend.core.model.metadata.security.RecordSecurityLock;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
+
+
+/*******************************************************************************
+ ** Personal tables require no collaboration.view grant: NOT_PROTECTED plus a
+ ** READ_AND_WRITE owner lock lets every signed-in user manage their own rows.
+ ** Administrators receive the all-access key. The permission checker initializes
+ ** keys before enforced core actions (RC.5 has no pre-query customizer); services
+ ** and the home also ensure keys, like Alerts. Hosts may call applyToSession
+ ** after authentication. System sessions are left untouched.
+ *******************************************************************************/
+public class CollaborationSecurity implements CustomPermissionChecker
+{
+   public static final String KEY_USER = "collaboration_user";
+   public static final String KEY_USER_ALL_ACCESS = "collaboration_user_all_access";
+
+
+
+   /*******************************************************************************
+    ** Register the owner key and its administrator override.
+    *******************************************************************************/
+   public static List<QSecurityKeyType> buildSecurityKeyTypes()
+   {
+      return (List.of(new QSecurityKeyType().withName(KEY_USER).withAllAccessKeyName(KEY_USER_ALL_ACCESS)));
+   }
+
+
+
+   /*******************************************************************************
+    ** Apply ownership to reads and writes, including changes to the owner field.
+    *******************************************************************************/
+   public static RecordSecurityLock ownerLock(String fieldName)
+   {
+      return (new RecordSecurityLock().withSecurityKeyType(KEY_USER).withFieldName(fieldName)
+         .withLockScope(RecordSecurityLock.LockScope.READ_AND_WRITE));
+   }
+
+
+
+   /*******************************************************************************
+    ** Replace our keys so a changed user or revoked admin permission cannot linger.
+    *******************************************************************************/
+   public static void applyToSession(QInstance instance, QSession session)
+   {
+      if(instance == null || session == null || session instanceof QSystemUserSession)
+      {
+         return;
+      }
+      if(session.getSecurityKeyValues() != null)
+      {
+         session.getSecurityKeyValues().remove(KEY_USER);
+         session.getSecurityKeyValues().remove(KEY_USER_ALL_ACCESS);
+      }
+      String userId = userId(session);
+      if(userId != null && !userId.isBlank())
+      {
+         session.withSecurityKeyValue(KEY_USER, userId);
+         if(session.hasPermission(CollaborationPermissions.ADMIN))
+         {
+            session.withSecurityKeyValue(KEY_USER_ALL_ACCESS, true);
+         }
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Cheaply refresh the two keys on every entry point; no metadata scan needed.
+    *******************************************************************************/
+   public static void ensureSessionKeys(QInstance instance, QSession session)
+   {
+      applyToSession(instance, session);
+   }
+
+
+
+   /*******************************************************************************
+    ** Authentication's stable user reference, never a display name or session id.
+    *******************************************************************************/
+   public static String userId(QSession session)
+   {
+      return (session == null || session.getUser() == null ? null : session.getUser().getIdReference());
+   }
+
+
+
+   /*******************************************************************************
+    ** Initialize before direct query/get/count/aggregate/insert/update/delete.
+    *******************************************************************************/
+   @Override
+   public void checkPermissionsThrowing(AbstractActionInput input, MetaDataWithPermissionRules metadata) throws QPermissionDeniedException
+   {
+      QSession session = QContext.getQSession();
+      ensureSessionKeys(QContext.getQInstance(), session);
+      if(!(session instanceof QSystemUserSession) && (userId(session) == null || userId(session).isBlank()))
+      {
+         throw (new QPermissionDeniedException("Sign in to manage favorites and recents."));
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/PersonalRecords.java

@@ -0,0 +1,179 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+
+import java.io.Serializable;
+import java.util.List;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+
+/*******************************************************************************
+ ** Shared current-session persistence. Explicit user filters keep personal service
+ ** calls scoped to the caller even when administrators hold the all-access key.
+ *******************************************************************************/
+public final class PersonalRecords
+{
+   /*******************************************************************************
+    ** Static operations only.
+    *******************************************************************************/
+   private PersonalRecords()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Require an authenticated owner before accepting a personal operation.
+    *******************************************************************************/
+   public static String currentUserId() throws QPermissionDeniedException
+   {
+      CollaborationSecurity.ensureSessionKeys(QContext.getQInstance(), QContext.getQSession());
+      String userId = CollaborationSecurity.userId(QContext.getQSession());
+      if(userId == null || userId.isBlank())
+      {
+         throw (new QPermissionDeniedException("Sign in to manage favorites and recents."));
+      }
+      return (userId);
+   }
+
+
+
+   /*******************************************************************************
+    ** Always constrain personal services to the current owner.
+    *******************************************************************************/
+   public static QQueryFilter ownFilter() throws QPermissionDeniedException
+   {
+      return (new QQueryFilter().withCriteria("userId", QCriteriaOperator.EQUALS, currentUserId()));
+   }
+
+
+
+   /*******************************************************************************
+    ** Null record ids use IS_BLANK, not SQL equality with NULL.
+    *******************************************************************************/
+   public static QQueryFilter targetFilter(String type, String name, String recordId) throws QPermissionDeniedException
+   {
+      QQueryFilter filter = ownFilter().withCriteria("targetType", QCriteriaOperator.EQUALS, type)
+         .withCriteria("targetName", QCriteriaOperator.EQUALS, name);
+      if(recordId == null)
+      {
+         filter.withCriteria("recordId", QCriteriaOperator.IS_BLANK);
+      }
+      else
+      {
+         filter.withCriteria("recordId", QCriteriaOperator.EQUALS, recordId);
+      }
+      return (filter);
+   }
+
+
+
+   /*******************************************************************************
+    ** Enforce permissions independently of the host's core-action default.
+    *******************************************************************************/
+   public static List<QRecord> query(String table, QQueryFilter filter) throws QException
+   {
+      QueryInput input = new QueryInput(table).withFilter(filter);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      return (new QueryAction().execute(input).getRecords());
+   }
+
+
+
+   /*******************************************************************************
+    ** Propagate per-record validation failures instead of reporting success.
+    *******************************************************************************/
+   public static QRecord insert(String table, QRecord record) throws QException
+   {
+      InsertInput input = new InsertInput(table).withRecords(List.of(record));
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      QRecord result = new InsertAction().execute(input).getRecords().getFirst();
+      checkErrors(List.of(result));
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** Update only fields supplied by the service, using the current session.
+    *******************************************************************************/
+   public static void update(String table, List<QRecord> records) throws QException
+   {
+      if(records.isEmpty())
+      {
+         return;
+      }
+      UpdateInput input = new UpdateInput(table).withRecords(records);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      checkErrors(new UpdateAction().execute(input).getRecords());
+   }
+
+
+
+   /*******************************************************************************
+    ** Delete already selected ids; row locks are still enforced by DeleteAction.
+    *******************************************************************************/
+   public static void delete(String table, List<Serializable> ids) throws QException
+   {
+      if(ids.isEmpty())
+      {
+         return;
+      }
+      DeleteInput input = new DeleteInput(table).withPrimaryKeys(ids);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      checkErrors(new DeleteAction().execute(input).getRecordsWithErrors());
+   }
+
+
+
+   /*******************************************************************************
+    ** QQQ actions can return record errors without throwing.
+    *******************************************************************************/
+   private static void checkErrors(List<QRecord> records) throws QException
+   {
+      if(records != null)
+      {
+         for(QRecord record : records)
+         {
+            if(record.getErrors() != null && !record.getErrors().isEmpty())
+            {
+               throw (new QException("Could not save personal target: " + record.getErrors()));
+            }
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/RecordCursor.java

@@ -0,0 +1,92 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.nio.charset.StandardCharsets;
+import java.time.Instant;
+import java.util.Base64;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+/*******************************************************************************
+ ** Versioned opaque keyset cursor shared by comments and timeline.
+ *******************************************************************************/
+public record RecordCursor(Instant at, String kind, Long id)
+{
+   /*******************************************************************************
+    ** No record data is embedded in a cursor.
+    *******************************************************************************/
+   public String encode()
+   {
+      return (Base64.getUrlEncoder().withoutPadding().encodeToString(("1\n" + at + "\n" + kind + "\n" + id).getBytes(StandardCharsets.UTF_8)));
+   }
+
+   /*******************************************************************************
+    ** Reject malformed cursors with a consistent service error.
+    *******************************************************************************/
+   public static RecordCursor decode(String cursor) throws QException
+   {
+      try
+      {
+         String[] parts = new String(Base64.getUrlDecoder().decode(cursor), StandardCharsets.UTF_8).split("\n", -1);
+         if(parts.length != 4 || !parts[0].equals("1") || !java.util.List.of("COMMENT", "ACTIVITY", "AUDIT").contains(parts[2]))
+         {
+            throw (new IllegalArgumentException("Invalid cursor"));
+         }
+         return (new RecordCursor(Instant.parse(parts[1]), parts[2], Long.valueOf(parts[3])));
+      }
+      catch(RuntimeException e)
+      {
+         throw (new QException("Invalid cursor", e));
+      }
+   }
+
+   /*******************************************************************************
+    ** Strict ordering for descending (time, kind, id) pagination.
+    *******************************************************************************/
+   public boolean isBefore(RecordCursor other)
+   {
+      int time = at.compareTo(other.at);
+      int type = kind.compareTo(other.kind);
+      return (time < 0 || (time == 0 && (type < 0 || (type == 0 && id < other.id))));
+   }
+
+   /*******************************************************************************
+    ** Apply the same tuple ordering in backend queries, including equal timestamps.
+    *******************************************************************************/
+   public QQueryFilter beforeFilter(String atField, String streamKind)
+   {
+      QQueryFilter filter = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR)
+         .withSubFilter(new QQueryFilter().withCriteria(atField, QCriteriaOperator.LESS_THAN, at));
+      if(streamKind.compareTo(kind) <= 0)
+      {
+         QQueryFilter equal = new QQueryFilter().withCriteria(atField, QCriteriaOperator.EQUALS, at);
+         if(streamKind.equals(kind))
+         {
+            equal.withCriteria("id", QCriteriaOperator.LESS_THAN, id.toString());
+         }
+         filter.withSubFilter(equal);
+      }
+      return (filter);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/TargetResolver.java

@@ -0,0 +1,316 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+
+import java.io.Serializable;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.favorites.FavoriteEntry;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionsHelper;
+import com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType;
+import com.kingsrook.qqq.backend.core.actions.tables.GetAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.exceptions.QValueException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.utils.ValueUtils;
+
+
+/*******************************************************************************
+ ** Resolves targets only with released RC.5 APIs. Each list batches record label
+ ** refreshes by table, preserving table permissions and record security locks.
+ ** Next accepts the flat /app/name/ routes, including dotted process names.
+ *******************************************************************************/
+public final class TargetResolver
+{
+   private static final Set<String> TYPES = Set.of("TABLE", "APP", "RECORD", "PROCESS", "REPORT", "SAVED_VIEW");
+
+
+
+   /*******************************************************************************
+    ** Static operations only.
+    *******************************************************************************/
+   private TargetResolver()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Validate target shape without requiring visibility (also used to unstar).
+    *******************************************************************************/
+   public static String recordId(String type, String name, Serializable recordId) throws QException
+   {
+      String id = recordId == null ? null : recordId.toString();
+      if(type == null || !TYPES.contains(type) || name == null || name.isBlank()
+         || ("RECORD".equals(type) ? id == null || id.isBlank() : id != null))
+      {
+         throw (new QException("Invalid target"));
+      }
+      if("RECORD".equals(type))
+      {
+         QTableMetaData table = QContext.getQInstance().getTable(name);
+         if(table != null && table.getPrimaryKeyField() != null)
+         {
+            try
+            {
+               id = ValueUtils.getValueAsFieldType(table.getField(table.getPrimaryKeyField()).getType(), id).toString();
+            }
+            catch(QValueException expected)
+            {
+               throw (new QException("Not found"));
+            }
+         }
+      }
+      return (id);
+   }
+
+
+
+   /*******************************************************************************
+    ** Resolve one target for writes; missing and invisible have the same error.
+    *******************************************************************************/
+   public static FavoriteEntry require(String type, String name, Serializable id) throws QException
+   {
+      String recordId = recordId(type, name, id);
+      QRecord row = new QRecord().withValue("targetType", type).withValue("targetName", name).withValue("recordId", recordId);
+      FavoriteEntry entry;
+      if("RECORD".equals(type))
+      {
+         QRecord record = get(name, recordId);
+         entry = entry(row, record == null ? null : record.getRecordLabel(), record == null ? null : path(name) + encode(recordId) + "/");
+      }
+      else
+      {
+         entry = metadataEntry(row);
+      }
+      if(!entry.available())
+      {
+         throw (new QException("Not found"));
+      }
+      return (entry);
+   }
+
+
+
+   /*******************************************************************************
+    ** One QueryAction per referenced record table; no cached labels escape.
+    *******************************************************************************/
+   public static List<FavoriteEntry> refresh(List<QRecord> rows) throws QException
+   {
+      Map<String, List<String>> idsByTable = new LinkedHashMap<>();
+      for(QRecord row : rows)
+      {
+         if("RECORD".equals(row.getValueString("targetType")))
+         {
+            idsByTable.computeIfAbsent(row.getValueString("targetName"), key -> new ArrayList<>()).add(row.getValueString("recordId"));
+         }
+      }
+      Map<String, Map<String, QRecord>> recordsByTable = new HashMap<>();
+      for(Map.Entry<String, List<String>> group : idsByTable.entrySet())
+      {
+         String table = group.getKey();
+         Map<String, QRecord> records = new HashMap<>();
+         recordsByTable.put(table, records);
+         if(canReadTable(table))
+         {
+            QueryInput input = new QueryInput(table).withShouldGenerateDisplayValues(true)
+               .withFilter(new QQueryFilter().withCriteria(QContext.getQInstance().getTable(table).getPrimaryKeyField(), QCriteriaOperator.IN, group.getValue()));
+            input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+            try
+            {
+               for(QRecord record : new QueryAction().execute(input).getRecords())
+               {
+                  records.put(record.getValueString(QContext.getQInstance().getTable(table).getPrimaryKeyField()), record);
+               }
+            }
+            catch(QPermissionDeniedException expected)
+            {
+               // Permission may have changed since the metadata check; fail closed.
+            }
+         }
+      }
+      List<FavoriteEntry> entries = new ArrayList<>();
+      for(QRecord row : rows)
+      {
+         String table = row.getValueString("targetName");
+         String id = row.getValueString("recordId");
+         if("RECORD".equals(row.getValueString("targetType")))
+         {
+            QRecord record = recordsByTable.get(table).get(id);
+            entries.add(entry(row, record == null ? null : record.getRecordLabel(), record == null ? null : path(table) + encode(id) + "/"));
+         }
+         else
+         {
+            entries.add(metadataEntry(row));
+         }
+      }
+      return (entries);
+   }
+
+
+
+   /*******************************************************************************
+    ** Metadata targets use the same permission helpers as core. Saved views also
+    ** require a visible savedView row and READ on the view's target table.
+    *******************************************************************************/
+   private static FavoriteEntry metadataEntry(QRecord row) throws QException
+   {
+      QInstance instance = QContext.getQInstance();
+      AbstractActionInput input = new AbstractActionInput();
+      String name = row.getValueString("targetName");
+      String label = null;
+      String href = null;
+      switch(row.getValueString("targetType"))
+      {
+         case "TABLE" ->
+         {
+            if(canReadTable(name))
+            {
+               label = instance.getTable(name).getLabel();
+               href = path(name);
+            }
+         }
+         case "APP" ->
+         {
+            if(PermissionsHelper.hasAppPermission(input, name))
+            {
+               label = instance.getApp(name).getLabel();
+               href = path(name);
+            }
+         }
+         case "PROCESS" ->
+         {
+            if(PermissionsHelper.hasProcessPermission(input, name))
+            {
+               label = instance.getProcess(name).getLabel();
+               href = path(name);
+            }
+         }
+         case "REPORT" ->
+         {
+            if(PermissionsHelper.hasReportPermission(input, name))
+            {
+               label = instance.getReport(name).getLabel();
+               href = path(name);
+            }
+         }
+         case "SAVED_VIEW" ->
+         {
+            QRecord view = get("savedView", name);
+            if(view != null && canReadTable(view.getValueString("tableName")))
+            {
+               label = view.getValueString("label");
+               href = path(view.getValueString("tableName")) + "savedView/" + encode(name) + "/";
+            }
+         }
+         default ->
+         {
+            // Unknown persisted types are unavailable rather than exposing their cache.
+         }
+      }
+      return (entry(row, label, href));
+   }
+
+
+
+   /*******************************************************************************
+    ** Both table visibility and per-record security are checked by GetAction.
+    *******************************************************************************/
+   private static QRecord get(String table, Serializable id) throws QException
+   {
+      if(!canReadTable(table))
+      {
+         return (null);
+      }
+      GetInput input = new GetInput(table).withPrimaryKey(id).withShouldGenerateDisplayValues(true);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      try
+      {
+         return (new GetAction().execute(input).getRecord());
+      }
+      catch(QPermissionDeniedException expected)
+      {
+         return (null);
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Guard existence before invoking the core table permission helper.
+    *******************************************************************************/
+   private static boolean canReadTable(String table)
+   {
+      return (table != null && QContext.getQInstance().getTable(table) != null
+         && PermissionsHelper.hasTablePermission(new AbstractActionInput(), table, TablePermissionSubType.READ));
+   }
+
+
+
+   /*******************************************************************************
+    ** A missing href means unavailable; never substitute a cached label.
+    *******************************************************************************/
+   private static FavoriteEntry entry(QRecord row, String label, String href)
+   {
+      return (new FavoriteEntry(row.getValueInteger("id"), row.getValueString("targetType"), row.getValueString("targetName"),
+         row.getValueString("recordId"), href == null ? "Unavailable" : label == null ? row.getValueString("targetName") : label,
+         row.getValueString("folder"), row.getValueInteger("sortOrder"), href != null, href));
+   }
+
+
+
+   /*******************************************************************************
+    ** Flat Next router path; trailing slash also supports dotted process names.
+    *******************************************************************************/
+   private static String path(String name)
+   {
+      return ("/app/" + encode(name) + "/");
+   }
+
+
+
+   /*******************************************************************************
+    ** Encode a single route segment, including slash, hash and spaces in ids.
+    *******************************************************************************/
+   private static String encode(String value)
+   {
+      return (URLEncoder.encode(value, StandardCharsets.UTF_8).replace("+", "%20"));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/activity/ActivityWriter.java

@@ -0,0 +1,53 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.activity;
+
+import java.time.Instant;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Internal activity writer; the calling service has already checked the parent.
+ *******************************************************************************/
+public final class ActivityWriter
+{
+   /*******************************************************************************
+    ** Static service boundary.
+    *******************************************************************************/
+   private ActivityWriter()
+   {
+   }
+
+   /*******************************************************************************
+    ** Store references, never copies of comment bodies or attachment contents.
+    *******************************************************************************/
+   public static void write(String table, String recordId, String type, String summary, String refTable, String refId) throws QException
+   {
+      CollaborationRecords.insert(CollaborationTables.ACTIVITY, new QRecord().withValue("tableName", table).withValue("recordId", recordId)
+         .withValue("at", Instant.now()).withValue("actorUserId", CollaborationSecurity.userId(QContext.getQSession()))
+         .withValue("type", type).withValue("summary", summary).withValue("refTableName", refTable).withValue("refId", refId).withValue("parentDeleted", false));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/app/CollaborationHome.java

@@ -0,0 +1,249 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.app;
+
+
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.dashboard.widgets.AbstractWidgetRenderer;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.AggregateAction;
+import com.kingsrook.qqq.backend.core.actions.tables.CountAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.Aggregate;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateResult;
+import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterCriteria;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.widgets.RenderWidgetInput;
+import com.kingsrook.qqq.backend.core.model.actions.widgets.RenderWidgetOutput;
+import com.kingsrook.qqq.backend.core.model.dashboard.widgets.RawHTML;
+import com.kingsrook.qqq.backend.core.model.dashboard.widgets.WidgetType;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.dashboard.QWidgetMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QAppMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QAppSection;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+
+
+/*******************************************************************************
+ ** The Collaboration app and its home. Counts use QQQ actions with the current
+ ** QContext session, preserving permissions and record security.
+ *******************************************************************************/
+public final class CollaborationHome
+{
+   public static final String HOME_WIDGET = "collaborationHome";
+
+
+
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private CollaborationHome()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Main tables only; processes never appear in navigation.
+    *******************************************************************************/
+   public static QAppMetaData app(CollaborationQBitConfig config)
+   {
+      QAppMetaData app = new QAppMetaData().withName(config.getAppName()).withLabel("Collaboration").withIcon(new QIcon("forum"))
+         .withPermissionRules(CollaborationPermissions.permissionRules())
+         .withWidgets(List.of(HOME_WIDGET))
+         .withSection(new QAppSection().withName("collaboration").withLabel("Collaboration").withIcon(new QIcon("forum"))
+            .withTables(List.of(CollaborationTables.COMMENT, CollaborationTables.ATTACHMENT, CollaborationTables.TAG, CollaborationTables.ACTIVITY, CollaborationTables.FEATURE_SETTING, CollaborationTables.USER)));
+      app.setParentAppName(config.getParentAppName());
+      return (app);
+   }
+
+
+
+   /*******************************************************************************
+    ** Full-width HTML widget, following the reference Storage home renderer.
+    *******************************************************************************/
+   public static QWidgetMetaData widget()
+   {
+      return (new QWidgetMetaData().withName(HOME_WIDGET).withLabel("Overview").withType(WidgetType.HTML.getType())
+         .withCodeReference(new QCodeReference(HomeRenderer.class)).withGridColumns(12).withIsCard(false)
+         .withPermissionRules(CollaborationPermissions.permissionRules()));
+   }
+
+
+
+   /*******************************************************************************
+    ** Show persisted enabled overrides by scope type, and recent directory use.
+    ** These are settings counts, not a claim about resolved host-table features.
+    *******************************************************************************/
+   public static String render(Instant now) throws QException
+   {
+      CollaborationSecurity.ensureSessionKeys(QContext.getQInstance(), QContext.getQSession());
+      StringBuilder html = new StringBuilder("<div style=\"display:flex;flex-direction:column;gap:1rem;width:100%;overflow-wrap:anywhere;\"><section><h3>Feature settings</h3>");
+      long settings = count(CollaborationTables.FEATURE_SETTING, new QQueryFilter());
+      if(settings == 0)
+      {
+         html.append("<p>No feature settings yet: features follow the code defaults</p>");
+      }
+      else
+      {
+         html.append("<p>Enabled feature settings per scope:</p><ul>");
+         for(String scope : List.of("INSTANCE", "APP", "TABLE"))
+         {
+            long enabled = count(CollaborationTables.FEATURE_SETTING, new QQueryFilter()
+               .withCriteria(new QFilterCriteria("scopeType", QCriteriaOperator.EQUALS, scope))
+               .withCriteria(new QFilterCriteria("enabled", QCriteriaOperator.EQUALS, true)));
+            html.append("<li>").append(scope).append(": ").append(enabled).append("</li>");
+         }
+         html.append("</ul><p>Stored overrides; applying them awaits the core collaboration contracts.</p>");
+      }
+      long people = count(CollaborationTables.USER, new QQueryFilter());
+      long recent = count(CollaborationTables.USER, new QQueryFilter()
+         .withCriteria(new QFilterCriteria("lastSeenAt", QCriteriaOperator.GREATER_THAN_OR_EQUALS, now.minus(7, ChronoUnit.DAYS)))
+         .withCriteria(new QFilterCriteria("lastSeenAt", QCriteriaOperator.LESS_THAN_OR_EQUALS, now)));
+      html.append("</section><section><h3>People</h3><p>People known: ").append(people)
+         .append("</p><p>Active in the last 7 days: ").append(recent).append("</p>");
+      if(people == 0)
+      {
+         html.append("<p>No people yet: the directory will be filled by collaboration calls when the feature services are installed.</p>");
+      }
+      html.append("</section>");
+      personalSummary(html, CollaborationTables.FAVORITE, "Favorites");
+      personalSummary(html, CollaborationTables.RECENT, "Recently viewed");
+      attachmentSummary(html);
+      tagSummary(html);
+      html.append("<section><h3>Comments this week</h3><p>").append(count(CollaborationTables.COMMENT, new QQueryFilter()
+         .withCriteria("createDate", QCriteriaOperator.GREATER_THAN_OR_EQUALS, now.minus(7, ChronoUnit.DAYS))
+         .withCriteria("createDate", QCriteriaOperator.LESS_THAN_OR_EQUALS, now).withCriteria("deletedAt", QCriteriaOperator.IS_BLANK))).append("</p></section>");
+      html.append("<section><h3>Open threads</h3><p>").append(count(CollaborationTables.COMMENT, new QQueryFilter()
+         .withCriteria("threadId", QCriteriaOperator.IS_BLANK).withCriteria("resolvedAt", QCriteriaOperator.IS_BLANK)
+         .withCriteria("deletedAt", QCriteriaOperator.IS_BLANK))).append("</p></section>");
+      if(QContext.getQSession().hasPermission(CollaborationPermissions.ADMIN))
+      {
+         html.append("<section><h3>Followers</h3><p>").append(count(CollaborationTables.FOLLOW, new QQueryFilter())).append("</p></section>");
+      }
+      html.append("<p>Conversation totals are approximate where parent record locks require post-filtering.</p>");
+      return (html.append("</div>").toString());
+   }
+
+
+
+   /*******************************************************************************
+    ** Caller-filtered vocabulary totals and five most used active tags.
+    *******************************************************************************/
+   private static void tagSummary(StringBuilder html) throws QException
+   {
+      QQueryFilter active = new QQueryFilter().withCriteria("mergedIntoTagId", QCriteriaOperator.IS_BLANK);
+      html.append("<section><h3>Tags</h3><p>Vocabulary size: ").append(count(CollaborationTables.TAG, active))
+         .append("</p><p>Pending suggestions: ").append(count(CollaborationTables.TAG, new QQueryFilter()
+            .withCriteria("mergedIntoTagId", QCriteriaOperator.IS_BLANK).withCriteria("approved", QCriteriaOperator.EQUALS, false)))
+         .append("</p><ul>");
+      com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput input = new com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput(CollaborationTables.TAG)
+         .withFilter(active.withCriteria("approved", QCriteriaOperator.EQUALS, true).withOrderBy(new QFilterOrderBy("usageCount", false)).withOrderBy(new QFilterOrderBy("label")).withLimit(5));
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      for(com.kingsrook.qqq.backend.core.model.data.QRecord tag : new com.kingsrook.qqq.backend.core.actions.tables.QueryAction().execute(input).getRecords())
+      {
+         html.append("<li>").append(tag.getValueString("label").replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;"))
+            .append(": ").append(tag.getValueInteger("usageCount")).append("</li>");
+      }
+      html.append("</ul></section>");
+   }
+
+   /*******************************************************************************
+    ** Real table aggregates, restricted to readable parent tables. Parent locks
+    ** are post-filtered on rows, so these aggregate totals are approximate.
+    *******************************************************************************/
+   private static void attachmentSummary(StringBuilder html) throws QException
+   {
+      Aggregate count = new Aggregate().withFieldName("id").withOperator(AggregateOperator.COUNT);
+      Aggregate bytes = new Aggregate().withFieldName("sizeBytes").withOperator(AggregateOperator.SUM);
+      AggregateInput input = new AggregateInput(CollaborationTables.ATTACHMENT).withAggregates(List.of(count, bytes));
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      List<AggregateResult> results = new AggregateAction().execute(input).getResults();
+      Object rowCount = results.isEmpty() ? 0 : results.getFirst().getAggregateValue(count);
+      Object totalBytes = results.isEmpty() ? 0 : results.getFirst().getAggregateValue(bytes);
+      html.append("<section><h3>Attachments</h3><p>Attachments: ").append(rowCount)
+         .append("</p><p>Total size (bytes): ").append(totalBytes == null ? 0 : totalBytes)
+         .append("</p><p>Approximate totals: parent record locks are applied when browsing attachments.</p>");
+      if("0".equals(String.valueOf(rowCount)))
+      {
+         html.append("<p>No attachments yet.</p>");
+      }
+      html.append("</section>");
+   }
+
+
+
+   /*******************************************************************************
+    ** Aggregate rows and distinct owners without loading high-volume personal data.
+    *******************************************************************************/
+   private static void personalSummary(StringBuilder html, String table, String label) throws QException
+   {
+      Aggregate rows = new Aggregate().withFieldName("id").withOperator(AggregateOperator.COUNT);
+      Aggregate users = new Aggregate().withFieldName("userId").withOperator(AggregateOperator.COUNT_DISTINCT);
+      AggregateInput input = new AggregateInput(table).withAggregates(List.of(rows, users));
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      List<AggregateResult> results = new AggregateAction().execute(input).getResults();
+      html.append("<section><h3>").append(label).append("</h3><p>Rows: ").append(results.isEmpty() ? 0 : results.getFirst().getAggregateValue(rows))
+         .append("</p><p>Distinct users: ").append(results.isEmpty() ? 0 : results.getFirst().getAggregateValue(users)).append("</p></section>");
+   }
+
+
+
+   /*******************************************************************************
+    ** Count without materializing rows or substituting a privileged session.
+    *******************************************************************************/
+   private static long count(String table, QQueryFilter filter) throws QException
+   {
+      CountInput input = new CountInput(table).withFilter(filter);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      return (new CountAction().execute(input).getCount());
+   }
+
+
+
+   /*******************************************************************************
+    ** Widget renderer instantiated by QQQ.
+    *******************************************************************************/
+   public static class HomeRenderer extends AbstractWidgetRenderer
+   {
+      /*******************************************************************************
+       ** Render using the current session and time.
+       *******************************************************************************/
+      @Override
+      public RenderWidgetOutput render(RenderWidgetInput input) throws QException
+      {
+         return (new RenderWidgetOutput(new RawHTML(null, CollaborationHome.render(Instant.now()))));
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentCleanup.java

@@ -0,0 +1,79 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import java.io.Serializable;
+import java.util.List;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Trusted after-commit callback. Wire to core RecordReferenceCleanupInterface
+ ** when released. Never expose as a user endpoint: the parent is already gone.
+ *******************************************************************************/
+public class AttachmentCleanup
+{
+   private final AttachmentsService service;
+
+   /*******************************************************************************
+    ** Production cleanup using the installed qbit and object storage.
+    *******************************************************************************/
+   public AttachmentCleanup()
+   {
+      this(new AttachmentsService());
+   }
+
+   /*******************************************************************************
+    ** Use the same storage boundary as normal deletion.
+    *******************************************************************************/
+   public AttachmentCleanup(AttachmentsService service)
+   {
+      this.service = service;
+   }
+
+   /*******************************************************************************
+    ** Repeated calls are safe; provider failures leave the row for a later retry.
+    *******************************************************************************/
+   public void onParentsDeleted(String table, List<? extends Serializable> ids) throws QException
+   {
+      if(ids.isEmpty())
+      {
+         return;
+      }
+      new com.kingsrook.qbits.collaboration.tags.TagsService().onParentsDeleted(table, ids);
+      while(true)
+      {
+         List<QRecord> rows = AttachmentRecords.query(new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, table)
+            .withCriteria("recordId", QCriteriaOperator.IN, ids.stream().map(Object::toString).toList()).withLimit(200));
+         if(rows.isEmpty())
+         {
+            return;
+         }
+         for(QRecord row : rows)
+         {
+            service.deleteStoredRow(row);
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentEntry.java

@@ -0,0 +1,32 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import java.time.Instant;
+
+/*******************************************************************************
+ ** Panel DTO. Storage locations and ephemeral signed URLs stay server-side.
+ *******************************************************************************/
+public record AttachmentEntry(Integer id, String tableName, String recordId, String fileName, String contentType,
+   Long sizeBytes, String sha256, String description, String createdByUserId, Instant createDate, Boolean canDelete)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentPreviewCustomizer.java

@@ -0,0 +1,100 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import java.util.ArrayList;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizerInterface;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.logging.QLogger;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrGetInputInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Filter invisible parents before generating ephemeral preview/download URLs.
+ ** Counts are approximate and pages can be short until core mirrors locks.
+ *******************************************************************************/
+public class AttachmentPreviewCustomizer implements TableCustomizerInterface
+{
+   private static final QLogger LOG = QLogger.getLogger(AttachmentPreviewCustomizer.class);
+
+   /*******************************************************************************
+    ** GetAction expects one result: throw Not found rather than return an empty list.
+    *******************************************************************************/
+   @Override
+   public List<QRecord> postQuery(QueryOrGetInputInterface input, List<QRecord> records) throws QException
+   {
+      return (filter(records, input instanceof GetInput, new AttachmentsService()));
+   }
+
+   /*******************************************************************************
+    ** Keep filtering every row even when the preview generation cap is reached.
+    *******************************************************************************/
+   List<QRecord> filter(List<QRecord> records, boolean isGet, AttachmentsService service) throws QException
+   {
+      List<QRecord> visible = new ArrayList<>();
+      for(QRecord record : records)
+      {
+         try
+         {
+            if(Boolean.TRUE.equals(record.getValueBoolean("parentDeleted")))
+            {
+               throw (new QNotFoundException("Not found"));
+            }
+            ParentRecordAccess.requireVisibleParent(record.getValueString("tableName"), record.getValueString("recordId"));
+         }
+         catch(QNotFoundException expected)
+         {
+            if(isGet)
+            {
+               throw (expected);
+            }
+            continue;
+         }
+         // Never retain URLs from a previous read of a memory-backend record.
+         QRecord row = new QRecord(record);
+         row.setValue("previewUrl", null);
+         row.setValue("downloadUrl", null);
+         row.withDisplayValue("downloadUrl", null).withDisplayValue("downloadUrl:downloadUrlDynamic", null);
+         visible.add(row);
+         if(visible.size() <= 200)
+         {
+            try
+            {
+               row.setValue("previewUrl", service.url(row, true).toString());
+               String downloadUrl = service.url(row, false).toString();
+               row.setValue("downloadUrl", downloadUrl);
+               row.withDisplayValue("downloadUrl", row.getValueString("fileName"))
+                  .withDisplayValue("downloadUrl:downloadUrlDynamic", downloadUrl);
+            }
+            catch(RuntimeException e)
+            {
+               LOG.debug("Could not make an attachment preview URL", e);
+            }
+         }
+      }
+      return (visible);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentRecords.java

@@ -0,0 +1,83 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Package-private raw reads for services and trusted parent cleanup. Callers
+ ** must check the parent before exposing any values or performing user writes.
+ *******************************************************************************/
+final class AttachmentRecords
+{
+   /*******************************************************************************
+    ** Static persistence helpers only.
+    *******************************************************************************/
+   private AttachmentRecords()
+   {
+   }
+
+   /*******************************************************************************
+    ** Use a per-input clone so shared metadata and session remain unchanged.
+    *******************************************************************************/
+   static List<QRecord> query(QQueryFilter filter) throws QException
+   {
+      QueryInput input = new QueryInput(CollaborationTables.ATTACHMENT).withFilter(filter).withShouldFetchHeavyFields(true);
+      input.setTableMetaData(storageTable());
+      input.withPermissionBypass("Attachment service checks parent access; cleanup is a trusted after-delete callback.");
+      return (new QueryAction().execute(input).getRecords());
+   }
+
+   /*******************************************************************************
+    ** Internal persistence must not generate URLs or filter a deleted parent.
+    ** Clone only this action's metadata; retain auditing and backend behavior.
+    *******************************************************************************/
+   static QTableMetaData storageTable()
+   {
+      return (QContext.getQInstance().getTable(CollaborationTables.ATTACHMENT).clone().withCustomizers(null));
+   }
+
+   /*******************************************************************************
+    ** QQQ validation errors may be returned on rows rather than thrown.
+    *******************************************************************************/
+   static void checkErrors(List<QRecord> records) throws QException
+   {
+      if(records != null)
+      {
+         for(QRecord record : records)
+         {
+            if(record.getErrors() != null && !record.getErrors().isEmpty())
+            {
+               throw (new QException("Could not save attachment: " + record.getErrors()));
+            }
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentSecurity.java

@@ -0,0 +1,66 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissionChecker;
+import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrCountInputInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
+
+/*******************************************************************************
+ ** RC.5 has no PRE_QUERY customizer. Its permission checker provides the
+ ** pre-query restriction for query, count and aggregate; post-query checks
+ ** handle parent record locks. Direct writes must use the attachment service.
+ *******************************************************************************/
+public class AttachmentSecurity implements CustomPermissionChecker
+{
+   /*******************************************************************************
+    ** Browse requires collaboration.view; writes cannot bypass storage lifecycle.
+    *******************************************************************************/
+   @Override
+   public void checkPermissionsThrowing(AbstractActionInput input, MetaDataWithPermissionRules metadata) throws QPermissionDeniedException
+   {
+      if(input instanceof InsertInput || input instanceof UpdateInput || input instanceof DeleteInput)
+      {
+         throw (new QPermissionDeniedException("Use the attachment service or Delete attachments action."));
+      }
+      new CollaborationPermissionChecker().checkPermissionsThrowing(input, metadata);
+      if(input instanceof QueryOrCountInputInterface query)
+      {
+         restrict(query);
+      }
+   }
+
+   /*******************************************************************************
+    ** AND the restriction outside any user OR clauses; preserve paging and sort.
+    ** Counts and aggregates are approximate because parent locks are post-filtered.
+    *******************************************************************************/
+   public static void restrict(QueryOrCountInputInterface input)
+   {
+      com.kingsrook.qbits.collaboration.security.ParentTableRestriction.restrict(input);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentStorage.java

@@ -0,0 +1,81 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import java.net.URL;
+import java.util.UUID;
+import com.kingsrook.qbits.objectstorage.api.DeleteMode;
+import com.kingsrook.qbits.objectstorage.api.DeleteRequest;
+import com.kingsrook.qbits.objectstorage.api.ObjectStorage;
+import com.kingsrook.qbits.objectstorage.api.PresignGet;
+import com.kingsrook.qbits.objectstorage.api.PutRequest;
+import com.kingsrook.qbits.objectstorage.api.StorageBucket;
+
+/*******************************************************************************
+ ** Narrow storage boundary. The caller must check collaboration access first.
+ ** Tests can substitute an in-memory implementation without an S3 service.
+ *******************************************************************************/
+public class AttachmentStorage
+{
+   /*******************************************************************************
+    ** Tag storage operations as the calling qbit, retaining the initiating user.
+    *******************************************************************************/
+   private StorageBucket bucket(String name)
+   {
+      return (ObjectStorage.asSystem("collaboration", UUID.randomUUID().toString()).bucket(name));
+   }
+
+   /*******************************************************************************
+    ** Enforce the bucket's cap as well as collaboration's configured cap.
+    *******************************************************************************/
+   public long maxBytes(String name)
+   {
+      return (bucket(name).config().getMaxUploadBytes());
+   }
+
+   /*******************************************************************************
+    ** Put a bounded stream through object storage's multipart implementation.
+    *******************************************************************************/
+   public void put(String name, PutRequest request)
+   {
+      bucket(name).put(request);
+   }
+
+   /*******************************************************************************
+    ** Prefer soft deletion; allow permanent deletion only where no soft mode exists.
+    *******************************************************************************/
+   public void delete(String name, String key)
+   {
+      if(bucket(name).delete(DeleteRequest.of(key).withAllowPermanentWhenNoSoftDelete(true)).getMode() == DeleteMode.SKIPPED_OBJECT_LOCK)
+      {
+         throw (new IllegalStateException("Object retention prevents attachment deletion."));
+      }
+   }
+
+   /*******************************************************************************
+    ** Create a temporary link, never a persistent table value.
+    *******************************************************************************/
+   public URL presign(String name, PresignGet request)
+   {
+      return (bucket(name).presignGet(request));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/attachments/AttachmentsService.java

@@ -0,0 +1,399 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.Serializable;
+import java.net.URL;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.time.Duration;
+import java.util.ArrayList;
+import java.util.HexFormat;
+import java.util.List;
+import java.util.Locale;
+import java.util.UUID;
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qbits.objectstorage.api.PresignGet;
+import com.kingsrook.qbits.objectstorage.api.PutRequest;
+import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Attachment operations with parent access checked using the caller's session.
+ *******************************************************************************/
+public class AttachmentsService
+{
+   private final CollaborationQBitConfig config;
+   private final AttachmentStorage storage;
+
+   /*******************************************************************************
+    ** Resolve the installed configuration without a global mutable singleton.
+    *******************************************************************************/
+   public AttachmentsService()
+   {
+      this((CollaborationQBitConfig) QContext.getQInstance().getQBits().values().stream()
+         .filter(qbit -> qbit.getConfig() instanceof CollaborationQBitConfig).findFirst().orElseThrow().getConfig(), new AttachmentStorage());
+   }
+
+   /*******************************************************************************
+    ** Injectable storage boundary for deterministic service tests.
+    *******************************************************************************/
+   public AttachmentsService(CollaborationQBitConfig config, AttachmentStorage storage)
+   {
+      this.config = config;
+      this.storage = storage;
+   }
+
+   /*******************************************************************************
+    ** Stream to a bounded temporary file while hashing, then put and insert.
+    ** The caller owns the input stream. Oversize files never reach object storage.
+    *******************************************************************************/
+   public AttachmentEntry upload(String tableName, Serializable recordId, String fileName, String contentType, InputStream stream, String description) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      ParentRecordAccess.requireFeature(tableName, recordId, "attach");
+      String user = requireUser();
+      String id = canonicalId(tableName, recordId);
+      String name = sanitize(fileName);
+      String bucket = config.getAttachmentsBucketName();
+      String key = "attachments/" + segment(tableName) + "/" + segment(id) + "/" + UUID.randomUUID() + "/" + name;
+      if(tableName.length() > 128 || id.length() > 64 || user.length() > 255 || bucket.length() > 255 || key.length() > 1024
+         || (contentType != null && contentType.length() > 255))
+      {
+         throw (new QException("Attachment metadata exceeds the supported field lengths."));
+      }
+      long limit = Math.min(config.getDefaultMaxBytes(), storage.maxBytes(bucket));
+      Path temporary = null;
+      try
+      {
+         MessageDigest digest = MessageDigest.getInstance("SHA-256");
+         temporary = Files.createTempFile("collaboration-attachment-", ".upload");
+         long size = 0;
+         try(OutputStream out = Files.newOutputStream(temporary))
+         {
+            byte[] buffer = new byte[8192];
+            int read;
+            while((read = stream.read(buffer)) != -1)
+            {
+               if(read > limit - size)
+               {
+                  throw (new QException("Attachment exceeds the size limit of " + limit + " bytes."));
+               }
+               size += read;
+               digest.update(buffer, 0, read);
+               out.write(buffer, 0, read);
+            }
+         }
+         String type = contentType == null || contentType.isBlank() ? "application/octet-stream" : contentType;
+         try(InputStream upload = Files.newInputStream(temporary))
+         {
+            storage.put(bucket, PutRequest.of(key, upload).withContentLength(size).withContentType(type).withContentDisposition("inline"));
+         }
+         boolean rowSaved = false;
+         try
+         {
+            QRecord row = new QRecord().withValue("tableName", tableName).withValue("recordId", id).withValue("fileName", name)
+               .withValue("contentType", type).withValue("sizeBytes", size).withValue("sha256", HexFormat.of().formatHex(digest.digest()))
+               .withValue("bucketName", bucket).withValue("storageKey", key).withValue("description", description)
+               .withValue("createdByUserId", user).withValue("parentDeleted", false);
+            InsertInput input = new InsertInput(CollaborationTables.ATTACHMENT).withRecords(List.of(row));
+            input.withPermissionBypass("AttachmentsService checked parent and attach permission before upload.");
+            List<QRecord> records = new InsertAction().execute(input).getRecords();
+            AttachmentRecords.checkErrors(records);
+            rowSaved = true;
+            com.kingsrook.qbits.collaboration.activity.ActivityWriter.write(tableName, id, "FILE_ADDED", "File added", CollaborationTables.ATTACHMENT, records.getFirst().getValueString("id"));
+            return (entry(records.getFirst()));
+         }
+         catch(QException | RuntimeException failure)
+         {
+            try
+            {
+               if(!rowSaved)
+               {
+                  storage.delete(bucket, key);
+               }
+            }
+            catch(RuntimeException cleanupFailure)
+            {
+               failure.addSuppressed(cleanupFailure);
+            }
+            throw (failure);
+         }
+      }
+      catch(IOException | NoSuchAlgorithmException e)
+      {
+         throw (new QException("Could not read attachment upload", e));
+      }
+      finally
+      {
+         if(temporary != null)
+         {
+            try
+            {
+               Files.deleteIfExists(temporary);
+            }
+            catch(IOException e)
+            {
+               temporary.toFile().deleteOnExit();
+            }
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Newest first, independently of collaboration.view.
+    *******************************************************************************/
+   public List<AttachmentEntry> list(String tableName, Serializable recordId) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      String id = canonicalId(tableName, recordId);
+      List<AttachmentEntry> entries = new ArrayList<>();
+      for(QRecord row : AttachmentRecords.query(new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, tableName)
+         .withCriteria("recordId", QCriteriaOperator.EQUALS, id).withCriteria("parentDeleted", QCriteriaOperator.NOT_EQUALS, true)
+         .withOrderBy(new QFilterOrderBy("createDate", false)).withOrderBy(new QFilterOrderBy("id", false))))
+      {
+         entries.add(entry(row));
+      }
+      return (entries);
+   }
+
+   /*******************************************************************************
+    ** Re-check the attachment's actual parent before signing a five-minute GET.
+    ** Inline uses the stored inline header; RC.2 only overrides attachment names.
+    *******************************************************************************/
+   public URL downloadUrl(Serializable attachmentId, boolean inline) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      return (url(requireRow(attachmentId), inline));
+   }
+
+   /*******************************************************************************
+    ** Sign an already-authorized row, also used by the preview customizer.
+    *******************************************************************************/
+   URL url(QRecord row, boolean inline)
+   {
+      PresignGet request = PresignGet.of(row.getValueString("storageKey")).ttl(Duration.ofMinutes(5));
+      if(!inline)
+      {
+         request.downloadAs(row.getValueString("fileName"));
+      }
+      return (storage.presign(row.getValueString("bucketName"), request));
+   }
+
+   /*******************************************************************************
+    ** Authorize all selected rows before the first storage mutation.
+    *******************************************************************************/
+   public void delete(List<? extends Serializable> attachmentIds) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      List<QRecord> rows = new ArrayList<>();
+      for(Serializable id : attachmentIds.stream().distinct().toList())
+      {
+         rows.add(requireMutable(id));
+      }
+      for(QRecord row : rows)
+      {
+         deleteStoredRow(row);
+         com.kingsrook.qbits.collaboration.activity.ActivityWriter.write(row.getValueString("tableName"), row.getValueString("recordId"), "FILE_REMOVED", "File removed", CollaborationTables.ATTACHMENT, row.getValueString("id"));
+      }
+   }
+
+   /*******************************************************************************
+    ** Change display metadata only; the immutable storage key stays stable.
+    ** Null means unchanged; an empty description clears it.
+    *******************************************************************************/
+   public AttachmentEntry rename(Serializable attachmentId, String fileName, String description) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      QRecord row = requireMutable(attachmentId);
+      QRecord change = new QRecord().withValue("id", row.getValue("id"));
+      if(fileName != null)
+      {
+         change.setValue("fileName", sanitize(fileName));
+      }
+      if(description != null)
+      {
+         change.setValue("description", description);
+      }
+      UpdateInput input = new UpdateInput(CollaborationTables.ATTACHMENT).withRecords(List.of(change));
+      input.setTableMetaData(AttachmentRecords.storageTable());
+      input.withPermissionBypass("AttachmentsService checked the actual parent and author/admin before metadata update.");
+      AttachmentRecords.checkErrors(new UpdateAction().execute(input).getRecords());
+      return (entry(requireRow(attachmentId)));
+   }
+
+   /*******************************************************************************
+    ** Description-only convenience operation.
+    *******************************************************************************/
+   public AttachmentEntry describe(Serializable attachmentId, String description) throws QException
+   {
+      return (rename(attachmentId, null, description));
+   }
+
+   /*******************************************************************************
+    ** Process Review uses persisted identity rather than trusting client rows.
+    *******************************************************************************/
+   public QRecord requireMutable(Serializable attachmentId) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      QRecord row = requireRow(attachmentId);
+      requireUser();
+      if(!canDelete(row))
+      {
+         throw (new QPermissionDeniedException("Only the author or collaboration.admin can change this attachment."));
+      }
+      if(!isAdmin())
+      {
+         ParentRecordAccess.requireFeature(row.getValueString("tableName"), row.getValueString("recordId"), "attach");
+      }
+      return (row);
+   }
+
+   /*******************************************************************************
+    ** Delete storage first so a provider failure leaves a retryable row.
+    *******************************************************************************/
+   void deleteStoredRow(QRecord row) throws QException
+   {
+      storage.delete(row.getValueString("bucketName"), row.getValueString("storageKey"));
+      DeleteInput input = new DeleteInput(CollaborationTables.ATTACHMENT).withPrimaryKeys(List.of(row.getValue("id")));
+      input.setTableMetaData(AttachmentRecords.storageTable());
+      input.withPermissionBypass("Attachment service authorized deletion, or trusted parent cleanup selected this row.");
+      AttachmentRecords.checkErrors(new DeleteAction().execute(input).getRecordsWithErrors());
+   }
+
+   /*******************************************************************************
+    ** Missing rows and invisible parents have the same response.
+    *******************************************************************************/
+   private QRecord requireRow(Serializable id) throws QException
+   {
+      List<QRecord> rows = AttachmentRecords.query(new QQueryFilter().withCriteria("id", QCriteriaOperator.EQUALS, id));
+      if(rows.isEmpty() || Boolean.TRUE.equals(rows.getFirst().getValueBoolean("parentDeleted")))
+      {
+         throw (new QNotFoundException("Not found"));
+      }
+      QRecord row = rows.getFirst();
+      ParentRecordAccess.requireVisibleParent(row.getValueString("tableName"), row.getValueString("recordId"));
+      return (row);
+   }
+
+   /*******************************************************************************
+    ** Use the parent's actual primary key so alternate numeric strings converge.
+    *******************************************************************************/
+   private String canonicalId(String table, Serializable id) throws QException
+   {
+      return (ParentRecordAccess.requireVisibleParent(table, id).getValueString(QContext.getQInstance().getTable(table).getPrimaryKeyField()));
+   }
+
+   /*******************************************************************************
+    ** Ownership is layered on parent visibility; admins still need that visibility.
+    *******************************************************************************/
+   private boolean canDelete(QRecord row)
+   {
+      String user = CollaborationSecurity.userId(QContext.getQSession());
+      return (user != null && (isAdmin() || user.equals(row.getValueString("createdByUserId"))));
+   }
+
+   /*******************************************************************************
+    ** Collaboration moderation grant.
+    *******************************************************************************/
+   private boolean isAdmin()
+   {
+      return (QContext.getQSession() != null && QContext.getQSession().hasPermission(CollaborationPermissions.ADMIN));
+   }
+
+   /*******************************************************************************
+    ** Stable author identity is mandatory for writes.
+    *******************************************************************************/
+   private String requireUser() throws QPermissionDeniedException
+   {
+      String user = CollaborationSecurity.userId(QContext.getQSession());
+      if(user == null || user.isBlank())
+      {
+         throw (new QPermissionDeniedException("Sign in to manage attachments."));
+      }
+      return (user);
+   }
+
+   /*******************************************************************************
+    ** Return display data, without internal storage coordinates.
+    *******************************************************************************/
+   private AttachmentEntry entry(QRecord row)
+   {
+      return (new AttachmentEntry(row.getValueInteger("id"), row.getValueString("tableName"), row.getValueString("recordId"),
+         row.getValueString("fileName"), row.getValueString("contentType"), row.getValueLong("sizeBytes"), row.getValueString("sha256"),
+         row.getValueString("description"), row.getValueString("createdByUserId"), row.getValueInstant("createDate"), canDelete(row)));
+   }
+
+   /*******************************************************************************
+    ** Strip paths and unsafe header/key characters; enforce extension policy.
+    *******************************************************************************/
+   private String sanitize(String fileName) throws QException
+   {
+      if(fileName == null || fileName.isBlank())
+      {
+         throw (new QException("A file name is required."));
+      }
+      String name = fileName.replace('\\', '/');
+      name = name.substring(name.lastIndexOf('/') + 1).replaceAll("[^A-Za-z0-9._ -]", "_").strip();
+      if(name.isBlank() || name.equals(".") || name.equals("..") || name.length() > 255)
+      {
+         throw (new QException("Invalid file name."));
+      }
+      String extension = name.substring(name.lastIndexOf('.') + 1).toLowerCase(Locale.ROOT);
+      if(config.getBlockedExtensions().stream().anyMatch(blocked -> extension.equals(blocked.replaceFirst("^\\.", "").toLowerCase(Locale.ROOT))))
+      {
+         throw (new QException("This file extension is blocked."));
+      }
+      return (name);
+   }
+
+   /*******************************************************************************
+    ** Keep arbitrary string primary keys inside one object-key segment.
+    *******************************************************************************/
+   private String segment(String value)
+   {
+      return (URLEncoder.encode(value, StandardCharsets.UTF_8).replace("+", "%20").replace(".", "%2E"));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/attachments/DeleteAttachmentsProcess.java

@@ -0,0 +1,210 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLine;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLineInterface;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.Status;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.AbstractLoadStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.AbstractTransformStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.ExtractViaQueryStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.ProcessSummaryProviderInterface;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.StreamedETLWithFrontendProcess;
+
+/*******************************************************************************
+ ** Record action with the standard streamed ETL Review and Result screens.
+ *******************************************************************************/
+public final class DeleteAttachmentsProcess
+{
+   public static final String NAME = "collaborationDeleteAttachments";
+
+   /*******************************************************************************
+    ** Metadata factory only.
+    *******************************************************************************/
+   private DeleteAttachmentsProcess()
+   {
+   }
+
+   /*******************************************************************************
+    ** Register on the table, never in navigation.
+    *******************************************************************************/
+   public static QProcessMetaData metadata()
+   {
+      Map<String, Serializable> values = new HashMap<>();
+      values.put(StreamedETLWithFrontendProcess.FIELD_SOURCE_TABLE, CollaborationTables.ATTACHMENT);
+      values.put(StreamedETLWithFrontendProcess.FIELD_DESTINATION_TABLE, CollaborationTables.ATTACHMENT);
+      values.put(StreamedETLWithFrontendProcess.FIELD_SUPPORTS_FULL_VALIDATION, true);
+      values.put(StreamedETLWithFrontendProcess.FIELD_DO_FULL_VALIDATION, true);
+      values.put(StreamedETLWithFrontendProcess.FIELD_PREVIEW_MESSAGE,
+         "Delete the selected attachments. Storage uses versioning or trash where configured; otherwise deletion is permanent.");
+      return (StreamedETLWithFrontendProcess.defineProcessMetaData(ExtractViaQueryStep.class, Review.class, Delete.class, values)
+         .withName(NAME).withLabel("Delete attachments").withIcon(new QIcon("delete"))
+         .withTableName(CollaborationTables.ATTACHMENT).withPermissionRules(CollaborationPermissions.permissionRules()));
+   }
+
+   /*******************************************************************************
+    ** Future and past wording for the standard summary renderer.
+    *******************************************************************************/
+   private static ProcessSummaryLine line(Status status, String future, String past)
+   {
+      ProcessSummaryLine line = new ProcessSummaryLine(status, 0, null);
+      line.setSingularFutureMessage("attachment " + future);
+      line.setPluralFutureMessage("attachments " + future);
+      line.setSingularPastMessage("attachment " + past);
+      line.setPluralPastMessage("attachments " + past);
+      return (line);
+   }
+
+   /*******************************************************************************
+    ** Review re-reads persisted rows and skips unauthorized selections.
+    *******************************************************************************/
+   public static class Review extends AbstractTransformStep implements ProcessSummaryProviderInterface
+   {
+      private final AttachmentsService service;
+      private final ProcessSummaryLine selected = line(Status.OK, "will be deleted", "deleted");
+      private final ProcessSummaryLine skipped = line(Status.WARNING, "cannot be deleted (skipped)", "skipped");
+
+      /*******************************************************************************
+       ** QQQ constructor.
+       *******************************************************************************/
+      public Review()
+      {
+         this(new AttachmentsService());
+      }
+
+      /*******************************************************************************
+       ** Injectable service for process tests.
+       *******************************************************************************/
+      public Review(AttachmentsService service)
+      {
+         this.service = service;
+      }
+
+      /*******************************************************************************
+       ** Dry run only; no object or row mutations.
+       *******************************************************************************/
+      @Override
+      public void runOnePage(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         for(QRecord row : input.getRecords())
+         {
+            try
+            {
+               QRecord checked = service.requireMutable(row.getValue("id"));
+               output.getRecords().add(checked);
+               selected.incrementCountAndAddPrimaryKey(checked.getValue("id"));
+            }
+            catch(QException expected)
+            {
+               skipped.incrementCountAndAddPrimaryKey(row.getValue("id"));
+            }
+         }
+      }
+
+      /*******************************************************************************
+       ** Review summary includes authorized and skipped counts.
+       *******************************************************************************/
+      @Override
+      public ArrayList<ProcessSummaryLineInterface> getProcessSummary(RunBackendStepOutput output, boolean isForResultScreen)
+      {
+         ArrayList<ProcessSummaryLineInterface> lines = new ArrayList<>();
+         selected.addSelfToListIfAnyCount(lines);
+         skipped.addSelfToListIfAnyCount(lines);
+         return (lines);
+      }
+   }
+
+   /*******************************************************************************
+    ** Execute and re-authorize each row; one failure does not stop the batch.
+    *******************************************************************************/
+   public static class Delete extends AbstractLoadStep implements ProcessSummaryProviderInterface
+   {
+      private final AttachmentsService service;
+      private final ProcessSummaryLine deleted = line(Status.OK, "will be deleted", "deleted");
+      private final ProcessSummaryLine failed = line(Status.ERROR, "could not be deleted", "could not be deleted (retry required)");
+
+      /*******************************************************************************
+       ** QQQ constructor.
+       *******************************************************************************/
+      public Delete()
+      {
+         this(new AttachmentsService());
+      }
+
+      /*******************************************************************************
+       ** Injectable service for process tests.
+       *******************************************************************************/
+      public Delete(AttachmentsService service)
+      {
+         this.service = service;
+      }
+
+      /*******************************************************************************
+       ** Count success only after both storage and row deletion succeed.
+       *******************************************************************************/
+      @Override
+      public void runOnePage(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         for(QRecord row : input.getRecords())
+         {
+            try
+            {
+               service.delete(List.of(row.getValue("id")));
+               deleted.incrementCountAndAddPrimaryKey(row.getValue("id"));
+            }
+            catch(QException | RuntimeException expected)
+            {
+               failed.incrementCountAndAddPrimaryKey(row.getValue("id"));
+            }
+         }
+      }
+
+      /*******************************************************************************
+       ** Actual results, plus the Review's skipped rows.
+       *******************************************************************************/
+      @Override
+      public ArrayList<ProcessSummaryLineInterface> getProcessSummary(RunBackendStepOutput output, boolean isForResultScreen)
+      {
+         ArrayList<ProcessSummaryLineInterface> lines = new ArrayList<>();
+         deleted.addSelfToListIfAnyCount(lines);
+         if(getTransformStep() instanceof Review review)
+         {
+            review.skipped.addSelfToListIfAnyCount(lines);
+         }
+         failed.addSelfToListIfAnyCount(lines);
+         return (lines);
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/comments/CommentEntry.java

@@ -0,0 +1,32 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.comments;
+
+import java.time.Instant;
+import java.util.List;
+
+/*******************************************************************************
+ ** Thread item; deleted bodies are never returned.
+ *******************************************************************************/
+public record CommentEntry(Integer id, Integer threadId, Integer parentCommentId, String body, String fieldName, String authorUserId, String authorDisplayName, Instant createdAt, Instant editedAt, Boolean deleted, Boolean resolved, Boolean canEdit, Boolean canDelete, List<MentionEntry> mentions, List<CommentEntry> replies)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/comments/CommentPage.java

@@ -0,0 +1,31 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.comments;
+
+import java.util.List;
+
+/*******************************************************************************
+ ** A page counts root threads; replies stay grouped under each root.
+ *******************************************************************************/
+public record CommentPage(List<CommentEntry> threads, String nextCursor)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/comments/CommentRevision.java

@@ -0,0 +1,31 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.comments;
+
+import java.time.Instant;
+
+/*******************************************************************************
+ ** Prior body and the identity/time of the edit that replaced it.
+ *******************************************************************************/
+public record CommentRevision(Integer id, String body, Instant editedAt, String editedByUserId)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/comments/CommentsService.java

@@ -0,0 +1,435 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.comments;
+
+import java.io.Serializable;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.RecordCursor;
+import com.kingsrook.qbits.collaboration.activity.ActivityWriter;
+import com.kingsrook.qbits.collaboration.follow.FollowEntry;
+import com.kingsrook.qbits.collaboration.follow.FollowService;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.notify.CollaborationNotification;
+import com.kingsrook.qbits.collaboration.notify.Notifications;
+import com.kingsrook.qbits.collaboration.people.PeopleService;
+import com.kingsrook.qbits.collaboration.people.PersonEntry;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qbits.collaboration.security.OtherUserAccess;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Record comments, one-level threads, edit history and recipient-safe mentions.
+ *******************************************************************************/
+public class CommentsService
+{
+   private static final Pattern MENTION = Pattern.compile("@\\[[^\\]\\r\\n]+]\\(user:([^()\\s]+)\\)");
+
+   /*******************************************************************************
+    ** Validate all input and the optional reply target before inserting anything.
+    *******************************************************************************/
+   public CommentEntry post(String table, Serializable recordId, String body, Integer parentCommentId, String fieldName) throws QException
+   {
+      new PeopleService().touch();
+      ParentRecordAccess.requireFeature(table, recordId, "comment");
+      String id = FollowService.canonicalId(table, recordId);
+      Set<String> mentions = parse(body);
+      Integer rootId = null;
+      if(parentCommentId != null)
+      {
+         QRecord parent = requireComment(parentCommentId);
+         if(!table.equals(parent.getValueString("tableName")) || !id.equals(parent.getValueString("recordId")))
+         {
+            throw (new QNotFoundException("Not found"));
+         }
+         rootId = parent.getValueInteger("threadId") == null ? parent.getValueInteger("id") : parent.getValueInteger("threadId");
+      }
+      if(fieldName != null && !QContext.getQInstance().getTable(table).getFields().containsKey(fieldName))
+      {
+         throw (new QException("Unknown field"));
+      }
+      Instant now = Instant.now();
+      QRecord row = CollaborationRecords.insert(CollaborationTables.COMMENT, reference(table, id).withValue("body", body)
+         .withValue("threadId", rootId).withValue("parentCommentId", rootId).withValue("fieldName", fieldName)
+         .withValue("authorUserId", PersonalRecords.currentUserId()).withValue("lastActivityAt", now));
+      bumpRoot(row, now);
+      Set<String> notified = processMentions(row, mentions);
+      new FollowService().ensureFollower(PersonalRecords.currentUserId(), table, id, "COMMENTED");
+      ActivityWriter.write(table, id, "COMMENTED", "Comment added", CollaborationTables.COMMENT, row.getValueString("id"));
+      notifyFollowers(row, notified);
+      return (entry(row, List.of()));
+   }
+
+   /*******************************************************************************
+    ** Keyset-page root threads by latest activity; fetch replies oldest first.
+    *******************************************************************************/
+   public CommentPage list(String table, Serializable recordId, String cursor, Integer limit) throws QException
+   {
+      new PeopleService().touch();
+      String id = FollowService.canonicalId(table, recordId);
+      requireLimit(limit);
+      RecordCursor before = cursor == null ? null : RecordCursor.decode(cursor);
+      if(before != null && !before.kind().equals("COMMENT"))
+      {
+         throw (new QException("Invalid comment cursor"));
+      }
+      QQueryFilter filter = CollaborationRecords.parent(table, id).withCriteria("threadId", QCriteriaOperator.IS_BLANK)
+         .withOrderBy(new QFilterOrderBy("lastActivityAt", false)).withOrderBy(new QFilterOrderBy("id", false));
+      if(before != null)
+      {
+         filter.withSubFilter(before.beforeFilter("lastActivityAt", "COMMENT"));
+      }
+      List<QRecord> roots = CollaborationRecords.query(CollaborationTables.COMMENT, filter.withLimit(limit + 1));
+      List<CommentEntry> result = new ArrayList<>();
+      for(QRecord row : roots.stream().limit(limit).toList())
+      {
+         List<CommentEntry> replies = new ArrayList<>();
+         for(QRecord reply : CollaborationRecords.query(CollaborationTables.COMMENT, CollaborationRecords.parent(table, id)
+            .withCriteria("threadId", QCriteriaOperator.EQUALS, row.getValue("id"))
+            .withOrderBy(new QFilterOrderBy("createDate")).withOrderBy(new QFilterOrderBy("id"))))
+         {
+            replies.add(entry(reply, List.of()));
+         }
+         result.add(entry(row, replies));
+      }
+      return (new CommentPage(List.copyOf(result), roots.size() > limit ? key(roots.get(limit - 1)).encode() : null));
+   }
+
+   /*******************************************************************************
+    ** Authors alone can edit; administrators cannot rewrite another author's body.
+    *******************************************************************************/
+   public CommentEntry edit(Serializable commentId, String body) throws QException
+   {
+      new PeopleService().touch();
+      QRecord row = requireComment(commentId);
+      requireAuthor(row);
+      requireCommentFeature(row);
+      Set<String> mentions = parse(body);
+      Instant now = Instant.now();
+      CollaborationRecords.insert(CollaborationTables.COMMENT_REVISION, reference(row.getValueString("tableName"), row.getValueString("recordId"))
+         .withValue("commentId", row.getValue("id")).withValue("body", row.getValueString("body")).withValue("editedAt", now)
+         .withValue("editedByUserId", PersonalRecords.currentUserId()));
+      CollaborationRecords.update(CollaborationTables.COMMENT, new QRecord().withValue("id", row.getValue("id")).withValue("body", body)
+         .withValue("editedAt", now).withValue("lastActivityAt", now));
+      row.withValue("body", body).withValue("editedAt", now);
+      bumpRoot(row, now);
+      processMentions(row, mentions);
+      ActivityWriter.write(row.getValueString("tableName"), row.getValueString("recordId"), "COMMENT_EDITED", "Comment edited", CollaborationTables.COMMENT, row.getValueString("id"));
+      return (entry(row, List.of()));
+   }
+
+   /*******************************************************************************
+    ** Soft delete; moderators still need to see the actual parent.
+    *******************************************************************************/
+   public void delete(Serializable commentId) throws QException
+   {
+      new PeopleService().touch();
+      QRecord row = requireComment(commentId);
+      if(!isAdmin())
+      {
+         requireAuthor(row);
+         requireCommentFeature(row);
+      }
+      Instant now = Instant.now();
+      CollaborationRecords.update(CollaborationTables.COMMENT, new QRecord().withValue("id", row.getValue("id"))
+         .withValue("deletedAt", now).withValue("deletedByUserId", PersonalRecords.currentUserId()).withValue("lastActivityAt", now));
+      bumpRoot(row, now);
+   }
+
+   /*******************************************************************************
+    ** Resolve only a root thread.
+    *******************************************************************************/
+   public void resolve(Serializable commentId) throws QException
+   {
+      setResolved(commentId, true);
+   }
+
+   /*******************************************************************************
+    ** Reopen only a root thread.
+    *******************************************************************************/
+   public void reopen(Serializable commentId) throws QException
+   {
+      setResolved(commentId, false);
+   }
+
+   /*******************************************************************************
+    ** Anyone able to comment can change root resolution state.
+    *******************************************************************************/
+   private void setResolved(Serializable commentId, boolean resolved) throws QException
+   {
+      new PeopleService().touch();
+      QRecord row = requireComment(commentId);
+      requireCommentFeature(row);
+      if(row.getValue("threadId") != null)
+      {
+         throw (new QException("Resolve or reopen the root comment."));
+      }
+      Instant now = Instant.now();
+      CollaborationRecords.update(CollaborationTables.COMMENT, new QRecord().withValue("id", row.getValue("id"))
+         .withValue("resolvedAt", resolved ? now : null).withValue("resolvedByUserId", resolved ? PersonalRecords.currentUserId() : null).withValue("lastActivityAt", now));
+      ActivityWriter.write(row.getValueString("tableName"), row.getValueString("recordId"), resolved ? "COMMENT_RESOLVED" : "COMMENT_REOPENED",
+         resolved ? "Thread resolved" : "Thread reopened", CollaborationTables.COMMENT, row.getValueString("id"));
+   }
+
+   /*******************************************************************************
+    ** History follows parent read access without requiring edit permission.
+    *******************************************************************************/
+   public List<CommentRevision> history(Serializable commentId) throws QException
+   {
+      new PeopleService().touch();
+      QRecord row = requireComment(commentId);
+      return (CollaborationRecords.query(CollaborationTables.COMMENT_REVISION, new QQueryFilter().withCriteria("commentId", QCriteriaOperator.EQUALS, row.getValue("id"))
+         .withOrderBy(new QFilterOrderBy("editedAt")).withOrderBy(new QFilterOrderBy("id"))).stream()
+         .map(revision -> new CommentRevision(revision.getValueInteger("id"), revision.getValueString("body"), revision.getValueInstant("editedAt"), revision.getValueString("editedByUserId"))).toList());
+   }
+
+   /*******************************************************************************
+    ** Rank current participants before other matching active directory users.
+    *******************************************************************************/
+   public List<MentionCandidate> mentionCandidates(String table, Serializable recordId, String q) throws QException
+   {
+      new PeopleService().touch();
+      String id = FollowService.canonicalId(table, recordId);
+      Set<String> participants = new HashSet<>();
+      new FollowService().followers(table, id).forEach(follower -> participants.add(follower.userId()));
+      CollaborationRecords.query(CollaborationTables.COMMENT, CollaborationRecords.parent(table, id)).forEach(row -> participants.add(row.getValueString("authorUserId")));
+      List<PersonEntry> people = new PeopleService().search(q, 50, participants);
+      List<MentionCandidate> result = new ArrayList<>();
+      for(PersonEntry person : people)
+      {
+         result.add(new MentionCandidate(person, new OtherUserAccess().canRead(person.userId(), table, id)));
+      }
+      return (List.copyOf(result));
+   }
+
+   /*******************************************************************************
+    ** Validate before persistence; deduplicate and reject more than fifty mentions.
+    *******************************************************************************/
+   private Set<String> parse(String body) throws QException
+   {
+      if(body == null || body.isBlank() || body.length() > 20000)
+      {
+         throw (new QException("Comment body must contain 1 to 20000 characters."));
+      }
+      Set<String> users = new LinkedHashSet<>();
+      Matcher matcher = MENTION.matcher(body);
+      while(matcher.find())
+      {
+         if(matcher.group(1).length() > 255)
+         {
+            throw (new QException("Mention user ID is too long."));
+         }
+         users.add(matcher.group(1));
+      }
+      if(users.size() > 50)
+      {
+         throw (new QException("A comment may mention at most 50 users."));
+      }
+      return (users);
+   }
+
+   /*******************************************************************************
+    ** Keep historical mentions so an edit never re-notifies an already mentioned user.
+    *******************************************************************************/
+   private Set<String> processMentions(QRecord row, Set<String> users) throws QException
+   {
+      Set<String> existing = new HashSet<>();
+      mentionRows(row).forEach(mention -> existing.add(mention.getValueString("mentionedUserId")));
+      Set<String> notified = new HashSet<>();
+      String table = row.getValueString("tableName");
+      String id = row.getValueString("recordId");
+      for(String user : users)
+      {
+         if(existing.contains(user))
+         {
+            continue;
+         }
+         boolean visible = new OtherUserAccess().canRead(user, table, id).orElse(false);
+         QRecord mention = CollaborationRecords.insert(CollaborationTables.MENTION, reference(table, id).withValue("commentId", row.getValue("id"))
+            .withValue("mentionedUserId", user).withValue("visible", visible));
+         if(visible)
+         {
+            new FollowService().ensureFollower(user, table, id, "MENTIONED");
+            if(!user.equals(PersonalRecords.currentUserId()))
+            {
+               notify(row, user, CollaborationNotification.Category.MENTION, "You were mentioned in a comment", mention.getValueInteger("id"));
+               notified.add(user);
+            }
+         }
+      }
+      return (notified);
+   }
+
+   /*******************************************************************************
+    ** Mention recipients get one notification; muted and author subscriptions are skipped.
+    *******************************************************************************/
+   private void notifyFollowers(QRecord row, Set<String> mentioned) throws QException
+   {
+      String author = PersonalRecords.currentUserId();
+      for(FollowEntry follower : new FollowService().followers(row.getValueString("tableName"), row.getValueString("recordId")))
+      {
+         if(!author.equals(follower.userId()) && !mentioned.contains(follower.userId()) && Boolean.TRUE.equals(follower.notifyOnComment())
+            && (follower.mutedUntil() == null || !follower.mutedUntil().isAfter(Instant.now())))
+         {
+            notify(row, follower.userId(), CollaborationNotification.Category.FOLLOW, "New comment on a followed record", null);
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Delivery re-checks recipient access, including after transaction commit.
+    *******************************************************************************/
+   private void notify(QRecord row, String user, CollaborationNotification.Category category, String title, Integer mentionId) throws QException
+   {
+      Notifications.send(new CollaborationNotification(user, title, row.getValueString("body"), category,
+         row.getValueString("tableName"), row.getValueString("recordId"), Notifications.link(row.getValueString("tableName"), row.getValueString("recordId"))),
+         mentionId == null ? null : () -> CollaborationRecords.update(CollaborationTables.MENTION,
+            new QRecord().withValue("id", mentionId).withValue("notifiedAt", Instant.now())));
+   }
+
+   /*******************************************************************************
+    ** Generic child reference for query security.
+    *******************************************************************************/
+   private QRecord reference(String table, String id)
+   {
+      return (new QRecord().withValue("tableName", table).withValue("recordId", id).withValue("parentDeleted", false));
+   }
+
+   /*******************************************************************************
+    ** Parent visibility is checked before exposing even ownership metadata.
+    *******************************************************************************/
+   private QRecord requireComment(Serializable id) throws QException
+   {
+      List<QRecord> rows = CollaborationRecords.query(CollaborationTables.COMMENT, new QQueryFilter().withCriteria("id", QCriteriaOperator.EQUALS, id));
+      if(rows.isEmpty() || Boolean.TRUE.equals(rows.getFirst().getValueBoolean("parentDeleted")))
+      {
+         throw (new QNotFoundException("Not found"));
+      }
+      QRecord row = rows.getFirst();
+      ParentRecordAccess.requireVisibleParent(row.getValueString("tableName"), row.getValueString("recordId"));
+      return (row);
+   }
+
+   /*******************************************************************************
+    ** Deleted comments cannot be edited by their author.
+    *******************************************************************************/
+   private void requireAuthor(QRecord row) throws QException
+   {
+      if(!PersonalRecords.currentUserId().equals(row.getValueString("authorUserId")) || row.getValue("deletedAt") != null)
+      {
+         throw (new QPermissionDeniedException("Only the author can edit or delete this comment."));
+      }
+   }
+
+   /*******************************************************************************
+    ** Shared feature permission stand-in.
+    *******************************************************************************/
+   private void requireCommentFeature(QRecord row) throws QException
+   {
+      ParentRecordAccess.requireFeature(row.getValueString("tableName"), row.getValueString("recordId"), "comment");
+   }
+
+   /*******************************************************************************
+    ** Update root ordering whenever a reply changes.
+    *******************************************************************************/
+   private void bumpRoot(QRecord row, Instant at) throws QException
+   {
+      if(row.getValue("threadId") != null)
+      {
+         CollaborationRecords.update(CollaborationTables.COMMENT, new QRecord().withValue("id", row.getValue("threadId")).withValue("lastActivityAt", at));
+      }
+   }
+
+   /*******************************************************************************
+    ** Comment cursor key uses root activity, not creation time.
+    *******************************************************************************/
+   private RecordCursor key(QRecord row)
+   {
+      return (new RecordCursor(row.getValueInstant("lastActivityAt"), "COMMENT", row.getValueLong("id")));
+   }
+
+   /*******************************************************************************
+    ** Bound public collection responses.
+    *******************************************************************************/
+   private void requireLimit(Integer limit) throws QException
+   {
+      if(limit == null || limit < 1 || limit > 50)
+      {
+         throw (new QException("Limit must be between 1 and 50"));
+      }
+   }
+
+   /*******************************************************************************
+    ** Child rows are safe after comment or parent authorization.
+    *******************************************************************************/
+   private List<QRecord> mentionRows(QRecord row) throws QException
+   {
+      return (CollaborationRecords.query(CollaborationTables.MENTION, new QQueryFilter().withCriteria("commentId", QCriteriaOperator.EQUALS, row.getValue("id"))));
+   }
+
+   /*******************************************************************************
+    ** Capabilities reflect ownership and the same write permission as mutations.
+    *******************************************************************************/
+   private CommentEntry entry(QRecord row, List<CommentEntry> replies) throws QException
+   {
+      boolean author = PersonalRecords.currentUserId().equals(row.getValueString("authorUserId"));
+      boolean deleted = row.getValue("deletedAt") != null;
+      boolean feature;
+      try
+      {
+         requireCommentFeature(row);
+         feature = true;
+      }
+      catch(QPermissionDeniedException expected)
+      {
+         feature = false;
+      }
+      List<MentionEntry> mentions = mentionRows(row).stream().map(mention -> new MentionEntry(mention.getValueString("mentionedUserId"), mention.getValueBoolean("visible"))).toList();
+      return (new CommentEntry(row.getValueInteger("id"), row.getValueInteger("threadId"), row.getValueInteger("parentCommentId"), deleted ? null : row.getValueString("body"),
+         row.getValueString("fieldName"), row.getValueString("authorUserId"), new PeopleService().displayName(row.getValueString("authorUserId")), row.getValueInstant("createDate"),
+         row.getValueInstant("editedAt"), deleted, row.getValue("resolvedAt") != null, author && feature && !deleted, !deleted && ((author && feature) || isAdmin()), mentions, replies));
+   }
+
+   /*******************************************************************************
+    ** Moderation is distinct from permission to edit another author's text.
+    *******************************************************************************/
+   private boolean isAdmin()
+   {
+      return (QContext.getQSession().hasPermission(CollaborationPermissions.ADMIN));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/comments/MentionCandidate.java

@@ -0,0 +1,32 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.comments;
+
+import java.util.Optional;
+import com.kingsrook.qbits.collaboration.people.PersonEntry;
+
+/*******************************************************************************
+ ** Tri-state access is exposed only after the caller can read the parent.
+ *******************************************************************************/
+public record MentionCandidate(PersonEntry person, Optional<Boolean> canRead)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/comments/MentionEntry.java

@@ -0,0 +1,30 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.comments;
+
+
+/*******************************************************************************
+ ** Mention visibility is the recipient access result at processing time.
+ *******************************************************************************/
+public record MentionEntry(String userId, Boolean visible)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/favorites/FavoriteEntry.java

@@ -0,0 +1,32 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.favorites;
+
+
+/*******************************************************************************
+ ** A freshly permission-checked target. Unavailable entries never expose the
+ ** cached label or a navigable href. Also used for the ordered recents list.
+ *******************************************************************************/
+public record FavoriteEntry(Integer id, String targetType, String targetName, String recordId,
+   String label, String folder, Integer sortOrder, Boolean available, String href)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/favorites/FavoritesService.java

@@ -0,0 +1,157 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.favorites;
+
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.TargetResolver;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+
+/*******************************************************************************
+ ** Current-user favorites. All actions preserve QContext; administrators use the
+ ** standard table screens for cross-user management, not these personal methods.
+ *******************************************************************************/
+public final class FavoritesService
+{
+   /*******************************************************************************
+    ** Static service.
+    *******************************************************************************/
+   private FavoritesService()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Idempotently star a visible target, appending it after existing favorites.
+    *******************************************************************************/
+   public static void star(String targetType, String targetName, Serializable recordId) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      String userId = PersonalRecords.currentUserId();
+      FavoriteEntry target = TargetResolver.require(targetType, targetName, recordId);
+      QQueryFilter filter = PersonalRecords.targetFilter(targetType, targetName, target.recordId());
+      if(!PersonalRecords.query(CollaborationTables.FAVORITE, filter).isEmpty())
+      {
+         return;
+      }
+      List<QRecord> last = PersonalRecords.query(CollaborationTables.FAVORITE, PersonalRecords.ownFilter()
+         .withOrderBy(new QFilterOrderBy("sortOrder", false)).withLimit(1));
+      Integer order = last.isEmpty() ? 0 : Math.addExact(last.getFirst().getValueInteger("sortOrder"), 1);
+      QRecord row = new QRecord().withValue("userId", userId).withValue("targetType", targetType).withValue("targetName", targetName)
+         .withValue("recordId", target.recordId()).withValue("label", target.label()).withValue("sortOrder", order);
+      try
+      {
+         PersonalRecords.insert(CollaborationTables.FAVORITE, row);
+      }
+      catch(QException e)
+      {
+         if(PersonalRecords.query(CollaborationTables.FAVORITE, filter).isEmpty())
+         {
+            throw (e);
+         }
+         // A concurrent star won the unique-key race; the requested state exists.
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Removing a star does not require continued access to its target.
+    *******************************************************************************/
+   public static void unstar(String targetType, String targetName, Serializable recordId) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      String id = TargetResolver.recordId(targetType, targetName, recordId);
+      List<QRecord> rows = PersonalRecords.query(CollaborationTables.FAVORITE, PersonalRecords.targetFilter(targetType, targetName, id));
+      PersonalRecords.delete(CollaborationTables.FAVORITE, rows.stream().map(row -> row.getValue("id")).toList());
+   }
+
+
+
+   /*******************************************************************************
+    ** Ordered favorites with freshly checked labels and availability.
+    *******************************************************************************/
+   public static List<FavoriteEntry> list() throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      return (TargetResolver.refresh(PersonalRecords.query(CollaborationTables.FAVORITE, PersonalRecords.ownFilter()
+         .withOrderBy(new QFilterOrderBy("sortOrder")).withOrderBy(new QFilterOrderBy("id")))));
+   }
+
+
+
+   /*******************************************************************************
+    ** Move the supplied ids first, preserving order of omitted favorites. Folder
+    ** values may be null to clear them. Validate all ids before writing anything.
+    *******************************************************************************/
+   public static void reorder(List<Integer> ids, Map<Integer, String> folders) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      List<QRecord> rows = PersonalRecords.query(CollaborationTables.FAVORITE, PersonalRecords.ownFilter()
+         .withOrderBy(new QFilterOrderBy("sortOrder")).withOrderBy(new QFilterOrderBy("id")));
+      Set<Integer> owned = new HashSet<>(rows.stream().map(row -> row.getValueInteger("id")).toList());
+      if(ids == null || folders == null || new HashSet<>(ids).size() != ids.size() || !owned.containsAll(ids) || !owned.containsAll(folders.keySet()))
+      {
+         throw (new QException("Invalid favorite ids"));
+      }
+      for(String folder : folders.values())
+      {
+         if(folder != null && folder.length() > 255)
+         {
+            throw (new QException("Folder is too long"));
+         }
+      }
+      List<Integer> order = new ArrayList<>(ids);
+      for(QRecord row : rows)
+      {
+         Integer id = row.getValueInteger("id");
+         if(!ids.contains(id))
+         {
+            order.add(id);
+         }
+      }
+      List<QRecord> changes = new ArrayList<>();
+      for(int i = 0; i < order.size(); i++)
+      {
+         Integer id = order.get(i);
+         QRecord change = new QRecord().withValue("id", id).withValue("sortOrder", i);
+         if(folders.containsKey(id))
+         {
+            change.setValue("folder", folders.get(id));
+         }
+         changes.add(change);
+      }
+      PersonalRecords.update(CollaborationTables.FAVORITE, changes);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/follow/FollowChangeBatcher.java

@@ -0,0 +1,214 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.follow;
+
+import java.time.Clock;
+import java.time.Instant;
+import java.util.Arrays;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Objects;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.notify.CollaborationNotification;
+import com.kingsrook.qbits.collaboration.notify.Notifications;
+import com.kingsrook.qqq.backend.core.actions.tables.listeners.RecordChangeEvent;
+import com.kingsrook.qqq.backend.core.actions.tables.listeners.RecordChangeListenerInterface;
+import com.kingsrook.qqq.backend.core.actions.tables.listeners.RecordChangeType;
+import com.kingsrook.qqq.backend.core.context.CapturedContext;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Durable five-minute follow digests. RC.5 listeners queue only committed updates.
+ ** The scheduler must run once per installation; local synchronization coordinates
+ ** listener instances, while unique keys protect subscription/batch identity.
+ *******************************************************************************/
+public class FollowChangeBatcher implements RecordChangeListenerInterface
+{
+   private final Clock clock;
+
+   /*******************************************************************************
+    ** Core creates a listener instance for each event.
+    *******************************************************************************/
+   public FollowChangeBatcher()
+   {
+      this(Clock.systemUTC());
+   }
+
+   /*******************************************************************************
+    ** Inject time for deterministic batching tests.
+    *******************************************************************************/
+   public FollowChangeBatcher(Clock clock)
+   {
+      this.clock = clock;
+   }
+
+   /*******************************************************************************
+    ** Only configured host-table updates need old records fetched by core.
+    *******************************************************************************/
+   @Override
+   public boolean appliesTo(String tableName, RecordChangeType type)
+   {
+      return (type == RecordChangeType.UPDATE && CollaborationRecords.config().getFollowChangeTables().contains(tableName));
+   }
+
+   /*******************************************************************************
+    ** Copy event data before retaining anything in an after-commit callback.
+    *******************************************************************************/
+   @Override
+   public void onRecordsChanged(RecordChangeEvent event) throws QException
+   {
+      if(!appliesTo(event.getTableName(), event.getType()))
+      {
+         return;
+      }
+      String actor = CollaborationSecurity.userId(QContext.getQSession());
+      String primaryKey = QContext.getQInstance().getTable(event.getTableName()).getPrimaryKeyField();
+      CapturedContext context = new CapturedContext(QContext.getQInstance(), QContext.getQSession());
+      for(int i = 0; i < event.getRecords().size(); i++)
+      {
+         QRecord row = event.getRecords().get(i);
+         QRecord old = event.getOldRecords() == null ? null : event.getOldRecords().get(i);
+         Set<String> fields = new LinkedHashSet<>();
+         for(String field : row.getValues().keySet())
+         {
+            if(!field.equals(primaryKey) && !field.equals("modifyDate") && (old == null || !Objects.equals(row.getValue(field), old.getValue(field))))
+            {
+               fields.add(field);
+            }
+         }
+         String id = row.getValueString(primaryKey);
+         if(!fields.isEmpty())
+         {
+            if(event.getTransaction() == null)
+            {
+               recordChange(event.getTableName(), id, actor, fields);
+            }
+            else
+            {
+               event.getTransaction().addAfterCommitCallback(() ->
+               {
+                  try
+                  {
+                     QContext.withTemporaryContext(context, () -> recordChange(event.getTableName(), id, actor, fields));
+                  }
+                  catch(QException e)
+                  {
+                     throw (new IllegalStateException("Could not queue follow digest", e));
+                  }
+               });
+            }
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Trusted host-hook helper; invoke after the host update commits. Values are
+    ** never copied into digests, and a recipient's own changes are never queued.
+    *******************************************************************************/
+   public void recordChange(String table, String id, String actor, Set<String> fields) throws QException
+   {
+      if(fields.isEmpty())
+      {
+         return;
+      }
+      synchronized(CollaborationRecords.config())
+      {
+         Instant now = clock.instant();
+         for(QRecord follower : CollaborationRecords.query(CollaborationTables.FOLLOW, CollaborationRecords.parent(table, id)))
+         {
+            String user = follower.getValueString("userId");
+            if(user.equals(actor) || !eligible(follower, now))
+            {
+               continue;
+            }
+            List<QRecord> batches = CollaborationRecords.query(CollaborationTables.FOLLOW_DIGEST,
+               CollaborationRecords.parent(table, id).withCriteria("userId", QCriteriaOperator.EQUALS, user));
+            Set<String> changes = new LinkedHashSet<>();
+            if(!batches.isEmpty())
+            {
+               changes.addAll(Arrays.asList(batches.getFirst().getValueString("changes").split("\n")));
+            }
+            for(String field : fields)
+            {
+               changes.add(field + " (by " + (actor == null ? "system" : actor) + ")");
+            }
+            QRecord batch = new QRecord().withValue("changes", String.join("\n", changes));
+            if(batches.isEmpty())
+            {
+               CollaborationRecords.insert(CollaborationTables.FOLLOW_DIGEST, batch.withValue("tableName", table).withValue("recordId", id)
+                  .withValue("userId", user).withValue("dueAt", now.plusSeconds(300)).withValue("parentDeleted", false));
+            }
+            else
+            {
+               CollaborationRecords.update(CollaborationTables.FOLLOW_DIGEST, batch.withValue("id", batches.getFirst().getValue("id")));
+            }
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** The scheduler invokes outside a transaction so deletion follows delivery.
+    ** Re-check current subscription, mute and access; failures retain a retryable row.
+    *******************************************************************************/
+   public void sendDue() throws QException
+   {
+      new SendFollowDigestsProcess().checkPermissionsThrowing(null, null);
+      if(QContext.getQBackendTransaction() != null)
+      {
+         throw (new QException("Send follow digests outside a transaction."));
+      }
+      synchronized(CollaborationRecords.config())
+      {
+         Instant now = clock.instant();
+         for(QRecord batch : CollaborationRecords.query(CollaborationTables.FOLLOW_DIGEST, new QQueryFilter().withCriteria("dueAt", QCriteriaOperator.LESS_THAN_OR_EQUALS, now)))
+         {
+            String table = batch.getValueString("tableName");
+            String id = batch.getValueString("recordId");
+            String user = batch.getValueString("userId");
+            List<QRecord> follows = CollaborationRecords.query(CollaborationTables.FOLLOW,
+               CollaborationRecords.parent(table, id).withCriteria("userId", QCriteriaOperator.EQUALS, user));
+            if(!follows.isEmpty() && eligible(follows.getFirst(), now))
+            {
+               Notifications.send(new CollaborationNotification(user, "Changes to a followed record", batch.getValueString("changes"),
+                  CollaborationNotification.Category.FOLLOW, table, id, Notifications.link(table, id)));
+            }
+            CollaborationRecords.delete(CollaborationTables.FOLLOW_DIGEST, batch.getValue("id"));
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Mute ends at its timestamp, including exact equality with now.
+    *******************************************************************************/
+   private boolean eligible(QRecord row, Instant now)
+   {
+      return (Boolean.TRUE.equals(row.getValueBoolean("notifyOnChange"))
+         && (row.getValueInstant("mutedUntil") == null || !row.getValueInstant("mutedUntil").isAfter(now)));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/follow/FollowEntry.java

@@ -0,0 +1,31 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.follow;
+
+import java.time.Instant;
+
+/*******************************************************************************
+ ** Record follower preferences; users can only mutate their own state publicly.
+ *******************************************************************************/
+public record FollowEntry(Integer id, String userId, String reason, Boolean notifyOnChange, Boolean notifyOnComment, Instant mutedUntil)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/follow/FollowProcesses.java

@@ -0,0 +1,205 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.follow;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType;
+import com.kingsrook.qqq.backend.core.actions.permissions.UseTablePermissionCustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLine;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLineInterface;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.Status;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.AbstractLoadStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.AbstractTransformStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.ExtractViaQueryStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.ProcessSummaryProviderInterface;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.StreamedETLWithFrontendProcess;
+
+/*******************************************************************************
+ ** Standard streamed ETL Follow/Unfollow actions for any host table with a key.
+ *******************************************************************************/
+public final class FollowProcesses
+{
+   /*******************************************************************************
+    ** Metadata factory.
+    *******************************************************************************/
+   private FollowProcesses()
+   {
+   }
+
+   /*******************************************************************************
+    ** Hosts can register these directly or configure followActionTables.
+    *******************************************************************************/
+   public static List<QProcessMetaData> processesFor(String tableName)
+   {
+      return (List.of(process(tableName, true), process(tableName, false)));
+   }
+
+   /*******************************************************************************
+    ** Process table association puts actions on records, never in navigation.
+    *******************************************************************************/
+   private static QProcessMetaData process(String table, boolean follow)
+   {
+      Map<String, Serializable> values = new HashMap<>();
+      values.put(StreamedETLWithFrontendProcess.FIELD_SOURCE_TABLE, table);
+      values.put(StreamedETLWithFrontendProcess.FIELD_DESTINATION_TABLE, table);
+      values.put(StreamedETLWithFrontendProcess.FIELD_SUPPORTS_FULL_VALIDATION, true);
+      values.put(StreamedETLWithFrontendProcess.FIELD_DO_FULL_VALIDATION, true);
+      values.put(StreamedETLWithFrontendProcess.FIELD_PREVIEW_MESSAGE, (follow ? "Follow" : "Unfollow") + " the selected records.");
+      return (StreamedETLWithFrontendProcess.defineProcessMetaData(ExtractViaQueryStep.class, Review.class, Apply.class, values)
+         .withName("collaboration" + (follow ? "Follow_" : "Unfollow_") + table).withLabel(follow ? "Follow" : "Unfollow")
+         .withTableName(table).withIcon(new QIcon(follow ? "notifications" : "notifications_off"))
+         .withPermissionRules(new QPermissionRules().withCustomPermissionChecker(UseTablePermissionCustomPermissionChecker.build(table, TablePermissionSubType.READ))));
+   }
+
+   /*******************************************************************************
+    ** Stable process metadata, not client values, chooses table and operation.
+    *******************************************************************************/
+   private static String table(RunBackendStepInput input)
+   {
+      return (input.getProcess().getTableName());
+   }
+
+   /*******************************************************************************
+    ** Summary renderer has both Review and Result wording.
+    *******************************************************************************/
+   private static ProcessSummaryLine line(Status status, String future, String past)
+   {
+      ProcessSummaryLine line = new ProcessSummaryLine(status, 0, null);
+      line.setSingularFutureMessage("record " + future);
+      line.setPluralFutureMessage("records " + future);
+      line.setSingularPastMessage("record " + past);
+      line.setPluralPastMessage("records " + past);
+      return (line);
+   }
+
+   /*******************************************************************************
+    ** Dry-run authorization re-reads parents under the current session.
+    *******************************************************************************/
+   public static class Review extends AbstractTransformStep implements ProcessSummaryProviderInterface
+   {
+      private final ProcessSummaryLine selected = line(Status.OK, "will be processed", "processed");
+      private final ProcessSummaryLine skipped = line(Status.WARNING, "is unavailable (skipped)", "skipped");
+
+      /*******************************************************************************
+       ** No writes during review.
+       *******************************************************************************/
+      @Override
+      public void runOnePage(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         String table = table(input);
+         String key = QContext.getQInstance().getTable(table).getPrimaryKeyField();
+         for(QRecord row : input.getRecords())
+         {
+            try
+            {
+               QRecord parent = ParentRecordAccess.requireVisibleParent(table, row.getValue(key));
+               output.getRecords().add(parent);
+               selected.incrementCountAndAddPrimaryKey(parent.getValue(key));
+            }
+            catch(QNotFoundException expected)
+            {
+               skipped.incrementCountAndAddPrimaryKey(row.getValue(key));
+            }
+         }
+      }
+
+      /*******************************************************************************
+       ** Authorized and skipped selections.
+       *******************************************************************************/
+      @Override
+      public ArrayList<ProcessSummaryLineInterface> getProcessSummary(RunBackendStepOutput output, boolean isForResultScreen)
+      {
+         ArrayList<ProcessSummaryLineInterface> lines = new ArrayList<>();
+         selected.addSelfToListIfAnyCount(lines);
+         skipped.addSelfToListIfAnyCount(lines);
+         return (lines);
+      }
+   }
+
+   /*******************************************************************************
+    ** Re-authorize during load; report actual successes and failures.
+    *******************************************************************************/
+   public static class Apply extends AbstractLoadStep implements ProcessSummaryProviderInterface
+   {
+      private final ProcessSummaryLine done = line(Status.OK, "will be processed", "processed");
+      private final ProcessSummaryLine failed = line(Status.ERROR, "cannot be processed", "failed (retry required)");
+
+      /*******************************************************************************
+       ** A failed record does not prevent other selections being processed.
+       *******************************************************************************/
+      @Override
+      public void runOnePage(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         String table = table(input);
+         String key = QContext.getQInstance().getTable(table).getPrimaryKeyField();
+         for(QRecord row : input.getRecords())
+         {
+            try
+            {
+               if(input.getProcessName().equals("collaborationFollow_" + table))
+               {
+                  new FollowService().follow(table, row.getValue(key), null, null);
+               }
+               else
+               {
+                  new FollowService().unfollow(table, row.getValue(key));
+               }
+               done.incrementCountAndAddPrimaryKey(row.getValue(key));
+            }
+            catch(QException expected)
+            {
+               failed.incrementCountAndAddPrimaryKey(row.getValue(key));
+            }
+         }
+      }
+
+      /*******************************************************************************
+       ** Result includes review skips and load failures.
+       *******************************************************************************/
+      @Override
+      public ArrayList<ProcessSummaryLineInterface> getProcessSummary(RunBackendStepOutput output, boolean isForResultScreen)
+      {
+         ArrayList<ProcessSummaryLineInterface> lines = new ArrayList<>();
+         done.addSelfToListIfAnyCount(lines);
+         if(getTransformStep() instanceof Review review)
+         {
+            review.skipped.addSelfToListIfAnyCount(lines);
+         }
+         failed.addSelfToListIfAnyCount(lines);
+         return (lines);
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/follow/FollowService.java

@@ -0,0 +1,176 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.follow;
+
+import java.io.Serializable;
+import java.util.List;
+import java.util.Optional;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.activity.ActivityWriter;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.people.PeopleService;
+import com.kingsrook.qbits.collaboration.security.OtherUserAccess;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Following requires parent visibility, without a separate feature permission.
+ *******************************************************************************/
+public class FollowService
+{
+   /*******************************************************************************
+    ** Nullable preferences retain existing settings on repeat calls.
+    *******************************************************************************/
+   public FollowEntry follow(String table, Serializable recordId, Boolean notifyOnChange, Boolean notifyOnComment) throws QException
+   {
+      new PeopleService().touch();
+      String id = canonicalId(table, recordId);
+      QRecord row = ensure(PersonalRecords.currentUserId(), table, id, "MANUAL");
+      QRecord update = new QRecord().withValue("id", row.getValue("id"));
+      if(notifyOnChange != null)
+      {
+         update.withValue("notifyOnChange", notifyOnChange);
+      }
+      if(notifyOnComment != null)
+      {
+         update.withValue("notifyOnComment", notifyOnComment);
+      }
+      CollaborationRecords.update(CollaborationTables.FOLLOW, update);
+      return (state(table, id).orElseThrow());
+   }
+
+   /*******************************************************************************
+    ** Remove only the caller's subscription and queued digest.
+    *******************************************************************************/
+   public void unfollow(String table, Serializable recordId) throws QException
+   {
+      new PeopleService().touch();
+      String id = canonicalId(table, recordId);
+      for(String target : List.of(CollaborationTables.FOLLOW, CollaborationTables.FOLLOW_DIGEST))
+      {
+         for(QRecord row : CollaborationRecords.query(target, mine(table, id)))
+         {
+            CollaborationRecords.delete(target, row.getValue("id"));
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Current-user state; absent means not followed.
+    *******************************************************************************/
+   public Optional<FollowEntry> state(String table, Serializable recordId) throws QException
+   {
+      new PeopleService().touch();
+      List<QRecord> rows = CollaborationRecords.query(CollaborationTables.FOLLOW, mine(table, canonicalId(table, recordId)));
+      return (rows.stream().findFirst().map(FollowService::entry));
+   }
+
+   /*******************************************************************************
+    ** Parent readers may see its followers independently of admin table browsing.
+    *******************************************************************************/
+   public List<FollowEntry> followers(String table, Serializable recordId) throws QException
+   {
+      new PeopleService().touch();
+      return (CollaborationRecords.query(CollaborationTables.FOLLOW, CollaborationRecords.parent(table, canonicalId(table, recordId)))
+         .stream().map(FollowService::entry).toList());
+   }
+
+   /*******************************************************************************
+    ** Internal automatic follow; unknown access never grants a subscription.
+    *******************************************************************************/
+   public void ensureFollower(String userId, String table, Serializable recordId, String reason) throws QException
+   {
+      new PeopleService().touch();
+      String id = canonicalId(table, recordId);
+      if(!userId.equals(PersonalRecords.currentUserId()) && !new OtherUserAccess().canRead(userId, table, id).orElse(false))
+      {
+         return;
+      }
+      ensure(userId, table, id, reason);
+   }
+
+   /*******************************************************************************
+    ** Existing preferences always win over automatic follow defaults.
+    *******************************************************************************/
+   private QRecord ensure(String user, String table, String id, String reason) throws QException
+   {
+      if(!List.of("MANUAL", "AUTHOR", "COMMENTED", "MENTIONED", "ASSIGNED", "SHARED").contains(reason))
+      {
+         throw (new QException("Unknown follow reason"));
+      }
+      QQueryFilter filter = CollaborationRecords.parent(table, id).withCriteria("userId", QCriteriaOperator.EQUALS, user);
+      List<QRecord> rows = CollaborationRecords.query(CollaborationTables.FOLLOW, filter);
+      if(!rows.isEmpty())
+      {
+         return (rows.getFirst());
+      }
+      QRecord row;
+      try
+      {
+         row = CollaborationRecords.insert(CollaborationTables.FOLLOW, new QRecord().withValue("tableName", table).withValue("recordId", id)
+            .withValue("userId", user).withValue("reason", reason).withValue("notifyOnChange", reason.equals("MANUAL") || reason.equals("ASSIGNED"))
+            .withValue("notifyOnComment", true).withValue("parentDeleted", false));
+      }
+      catch(QException e)
+      {
+         rows = CollaborationRecords.query(CollaborationTables.FOLLOW, filter);
+         if(rows.isEmpty())
+         {
+            throw (e);
+         }
+         return (rows.getFirst());
+      }
+      ActivityWriter.write(table, id, "FOLLOWED", "Record followed", CollaborationTables.FOLLOW, row.getValueString("id"));
+      return (row);
+   }
+
+   /*******************************************************************************
+    ** Normalize numeric aliases to the parent's actual primary key.
+    *******************************************************************************/
+   public static String canonicalId(String table, Serializable id) throws QException
+   {
+      return (ParentRecordAccess.requireVisibleParent(table, id).getValueString(QContext.getQInstance().getTable(table).getPrimaryKeyField()));
+   }
+
+   /*******************************************************************************
+    ** Ownership filter always accompanies parent selection.
+    *******************************************************************************/
+   private QQueryFilter mine(String table, String id) throws QPermissionDeniedException
+   {
+      return (CollaborationRecords.parent(table, id).withCriteria("userId", QCriteriaOperator.EQUALS, PersonalRecords.currentUserId()));
+   }
+
+   /*******************************************************************************
+    ** Immutable public view.
+    *******************************************************************************/
+   private static FollowEntry entry(QRecord row)
+   {
+      return (new FollowEntry(row.getValueInteger("id"), row.getValueString("userId"), row.getValueString("reason"),
+         row.getValueBoolean("notifyOnChange"), row.getValueBoolean("notifyOnComment"), row.getValueInstant("mutedUntil")));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/follow/SendFollowDigestsProcess.java

@@ -0,0 +1,99 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.follow;
+
+
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.actions.processes.BackendStep;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QBackendStepMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.scheduleing.QScheduleMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
+
+
+/*******************************************************************************
+ ** Hidden minute-by-minute digest job. Runs with its caller's session, which must be a
+ ** scheduler system session or collaboration admin; never elevates a user.
+ *******************************************************************************/
+public class SendFollowDigestsProcess implements BackendStep, CustomPermissionChecker
+{
+   public static final String NAME = "collaborationSendFollowDigests";
+
+
+
+   /*******************************************************************************
+    ** Always register the backend-only process; scheduling is opt-in.
+    *******************************************************************************/
+   public static QProcessMetaData metadata(CollaborationQBitConfig config)
+   {
+      QProcessMetaData process = new QProcessMetaData().withName(NAME).withLabel("Send follow digests").withIsHidden(true).withIcon(new QIcon("history"))
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.HAS_ACCESS_PERMISSION)
+            .withPermissionBaseName("collaboration").withCustomPermissionChecker(new QCodeReference(SendFollowDigestsProcess.class)))
+         .withStep(new QBackendStepMetaData().withName("run").withCode(new QCodeReference(SendFollowDigestsProcess.class)));
+      if(config.getSchedulerName() != null)
+      {
+         process.withSchedule(new QScheduleMetaData().withSchedulerName(config.getSchedulerName()).withRepeatSeconds(60).withInitialDelaySeconds(60));
+      }
+      return (process);
+   }
+
+
+
+   /*******************************************************************************
+    ** Hidden is a presentation setting, so explicitly guard execution as well.
+    *******************************************************************************/
+   @Override
+   public void checkPermissionsThrowing(AbstractActionInput input, MetaDataWithPermissionRules metadata) throws QPermissionDeniedException
+   {
+      QSession session = QContext.getQSession();
+      if(!(session instanceof QSystemUserSession) && (session == null || !session.hasPermission(CollaborationPermissions.ADMIN)))
+      {
+         throw (new QPermissionDeniedException("This needs the collaboration.admin permission."));
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Deliver due batches using fresh recipient permissions.
+    *******************************************************************************/
+   @Override
+   public void run(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+   {
+      checkPermissionsThrowing(input, null);
+      new FollowChangeBatcher().sendDue();
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/model/CollaborationTables.java

@@ -0,0 +1,385 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.model;
+
+
+import java.util.ArrayList;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
+import com.kingsrook.qbits.collaboration.attachments.AttachmentPreviewCustomizer;
+import com.kingsrook.qbits.collaboration.attachments.AttachmentSecurity;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizers;
+import com.kingsrook.qqq.backend.core.instances.QInstanceEnricher;
+import com.kingsrook.qqq.backend.core.model.metadata.audits.AuditLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.audits.QAuditRules;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.AdornmentType;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.FieldAdornment;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QVirtualFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValue;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValueSource;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValueSourceType;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QFieldSection;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QFieldSectionAlternativeType;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.Tier;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.UniqueKey;
+
+
+/*******************************************************************************
+ ** Visible Collaboration tables. Enum ids are phase-a stand-ins for the core
+ ** collaboration enums; replace them when those contracts are released.
+ *******************************************************************************/
+public final class CollaborationTables
+{
+   public static final String TAG = "collaboration_tag";
+   public static final String RECORD_TAG = "collaboration_record_tag";
+   public static final String COMMENT = "collaboration_comment";
+   public static final String COMMENT_REVISION = "collaboration_comment_revision";
+   public static final String MENTION = "collaboration_mention";
+   public static final String FOLLOW = "collaboration_follow";
+   public static final String ACTIVITY = "collaboration_activity";
+   public static final String FOLLOW_DIGEST = "collaboration_follow_digest";
+   public static final String ATTACHMENT = "collaboration_attachment";
+   public static final String FEATURE_SETTING = "collaboration_feature_setting";
+   public static final String FAVORITE = "collaboration_favorite";
+   public static final String RECENT = "collaboration_recent";
+   public static final String TARGET_TYPE = "collaboration_target_type";
+   public static final String USER = "collaboration_user";
+   public static final String SCOPE_TYPE = "collaboration_scope_type";
+   public static final String FEATURE = "collaboration_feature";
+   public static final String PERMISSION_MODE = "collaboration_permission_mode";
+
+
+
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private CollaborationTables()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Enumerated feature settings and table references.
+    *******************************************************************************/
+   public static List<QPossibleValueSource> possibleValueSources()
+   {
+      return (List.of(
+         QPossibleValueSource.newForTable(TAG), QPossibleValueSource.newForTable(RECORD_TAG),
+         QPossibleValueSource.newForTable(COMMENT), QPossibleValueSource.newForTable(COMMENT_REVISION), QPossibleValueSource.newForTable(MENTION), QPossibleValueSource.newForTable(FOLLOW), QPossibleValueSource.newForTable(ACTIVITY), QPossibleValueSource.newForTable(FOLLOW_DIGEST),
+         enumSource(TARGET_TYPE, "TABLE", "APP", "RECORD", "PROCESS", "REPORT", "SAVED_VIEW"),
+         QPossibleValueSource.newForTable(ATTACHMENT), QPossibleValueSource.newForTable(FAVORITE), QPossibleValueSource.newForTable(RECENT),
+         enumSource(SCOPE_TYPE, "INSTANCE", "APP", "TABLE"),
+         enumSource(FEATURE, "ATTACHMENTS", "TAGS", "CUSTOM_FIELDS", "COMMENTS", "PRESENCE", "SHARING",
+            "FAVORITES", "FOLLOW", "TIMELINE", "RECENTS", "TASKS", "ASSIGNMENT"),
+         enumSource(PERMISSION_MODE, "EDIT_OR_GRANTED", "GRANTED_ONLY"),
+         QPossibleValueSource.newForTable(FEATURE_SETTING), QPossibleValueSource.newForTable(USER)));
+   }
+
+
+
+   /*******************************************************************************
+    ** String ids preserve the names of the planned core enums.
+    *******************************************************************************/
+   private static QPossibleValueSource enumSource(String name, String... values)
+   {
+      List<QPossibleValue<?>> entries = new ArrayList<>();
+      for(String value : values)
+      {
+         entries.add(new QPossibleValue<>(value, value));
+      }
+      return (new QPossibleValueSource().withName(name).withType(QPossibleValueSourceType.ENUM).withEnumValues(entries));
+   }
+
+
+
+   /*******************************************************************************
+    ** Build the tables and stable SQL column names. QQQ infers the SQL table
+    ** name from the already snake_case metadata name for RDBMS backends.
+    *******************************************************************************/
+   public static List<QTableMetaData> tables(CollaborationQBitConfig config)
+   {
+      QTableMetaData settings = base(config, FEATURE_SETTING, "Feature Settings", "settings")
+         .withRecordLabelFormatAndFields("%s %s: %s", "scopeType", "scopeName", "feature")
+         .withField(string("scopeType", "Scope Type", 20).withIsRequired(true).withPossibleValueSourceName(SCOPE_TYPE))
+         .withField(string("scopeName", "Scope Name", 128).withIsRequired(true))
+         .withField(string("feature", "Feature", 32).withIsRequired(true).withPossibleValueSourceName(FEATURE))
+         .withField(new QFieldMetaData("enabled", QFieldType.BOOLEAN).withLabel("Enabled").withIsRequired(true).withDefaultValue(false))
+         .withField(new QFieldMetaData("settings", QFieldType.TEXT).withLabel("Settings (JSON)"))
+         .withField(string("permissionMode", "Permission Mode", 32).withPossibleValueSourceName(PERMISSION_MODE).withDefaultValue("EDIT_OR_GRANTED"))
+         .withUniqueKey(new UniqueKey("scopeType", "scopeName", "feature"))
+         .withAuditRules(new QAuditRules().withAuditLevel(AuditLevel.FIELD))
+         .withSection(new QFieldSection("identity", new QIcon("badge"), Tier.T1, List.of("id", "scopeType", "scopeName", "feature")).withLabel("Identity"))
+         .withSection(new QFieldSection("details", new QIcon("settings"), Tier.T2, List.of("enabled", "settings", "permissionMode")).withLabel("Details"));
+      QTableMetaData people = base(config, USER, "People", "people")
+         .withRecordLabelFormatAndFields("%s", "displayName")
+         .withField(string("userId", "User ID", 255).withIsRequired(true))
+         .withField(string("displayName", "Display Name", 255))
+         .withField(string("email", "Email", 255))
+         .withField(string("avatarUrl", "Avatar URL", 2048))
+         .withField(new QFieldMetaData("lastSeenAt", QFieldType.DATE_TIME).withLabel("Last Seen At"))
+         .withField(new QFieldMetaData("active", QFieldType.BOOLEAN).withLabel("Active").withDefaultValue(true))
+         .withUniqueKey(new UniqueKey("userId"))
+         .withSection(new QFieldSection("identity", new QIcon("badge"), Tier.T1, List.of("id", "userId", "displayName")).withLabel("Identity"))
+         .withSection(new QFieldSection("details", new QIcon("people"), Tier.T2, List.of("email", "avatarUrl", "lastSeenAt", "active")).withLabel("Details"));
+      for(QFieldMetaData field : people.getFields().values())
+      {
+         field.setIsEditable(false);
+      }
+      QTableMetaData favorites = personal(config, FAVORITE, "Favorites", "star")
+         .withField(new QFieldMetaData("sortOrder", QFieldType.INTEGER).withLabel("Sort Order").withIsRequired(true).withDefaultValue(0))
+         .withField(string("folder", "Folder", 255))
+         .withSection(new QFieldSection("details", new QIcon("star"), Tier.T2, List.of("label", "sortOrder", "folder")).withLabel("Details"));
+      QTableMetaData recents = personal(config, RECENT, "Recently Viewed", "history")
+         .withField(new QFieldMetaData("lastViewedAt", QFieldType.DATE_TIME).withLabel("Last Viewed At").withIsRequired(true))
+         .withField(new QFieldMetaData("viewCount", QFieldType.INTEGER).withLabel("View Count").withIsRequired(true).withDefaultValue(1))
+         .withSection(new QFieldSection("details", new QIcon("history"), Tier.T2, List.of("label", "lastViewedAt", "viewCount")).withLabel("Details"));
+      List<QTableMetaData> tables = new ArrayList<>(List.of(settings, people, favorites, recents, attachment(config)));
+      tables.addAll(conversationTables(config));
+      tables.addAll(tagTables(config));
+      for(QTableMetaData table : tables)
+      {
+         table.withSection(new QFieldSection("dates", new QIcon("calendar_today"), Tier.T3, List.of("createDate", "modifyDate")).withLabel("Dates"));
+         QInstanceEnricher.setInferredFieldBackendNames(table);
+      }
+      return (tables);
+   }
+
+
+
+   /*******************************************************************************
+    ** Common identity, dates, backend and permissions.
+    *******************************************************************************/
+   private static QTableMetaData base(CollaborationQBitConfig config, String name, String label, String icon)
+   {
+      return (new QTableMetaData().withName(name).withLabel(label).withIcon(new QIcon(icon))
+         .withBackendName(config.getBackendName()).withPrimaryKeyField("id").withPermissionRules(CollaborationPermissions.permissionRules())
+         .withField(new QFieldMetaData("id", QFieldType.INTEGER).withLabel("ID").withIsEditable(false))
+         .withField(new QFieldMetaData("createDate", QFieldType.DATE_TIME).withLabel("Created").withIsEditable(false))
+         .withField(new QFieldMetaData("modifyDate", QFieldType.DATE_TIME).withLabel("Modified").withIsEditable(false)));
+   }
+
+
+
+   /*******************************************************************************
+    ** Personal high-volume data: owner locks replace a table-level permission.
+    ** Kept out of app navigation; the standard tables remain addressable by admins.
+    *******************************************************************************/
+   private static QTableMetaData personal(CollaborationQBitConfig config, String name, String label, String icon)
+   {
+      return (base(config, name, label, icon)
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.NOT_PROTECTED)
+            .withCustomPermissionChecker(new QCodeReference(CollaborationSecurity.class)))
+         .withRecordSecurityLock(CollaborationSecurity.ownerLock("userId"))
+         .withAuditRules(new QAuditRules().withAuditLevel(AuditLevel.NONE))
+         .withRecordLabelFormatAndFields("%s", "label")
+         .withField(string("userId", "User ID", 255).withIsRequired(true))
+         .withField(string("targetType", "Target Type", 20).withIsRequired(true).withPossibleValueSourceName(TARGET_TYPE))
+         .withField(string("targetName", "Target Name", 255).withIsRequired(true))
+         .withField(string("recordId", "Record ID", 255))
+         .withField(string("label", "Label", 1024))
+         .withUniqueKey(new UniqueKey("userId", "targetType", "targetName", "recordId"))
+         .withSection(new QFieldSection("identity", new QIcon("badge"), Tier.T1,
+            List.of("id", "userId", "targetType", "targetName", "recordId")).withLabel("Identity")));
+   }
+
+
+
+   /*******************************************************************************
+    ** A bounded string field.
+    *******************************************************************************/
+   private static QFieldMetaData string(String name, String label, Integer length)
+   {
+      return (new QFieldMetaData(name, QFieldType.STRING).withLabel(label).withMaxLength(length));
+   }
+
+   /*******************************************************************************
+    ** Main attachment table; virtual URLs never have backend columns.
+    *******************************************************************************/
+   private static QTableMetaData attachment(CollaborationQBitConfig config)
+   {
+      return (base(config, ATTACHMENT, "Attachments", "attach_file")
+         .withPermissionRules(CollaborationPermissions.permissionRules()
+            .withCustomPermissionChecker(new QCodeReference(AttachmentSecurity.class)))
+         .withRecordLabelFormatAndFields("%s", "fileName")
+         .withSearchFields(List.of("fileName", "description"))
+         .withAuditRules(new QAuditRules().withAuditLevel(AuditLevel.FIELD))
+         .withField(string("tableName", "Table", 128).withIsRequired(true))
+         .withField(string("recordId", "Record ID", 64).withIsRequired(true))
+         .withField(string("fileName", "File Name", 255).withIsRequired(true))
+         .withField(string("contentType", "Content Type", 255).withIsRequired(true))
+         .withField(new QFieldMetaData("sizeBytes", QFieldType.LONG).withLabel("Size (bytes)").withIsRequired(true))
+         .withField(string("sha256", "SHA-256", 64).withIsRequired(true))
+         .withField(string("bucketName", "Bucket", 255).withIsRequired(true))
+         .withField(string("storageKey", "Storage Key", 1024).withIsRequired(true))
+         .withField(string("thumbnailKey", "Thumbnail Key", 1024))
+         .withField(new QFieldMetaData("description", QFieldType.TEXT).withLabel("Description"))
+         .withField(string("createdByUserId", "Created By", 255).withIsRequired(true))
+         .withField(new QFieldMetaData("parentDeleted", QFieldType.BOOLEAN).withLabel("Parent Deleted").withIsRequired(true).withDefaultValue(false))
+         .withVirtualField(new QVirtualFieldMetaData("previewUrl", QFieldType.STRING).withLabel("Preview").withIsEditable(false).withIsQuerySelectable(true)
+            .withFieldAdornment(AdornmentType.FilePreviewValues.newFieldAdornment()
+               .withValue(AdornmentType.FilePreviewValues.FILE_NAME_FIELD, "fileName")
+               .withValue(AdornmentType.FilePreviewValues.MIME_TYPE_FIELD, "contentType")
+               .withValue(AdornmentType.FilePreviewValues.SIZE_BYTES_FIELD, "sizeBytes")
+               .withValue(AdornmentType.FilePreviewValues.THUMBNAIL_MAX_SIZE, 48)))
+         .withVirtualField(new QVirtualFieldMetaData("downloadUrl", QFieldType.STRING).withLabel("Download").withIsEditable(false).withIsQuerySelectable(true)
+            .withFieldAdornment(new FieldAdornment(AdornmentType.FILE_DOWNLOAD)
+               .withValue(AdornmentType.FileDownloadValues.FILE_NAME_FIELD, "fileName")
+               .withValue(AdornmentType.FileDownloadValues.DOWNLOAD_URL_DYNAMIC, true)))
+         .withCustomizer(TableCustomizers.POST_QUERY_RECORD, new QCodeReference(AttachmentPreviewCustomizer.class))
+         .withSection(new QFieldSection("file", new QIcon("attach_file"), Tier.T1,
+            List.of("fileName", "contentType", "sizeBytes", "description")).withLabel("File")
+            .withAlternative(QFieldSectionAlternativeType.RECORD_VIEW, section -> section.setFieldNames(List.of("previewUrl", "downloadUrl", "fileName", "contentType", "sizeBytes", "description"))))
+         .withSection(new QFieldSection("parent", new QIcon("link"), Tier.T2,
+            List.of("tableName", "recordId", "createdByUserId", "parentDeleted")).withLabel("Parent"))
+         .withSection(new QFieldSection("storage", new QIcon("storage"), Tier.T3,
+            List.of("id", "bucketName", "storageKey", "thumbnailKey", "sha256")).withLabel("Storage")));
+   }
+
+
+   /*******************************************************************************
+    ** Conversation tables share immutable parent references and service-only writes.
+    *******************************************************************************/
+   private static List<QTableMetaData> conversationTables(CollaborationQBitConfig config)
+   {
+      QTableMetaData comments = referenced(config, COMMENT, "Comments", "forum")
+         .withAuditRules(new QAuditRules().withAuditLevel(AuditLevel.FIELD))
+         .withSearchFields(List.of("body"))
+         .withField(new QFieldMetaData("threadId", QFieldType.INTEGER).withPossibleValueSourceName(COMMENT))
+         .withField(new QFieldMetaData("parentCommentId", QFieldType.INTEGER).withPossibleValueSourceName(COMMENT))
+         .withField(new QFieldMetaData("body", QFieldType.TEXT).withMaxLength(20000))
+         .withField(string("fieldName", "Field", 128))
+         .withField(string("authorUserId", "Author", 255).withIsRequired(true))
+         .withField(new QFieldMetaData("lastActivityAt", QFieldType.DATE_TIME).withIsRequired(true))
+         .withField(new QFieldMetaData("editedAt", QFieldType.DATE_TIME))
+         .withField(new QFieldMetaData("resolvedAt", QFieldType.DATE_TIME))
+         .withField(string("resolvedByUserId", "Resolved By", 255))
+         .withField(new QFieldMetaData("deletedAt", QFieldType.DATE_TIME))
+         .withField(string("deletedByUserId", "Deleted By", 255))
+         .withRecordLabelFormatAndFields("Comment %s", "id");
+      QTableMetaData revisions = referenced(config, COMMENT_REVISION, "Comment History", "history")
+         .withField(new QFieldMetaData("commentId", QFieldType.INTEGER).withIsRequired(true).withPossibleValueSourceName(COMMENT))
+         .withField(new QFieldMetaData("body", QFieldType.TEXT))
+         .withField(new QFieldMetaData("editedAt", QFieldType.DATE_TIME).withIsRequired(true))
+         .withField(string("editedByUserId", "Edited By", 255));
+      QTableMetaData mentions = referenced(config, MENTION, "Mentions", "alternate_email")
+         .withField(new QFieldMetaData("commentId", QFieldType.INTEGER).withIsRequired(true).withPossibleValueSourceName(COMMENT))
+         .withField(string("mentionedUserId", "Mentioned User", 255).withIsRequired(true))
+         .withField(new QFieldMetaData("visible", QFieldType.BOOLEAN).withIsRequired(true))
+         .withField(new QFieldMetaData("notifiedAt", QFieldType.DATE_TIME))
+         .withUniqueKey(new UniqueKey("commentId", "mentionedUserId"));
+      QTableMetaData follows = referenced(config, FOLLOW, "Followers", "notifications")
+         .withField(string("userId", "User", 255).withIsRequired(true))
+         .withField(string("reason", "Reason", 32).withIsRequired(true))
+         .withField(new QFieldMetaData("notifyOnChange", QFieldType.BOOLEAN).withIsRequired(true))
+         .withField(new QFieldMetaData("notifyOnComment", QFieldType.BOOLEAN).withIsRequired(true))
+         .withField(new QFieldMetaData("mutedUntil", QFieldType.DATE_TIME))
+         .withUniqueKey(new UniqueKey("tableName", "recordId", "userId"));
+      QTableMetaData activity = referenced(config, ACTIVITY, "Activity", "history")
+         .withoutCapabilities(com.kingsrook.qqq.backend.core.model.metadata.tables.Capability.TABLE_INSERT,
+            com.kingsrook.qqq.backend.core.model.metadata.tables.Capability.TABLE_UPDATE, com.kingsrook.qqq.backend.core.model.metadata.tables.Capability.TABLE_DELETE)
+         .withField(new QFieldMetaData("at", QFieldType.DATE_TIME).withIsRequired(true))
+         .withField(string("actorUserId", "Actor", 255))
+         .withField(string("type", "Type", 64).withIsRequired(true))
+         .withField(new QFieldMetaData("summary", QFieldType.TEXT))
+         .withField(string("refTableName", "Reference Table", 128))
+         .withField(string("refId", "Reference ID", 64));
+      QTableMetaData digests = referenced(config, FOLLOW_DIGEST, "Follow Digests", "notifications")
+         .withField(string("userId", "Recipient", 255).withIsRequired(true))
+         .withField(new QFieldMetaData("dueAt", QFieldType.DATE_TIME).withIsRequired(true))
+         .withField(new QFieldMetaData("changes", QFieldType.TEXT))
+         .withUniqueKey(new UniqueKey("tableName", "recordId", "userId"));
+      List<QTableMetaData> tables = List.of(comments, revisions, mentions, follows, activity, digests);
+      for(QTableMetaData table : tables)
+      {
+         table.withSection(new QFieldSection("details", new QIcon("info"), Tier.T1,
+            table.getFields().keySet().stream().filter(name -> !List.of("createDate", "modifyDate", "tableName", "recordId", "parentDeleted").contains(name)).toList()).withLabel("Details"));
+         for(QFieldMetaData field : table.getFields().values())
+         {
+            field.setIsEditable(false);
+         }
+      }
+      return (tables);
+   }
+
+   /*******************************************************************************
+    ** Denormalized references on children permit the same pre-query security.
+    *******************************************************************************/
+   private static QTableMetaData referenced(CollaborationQBitConfig config, String name, String label, String icon)
+   {
+      return (base(config, name, label, icon)
+         .withAuditRules(new QAuditRules().withAuditLevel(AuditLevel.NONE))
+         .withPermissionRules(CollaborationPermissions.permissionRules()
+            .withDenyBehavior(com.kingsrook.qqq.backend.core.model.metadata.permissions.DenyBehavior.HIDDEN)
+            .withCustomPermissionChecker(new QCodeReference(com.kingsrook.qbits.collaboration.security.CollaborationRowSecurity.class)))
+         .withCustomizer(TableCustomizers.POST_QUERY_RECORD, new QCodeReference(com.kingsrook.qbits.collaboration.security.ParentRowCustomizer.class))
+         .withField(string("tableName", "Table", 128).withIsRequired(true))
+         .withField(string("recordId", "Record ID", 64).withIsRequired(true))
+         .withField(new QFieldMetaData("parentDeleted", QFieldType.BOOLEAN).withIsRequired(true).withDefaultValue(false))
+         .withRecordLabelFormatAndFields("%s", "id")
+         .withSection(new QFieldSection("parent", new QIcon("link"), Tier.T2, List.of("tableName", "recordId", "parentDeleted")).withLabel("Parent")));
+   }
+
+   /*******************************************************************************
+    ** Vocabulary is visible; assignments inherit parent restrictions and locks.
+    *******************************************************************************/
+   private static List<QTableMetaData> tagTables(CollaborationQBitConfig config)
+   {
+      QTableMetaData tags = base(config, TAG, "Tags", "label")
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.NOT_PROTECTED)
+            .withCustomPermissionChecker(new QCodeReference(com.kingsrook.qbits.collaboration.tags.TagSecurity.class)))
+         .withAuditRules(new QAuditRules().withAuditLevel(AuditLevel.FIELD))
+         .withSearchFields(List.of("label"))
+         .withRecordLabelFormatAndFields("%s", "label")
+         .withField(string("name", "Name", 60).withIsRequired(true))
+         .withField(string("label", "Label", 255).withIsRequired(true))
+         .withField(string("color", "Color", 64))
+         .withField(string("tableName", "Table", 128))
+         .withField(new QFieldMetaData("approved", QFieldType.BOOLEAN).withIsRequired(true))
+         .withField(new QFieldMetaData("description", QFieldType.TEXT))
+         .withField(string("createdByUserId", "Created By", 255).withIsRequired(true))
+         .withField(new QFieldMetaData("usageCount", QFieldType.INTEGER).withIsRequired(true).withDefaultValue(0))
+         .withField(new QFieldMetaData("mergedIntoTagId", QFieldType.INTEGER).withPossibleValueSourceName(TAG))
+         .withUniqueKey(new UniqueKey("tableName", "name"))
+         .withSection(new QFieldSection("details", new QIcon("label"), Tier.T1,
+            List.of("id", "name", "label", "color", "tableName", "approved", "description", "createdByUserId", "usageCount", "mergedIntoTagId")).withLabel("Details"));
+      QTableMetaData links = referenced(config, RECORD_TAG, "Record Tags", "label")
+         .withField(new QFieldMetaData("tagId", QFieldType.INTEGER).withIsRequired(true).withPossibleValueSourceName(TAG))
+         .withField(string("createdByUserId", "Created By", 255).withIsRequired(true))
+         .withUniqueKey(new UniqueKey("tableName", "recordId", "tagId"))
+         .withSection(new QFieldSection("details", new QIcon("label"), Tier.T1, List.of("id", "tagId", "createdByUserId")).withLabel("Details"));
+      for(QTableMetaData table : List.of(tags, links))
+      {
+         table.getFields().values().forEach(field -> field.setIsEditable(false));
+      }
+      return (List.of(tags, links));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/model/ConversationChildren.java

@@ -0,0 +1,73 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.model;
+
+import java.util.List;
+import com.kingsrook.qqq.backend.core.actions.dashboard.widgets.ChildRecordListRenderer;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.joins.JoinOn;
+import com.kingsrook.qqq.backend.core.model.metadata.joins.JoinType;
+import com.kingsrook.qqq.backend.core.model.metadata.joins.QJoinMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QFieldSection;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.Tier;
+
+/*******************************************************************************
+ ** Standard child lists keep revision, mention and follower tables out of navigation.
+ *******************************************************************************/
+public final class ConversationChildren
+{
+   /*******************************************************************************
+    ** Static metadata helper.
+    *******************************************************************************/
+   private ConversationChildren()
+   {
+   }
+
+   /*******************************************************************************
+    ** Install after tables have been registered.
+    *******************************************************************************/
+   public static void install(QInstance instance)
+   {
+      QJoinMetaData tagJoin = new QJoinMetaData().withLeftTable(CollaborationTables.TAG).withRightTable(CollaborationTables.RECORD_TAG)
+         .withInferredName().withType(JoinType.ONE_TO_MANY).withJoinOns(List.of(new JoinOn("id", "tagId")));
+      instance.addJoin(tagJoin);
+      instance.addWidget(ChildRecordListRenderer.widgetMetaDataBuilder(tagJoin).withLabel("Record Tags").withCanAddChildRecord(false).getWidgetMetaData());
+      instance.getTable(CollaborationTables.TAG).withSection(new QFieldSection("recordTags", new QIcon("list"), Tier.T2)
+         .withLabel("Record Tags").withWidgetName(tagJoin.getName()));
+      child(instance, CollaborationTables.COMMENT_REVISION, "Comment History", List.of(new JoinOn("id", "commentId")));
+      child(instance, CollaborationTables.MENTION, "Mentions", List.of(new JoinOn("id", "commentId")));
+      child(instance, CollaborationTables.FOLLOW, "Followers", List.of(new JoinOn("tableName", "tableName"), new JoinOn("recordId", "recordId")));
+   }
+
+   /*******************************************************************************
+    ** Child records are managed by services, so the add button is disabled.
+    *******************************************************************************/
+   private static void child(QInstance instance, String table, String label, List<JoinOn> conditions)
+   {
+      QJoinMetaData join = new QJoinMetaData().withLeftTable(CollaborationTables.COMMENT).withRightTable(table)
+         .withInferredName().withType(JoinType.ONE_TO_MANY).withJoinOns(conditions);
+      instance.addJoin(join);
+      instance.addWidget(ChildRecordListRenderer.widgetMetaDataBuilder(join).withLabel(label).withCanAddChildRecord(false).getWidgetMetaData());
+      instance.getTable(CollaborationTables.COMMENT).withSection(new QFieldSection(table, new QIcon("list"), Tier.T2).withLabel(label).withWidgetName(join.getName()));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/notify/CollaborationNotification.java

@@ -0,0 +1,38 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.notify;
+
+
+/*******************************************************************************
+ ** Transport-neutral notification. Body is markdown; link is a record href.
+ *******************************************************************************/
+public record CollaborationNotification(String recipientUserId, String title, String body, Category category,
+   String sourceTableName, String sourceRecordId, String link)
+{
+   /*******************************************************************************
+    ** Categories supported by the collaboration notification boundary.
+    *******************************************************************************/
+   public enum Category
+   {
+      MENTION, SHARE, FOLLOW, TASK
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/notify/CollaborationNotifier.java

@@ -0,0 +1,34 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.notify;
+
+
+/*******************************************************************************
+ ** replace with a QAlerts.notify adapter when QRun-IO/qqq#1125 is released
+ *******************************************************************************/
+public interface CollaborationNotifier
+{
+   /*******************************************************************************
+    ** Deliver a recipient-authorized notification.
+    *******************************************************************************/
+   void notify(CollaborationNotification n);
+}

src/main/java/com/kingsrook/qbits/collaboration/notify/NoOpNotifier.java

@@ -0,0 +1,37 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.notify;
+
+
+/*******************************************************************************
+ ** Default when no notification transport is installed.
+ *******************************************************************************/
+public class NoOpNotifier implements CollaborationNotifier
+{
+   /*******************************************************************************
+    ** Activity remains available in the timeline without a delivery transport.
+    *******************************************************************************/
+   @Override
+   public void notify(CollaborationNotification n)
+   {
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/notify/Notifications.java

@@ -0,0 +1,105 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.notify;
+
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.security.OtherUserAccess;
+import com.kingsrook.qqq.backend.core.actions.customizers.QCodeLoader;
+import com.kingsrook.qqq.backend.core.context.CapturedContext;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.utils.lambdas.UnsafeVoidVoidMethod;
+
+/*******************************************************************************
+ ** Notification delivery uses RC.5 after-commit callbacks and fresh recipient access.
+ ** replace with a QAlerts.notify adapter when QRun-IO/qqq#1125 is released
+ *******************************************************************************/
+public final class Notifications
+{
+   /*******************************************************************************
+    ** Static transport boundary.
+    *******************************************************************************/
+   private Notifications()
+   {
+   }
+
+   /*******************************************************************************
+    ** Capture instance/session, but never carry a completed transaction into delivery.
+    *******************************************************************************/
+   public static void send(CollaborationNotification notification) throws QException
+   {
+      send(notification, null);
+   }
+
+   /*******************************************************************************
+    ** Optional receipt runs only after actual transport delivery, never on rollback.
+    *******************************************************************************/
+   public static void send(CollaborationNotification notification, UnsafeVoidVoidMethod<QException> receipt) throws QException
+   {
+      CapturedContext context = new CapturedContext(QContext.getQInstance(), QContext.getQSession());
+      if(QContext.getQBackendTransaction() != null)
+      {
+         QContext.getQBackendTransaction().addAfterCommitCallback(() ->
+         {
+            try
+            {
+               QContext.withTemporaryContext(context, () -> deliver(notification, receipt));
+            }
+            catch(QException e)
+            {
+               throw (new IllegalStateException("Collaboration notification failed after commit", e));
+            }
+         });
+      }
+      else
+      {
+         deliver(notification, receipt);
+      }
+   }
+
+   /*******************************************************************************
+    ** Re-check immediately before exposing record data to the transport.
+    *******************************************************************************/
+   private static void deliver(CollaborationNotification notification, UnsafeVoidVoidMethod<QException> receipt) throws QException
+   {
+      if(new OtherUserAccess().canRead(notification.recipientUserId(), notification.sourceTableName(), notification.sourceRecordId()).orElse(false))
+      {
+         CollaborationNotifier notifier = QCodeLoader.getAdHoc(CollaborationNotifier.class, CollaborationRecords.config().getNotifier());
+         notifier.notify(notification);
+         if(receipt != null && !(notifier instanceof NoOpNotifier))
+         {
+            receipt.run();
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Relative canonical frontend link with separately encoded path segments.
+    *******************************************************************************/
+   public static String link(String table, String id)
+   {
+      return ("/app/" + URLEncoder.encode(table, StandardCharsets.UTF_8).replace("+", "%20") + "/"
+         + URLEncoder.encode(id, StandardCharsets.UTF_8).replace("+", "%20"));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/notify/RecordingNotifier.java

@@ -0,0 +1,50 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.notify;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/*******************************************************************************
+ ** In-memory transport for tests; each instance owns its recorded notifications.
+ *******************************************************************************/
+public class RecordingNotifier implements CollaborationNotifier
+{
+   private final List<CollaborationNotification> notifications = new ArrayList<>();
+
+   /*******************************************************************************
+    ** Record delivery for assertions.
+    *******************************************************************************/
+   @Override
+   public synchronized void notify(CollaborationNotification n)
+   {
+      notifications.add(n);
+   }
+
+   /*******************************************************************************
+    ** Immutable snapshot of delivered notifications.
+    *******************************************************************************/
+   public synchronized List<CollaborationNotification> notifications()
+   {
+      return (List.copyOf(notifications));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/people/PeopleService.java

@@ -0,0 +1,162 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.people;
+
+import java.time.Clock;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.CriteriaOption;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterCriteria;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Lazy, service-managed directory. Persisted timestamps make throttling survive
+ ** service recreation and avoid a cache claiming success after rollback.
+ *******************************************************************************/
+public class PeopleService
+{
+   private final Clock clock;
+
+   /*******************************************************************************
+    ** Production clock.
+    *******************************************************************************/
+   public PeopleService()
+   {
+      this(Clock.systemUTC());
+   }
+
+   /*******************************************************************************
+    ** Deterministic clock for directory maintenance tests.
+    *******************************************************************************/
+   public PeopleService(Clock clock)
+   {
+      this.clock = clock;
+   }
+
+   /*******************************************************************************
+    ** Upsert only the caller, at most once every ten minutes.
+    *******************************************************************************/
+   public void touch() throws QException
+   {
+      String user = PersonalRecords.currentUserId();
+      List<QRecord> rows = CollaborationRecords.query(CollaborationTables.USER, new QQueryFilter().withCriteria("userId", QCriteriaOperator.EQUALS, user));
+      Instant now = clock.instant();
+      if(!rows.isEmpty() && rows.getFirst().getValueInstant("lastSeenAt") != null
+         && rows.getFirst().getValueInstant("lastSeenAt").plusSeconds(600).isAfter(now))
+      {
+         return;
+      }
+      String name = QContext.getQSession().getUser().getFullName();
+      QRecord row = new QRecord().withValue("userId", user).withValue("displayName", name == null || name.isBlank() ? user : name).withValue("lastSeenAt", now);
+      if(rows.isEmpty())
+      {
+         try
+         {
+            CollaborationRecords.insert(CollaborationTables.USER, row.withValue("active", true));
+         }
+         catch(QException e)
+         {
+            if(CollaborationRecords.query(CollaborationTables.USER, new QQueryFilter().withCriteria("userId", QCriteriaOperator.EQUALS, user)).isEmpty())
+            {
+               throw (e);
+            }
+            // A concurrent first call populated the same directory identity.
+         }
+      }
+      else
+      {
+         CollaborationRecords.update(CollaborationTables.USER, row.withValue("id", rows.getFirst().getValue("id")));
+      }
+   }
+
+   /*******************************************************************************
+    ** Directory search requires a signed-in caller and excludes inactive people.
+    *******************************************************************************/
+   public List<PersonEntry> search(String q, Integer limit) throws QException
+   {
+      return (search(q, limit, Set.of()));
+   }
+
+   /*******************************************************************************
+    ** Rank participants before limiting, with bounded backend queries for both groups.
+    *******************************************************************************/
+   public List<PersonEntry> search(String q, Integer limit, Set<String> preferredUserIds) throws QException
+   {
+      PersonalRecords.currentUserId();
+      if(limit == null || limit < 1 || limit > 50)
+      {
+         throw (new QException("Limit must be between 1 and 50"));
+      }
+      List<QRecord> rows = new ArrayList<>();
+      if(!preferredUserIds.isEmpty())
+      {
+         rows.addAll(CollaborationRecords.query(CollaborationTables.USER, searchFilter(q, limit)
+            .withCriteria("userId", QCriteriaOperator.IN, new ArrayList<>(preferredUserIds))));
+      }
+      if(rows.size() < limit)
+      {
+         QQueryFilter other = searchFilter(q, limit - rows.size());
+         if(!preferredUserIds.isEmpty())
+         {
+            other.withCriteria("userId", QCriteriaOperator.NOT_IN, new ArrayList<>(preferredUserIds));
+         }
+         rows.addAll(CollaborationRecords.query(CollaborationTables.USER, other));
+      }
+      return (rows.stream().map(row -> new PersonEntry(row.getValueString("userId"), row.getValueString("displayName"),
+         row.getValueString("email"), row.getValueInstant("lastSeenAt"))).toList());
+   }
+
+   /*******************************************************************************
+    ** Keep active and group restrictions outside the display-name/email OR.
+    *******************************************************************************/
+   private QQueryFilter searchFilter(String q, Integer limit)
+   {
+      QQueryFilter filter = new QQueryFilter().withCriteria("active", QCriteriaOperator.EQUALS, true)
+         .withOrderBy(new QFilterOrderBy("displayName")).withOrderBy(new QFilterOrderBy("userId")).withLimit(limit);
+      if(q != null && !q.isBlank())
+      {
+         filter.withSubFilter(new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR)
+            .withCriteria(new QFilterCriteria("displayName", QCriteriaOperator.CONTAINS, q).withOption(CriteriaOption.CASE_INSENSITIVE))
+            .withCriteria(new QFilterCriteria("email", QCriteriaOperator.CONTAINS, q).withOption(CriteriaOption.CASE_INSENSITIVE)));
+      }
+      return (filter);
+   }
+
+   /*******************************************************************************
+    ** Resolve display names without publishing the raw directory table.
+    *******************************************************************************/
+   public String displayName(String userId) throws QException
+   {
+      List<QRecord> rows = CollaborationRecords.query(CollaborationTables.USER, new QQueryFilter().withCriteria("userId", QCriteriaOperator.EQUALS, userId));
+      return (rows.isEmpty() || rows.getFirst().getValueString("displayName") == null ? userId : rows.getFirst().getValueString("displayName"));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/people/PersonEntry.java

@@ -0,0 +1,31 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.people;
+
+import java.time.Instant;
+
+/*******************************************************************************
+ ** Safe directory fields returned to mention autocomplete.
+ *******************************************************************************/
+public record PersonEntry(String userId, String displayName, String email, Instant lastSeenAt)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/permissions/CollaborationPermissionChecker.java

@@ -0,0 +1,66 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.permissions;
+
+
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+
+
+/*******************************************************************************
+ ** Reads require view (or admin); settings writes require admin. People are
+ ** service-managed and cannot be written directly by a user.
+ *******************************************************************************/
+public class CollaborationPermissionChecker implements CustomPermissionChecker
+{
+   /*******************************************************************************
+    ** Check the current session without an anonymous-access bypass.
+    *******************************************************************************/
+   @Override
+   public void checkPermissionsThrowing(AbstractActionInput input, MetaDataWithPermissionRules metadata) throws QPermissionDeniedException
+   {
+      String needed = CollaborationPermissions.VIEW;
+      boolean write = input instanceof InsertInput || input instanceof UpdateInput || input instanceof DeleteInput;
+      if(write && metadata instanceof QTableMetaData table)
+      {
+         if(!CollaborationTables.FEATURE_SETTING.equals(table.getName()))
+         {
+            throw (new QPermissionDeniedException("People are maintained by the collaboration directory service."));
+         }
+         needed = CollaborationPermissions.ADMIN;
+      }
+      QSession session = QContext.getQSession();
+      if(session == null || (!session.hasPermission(needed) && !session.hasPermission(CollaborationPermissions.ADMIN)))
+      {
+         throw (new QPermissionDeniedException("This needs the " + needed + " permission."));
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/permissions/CollaborationPermissions.java

@@ -0,0 +1,64 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.permissions;
+
+
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+
+
+/*******************************************************************************
+ ** Full permission names; fields management is reserved for a later phase.
+ *******************************************************************************/
+public final class CollaborationPermissions
+{
+   public static final String VIEW = "collaboration.view";
+   public static final String ADMIN = "collaboration.admin";
+   public static final String FIELDS_MANAGE = "collaboration.fields.manage";
+   public static final String TAGS_MANAGE = "collaboration.tags.manage";
+
+
+
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private CollaborationPermissions()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Shared permission checker for tables, app and home.
+    *******************************************************************************/
+   public static QPermissionRules permissionRules()
+   {
+      return (new QPermissionRules().withLevel(PermissionLevel.HAS_ACCESS_PERMISSION)
+         .withPermissionBaseName(CollaborationQBitConfig.PERMISSION_BASE_NAME)
+         .withCustomPermissionChecker(new QCodeReference(CollaborationPermissionChecker.class)));
+   }
+
+
+
+}

src/main/java/com/kingsrook/qbits/collaboration/recents/RecentsService.java

@@ -0,0 +1,132 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.recents;
+
+
+import java.io.Serializable;
+import java.time.Clock;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.TargetResolver;
+import com.kingsrook.qbits.collaboration.favorites.FavoriteEntry;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+
+/*******************************************************************************
+ ** Current-user recent targets, with persisted one-minute throttling. No process
+ ** cache or unreleased core contracts are needed. Lists drop unavailable targets.
+ *******************************************************************************/
+public final class RecentsService
+{
+   static Clock clock = Clock.systemUTC();
+
+
+
+   /*******************************************************************************
+    ** Static service.
+    *******************************************************************************/
+   private RecentsService()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Validate visibility, then insert or refresh at most once per minute.
+    *******************************************************************************/
+   public static void recordView(String targetType, String targetName, Serializable recordId) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      String userId = PersonalRecords.currentUserId();
+      FavoriteEntry target = TargetResolver.require(targetType, targetName, recordId);
+      QQueryFilter filter = PersonalRecords.targetFilter(targetType, targetName, target.recordId());
+      List<QRecord> existing = PersonalRecords.query(CollaborationTables.RECENT, filter);
+      Instant now = clock.instant();
+      if(existing.isEmpty())
+      {
+         QRecord row = new QRecord().withValue("userId", userId).withValue("targetType", targetType).withValue("targetName", targetName)
+            .withValue("recordId", target.recordId()).withValue("label", target.label()).withValue("lastViewedAt", now).withValue("viewCount", 1);
+         try
+         {
+            PersonalRecords.insert(CollaborationTables.RECENT, row);
+            return;
+         }
+         catch(QException e)
+         {
+            existing = PersonalRecords.query(CollaborationTables.RECENT, filter);
+            if(existing.isEmpty())
+            {
+               throw (e);
+            }
+            // A concurrent first view inserted this target. Apply normal throttling.
+         }
+      }
+      QRecord row = existing.getFirst();
+      if(row.getValueInstant("lastViewedAt").plusSeconds(60).isAfter(now))
+      {
+         return;
+      }
+      PersonalRecords.update(CollaborationTables.RECENT, List.of(new QRecord().withValue("id", row.getValue("id"))
+         .withValue("lastViewedAt", now).withValue("viewCount", Math.addExact(row.getValueInteger("viewCount"), 1)).withValue("label", target.label())));
+   }
+
+
+
+   /*******************************************************************************
+    ** Return at most 50 visible entries, newest first. Page until enough visible
+    ** targets are found, rather than letting unavailable rows consume the limit.
+    *******************************************************************************/
+   public static List<FavoriteEntry> list(Integer limit) throws QException
+   {
+      new com.kingsrook.qbits.collaboration.people.PeopleService().touch();
+      if(limit == null || limit < 1 || limit > 50)
+      {
+         throw (new QException("Limit must be between 1 and 50"));
+      }
+      List<FavoriteEntry> result = new ArrayList<>();
+      int skip = 0;
+      while(result.size() < limit)
+      {
+         List<QRecord> rows = PersonalRecords.query(CollaborationTables.RECENT, PersonalRecords.ownFilter()
+            .withOrderBy(new QFilterOrderBy("lastViewedAt", false)).withOrderBy(new QFilterOrderBy("id", false)).withSkip(skip).withLimit(50));
+         for(FavoriteEntry entry : TargetResolver.refresh(rows))
+         {
+            if(entry.available() && result.size() < limit)
+            {
+               result.add(entry);
+            }
+         }
+         if(rows.size() < 50)
+         {
+            break;
+         }
+         skip += rows.size();
+      }
+      return (result);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/recents/TrimRecentsProcess.java

@@ -0,0 +1,140 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.recents;
+
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.actions.processes.BackendStep;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QBackendStepMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.scheduleing.QScheduleMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
+
+
+/*******************************************************************************
+ ** Hidden daily retention job. Runs with its caller's session, which must be a
+ ** scheduler system session or collaboration admin; never elevates a user.
+ *******************************************************************************/
+public class TrimRecentsProcess implements BackendStep, CustomPermissionChecker
+{
+   public static final String NAME = "collaborationTrimRecents";
+
+
+
+   /*******************************************************************************
+    ** Always register the backend-only process; scheduling is opt-in.
+    *******************************************************************************/
+   public static QProcessMetaData metadata(CollaborationQBitConfig config)
+   {
+      QProcessMetaData process = new QProcessMetaData().withName(NAME).withLabel("Trim recents").withIsHidden(true).withIcon(new QIcon("history"))
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.HAS_ACCESS_PERMISSION)
+            .withPermissionBaseName("collaboration").withCustomPermissionChecker(new QCodeReference(TrimRecentsProcess.class)))
+         .withStep(new QBackendStepMetaData().withName("run").withCode(new QCodeReference(TrimRecentsProcess.class)));
+      if(config.getSchedulerName() != null)
+      {
+         process.withSchedule(new QScheduleMetaData().withSchedulerName(config.getSchedulerName()).withRepeatSeconds(86400).withInitialDelaySeconds(86400));
+      }
+      return (process);
+   }
+
+
+
+   /*******************************************************************************
+    ** Hidden is a presentation setting, so explicitly guard execution as well.
+    *******************************************************************************/
+   @Override
+   public void checkPermissionsThrowing(AbstractActionInput input, MetaDataWithPermissionRules metadata) throws QPermissionDeniedException
+   {
+      QSession session = QContext.getQSession();
+      if(!(session instanceof QSystemUserSession) && (session == null || !session.hasPermission(CollaborationPermissions.ADMIN)))
+      {
+         throw (new QPermissionDeniedException("This needs the collaboration.admin permission."));
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Keyset-page users, then delete overflow in bounded batches. Re-query each
+    ** user's newest N before every batch, avoiding offsets over deleted rows.
+    *******************************************************************************/
+   @Override
+   public void run(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+   {
+      checkPermissionsThrowing(input, null);
+      CollaborationSecurity.ensureSessionKeys(QContext.getQInstance(), QContext.getQSession());
+      CollaborationQBitConfig config = (CollaborationQBitConfig) QContext.getQInstance().getQBits().values().stream()
+         .filter(qbit -> qbit.getConfig() instanceof CollaborationQBitConfig).findFirst().orElseThrow().getConfig();
+      String previousUser = null;
+      while(true)
+      {
+         QQueryFilter nextUser = new QQueryFilter().withOrderBy(new QFilterOrderBy("userId")).withLimit(1);
+         if(previousUser != null)
+         {
+            nextUser.withCriteria("userId", QCriteriaOperator.GREATER_THAN, previousUser);
+         }
+         List<QRecord> next = PersonalRecords.query(CollaborationTables.RECENT, nextUser);
+         if(next.isEmpty())
+         {
+            break;
+         }
+         previousUser = next.getFirst().getValueString("userId");
+         while(true)
+         {
+            List<QRecord> overflow = PersonalRecords.query(CollaborationTables.RECENT, new QQueryFilter()
+               .withCriteria("userId", QCriteriaOperator.EQUALS, previousUser)
+               .withOrderBy(new QFilterOrderBy("lastViewedAt", false)).withOrderBy(new QFilterOrderBy("id", false))
+               .withSkip(config.getRecentsPerUser()).withLimit(500));
+            if(overflow.isEmpty())
+            {
+               break;
+            }
+            List<Serializable> ids = new ArrayList<>(overflow.stream().map(row -> row.getValue("id")).toList());
+            PersonalRecords.delete(CollaborationTables.RECENT, ids);
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/security/CollaborationRowSecurity.java

@@ -0,0 +1,65 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.security;
+
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissionChecker;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrCountInputInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Standard table/API access is read-only; service calls authorize separately.
+ *******************************************************************************/
+public class CollaborationRowSecurity implements CustomPermissionChecker
+{
+   /*******************************************************************************
+    ** Apply parent-table restrictions before count, query and aggregate execution.
+    *******************************************************************************/
+   @Override
+   public void checkPermissionsThrowing(AbstractActionInput input, MetaDataWithPermissionRules metadata) throws QPermissionDeniedException
+   {
+      if(input instanceof InsertInput || input instanceof UpdateInput || input instanceof DeleteInput)
+      {
+         throw (new QPermissionDeniedException("Use the collaboration service actions."));
+      }
+      new CollaborationPermissionChecker().checkPermissionsThrowing(input, metadata);
+      if(metadata instanceof QTableMetaData table
+         && (table.getName().equals(CollaborationTables.FOLLOW) || table.getName().equals(CollaborationTables.ACTIVITY) || table.getName().equals(CollaborationTables.FOLLOW_DIGEST))
+         && !QContext.getQSession().hasPermission(CollaborationPermissions.ADMIN))
+      {
+         throw (new QPermissionDeniedException("This needs collaboration.admin."));
+      }
+      if(input instanceof QueryOrCountInputInterface query)
+      {
+         ParentTableRestriction.restrict(query);
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/security/OtherUserAccess.java

@@ -0,0 +1,76 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.security;
+
+import java.io.Serializable;
+import java.util.Optional;
+import java.util.concurrent.atomic.AtomicReference;
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qqq.backend.core.actions.customizers.QCodeLoader;
+import com.kingsrook.qqq.backend.core.context.CapturedContext;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+
+/*******************************************************************************
+ ** Stand-in for core RecordAccessCheckerInterface. Unknown is never a grant.
+ *******************************************************************************/
+public class OtherUserAccess
+{
+   /*******************************************************************************
+    ** The temporary context has no inherited permission bypass or caller transaction.
+    *******************************************************************************/
+   public Optional<Boolean> canRead(String userId, String table, Serializable recordId) throws QException
+   {
+      CollaborationQBitConfig config = CollaborationRecords.config();
+      if(config.getUserSessionSupplier() == null)
+      {
+         return (Optional.empty());
+      }
+      UserSessionSupplier supplier = QCodeLoader.getAdHoc(UserSessionSupplier.class, config.getUserSessionSupplier());
+      Optional<QSession> session = supplier.sessionFor(userId);
+      if(session.isEmpty())
+      {
+         return (Optional.empty());
+      }
+      if(session.get().getUser() == null || !userId.equals(session.get().getUser().getIdReference()))
+      {
+         return (Optional.empty());
+      }
+      AtomicReference<Boolean> result = new AtomicReference<>(false);
+      QContext.withTemporaryContext(new CapturedContext(QContext.getQInstance(), session.get()), () ->
+      {
+         try
+         {
+            ParentRecordAccess.requireVisibleParent(table, recordId);
+            result.set(true);
+         }
+         catch(QNotFoundException expected)
+         {
+            result.set(false);
+         }
+      });
+      return (Optional.of(result.get()));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/security/ParentRecordAccess.java

@@ -0,0 +1,118 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.security;
+
+import java.io.Serializable;
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionsHelper;
+import com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType;
+import com.kingsrook.qqq.backend.core.actions.tables.GetAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.exceptions.QValueException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.utils.ValueUtils;
+
+/*******************************************************************************
+ ** Stand-in for QQQ core RecordReferenceSecurityHelper (QRun-IO/qqq collaboration phase a); replace when released
+ *******************************************************************************/
+public final class ParentRecordAccess
+{
+   /*******************************************************************************
+    ** Static operations only.
+    *******************************************************************************/
+   private ParentRecordAccess()
+   {
+   }
+
+   /*******************************************************************************
+    ** Exclude collaboration tables to avoid recursive references.
+    *******************************************************************************/
+   public static boolean canReadTable(String tableName)
+   {
+      QTableMetaData table = tableName == null ? null : QContext.getQInstance().getTable(tableName);
+      return (table != null && table.getPrimaryKeyField() != null && !tableName.startsWith(CollaborationQBitConfig.TABLE_NAME_PREFIX)
+         && PermissionsHelper.hasTablePermission(new AbstractActionInput(), tableName, TablePermissionSubType.READ));
+   }
+
+   /*******************************************************************************
+    ** Get as the caller, enforcing table permissions and the parent's read locks.
+    *******************************************************************************/
+   public static QRecord requireVisibleParent(String tableName, Serializable recordId) throws QException
+   {
+      if(!canReadTable(tableName) || recordId == null)
+      {
+         throw (new QNotFoundException("Not found"));
+      }
+      QTableMetaData table = QContext.getQInstance().getTable(tableName);
+      try
+      {
+         Serializable key = ValueUtils.getValueAsFieldType(table.getField(table.getPrimaryKeyField()).getType(), recordId);
+         GetInput input = new GetInput(tableName).withPrimaryKey(key);
+         input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+         QRecord parent = new GetAction().execute(input).getRecord();
+         if(parent == null)
+         {
+            throw (new QNotFoundException("Not found"));
+         }
+         return (parent);
+      }
+      catch(QPermissionDeniedException | QValueException expected)
+      {
+         throw (new QNotFoundException("Not found"));
+      }
+   }
+
+   /*******************************************************************************
+    ** Temporary approximation: EDIT plus a visible parent, not WRITE lock checks.
+    *******************************************************************************/
+   public static void requireFeature(String tableName, Serializable recordId, String feature) throws QException
+   {
+      requireVisibleParent(tableName, recordId);
+      requireTableFeature(tableName, feature);
+   }
+
+   /*******************************************************************************
+    ** Authorize vocabulary creation without requiring an arbitrary parent record.
+    *******************************************************************************/
+   public static void requireTableFeature(String tableName, String feature) throws QException
+   {
+      if(!canReadTable(tableName))
+      {
+         throw (new QNotFoundException("Not found"));
+      }
+      QTableMetaData table = QContext.getQInstance().getTable(tableName);
+      String base = table.getPermissionRules() == null ? null : table.getPermissionRules().getPermissionBaseName();
+      base = base == null || base.isBlank() ? tableName : base;
+      if(!QContext.getQSession().hasPermission(tableName + "." + feature) && !QContext.getQSession().hasPermission(base + "." + feature)
+         && !PermissionsHelper.hasTablePermission(new AbstractActionInput(), tableName, TablePermissionSubType.EDIT))
+      {
+         throw (new QPermissionDeniedException("This needs the " + base + "." + feature + " permission or table EDIT."));
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/security/ParentRowCustomizer.java

@@ -0,0 +1,72 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.security;
+
+import java.util.ArrayList;
+import java.util.List;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizerInterface;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrGetInputInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Parent read locks also protect direct GetAction and unpinned table browsing.
+ ** Until core mirrors locks, aggregate counts are approximate and pages may be short.
+ *******************************************************************************/
+public class ParentRowCustomizer implements TableCustomizerInterface
+{
+   /*******************************************************************************
+    ** Children store the parent's reference so the same filter protects them.
+    *******************************************************************************/
+   @Override
+   public List<QRecord> postQuery(QueryOrGetInputInterface input, List<QRecord> records) throws QException
+   {
+      List<QRecord> visible = new ArrayList<>();
+      for(QRecord record : records)
+      {
+         try
+         {
+            if(Boolean.TRUE.equals(record.getValueBoolean("parentDeleted")))
+            {
+               throw (new QNotFoundException("Not found"));
+            }
+            ParentRecordAccess.requireVisibleParent(record.getValueString("tableName"), record.getValueString("recordId"));
+            QRecord row = new QRecord(record);
+            if(row.getValue("deletedAt") != null)
+            {
+               row.setValue("body", null);
+            }
+            visible.add(row);
+         }
+         catch(QNotFoundException expected)
+         {
+            if(input instanceof GetInput)
+            {
+               throw (expected);
+            }
+         }
+      }
+      return (visible);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/security/ParentTableRestriction.java

@@ -0,0 +1,58 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.security;
+
+import java.util.List;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrCountInputInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+/*******************************************************************************
+ ** Shared pre-query parent-table restriction. Record locks require post-filtering.
+ *******************************************************************************/
+public final class ParentTableRestriction
+{
+   /*******************************************************************************
+    ** Static helper.
+    *******************************************************************************/
+   private ParentTableRestriction()
+   {
+   }
+
+   /*******************************************************************************
+    ** AND outside caller OR clauses while retaining paging and sort order.
+    *******************************************************************************/
+   public static void restrict(QueryOrCountInputInterface input)
+   {
+      List<String> readable = QContext.getQInstance().getTables().keySet().stream().filter(ParentRecordAccess::canReadTable).toList();
+      QQueryFilter original = input.getFilter();
+      QQueryFilter filter = new QQueryFilter().withCriteria("tableName", QCriteriaOperator.IN, readable)
+         .withCriteria("parentDeleted", QCriteriaOperator.EQUALS, false);
+      if(original != null)
+      {
+         filter.withSubFilter(original).withLimit(original.getLimit()).withSkip(original.getSkip());
+         filter.setOrderBys(original.getOrderBys());
+      }
+      input.setFilter(filter);
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/security/UserSessionSupplier.java

@@ -0,0 +1,37 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.security;
+
+import java.util.Optional;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+
+/*******************************************************************************
+ ** Stand-in for the unreleased core UserSessionProviderInterface.
+ *******************************************************************************/
+public interface UserSessionSupplier
+{
+   /*******************************************************************************
+    ** Return a freshly authorized session, or unknown when identity is unavailable.
+    *******************************************************************************/
+   Optional<QSession> sessionFor(String userId) throws QException;
+}

src/main/java/com/kingsrook/qbits/collaboration/tags/TagEntry.java

@@ -0,0 +1,29 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.tags;
+
+/*******************************************************************************
+ ** A vocabulary entry or record chip, without exposing assignment rows.
+ *******************************************************************************/
+public record TagEntry(Integer id, String name, String label, String color, String tableName, Boolean approved, Integer usageCount)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/tags/TagFilterTranslator.java

@@ -0,0 +1,126 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.tags;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+/*******************************************************************************
+ ** Materialized tag filter logic independent of the unreleased core hooks in #1140.
+ ** Every operator returns matching caller-visible parent ids, including complements.
+ *******************************************************************************/
+public class TagFilterTranslator
+{
+   public static final int MAX_RECORD_IDS = 10000;
+
+   /*******************************************************************************
+    ** IN means any tag, CONTAINS_ALL means every requested tag, NOT_IN means none.
+    ** Empty IN matches none; empty CONTAINS_ALL and NOT_IN match all visible rows.
+    *******************************************************************************/
+   public List<String> recordIds(String table, String op, Collection<? extends Serializable> tags) throws QException
+   {
+      TagsService.requireTable(table);
+      if(!List.of("IN", "CONTAINS_ALL", "NOT_IN", "IS_BLANK", "IS_NOT_BLANK").contains(op))
+      {
+         throw (new QException("Unsupported tag operator: " + op));
+      }
+      Set<Integer> requested = new HashSet<>();
+      boolean missing = false;
+      if(!op.equals("IS_BLANK") && !op.equals("IS_NOT_BLANK"))
+      {
+         for(Serializable tag : tags == null ? List.<Serializable>of() : tags)
+         {
+            QQueryFilter filter = TagsService.vocabularyFilter(table).withCriteria("approved", QCriteriaOperator.EQUALS, true);
+            filter.withCriteria(tag instanceof Number ? "id" : "name", QCriteriaOperator.EQUALS,
+               tag instanceof Number ? tag : TagsService.normalize(tag == null ? null : tag.toString()));
+            List<QRecord> matches = CollaborationRecords.query(CollaborationTables.TAG, filter.withOrderBy(new QFilterOrderBy("id")));
+            if(matches.isEmpty())
+            {
+               missing = true;
+            }
+            else
+            {
+               QRecord match = matches.stream().filter(row -> row.getValue("tableName") == null).findFirst().orElse(matches.getFirst());
+               requested.add(match.getValueInteger("id"));
+            }
+         }
+      }
+      Map<String, Set<Integer>> assignments = new HashMap<>();
+      for(QRecord row : CollaborationRecords.query(CollaborationTables.RECORD_TAG, new QQueryFilter()
+         .withCriteria("tableName", QCriteriaOperator.EQUALS, table).withCriteria("parentDeleted", QCriteriaOperator.EQUALS, false)))
+      {
+         assignments.computeIfAbsent(row.getValueString("recordId"), ignored -> new HashSet<>()).add(row.getValueInteger("tagId"));
+      }
+      List<String> result = new ArrayList<>();
+      String key = QContext.getQInstance().getTable(table).getPrimaryKeyField();
+      for(int skip = 0; ; skip += 500)
+      {
+         QueryInput input = new QueryInput(table).withFilter(new QQueryFilter().withOrderBy(new QFilterOrderBy(key)).withSkip(skip).withLimit(500))
+            .withTransaction(QContext.getQBackendTransaction());
+         input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+         List<QRecord> parents = new QueryAction().execute(input).getRecords();
+         for(QRecord parent : parents)
+         {
+            String id = parent.getValueString(key);
+            Set<Integer> applied = assignments.getOrDefault(id, Set.of());
+            boolean any = requested.stream().anyMatch(applied::contains);
+            boolean match = switch(op)
+            {
+               case "IN" -> any;
+               case "NOT_IN" -> !any;
+               case "CONTAINS_ALL" -> !missing && applied.containsAll(requested);
+               case "IS_BLANK" -> applied.isEmpty();
+               default -> !applied.isEmpty();
+            };
+            if(match)
+            {
+               result.add(id);
+               if(result.size() > MAX_RECORD_IDS)
+               {
+                  throw (new QException("Tag filter exceeds 10,000 matching record ids."));
+               }
+            }
+         }
+         if(parents.size() < 500)
+         {
+            return (result);
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/tags/TagProcesses.java

@@ -0,0 +1,316 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.tags;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType;
+import com.kingsrook.qqq.backend.core.actions.permissions.UseTablePermissionCustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLine;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLineInterface;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.Status;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QComponentType;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QFrontendComponentMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QFrontendStepMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.AbstractLoadStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.AbstractTransformStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.ExtractViaQueryStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.ProcessSummaryProviderInterface;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.StreamedETLWithFrontendProcess;
+
+/*******************************************************************************
+ ** Managed vocabulary and host bulk actions using the standard streamed ETL flow.
+ *******************************************************************************/
+public final class TagProcesses
+{
+   public static final String TAGS = "tags";
+   public static final String TARGET = "targetTagId";
+
+   /*******************************************************************************
+    ** Metadata factory.
+    *******************************************************************************/
+   private TagProcesses()
+   {
+   }
+
+   /*******************************************************************************
+    ** Vocabulary record actions, never navigation entries.
+    *******************************************************************************/
+   public static List<QProcessMetaData> management()
+   {
+      return (List.of(process(CollaborationTables.TAG, "Approve"), process(CollaborationTables.TAG, "Merge"), process(CollaborationTables.TAG, "Delete")));
+   }
+
+   /*******************************************************************************
+    ** Host record actions configured by tagActionTables.
+    *******************************************************************************/
+   public static List<QProcessMetaData> processesFor(String table)
+   {
+      return (List.of(process(table, "Add"), process(table, "Remove")));
+   }
+
+   /*******************************************************************************
+    ** Approved scoped PVS inputs and explicit selection cardinality for clients.
+    *******************************************************************************/
+   private static QProcessMetaData process(String table, String operation)
+   {
+      boolean bulk = !table.equals(CollaborationTables.TAG);
+      Map<String, Serializable> values = new HashMap<>();
+      values.put(StreamedETLWithFrontendProcess.FIELD_SOURCE_TABLE, table);
+      values.put(StreamedETLWithFrontendProcess.FIELD_DESTINATION_TABLE, table);
+      values.put(StreamedETLWithFrontendProcess.FIELD_SUPPORTS_FULL_VALIDATION, true);
+      values.put(StreamedETLWithFrontendProcess.FIELD_DO_FULL_VALIDATION, true);
+      values.put(StreamedETLWithFrontendProcess.FIELD_PREVIEW_MESSAGE, operation + " tags on the selected records.");
+      QProcessMetaData process = StreamedETLWithFrontendProcess.defineProcessMetaData(ExtractViaQueryStep.class, Review.class, Apply.class, values)
+         .withName("collaboration" + operation + "Tags" + (bulk ? "_" + table : "")).withLabel(operation + " tags").withTableName(table).withIcon(new QIcon("label"))
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.NOT_PROTECTED).withCustomPermissionChecker(bulk
+            ? UseTablePermissionCustomPermissionChecker.build(table, TablePermissionSubType.READ) : new QCodeReference(TagSecurity.class)));
+      if(bulk || operation.equals("Merge"))
+      {
+         QQueryFilter filter = bulk ? TagsService.vocabularyFilter(table) : new QQueryFilter().withCriteria("mergedIntoTagId", QCriteriaOperator.IS_BLANK);
+         filter.withCriteria("approved", QCriteriaOperator.EQUALS, true).withOrderBy(new QFilterOrderBy("usageCount", false)).withOrderBy(new QFilterOrderBy("label"));
+         QFieldMetaData field = new QFieldMetaData(bulk ? TAGS : TARGET, QFieldType.INTEGER).withLabel(bulk ? "Tags" : "Target tag")
+            .withIsRequired(true).withPossibleValueSourceName(CollaborationTables.TAG).withPossibleValueSourceFilter(filter);
+         process.withStep(0, new QFrontendStepMetaData().withName("tags").withLabel(operation + " tags").withFormField(field)
+            .withComponent(new QFrontendComponentMetaData().withType(QComponentType.EDIT_FORM)
+               .withValue("multiSelectFields", new ArrayList<>(bulk ? List.of(TAGS) : List.of()))));
+      }
+      return (process);
+   }
+
+   /*******************************************************************************
+    ** Operation comes from installed metadata, never caller-supplied values.
+    *******************************************************************************/
+   private static String operation(RunBackendStepInput input)
+   {
+      return (input.getProcess().getName().substring("collaboration".length()).split("Tags")[0]);
+   }
+
+   /*******************************************************************************
+    ** PVS submissions are ids; accept serialized comma lists as well as arrays.
+    *******************************************************************************/
+   private static List<Integer> tagIds(RunBackendStepInput input) throws QException
+   {
+      Serializable value = input.getValue(TAGS);
+      Collection<?> values = value instanceof Collection<?> collection ? collection : java.util.Arrays.asList(value == null ? new String[0] : value.toString().split(","));
+      List<Integer> ids = new ArrayList<>();
+      try
+      {
+         for(Object id : values)
+         {
+            ids.add(Integer.valueOf(id.toString().strip()));
+         }
+      }
+      catch(NumberFormatException expected)
+      {
+         throw (new QException("Pick at least one approved tag."));
+      }
+      if(ids.isEmpty())
+      {
+         throw (new QException("Pick at least one approved tag."));
+      }
+      return (ids.stream().distinct().toList());
+   }
+
+   /*******************************************************************************
+    ** Shared renderer for Review and Result language.
+    *******************************************************************************/
+   private static ProcessSummaryLine line(Status status, String future, String past)
+   {
+      ProcessSummaryLine line = new ProcessSummaryLine(status, 0, null);
+      line.setSingularFutureMessage(future);
+      line.setPluralFutureMessage(future);
+      line.setSingularPastMessage(past);
+      line.setPluralPastMessage(past);
+      return (line);
+   }
+
+   /*******************************************************************************
+    ** Validate each record without mutation, reporting affected and unchanged rows.
+    *******************************************************************************/
+   public static class Review extends AbstractTransformStep implements ProcessSummaryProviderInterface
+   {
+      private ProcessSummaryLine selected;
+      private final ProcessSummaryLine skipped = line(Status.WARNING, "records cannot be processed (skipped)", "records skipped");
+      private final ProcessSummaryLine unchanged = line(Status.INFO, "records already in the requested tag state", "records already in the requested tag state");
+      private final ProcessSummaryLine affected = line(Status.INFO, "records will lose tag assignments", "records affected by tag deletion");
+      private final Set<String> affectedParents = new HashSet<>();
+
+      /*******************************************************************************
+       ** Parent and feature checks are made independently for every selected row.
+       *******************************************************************************/
+      @Override
+      public void runOnePage(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         String table = input.getProcess().getTableName();
+         String op = operation(input);
+         boolean bulk = !table.equals(CollaborationTables.TAG);
+         List<Integer> ids = bulk ? tagIds(input) : List.of();
+         if(selected == null)
+         {
+            selected = line(Status.OK, "records: " + op + " " + (bulk ? ids.size() + " " : "") + "tags", "records: " + op + " tags completed");
+         }
+         String key = QContext.getQInstance().getTable(table).getPrimaryKeyField();
+         TagsService service = new TagsService();
+         for(QRecord row : input.getRecords())
+         {
+            Serializable id = row.getValue(key);
+            try
+            {
+               if(bulk)
+               {
+                  ParentRecordAccess.requireFeature(table, id, "tag");
+                  service.resolve(table, ids, false);
+                  Set<Integer> present = new HashSet<>(service.tagsFor(table, id).stream().map(TagEntry::id).toList());
+                  if(op.equals("Add") ? present.containsAll(ids) : ids.stream().noneMatch(present::contains))
+                  {
+                     unchanged.incrementCountAndAddPrimaryKey(id);
+                  }
+               }
+               else
+               {
+                  TagsService.requireManage();
+                  TagsService.requireTag(id);
+                  if(op.equals("Merge"))
+                  {
+                     service.mergeTarget(id, input.getValue(TARGET));
+                  }
+                  if(op.equals("Delete"))
+                  {
+                     for(QRecord link : TagsService.links(id))
+                     {
+                        String parent = link.getValueString("tableName") + ":" + link.getValueString("recordId");
+                        if(affectedParents.add(parent))
+                        {
+                           affected.incrementCountAndAddPrimaryKey(parent);
+                        }
+                     }
+                  }
+               }
+               output.getRecords().add(row);
+               selected.incrementCountAndAddPrimaryKey(id);
+            }
+            catch(QException expected)
+            {
+               skipped.incrementCountAndAddPrimaryKey(id);
+            }
+         }
+      }
+
+      /*******************************************************************************
+       ** Review totals are cumulative over streamed pages.
+       *******************************************************************************/
+      @Override
+      public ArrayList<ProcessSummaryLineInterface> getProcessSummary(RunBackendStepOutput output, boolean isForResultScreen)
+      {
+         ArrayList<ProcessSummaryLineInterface> lines = new ArrayList<>();
+         if(selected != null)
+         {
+            selected.addSelfToListIfAnyCount(lines);
+         }
+         skipped.addSelfToListIfAnyCount(lines);
+         unchanged.addSelfToListIfAnyCount(lines);
+         affected.addSelfToListIfAnyCount(lines);
+         return (lines);
+      }
+   }
+
+   /*******************************************************************************
+    ** Execute with fresh authorization; report actual successes and failures.
+    *******************************************************************************/
+   public static class Apply extends AbstractLoadStep implements ProcessSummaryProviderInterface
+   {
+      private final ProcessSummaryLine done = line(Status.OK, "records will be processed", "records processed");
+      private final ProcessSummaryLine failed = line(Status.ERROR, "records cannot be processed", "records failed (retry required)");
+
+      /*******************************************************************************
+       ** The management service and parent service both recheck access at load time.
+       *******************************************************************************/
+      @Override
+      public void runOnePage(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         String table = input.getProcess().getTableName();
+         String key = QContext.getQInstance().getTable(table).getPrimaryKeyField();
+         TagsService service = new TagsService();
+         for(QRecord row : input.getRecords())
+         {
+            Serializable id = row.getValue(key);
+            try
+            {
+               switch(operation(input))
+               {
+                  case "Approve" -> service.approve(id);
+                  case "Merge" -> service.merge(id, input.getValue(TARGET));
+                  case "Delete" -> service.delete(id);
+                  case "Add" -> service.apply(table, id, tagIds(input), List.of());
+                  case "Remove" -> service.apply(table, id, List.of(), tagIds(input));
+                  default -> throw new QException("Unknown tag action.");
+               }
+               done.incrementCountAndAddPrimaryKey(id);
+            }
+            catch(QException expected)
+            {
+               failed.incrementCountAndAddPrimaryKey(id);
+            }
+         }
+      }
+
+      /*******************************************************************************
+       ** Result retains review skips and reports load failures separately.
+       *******************************************************************************/
+      @Override
+      public ArrayList<ProcessSummaryLineInterface> getProcessSummary(RunBackendStepOutput output, boolean isForResultScreen)
+      {
+         ArrayList<ProcessSummaryLineInterface> lines = new ArrayList<>();
+         done.addSelfToListIfAnyCount(lines);
+         failed.addSelfToListIfAnyCount(lines);
+         if(getTransformStep() instanceof Review review)
+         {
+            review.skipped.addSelfToListIfAnyCount(lines);
+         }
+         return (lines);
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/tags/TagSecurity.java

@@ -0,0 +1,104 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.tags;
+
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.actions.permissions.CustomPermissionChecker;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrCountInputInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.MetaDataWithPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+
+/*******************************************************************************
+ ** Vocabulary reads support pickers without collaboration.view. Management actions
+ ** require the explicit manage permission; direct writes must use the services.
+ *******************************************************************************/
+public class TagSecurity implements CustomPermissionChecker
+{
+   /*******************************************************************************
+    ** Restrict before query/count/aggregate and protect direct gets as well.
+    *******************************************************************************/
+   @Override
+   public void checkPermissionsThrowing(AbstractActionInput input, MetaDataWithPermissionRules metadata) throws QPermissionDeniedException
+   {
+      if(metadata instanceof QProcessMetaData)
+      {
+         TagsService.requireManage();
+         return;
+      }
+      if(input instanceof InsertInput || input instanceof UpdateInput || input instanceof DeleteInput)
+      {
+         throw (new QPermissionDeniedException("Use the tag service actions."));
+      }
+      if(TagsService.canManage())
+      {
+         return;
+      }
+      String user = CollaborationSecurity.userId(QContext.getQSession());
+      if(user == null)
+      {
+         throw (new QPermissionDeniedException("Sign in to view tags."));
+      }
+      if(input instanceof QueryOrCountInputInterface query)
+      {
+         QQueryFilter original = query.getFilter();
+         QQueryFilter filter = new QQueryFilter().withCriteria("mergedIntoTagId", QCriteriaOperator.IS_BLANK)
+            .withSubFilter(new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR).withCriteria("tableName", QCriteriaOperator.IS_BLANK)
+               .withCriteria("tableName", QCriteriaOperator.IN, QContext.getQInstance().getTables().keySet().stream().filter(ParentRecordAccess::canReadTable).toList()))
+            .withSubFilter(new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR).withCriteria("approved", QCriteriaOperator.EQUALS, true)
+               .withCriteria("createdByUserId", QCriteriaOperator.EQUALS, user));
+         if(original != null)
+         {
+            filter.withSubFilter(original).withLimit(original.getLimit()).withSkip(original.getSkip());
+            filter.setOrderBys(original.getOrderBys());
+         }
+         query.setFilter(filter);
+      }
+      if(input instanceof GetInput get)
+      {
+         try
+         {
+            QRecord row = TagsService.requireTag(get.getPrimaryKey());
+            if((row.getValue("tableName") != null && !ParentRecordAccess.canReadTable(row.getValueString("tableName")))
+               || (!Boolean.TRUE.equals(row.getValueBoolean("approved")) && !user.equals(row.getValueString("createdByUserId"))))
+            {
+               throw (new QPermissionDeniedException("Tag not available."));
+            }
+         }
+         catch(QException expected)
+         {
+            throw (new QPermissionDeniedException("Tag not available."));
+         }
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/tags/TagsService.java

@@ -0,0 +1,463 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.tags;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Objects;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.activity.ActivityWriter;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qqq.backend.core.context.CapturedContext;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+
+/*******************************************************************************
+ ** Tag vocabulary and assignments. Parent authorization precedes trusted storage.
+ ** Mutations join the caller's backend transaction; the config lock serializes
+ ** service calls within this instance, as in the existing collaboration services.
+ *******************************************************************************/
+public class TagsService
+{
+   public static final String MANAGE = com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions.TAGS_MANAGE;
+
+   /*******************************************************************************
+    ** Case-independent natural key; labels retain the user's capitalization.
+    *******************************************************************************/
+   public static String normalize(String label) throws QException
+   {
+      String name = label == null ? "" : label.strip().toLowerCase(Locale.ROOT).replaceAll("(?U)\\s+", " ").strip();
+      if(name.isEmpty() || name.length() > 60)
+      {
+         throw (new QException("Tag names must contain 1 to 60 characters."));
+      }
+      return (name);
+   }
+
+   /*******************************************************************************
+    ** Global and table vocabulary; pending suggestions are private to their author.
+    *******************************************************************************/
+   public List<TagEntry> vocabulary(String table, String q, Integer limit) throws QException
+   {
+      requireTable(table);
+      QQueryFilter filter = vocabularyFilter(table).withSubFilter(new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR)
+         .withCriteria("approved", QCriteriaOperator.EQUALS, true)
+         .withCriteria("createdByUserId", QCriteriaOperator.EQUALS, PersonalRecords.currentUserId()));
+      if(q != null && !q.isBlank())
+      {
+         filter.withCriteria("name", QCriteriaOperator.CONTAINS, q.strip().toLowerCase(Locale.ROOT));
+      }
+      filter.withOrderBy(new QFilterOrderBy("usageCount", false)).withOrderBy(new QFilterOrderBy("label")).withLimit(limit == null ? 20 : Math.max(1, Math.min(100, limit)));
+      return (CollaborationRecords.query(CollaborationTables.TAG, filter).stream().map(TagsService::entry).toList());
+   }
+
+   /*******************************************************************************
+    ** Shared picker filter, also enforced when submitted values reach the service.
+    *******************************************************************************/
+   public static QQueryFilter vocabularyFilter(String table)
+   {
+      QQueryFilter scope = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR).withCriteria("tableName", QCriteriaOperator.IS_BLANK);
+      if(table != null)
+      {
+         scope.withCriteria("tableName", QCriteriaOperator.EQUALS, table);
+      }
+      return (new QQueryFilter().withCriteria("mergedIntoTagId", QCriteriaOperator.IS_BLANK).withSubFilter(scope));
+   }
+
+   /*******************************************************************************
+    ** Resolve persisted policy as system, preserving the caller and transaction.
+    ** The preferred app path supplies the APP scope when a table has several apps.
+    *******************************************************************************/
+   public String mode(String table) throws QException
+   {
+      List<String> resolved = new ArrayList<>();
+      QContext.withTemporaryContext(new CapturedContext(QContext.getQInstance(), new QSystemUserSession(), QContext.getQBackendTransaction(), null), () ->
+      {
+         String path = QContext.getQInstance().getTablePath(table);
+         String[] parts = path == null ? new String[0] : path.split("/");
+         String app = parts.length > 2 ? parts[parts.length - 2] : null;
+         for(String scope : List.of("TABLE", "APP", "INSTANCE"))
+         {
+            if(scope.equals("APP") && app == null)
+            {
+               continue;
+            }
+            QQueryFilter filter = new QQueryFilter().withCriteria("feature", QCriteriaOperator.EQUALS, "TAGS")
+               .withCriteria("scopeType", QCriteriaOperator.EQUALS, scope);
+            if(!scope.equals("INSTANCE"))
+            {
+               filter.withCriteria("scopeName", QCriteriaOperator.EQUALS, scope.equals("TABLE") ? table : app);
+            }
+            for(QRecord row : CollaborationRecords.query(CollaborationTables.FEATURE_SETTING, filter))
+            {
+               String json = row.getValueString("settings");
+               if(json != null && !json.isBlank())
+               {
+                  Object value = settingMode(json);
+                  if(value != null)
+                  {
+                     String mode = value.toString();
+                     if(!List.of("FREE", "APPROVED_ONLY").contains(mode))
+                     {
+                        throw (new QException("Invalid TAGS mode: " + mode));
+                     }
+                     resolved.add(mode);
+                     return;
+                  }
+               }
+            }
+         }
+      });
+      return (resolved.isEmpty() ? CollaborationRecords.config().getDefaultTagMode() : resolved.getFirst());
+   }
+
+   /*******************************************************************************
+    ** Invalid JSON fails closed instead of silently relaxing an approval policy.
+    *******************************************************************************/
+   private Object settingMode(String json) throws QException
+   {
+      try
+      {
+         return (JsonUtils.toObject(json, Map.class).get("mode"));
+      }
+      catch(Exception e)
+      {
+         throw (new QException("Invalid TAGS settings JSON", e));
+      }
+   }
+
+   /*******************************************************************************
+    ** Create an approved free tag or a pending suggestion. Globals require manage.
+    *******************************************************************************/
+   public TagEntry create(String table, String label, String color) throws QException
+   {
+      if(table == null)
+      {
+         requireManage();
+      }
+      else
+      {
+         ParentRecordAccess.requireTableFeature(table, "tag");
+      }
+      synchronized(CollaborationRecords.config())
+      {
+         String name = normalize(label);
+         QQueryFilter filter = new QQueryFilter().withCriteria("name", QCriteriaOperator.EQUALS, name);
+         filter.withCriteria("tableName", table == null ? QCriteriaOperator.IS_BLANK : QCriteriaOperator.EQUALS, table);
+         List<QRecord> existing = CollaborationRecords.query(CollaborationTables.TAG, filter);
+         if(!existing.isEmpty())
+         {
+            QRecord row = existing.getFirst();
+            if(row.getValue("mergedIntoTagId") != null || (!Boolean.TRUE.equals(row.getValueBoolean("approved"))
+               && !PersonalRecords.currentUserId().equals(row.getValueString("createdByUserId")) && !canManage()))
+            {
+               throw (new QException("Tag name is already reserved."));
+            }
+            return (entry(row));
+         }
+         boolean approved = table == null || canManage() || mode(table).equals("FREE");
+         return (entry(CollaborationRecords.insert(CollaborationTables.TAG, new QRecord().withValue("name", name)
+            .withValue("label", label.strip()).withValue("color", color).withValue("tableName", table).withValue("approved", approved)
+            .withValue("createdByUserId", PersonalRecords.currentUserId()).withValue("usageCount", 0))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Read chips only after resolving the canonical, visible parent key.
+    *******************************************************************************/
+   public List<TagEntry> tagsFor(String table, Serializable recordId) throws QException
+   {
+      String id = parentId(table, recordId);
+      List<Integer> ids = assignments(table, id).stream().map(row -> row.getValueInteger("tagId")).toList();
+      if(ids.isEmpty())
+      {
+         return (List.of());
+      }
+      return (CollaborationRecords.query(CollaborationTables.TAG, vocabularyFilter(table).withCriteria("id", QCriteriaOperator.IN, ids)
+         .withCriteria("approved", QCriteriaOperator.EQUALS, true).withOrderBy(new QFilterOrderBy("label"))).stream().map(TagsService::entry).toList());
+   }
+
+   /*******************************************************************************
+    ** Resolve and validate all inputs before changing assignments. Numbers are ids;
+    ** strings are labels (including numeric labels), with global matches preferred.
+    *******************************************************************************/
+   List<QRecord> resolve(String table, Collection<? extends Serializable> values, boolean createMissing) throws QException
+   {
+      Map<Integer, QRecord> result = new LinkedHashMap<>();
+      for(Serializable value : values == null ? List.<Serializable>of() : values)
+      {
+         QQueryFilter filter = vocabularyFilter(table);
+         if(value instanceof Number)
+         {
+            filter.withCriteria("id", QCriteriaOperator.EQUALS, value);
+         }
+         else
+         {
+            filter.withCriteria("name", QCriteriaOperator.EQUALS, normalize(Objects.toString(value, null)));
+         }
+         List<QRecord> matches = CollaborationRecords.query(CollaborationTables.TAG, filter.withOrderBy(new QFilterOrderBy("id")));
+         QRecord row;
+         if(matches.isEmpty())
+         {
+            if(!createMissing || value instanceof Number || !mode(table).equals("FREE"))
+            {
+               throw (new QException("Pick an approved tag (or suggest one)"));
+            }
+            row = requireTag(create(table, value.toString(), null).id());
+         }
+         else
+         {
+            row = matches.stream().filter(tag -> tag.getValue("tableName") == null).findFirst().orElse(matches.getFirst());
+         }
+         if(!Boolean.TRUE.equals(row.getValueBoolean("approved")))
+         {
+            throw (new QException("Pick an approved tag (or suggest one)"));
+         }
+         result.put(row.getValueInteger("id"), row);
+      }
+      return (new ArrayList<>(result.values()));
+   }
+
+   /*******************************************************************************
+    ** Idempotent assignment changes, with activity only for actual changes.
+    ** Tags intentionally do not notify followers.
+    *******************************************************************************/
+   public void apply(String table, Serializable recordId, Collection<? extends Serializable> add, Collection<? extends Serializable> remove) throws QException
+   {
+      ParentRecordAccess.requireFeature(table, recordId, "tag");
+      String id = parentId(table, recordId);
+      synchronized(CollaborationRecords.config())
+      {
+         List<QRecord> removals = resolve(table, remove, false);
+         List<QRecord> additions = resolve(table, add, true);
+         for(QRecord tag : removals)
+         {
+            List<QRecord> links = assignments(table, id).stream().filter(row -> Objects.equals(row.getValue("tagId"), tag.getValue("id"))).toList();
+            for(QRecord link : links)
+            {
+               CollaborationRecords.delete(CollaborationTables.RECORD_TAG, link.getValue("id"));
+               ActivityWriter.write(table, id, "UNTAGGED", "Tag removed", CollaborationTables.TAG, tag.getValueString("id"));
+            }
+            recompute(tag.getValueInteger("id"));
+         }
+         for(QRecord tag : additions)
+         {
+            if(assignments(table, id).stream().noneMatch(row -> Objects.equals(row.getValue("tagId"), tag.getValue("id"))))
+            {
+               CollaborationRecords.insert(CollaborationTables.RECORD_TAG, new QRecord().withValue("tableName", table).withValue("recordId", id)
+                  .withValue("tagId", tag.getValue("id")).withValue("createdByUserId", PersonalRecords.currentUserId()).withValue("parentDeleted", false));
+               ActivityWriter.write(table, id, "TAGGED", "Tag added", CollaborationTables.TAG, tag.getValueString("id"));
+            }
+            recompute(tag.getValueInteger("id"));
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Approval never changes an already merged alias.
+    *******************************************************************************/
+   public void approve(Serializable id) throws QException
+   {
+      requireManage();
+      synchronized(CollaborationRecords.config())
+      {
+         requireTag(id);
+         CollaborationRecords.update(CollaborationTables.TAG, new QRecord().withValue("id", id).withValue("approved", true));
+      }
+   }
+
+   /*******************************************************************************
+    ** Validate a merge before review and again before load; prevent scope loss.
+    *******************************************************************************/
+   public QRecord mergeTarget(Serializable sourceId, Serializable targetId) throws QException
+   {
+      requireManage();
+      QRecord source = requireTag(sourceId);
+      QRecord target = requireTag(targetId);
+      if(Objects.equals(source.getValue("id"), target.getValue("id")) || !Boolean.TRUE.equals(target.getValueBoolean("approved"))
+         || (target.getValue("tableName") != null && !Objects.equals(source.getValue("tableName"), target.getValue("tableName"))))
+      {
+         throw (new QException("Choose a different approved tag in the same scope or global vocabulary."));
+      }
+      return (target);
+   }
+
+   /*******************************************************************************
+    ** Move references with deduplication and retain the source as an audited alias.
+    *******************************************************************************/
+   public void merge(Serializable sourceId, Serializable targetId) throws QException
+   {
+      requireManage();
+      synchronized(CollaborationRecords.config())
+      {
+         QRecord target = mergeTarget(sourceId, targetId);
+         for(QRecord link : links(sourceId))
+         {
+            boolean duplicate = assignments(link.getValueString("tableName"), link.getValueString("recordId")).stream()
+               .anyMatch(row -> Objects.equals(row.getValue("tagId"), target.getValue("id")));
+            if(duplicate)
+            {
+               CollaborationRecords.delete(CollaborationTables.RECORD_TAG, link.getValue("id"));
+            }
+            else
+            {
+               CollaborationRecords.update(CollaborationTables.RECORD_TAG, new QRecord().withValue("id", link.getValue("id")).withValue("tagId", target.getValue("id")));
+            }
+         }
+         CollaborationRecords.update(CollaborationTables.TAG, new QRecord().withValue("id", sourceId).withValue("mergedIntoTagId", target.getValue("id")));
+         recompute(sourceId);
+         recompute(targetId);
+      }
+   }
+
+   /*******************************************************************************
+    ** Delete the vocabulary entry and its assignments through the managed action.
+    *******************************************************************************/
+   public void delete(Serializable id) throws QException
+   {
+      requireManage();
+      synchronized(CollaborationRecords.config())
+      {
+         for(QRecord link : links(id))
+         {
+            CollaborationRecords.delete(CollaborationTables.RECORD_TAG, link.getValue("id"));
+         }
+         CollaborationRecords.delete(CollaborationTables.TAG, id);
+      }
+   }
+
+   /*******************************************************************************
+    ** Trusted parent cleanup callback; the parent no longer exists to authorize.
+    *******************************************************************************/
+   public void onParentsDeleted(String table, List<? extends Serializable> ids) throws QException
+   {
+      synchronized(CollaborationRecords.config())
+      {
+         for(QRecord link : CollaborationRecords.query(CollaborationTables.RECORD_TAG, new QQueryFilter().withCriteria("tableName", QCriteriaOperator.EQUALS, table)
+            .withCriteria("recordId", QCriteriaOperator.IN, ids.stream().map(Object::toString).toList())))
+         {
+            CollaborationRecords.delete(CollaborationTables.RECORD_TAG, link.getValue("id"));
+            recompute(link.getValue("tagId"));
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Recount instead of incrementing a potentially stale denormalized value.
+    *******************************************************************************/
+   private void recompute(Serializable id) throws QException
+   {
+      CollaborationRecords.update(CollaborationTables.TAG, new QRecord().withValue("id", id).withValue("usageCount", links(id).size()));
+   }
+
+   /*******************************************************************************
+    ** Internal references used by management actions after checking manage.
+    *******************************************************************************/
+   static List<QRecord> links(Serializable id) throws QException
+   {
+      return (CollaborationRecords.query(CollaborationTables.RECORD_TAG, new QQueryFilter().withCriteria("tagId", QCriteriaOperator.EQUALS, id)));
+   }
+
+   /*******************************************************************************
+    ** Canonical assignment list for an authorized parent.
+    *******************************************************************************/
+   private List<QRecord> assignments(String table, String id) throws QException
+   {
+      return (CollaborationRecords.query(CollaborationTables.RECORD_TAG, CollaborationRecords.parent(table, id)));
+   }
+
+   /*******************************************************************************
+    ** Reject missing and merged vocabulary ids.
+    *******************************************************************************/
+   static QRecord requireTag(Serializable id) throws QException
+   {
+      List<QRecord> rows = CollaborationRecords.query(CollaborationTables.TAG, new QQueryFilter().withCriteria("id", QCriteriaOperator.EQUALS, id)
+         .withCriteria("mergedIntoTagId", QCriteriaOperator.IS_BLANK));
+      if(rows.isEmpty())
+      {
+         throw (new QNotFoundException("Tag not found"));
+      }
+      return (rows.getFirst());
+   }
+
+   /*******************************************************************************
+    ** Table reads guard vocabulary calls without needing a particular record.
+    *******************************************************************************/
+   static void requireTable(String table) throws QException
+   {
+      if(!ParentRecordAccess.canReadTable(table))
+      {
+         throw (new QNotFoundException("Not found"));
+      }
+   }
+
+   /*******************************************************************************
+    ** Canonical keys prevent aliases such as 01 from creating duplicate assignments.
+    *******************************************************************************/
+   private String parentId(String table, Serializable id) throws QException
+   {
+      return (ParentRecordAccess.requireVisibleParent(table, id).getValueString(QContext.getQInstance().getTable(table).getPrimaryKeyField()));
+   }
+
+   /*******************************************************************************
+    ** Management is an explicit permission independent of collaboration.admin.
+    *******************************************************************************/
+   static boolean canManage()
+   {
+      return (QContext.getQSession().hasPermission(MANAGE));
+   }
+
+   /*******************************************************************************
+    ** Shared action and service permission check.
+    *******************************************************************************/
+   public static void requireManage() throws QPermissionDeniedException
+   {
+      if(!canManage())
+      {
+         throw (new QPermissionDeniedException("This needs " + MANAGE + "."));
+      }
+   }
+
+   /*******************************************************************************
+    ** Public vocabulary projection.
+    *******************************************************************************/
+   private static TagEntry entry(QRecord row)
+   {
+      return (new TagEntry(row.getValueInteger("id"), row.getValueString("name"), row.getValueString("label"), row.getValueString("color"),
+         row.getValueString("tableName"), row.getValueBoolean("approved"), row.getValueInteger("usageCount")));
+   }
+}

src/main/java/com/kingsrook/qbits/collaboration/timeline/TimelineDetail.java

@@ -0,0 +1,30 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.timeline;
+
+
+/*******************************************************************************
+ ** Field-level audit change, omitted entirely when the field is hidden.
+ *******************************************************************************/
+public record TimelineDetail(String fieldName, String oldValue, String newValue, String message)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/timeline/TimelineItem.java

@@ -0,0 +1,32 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.timeline;
+
+import java.time.Instant;
+import java.util.List;
+
+/*******************************************************************************
+ ** A typed timeline event; core audits do not store a stable session user ID.
+ *******************************************************************************/
+public record TimelineItem(String kind, Long id, Instant at, String actorUserId, String actorName, String summary, List<TimelineDetail> details, String refTable, String refId)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/timeline/TimelinePage.java

@@ -0,0 +1,31 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.timeline;
+
+import java.util.List;
+
+/*******************************************************************************
+ ** Merged events and opaque descending tuple cursor.
+ *******************************************************************************/
+public record TimelinePage(List<TimelineItem> items, String nextCursor)
+{
+}

src/main/java/com/kingsrook/qbits/collaboration/timeline/TimelineService.java

@@ -0,0 +1,184 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.timeline;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.CollaborationRecords;
+import com.kingsrook.qbits.collaboration.RecordCursor;
+import com.kingsrook.qbits.collaboration.follow.FollowService;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.people.PeopleService;
+import com.kingsrook.qqq.backend.core.actions.metadata.personalization.TableMetaDataPersonalizerAction;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.metadata.personalization.TableMetaDataPersonalizerInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QInputSource;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.audits.AuditsMetaDataProvider;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Merge core audit and collaboration activity using each source's read permissions.
+ ** Audit details use the same personalized host fields as core's audit screen.
+ *******************************************************************************/
+public class TimelineService
+{
+   /*******************************************************************************
+    ** Types accepts AUDIT/ACTIVITY or individual collaboration activity type names.
+    *******************************************************************************/
+   public TimelinePage timeline(String table, Serializable recordId, String beforeCursor, Integer limit, Set<String> types) throws QException
+   {
+      String id = FollowService.canonicalId(table, recordId);
+      if(limit == null || limit < 1 || limit > 50)
+      {
+         throw (new QException("Limit must be between 1 and 50"));
+      }
+      RecordCursor before = beforeCursor == null ? null : RecordCursor.decode(beforeCursor);
+      if(before != null && before.kind().equals("COMMENT"))
+      {
+         throw (new QException("Invalid timeline cursor"));
+      }
+      List<TimelineItem> items = new ArrayList<>();
+      boolean all = types == null || types.isEmpty();
+      if(all || types.contains("ACTIVITY") || types.stream().anyMatch(type -> !type.equals("AUDIT")))
+      {
+         QQueryFilter filter = CollaborationRecords.parent(table, id).withOrderBy(new QFilterOrderBy("at", false))
+            .withOrderBy(new QFilterOrderBy("id", false)).withLimit(limit + 1);
+         if(before != null)
+         {
+            filter.withSubFilter(before.beforeFilter("at", "ACTIVITY"));
+         }
+         if(!all && !types.contains("ACTIVITY"))
+         {
+            filter.withCriteria("type", QCriteriaOperator.IN, new ArrayList<>(types));
+         }
+         for(QRecord row : CollaborationRecords.query(CollaborationTables.ACTIVITY, filter))
+         {
+            items.add(new TimelineItem("ACTIVITY", row.getValueLong("id"), row.getValueInstant("at"), row.getValueString("actorUserId"),
+               new PeopleService().displayName(row.getValueString("actorUserId")), row.getValueString("summary"), List.of(), row.getValueString("refTableName"), row.getValueString("refId")));
+         }
+      }
+      if(all || types.contains("AUDIT"))
+      {
+         items.addAll(audits(table, id, before, limit + 1));
+      }
+      items.sort(Comparator.comparing(TimelineItem::at).thenComparing(TimelineItem::kind).thenComparing(TimelineItem::id).reversed());
+      List<TimelineItem> page = items.stream().limit(limit).toList();
+      String next = items.size() > limit ? key(page.getLast()).encode() : null;
+      return (new TimelinePage(page, next));
+   }
+
+   /*******************************************************************************
+    ** Missing audit installation or denied audit permission quietly omits the stream.
+    ** Read audit headers separately so a many-detail join never truncates an event.
+    *******************************************************************************/
+   private List<TimelineItem> audits(String table, String id, RecordCursor before, Integer limit) throws QException
+   {
+      if(QContext.getQInstance().getTable(AuditsMetaDataProvider.TABLE_NAME_AUDIT) == null)
+      {
+         return (List.of());
+      }
+      try
+      {
+         List<QRecord> tables = query(AuditsMetaDataProvider.TABLE_NAME_AUDIT_TABLE, new QQueryFilter().withCriteria("name", QCriteriaOperator.EQUALS, table));
+         if(tables.isEmpty())
+         {
+            return (List.of());
+         }
+         QQueryFilter filter = new QQueryFilter().withCriteria("auditTableId", QCriteriaOperator.EQUALS, tables.getFirst().getValue("id"))
+            .withCriteria("recordId", QCriteriaOperator.EQUALS, id).withOrderBy(new QFilterOrderBy("timestamp", false))
+            .withOrderBy(new QFilterOrderBy("id", false)).withLimit(limit);
+         if(before != null)
+         {
+            filter.withSubFilter(before.beforeFilter("timestamp", "AUDIT"));
+         }
+         List<QRecord> headers = query(AuditsMetaDataProvider.TABLE_NAME_AUDIT, filter);
+         if(headers.isEmpty())
+         {
+            return (List.of());
+         }
+         TableMetaDataPersonalizerInput personalization = new TableMetaDataPersonalizerInput().withTableName(table).withInputSource(QInputSource.USER);
+         personalization.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+         QTableMetaData personalized = TableMetaDataPersonalizerAction.execute(personalization);
+         Map<Long, List<TimelineDetail>> details = new HashMap<>();
+         for(QRecord detail : query(AuditsMetaDataProvider.TABLE_NAME_AUDIT_DETAIL, new QQueryFilter()
+            .withCriteria("auditId", QCriteriaOperator.IN, headers.stream().map(row -> row.getValue("id")).toList())
+            .withOrderBy(new QFilterOrderBy("id"))))
+         {
+            String field = detail.getValueString("fieldName");
+            if(field == null || field.isBlank() || (personalized != null && personalized.getFields().containsKey(field)))
+            {
+               details.computeIfAbsent(detail.getValueLong("auditId"), ignored -> new ArrayList<>())
+                  .add(new TimelineDetail(field, detail.getValueString("oldValue"), detail.getValueString("newValue"), detail.getValueString("message")));
+            }
+         }
+         Map<Integer, String> actors = new HashMap<>();
+         for(QRecord actor : query(AuditsMetaDataProvider.TABLE_NAME_AUDIT_USER, new QQueryFilter().withCriteria("id", QCriteriaOperator.IN,
+            headers.stream().map(row -> row.getValue("auditUserId")).filter(java.util.Objects::nonNull).distinct().toList())))
+         {
+            actors.put(actor.getValueInteger("id"), actor.getValueString("name"));
+         }
+         List<TimelineItem> result = new ArrayList<>();
+         for(QRecord row : headers)
+         {
+            result.add(new TimelineItem("AUDIT", row.getValueLong("id"), row.getValueInstant("timestamp"), null, actors.get(row.getValueInteger("auditUserId")),
+               row.getValueString("message"), List.copyOf(details.getOrDefault(row.getValueLong("id"), List.of())), AuditsMetaDataProvider.TABLE_NAME_AUDIT, row.getValueString("id")));
+         }
+         return (result);
+      }
+      catch(QPermissionDeniedException expected)
+      {
+         return (List.of());
+      }
+   }
+
+   /*******************************************************************************
+    ** Explicit enforcement applies to every audit table, independent of host defaults.
+    *******************************************************************************/
+   private List<QRecord> query(String table, QQueryFilter filter) throws QException
+   {
+      QueryInput input = new QueryInput(table).withFilter(filter);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      return (new QueryAction().execute(input).getRecords());
+   }
+
+   /*******************************************************************************
+    ** Stable descending key, including equal timestamps across both streams.
+    *******************************************************************************/
+   private RecordCursor key(TimelineItem item)
+   {
+      return (new RecordCursor(item.at(), item.kind(), item.id()));
+   }
+}

src/main/java/com/kingsrook/qbits/example/ExampleExtensionQBitConfig.java

@@ -1,75 +0,0 @@
-/*******************************************************************************
- ** Configuration for the Example Extension QBit.
- *******************************************************************************/
-package com.kingsrook.qbits.example;
-
-import java.util.List;
-
-import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
-import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitConfig;
-
-
-/*******************************************************************************
- ** Configuration class for the Example Extension QBit.
- *******************************************************************************/
-public class ExampleExtensionQBitConfig implements QBitConfig
-{
-   private String  targetTableName;
-   private Boolean enableFeatureX = true;
-
-
-
-   /*******************************************************************************
-    ** Validate configuration before QBit is produced.
-    *******************************************************************************/
-   @Override
-   public void validate(QInstance qInstance, List<String> errors)
-   {
-      if(targetTableName != null && qInstance.getTable(targetTableName) == null)
-      {
-         errors.add("Target table not found: " + targetTableName);
-      }
-   }
-
-
-
-   /*******************************************************************************
-    ** Getter for targetTableName
-    *******************************************************************************/
-   public String getTargetTableName()
-   {
-      return targetTableName;
-   }
-
-
-
-   /*******************************************************************************
-    ** Fluent setter for targetTableName
-    *******************************************************************************/
-   public ExampleExtensionQBitConfig withTargetTableName(String targetTableName)
-   {
-      this.targetTableName = targetTableName;
-      return this;
-   }
-
-
-
-   /*******************************************************************************
-    ** Getter for enableFeatureX
-    *******************************************************************************/
-   public Boolean getEnableFeatureX()
-   {
-      return enableFeatureX;
-   }
-
-
-
-   /*******************************************************************************
-    ** Fluent setter for enableFeatureX
-    *******************************************************************************/
-   public ExampleExtensionQBitConfig withEnableFeatureX(Boolean enableFeatureX)
-   {
-      this.enableFeatureX = enableFeatureX;
-      return this;
-   }
-}

src/main/java/com/kingsrook/qbits/example/ExampleExtensionQBitProducer.java

@@ -1,66 +0,0 @@
-/*******************************************************************************
- ** Producer for the Example Extension QBit.
- *******************************************************************************/
-package com.kingsrook.qbits.example;
-
-import com.kingsrook.qqq.backend.core.exceptions.QException;
-import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
-import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitMetaData;
-import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitProducer;
-
-
-/*******************************************************************************
- ** Producer class for the Example Extension QBit.
- *******************************************************************************/
-public class ExampleExtensionQBitProducer implements QBitProducer
-{
-   public static final String GROUP_ID    = "com.kingsrook.qbits";
-   public static final String ARTIFACT_ID = "qbit-example-extension";
-   public static final String VERSION     = "0.1.0";
-
-   private ExampleExtensionQBitConfig config;
-
-
-
-   /*******************************************************************************
-    ** Produce this QBit into the given QInstance.
-    *******************************************************************************/
-   @Override
-   public void produce(QInstance qInstance, String namespace) throws QException
-   {
-      QBitMetaData qBitMetaData = new QBitMetaData()
-         .withGroupId(GROUP_ID)
-         .withArtifactId(ARTIFACT_ID)
-         .withVersion(VERSION)
-         .withNamespace(namespace)
-         .withConfig(config);
-
-      qInstance.addQBit(qBitMetaData);
-
-      if(config != null && config.getTargetTableName() != null)
-      {
-         applyTableCustomizations(qInstance, config.getTargetTableName());
-      }
-   }
-
-
-
-   /*******************************************************************************
-    ** Apply customizations to the target table.
-    *******************************************************************************/
-   private void applyTableCustomizations(QInstance qInstance, String tableName)
-   {
-      // Implement your extension logic here
-   }
-
-
-
-   /*******************************************************************************
-    ** Fluent setter for config
-    *******************************************************************************/
-   public ExampleExtensionQBitProducer withConfig(ExampleExtensionQBitConfig config)
-   {
-      this.config = config;
-      return this;
-   }
-}

src/main/java/com/kingsrook/qbits/example/customizers/ExampleTableCustomizer.java

@@ -1,23 +0,0 @@
-/*******************************************************************************
- ** Example table customizer.
- *******************************************************************************/
-package com.kingsrook.qbits.example.customizers;
-
-import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
-
-
-/*******************************************************************************
- ** Example table customizer that adds behavior to existing tables.
- *******************************************************************************/
-public class ExampleTableCustomizer
-{
-
-   /*******************************************************************************
-    ** Apply customizations to the given table.
-    *******************************************************************************/
-   public void customize(QTableMetaData table)
-   {
-      // Example: Add audit tracking fields
-      // table.withField(new QFieldMetaData("createdAt", QFieldType.DATE_TIME));
-   }
-}

src/test/java/com/kingsrook/qbits/collaboration/CollaborationTest.java

@@ -0,0 +1,312 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.app.CollaborationHome;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.instances.QInstanceValidator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.actions.widgets.RenderWidgetInput;
+import com.kingsrook.qqq.backend.core.model.dashboard.widgets.RawHTML;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.authentication.QAuthenticationMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.QAuthenticationType;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.audits.AuditLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.QBackendMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QAppMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitConfigValidationException;
+import com.kingsrook.qqq.backend.core.model.metadata.security.QSecurityKeyType;
+import com.kingsrook.qqq.backend.core.model.metadata.security.RecordSecurityLock;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryBackendModule;
+import com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryRecordStore;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+
+/*******************************************************************************
+ ** Phase-a metadata, real data, security and schema acceptance tests.
+ *******************************************************************************/
+class CollaborationTest
+{
+   private QInstance instance;
+   private CollaborationQBitConfig config;
+
+
+
+   /*******************************************************************************
+    ** Fresh memory-backed instance for each test.
+    *******************************************************************************/
+   @BeforeEach
+   void setUp() throws Exception
+   {
+      MemoryRecordStore.getInstance().reset();
+      instance = new QInstance();
+      instance.withInstanceDefaultAuthentication(new QAuthenticationMetaData().withName("anonymous").withType(QAuthenticationType.FULLY_ANONYMOUS));
+      instance.addBackend(new QBackendMetaData().withName("memory").withBackendType(MemoryBackendModule.class));
+      instance.setEnforcePermissionsInCoreActions(true);
+      config = new CollaborationQBitConfig().withBackendName("memory");
+      new CollaborationQBitProducer().withQBitConfig(config).produce(instance);
+      QContext.init(instance, new QSession().withUser(new com.kingsrook.qqq.backend.core.model.session.QUser().withIdReference("admin")).withPermissions(CollaborationPermissions.ADMIN));
+   }
+
+
+
+   /*******************************************************************************
+    ** Release context and memory data.
+    *******************************************************************************/
+   @AfterEach
+   void tearDown()
+   {
+      MemoryRecordStore.getInstance().reset();
+      QContext.clear();
+   }
+
+
+
+   /*******************************************************************************
+    ** Complete metadata validates and publishes the intended app and tables.
+    *******************************************************************************/
+   @Test
+   void metadataValidates() throws Exception
+   {
+      new QInstanceValidator().validate(instance);
+      assertThat(instance.getTables()).containsKeys(CollaborationTables.FEATURE_SETTING, CollaborationTables.USER);
+      assertThat(instance.getPossibleValueSources()).containsKeys(CollaborationTables.FEATURE_SETTING, CollaborationTables.USER,
+         CollaborationTables.SCOPE_TYPE, CollaborationTables.FEATURE, CollaborationTables.PERMISSION_MODE);
+      assertThat(instance.getPossibleValueSource(CollaborationTables.FEATURE).getEnumValues()).hasSize(12);
+      assertThat(instance.getApp("collaboration").getChildren()).extracting(child -> child.getName())
+         .containsExactlyInAnyOrder(CollaborationTables.COMMENT, CollaborationTables.ATTACHMENT, CollaborationTables.TAG, CollaborationTables.ACTIVITY, CollaborationTables.FEATURE_SETTING, CollaborationTables.USER);
+      assertThat(instance.getApp("collaboration").getWidgets()).containsExactly(CollaborationHome.HOME_WIDGET);
+      assertThat(instance.getWidget(CollaborationHome.HOME_WIDGET)).isNotNull();
+      assertThat(instance.getTable(CollaborationTables.FEATURE_SETTING).getAuditRules().getAuditLevel()).isEqualTo(AuditLevel.FIELD);
+      assertThat(instance.getTable(CollaborationTables.FEATURE_SETTING).getUniqueKeys().getFirst().getFieldNames()).containsExactly("scopeType", "scopeName", "feature");
+      assertThat(instance.getTable(CollaborationTables.USER).getUniqueKeys().getFirst().getFieldNames()).containsExactly("userId");
+      assertThat(instance.getTable(CollaborationTables.USER).getSections()).extracting(section -> section.getName()).contains("identity", "details", "dates");
+      assertThat(instance.getQBits()).hasSize(1);
+   }
+
+
+
+   /*******************************************************************************
+    ** Required backend, defaults, setters, identity and optional placement.
+    *******************************************************************************/
+   @Test
+   void configAndProducer() throws Exception
+   {
+      assertThat(new CollaborationQBitProducer().isEnabled()).isFalse();
+      CollaborationQBitProducer producer = new CollaborationQBitProducer().withQBitConfig(config).withNamespace("collaboration");
+      assertThat(producer.isEnabled()).isTrue();
+      assertThat(producer.getQBitConfig()).isSameAs(config);
+      assertThat(producer.getNamespace()).isEqualTo("collaboration");
+      assertThat(producer.getQBitMetaData().getVersion()).isEqualTo("0.1.0");
+      assertThat(producer.getQBitMetaData().getArtifactId()).isEqualTo("qbit-collaboration");
+      assertThat(config.getDefaultBackendNameForTables()).isEqualTo("memory");
+      assertThat(config.getAdminApp()).isTrue();
+      assertThat(config.getSchedulerName()).isNull();
+      assertThatThrownBy(() -> new CollaborationQBitConfig().validate(instance)).isInstanceOf(QBitConfigValidationException.class);
+      assertThatThrownBy(() -> config.withBackendName("missing").validate(instance)).isInstanceOf(QBitConfigValidationException.class).hasMessageContaining("Unknown Collaboration backend");
+      config.setBackendName("memory");
+      config.setSchedulerName("scheduler");
+      assertThat(config.getSchedulerName()).isEqualTo("scheduler");
+      config.withSchedulerName(null);
+      config.setAppName("teamwork");
+      config.setParentAppName("admin");
+      assertThatThrownBy(() -> config.validate(instance)).isInstanceOf(QBitConfigValidationException.class).hasMessageContaining("parent app");
+      instance = new QInstance();
+      instance.withInstanceDefaultAuthentication(new QAuthenticationMetaData().withName("anonymous").withType(QAuthenticationType.FULLY_ANONYMOUS));
+      instance.addBackend(new QBackendMetaData().withName("memory").withBackendType(MemoryBackendModule.class));
+      instance.addApp(new QAppMetaData().withName("admin").withLabel("Admin").withIcon(new QIcon("settings")));
+      producer.produce(instance);
+      new QInstanceValidator().validate(instance);
+      assertThat(instance.getApp("teamwork").getParentAppName()).isEqualTo("admin");
+      assertThat(instance.getApp("admin").getChildren()).extracting(child -> child.getName()).contains("teamwork");
+      assertThatThrownBy(() -> config.withAppName(" ").validate(instance)).isInstanceOf(QBitConfigValidationException.class);
+      config.withAppName("collaboration").withParentAppName(null);
+      config.setAdminApp(false);
+      assertThat(config.getAdminApp()).isFalse();
+      config.withAdminApp(null).validate(instance);
+   }
+
+
+
+   /*******************************************************************************
+    ** Headless hosts keep the tables without app or widgets.
+    *******************************************************************************/
+   @Test
+   void headless() throws Exception
+   {
+      QInstance headless = new QInstance();
+      headless.addBackend(new QBackendMetaData().withName("memory").withBackendType(MemoryBackendModule.class));
+      new CollaborationQBitProducer().withQBitConfig(config.withAdminApp(false)).produce(headless);
+      assertThat(headless.getTables()).hasSize(13);
+      assertThat(headless.getApps()).isEmpty();
+      assertThat(headless.getWidgets()).hasSize(4);
+   }
+
+
+
+   /*******************************************************************************
+    ** Empty states explain what has not been populated.
+    *******************************************************************************/
+   @Test
+   void emptyHome() throws Exception
+   {
+      String html = CollaborationHome.render(Instant.now());
+      assertThat(html).contains("No feature settings yet: features follow the code defaults", "People known: 0", "Active in the last 7 days: 0", "No people yet");
+      RawHTML widget = (RawHTML) new CollaborationHome.HomeRenderer().render(new RenderWidgetInput()).getWidgetData();
+      assertThat(widget.getHtml()).contains("People known: 0");
+   }
+
+
+
+   /*******************************************************************************
+    ** Counts distinguish disabled settings and the inclusive seven-day window.
+    *******************************************************************************/
+   @Test
+   void realCounts() throws Exception
+   {
+      Instant now = Instant.parse("2026-10-13T12:00:00Z");
+      seed(CollaborationTables.FEATURE_SETTING,
+         setting("INSTANCE", "instance", "COMMENTS", true), setting("APP", "sales", "TAGS", true),
+         setting("TABLE", "orders", "TASKS", true), setting("TABLE", "orders", "COMMENTS", true),
+         setting("TABLE", "orders", "PRESENCE", false));
+      seed(CollaborationTables.USER, person("one", now), person("boundary", now.minus(7, ChronoUnit.DAYS)),
+         person("old", now.minus(7, ChronoUnit.DAYS).minusSeconds(1)), person("never", null), person("future", now.plusSeconds(1)));
+      String html = CollaborationHome.render(now);
+      assertThat(html).contains("INSTANCE: 1", "APP: 1", "TABLE: 2", "People known: 5", "Active in the last 7 days: 2").doesNotContain("No feature settings yet", "No people yet");
+   }
+
+
+
+   /*******************************************************************************
+    ** Enforced core actions use full custom permissions for reads and writes.
+    *******************************************************************************/
+   @Test
+   void permissions() throws Exception
+   {
+      QContext.getQSession().setPermissions(new java.util.HashSet<>());
+      assertThatThrownBy(() -> new QueryAction().execute(new QueryInput(CollaborationTables.USER))).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> CollaborationHome.render(Instant.now())).isInstanceOf(QPermissionDeniedException.class);
+      QContext.getQSession().withPermissions(CollaborationPermissions.VIEW);
+      new QueryAction().execute(new QueryInput(CollaborationTables.FEATURE_SETTING));
+      new QueryAction().execute(new QueryInput(CollaborationTables.USER));
+      assertThatThrownBy(() -> new InsertAction().execute(new InsertInput(CollaborationTables.FEATURE_SETTING).withRecords(List.of(setting("INSTANCE", "instance", "TAGS", true)))))
+         .isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> new UpdateAction().execute(new UpdateInput(CollaborationTables.FEATURE_SETTING).withRecords(List.of(new QRecord().withValue("id", 1)))))
+         .isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> new DeleteAction().execute(new DeleteInput(CollaborationTables.FEATURE_SETTING).withPrimaryKeys(List.of(1))))
+         .isInstanceOf(QPermissionDeniedException.class);
+      QContext.getQSession().withPermissions(CollaborationPermissions.ADMIN);
+      new InsertAction().execute(new InsertInput(CollaborationTables.FEATURE_SETTING).withRecords(List.of(setting("INSTANCE", "instance", "TAGS", true))));
+      assertThatThrownBy(() -> new InsertAction().execute(new InsertInput(CollaborationTables.USER).withRecords(List.of(person("denied", Instant.now())))))
+         .isInstanceOf(QPermissionDeniedException.class);
+      assertThat(CollaborationPermissions.FIELDS_MANAGE).isEqualTo("collaboration.fields.manage");
+      assertThat(CollaborationPermissions.TAGS_MANAGE).isEqualTo("collaboration.tags.manage");
+   }
+
+
+
+   /*******************************************************************************
+    ** Widget counts honor host-added row locks and enforce even with core default off.
+    *******************************************************************************/
+   @Test
+   void homeUsesCurrentSession() throws Exception
+   {
+      Instant now = Instant.now();
+      seed(CollaborationTables.USER, person("visible", now), person("hidden", now));
+      instance.addSecurityKeyType(new QSecurityKeyType().withName("person").withAllAccessKeyName("allPeople"));
+      instance.getTable(CollaborationTables.USER).withRecordSecurityLock(new RecordSecurityLock().withSecurityKeyType("person").withFieldName("userId"));
+      QContext.init(instance, new QSession().withUser(new com.kingsrook.qqq.backend.core.model.session.QUser().withIdReference("viewer")).withPermissions(CollaborationPermissions.VIEW).withSecurityKeyValue("person", "visible"));
+      assertThat(CollaborationHome.render(now)).contains("People known: 1", "Active in the last 7 days: 1");
+      instance.setEnforcePermissionsInCoreActions(false);
+      QContext.getQSession().setPermissions(new java.util.HashSet<>());
+      assertThatThrownBy(() -> new CollaborationHome.HomeRenderer().render(new RenderWidgetInput())).isInstanceOf(QPermissionDeniedException.class);
+   }
+
+
+
+   /*******************************************************************************
+    ** DDL uses metadata names, field lengths, identity, timestamps and unique keys.
+    *******************************************************************************/
+   @Test
+   void schema()
+   {
+      String ddl = CollaborationSchema.postgresScript(config);
+      assertThat(ddl).contains("CREATE TABLE IF NOT EXISTS collaboration_feature_setting", "CREATE TABLE IF NOT EXISTS collaboration_user",
+         "id INTEGER GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY", "scope_name VARCHAR(128) NOT NULL", "settings TEXT", "enabled BOOLEAN NOT NULL",
+         "last_seen_at TIMESTAMPTZ", "create_date TIMESTAMPTZ", "modify_date TIMESTAMPTZ", "avatar_url VARCHAR(2048)",
+         "CREATE UNIQUE INDEX IF NOT EXISTS uq_collaboration_feature_setting_1 ON collaboration_feature_setting (scope_type, scope_name, feature)",
+         "CREATE UNIQUE INDEX IF NOT EXISTS uq_collaboration_user_1 ON collaboration_user (user_id)");
+   }
+
+
+
+   /*******************************************************************************
+    ** Insert fixture rows as trusted service work, retaining query enforcement.
+    *******************************************************************************/
+   private void seed(String table, QRecord... records) throws Exception
+   {
+      InsertInput input = new InsertInput(table).withRecords(List.of(records));
+      input.withPermissionBypass("Test fixture simulates the future directory service");
+      assertThat(new InsertAction().execute(input).getRecords()).allSatisfy(record -> assertThat(record.getErrors()).isNullOrEmpty());
+   }
+
+
+
+   /*******************************************************************************
+    ** One feature setting.
+    *******************************************************************************/
+   private QRecord setting(String scope, String name, String feature, boolean enabled)
+   {
+      return (new QRecord().withValue("scopeType", scope).withValue("scopeName", name).withValue("feature", feature).withValue("enabled", enabled));
+   }
+
+
+
+   /*******************************************************************************
+    ** One directory person.
+    *******************************************************************************/
+   private QRecord person(String id, Instant seen)
+   {
+      return (new QRecord().withValue("userId", id).withValue("displayName", id).withValue("lastSeenAt", seen).withValue("active", true));
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/ConversationServicesTest.java

@@ -0,0 +1,532 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.time.Clock;
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.comments.CommentEntry;
+import com.kingsrook.qbits.collaboration.comments.CommentPage;
+import com.kingsrook.qbits.collaboration.comments.CommentsService;
+import com.kingsrook.qbits.collaboration.comments.MentionEntry;
+import com.kingsrook.qbits.collaboration.follow.FollowChangeBatcher;
+import com.kingsrook.qbits.collaboration.follow.FollowProcesses;
+import com.kingsrook.qbits.collaboration.follow.FollowService;
+import com.kingsrook.qbits.collaboration.follow.SendFollowDigestsProcess;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.notify.CollaborationNotification;
+import com.kingsrook.qbits.collaboration.notify.CollaborationNotifier;
+import com.kingsrook.qbits.collaboration.notify.NoOpNotifier;
+import com.kingsrook.qbits.collaboration.notify.RecordingNotifier;
+import com.kingsrook.qbits.collaboration.people.PeopleService;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qbits.collaboration.security.OtherUserAccess;
+import com.kingsrook.qbits.collaboration.security.UserSessionSupplier;
+import com.kingsrook.qqq.backend.core.actions.QBackendTransaction;
+import com.kingsrook.qqq.backend.core.actions.processes.RunProcessAction;
+import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
+import com.kingsrook.qqq.backend.core.actions.tables.GetAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.actions.tables.listeners.RecordChangeEvent;
+import com.kingsrook.qqq.backend.core.actions.tables.listeners.RecordChangeType;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.instances.QInstanceValidator;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLine;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessOutput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QUser;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.StreamedETLWithFrontendProcess;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/*******************************************************************************
+ ** Memory-backed acceptance tests exercise real permissions, actions and callbacks.
+ *******************************************************************************/
+public class ConversationServicesTest extends PersonalServiceFixture
+{
+   private static RecordingNotifier recorder;
+   private static final Map<String, QSession> sessions = new HashMap<>();
+   private final CommentsService comments = new CommentsService();
+   private final FollowService follows = new FollowService();
+
+   /*******************************************************************************
+    ** Isolated transport/session provider for each test.
+    *******************************************************************************/
+   @BeforeEach
+   void configure() throws Exception
+   {
+      recorder = new RecordingNotifier();
+      sessions.clear();
+      sessions.put("bob", session("bob", "a"));
+      sessions.put("eve", session("eve", "b"));
+      sessions.put("alice", session("alice", "a"));
+      config.withNotifier(new QCodeReference(TestNotifier.class)).withUserSessionSupplier(new QCodeReference(TestSessions.class));
+      QContext.getQSession().getUser().setFullName("Alice Example");
+      new QInstanceValidator().validate(instance);
+   }
+
+   /*******************************************************************************
+    ** Test transport configured through the actual QCodeReference loader.
+    *******************************************************************************/
+   public static class TestNotifier implements CollaborationNotifier
+   {
+      @Override
+      public void notify(CollaborationNotification n)
+      {
+         recorder.notify(n);
+      }
+   }
+
+   /*******************************************************************************
+    ** The provider returns explicit test identities with real record locks.
+    *******************************************************************************/
+   public static class TestSessions implements UserSessionSupplier
+   {
+      @Override
+      public Optional<QSession> sessionFor(String userId)
+      {
+         return (Optional.ofNullable(sessions.get(userId)));
+      }
+   }
+
+   /*******************************************************************************
+    ** Explicit read-only recipient permissions.
+    *******************************************************************************/
+   private static QSession session(String user, String tenant)
+   {
+      return (new QSession().withUser(new QUser().withIdReference(user)).withPermissions("document.read").withSecurityKeyValue("tenant", tenant));
+   }
+
+   /*******************************************************************************
+    ** Mentions are recipient safe and deduplicated.
+    *******************************************************************************/
+   @Test
+   void mentionsAreRecipientSafeAndDeduplicated() throws Exception
+   {
+      CommentEntry entry = comments.post("document", "01", "Hi @[Bob](user:bob) @[Again](user:bob) @[Eve](user:eve) @[Unknown](user:missing)", null, "title");
+      assertThat(entry.authorDisplayName()).isEqualTo("Alice Example");
+      assertThat(entry.canEdit()).isTrue();
+      assertThat(entry.canDelete()).isTrue();
+      assertThat(entry.mentions()).containsExactly(new MentionEntry("bob", true), new MentionEntry("eve", false), new MentionEntry("missing", false));
+      assertThat(recorder.notifications()).singleElement().satisfies(n ->
+      {
+         assertThat(n.recipientUserId()).isEqualTo("bob");
+         assertThat(n.category()).isEqualTo(CollaborationNotification.Category.MENTION);
+         assertThat(n.link()).isEqualTo("/app/document/1");
+         assertThat(n.sourceRecordId()).isEqualTo("1");
+      });
+      assertThat(CollaborationRecords.query(CollaborationTables.MENTION, new QQueryFilter().withCriteria("mentionedUserId", QCriteriaOperator.EQUALS, "bob")))
+         .singleElement().satisfies(mention -> assertThat(mention.getValueInstant("notifiedAt")).isNotNull());
+      assertThat(follows.followers("document", 1)).extracting(f -> f.userId()).containsExactlyInAnyOrder("alice", "bob");
+      assertThat(follows.followers("document", 1)).allSatisfy(f ->
+      {
+         assertThat(f.notifyOnComment()).isTrue();
+         assertThat(f.notifyOnChange()).isFalse();
+      });
+      comments.edit(entry.id(), "Again @[Bob](user:bob)");
+      assertThat(recorder.notifications()).hasSize(1);
+      config.withUserSessionSupplier(null);
+      CommentEntry unknown = comments.post("document", 2, "@[Bob](user:bob)", null, null);
+      assertThat(unknown.mentions()).containsExactly(new MentionEntry("bob", false));
+      assertThat(recorder.notifications()).hasSize(1);
+      assertThat(new OtherUserAccess().canRead("bob", "document", 1)).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Transactions defer delivery and recheck access.
+    *******************************************************************************/
+   @Test
+   void transactionsDeferDeliveryAndRecheckAccess() throws Exception
+   {
+      QBackendTransaction tx = new QBackendTransaction();
+      QContext.setTransaction(tx);
+      comments.post("document", 1, "@[Bob](user:bob)", null, null);
+      assertThat(recorder.notifications()).isEmpty();
+      assertThat(CollaborationRecords.query(CollaborationTables.MENTION, new QQueryFilter()).getFirst().getValueInstant("notifiedAt")).isNull();
+      tx.commit();
+      assertThat(recorder.notifications()).hasSize(1);
+      assertThat(QContext.getQSession().getUser().getIdReference()).isEqualTo("alice");
+      assertThat(QContext.getQBackendTransaction()).isSameAs(tx);
+      comments.post("document", 1, "Another @[Bob](user:bob)", null, null);
+      tx.rollback();
+      assertThat(recorder.notifications()).hasSize(1);
+      comments.post("document", 1, "Revoked @[Bob](user:bob)", null, null);
+      sessions.put("bob", session("bob", "b"));
+      tx.commit();
+      assertThat(recorder.notifications()).hasSize(1);
+      QContext.clearTransaction();
+      sessions.put("bob", session("wrong-user", "a"));
+      assertThat(new OtherUserAccess().canRead("bob", "document", 1)).isEmpty();
+      new NoOpNotifier().notify(recorder.notifications().getFirst());
+   }
+
+   /*******************************************************************************
+    ** Replies history and resolution.
+    *******************************************************************************/
+   @Test
+   void repliesHistoryAndResolution() throws Exception
+   {
+      CommentEntry root = comments.post("document", 1, "Root", null, null);
+      CommentEntry reply = comments.post("document", 1, "Reply", root.id(), null);
+      CommentEntry nested = comments.post("document", 1, "Flattened", reply.id(), null);
+      assertThat(nested.threadId()).isEqualTo(root.id());
+      assertThat(nested.parentCommentId()).isEqualTo(root.id());
+      CommentEntry edited = comments.edit(reply.id(), "Changed @[Bob](user:bob)");
+      assertThat(edited.editedAt()).isNotNull();
+      assertThat(comments.history(reply.id())).singleElement().satisfies(revision ->
+      {
+         assertThat(revision.body()).isEqualTo("Reply");
+         assertThat(revision.editedByUserId()).isEqualTo("alice");
+      });
+      comments.resolve(root.id());
+      assertThat(comments.list("document", 1, null, 20).threads().getFirst().resolved()).isTrue();
+      comments.reopen(root.id());
+      CommentEntry thread = comments.list("document", 1, null, 20).threads().getFirst();
+      assertThat(thread.resolved()).isFalse();
+      assertThat(thread.replies()).extracting(CommentEntry::id).containsExactly(reply.id(), nested.id());
+      assertThatThrownBy(() -> comments.resolve(reply.id())).hasMessageContaining("root");
+      assertThatThrownBy(() -> comments.post("document", 2, "Wrong parent", root.id(), null)).isInstanceOf(QNotFoundException.class);
+   }
+
+   /*******************************************************************************
+    ** Own delete others and moderation.
+    *******************************************************************************/
+   @Test
+   void ownDeleteOthersAndModeration() throws Exception
+   {
+      CommentEntry row = comments.post("document", 1, "Delete me", null, null);
+      login("bob");
+      assertThat(comments.history(row.id())).isEmpty();
+      assertThatThrownBy(() -> comments.delete(row.id())).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> comments.edit(row.id(), "rewrite")).isInstanceOf(QPermissionDeniedException.class);
+      admin();
+      assertThatThrownBy(() -> comments.edit(row.id(), "moderated rewrite")).isInstanceOf(QPermissionDeniedException.class);
+      comments.delete(row.id());
+      assertThat(comments.list("document", 1, null, 20).threads()).singleElement().satisfies(deleted ->
+      {
+         assertThat(deleted.body()).isNull();
+         assertThat(deleted.deleted()).isTrue();
+         assertThat(deleted.canEdit()).isFalse();
+      });
+      login("alice");
+      CommentEntry mine = comments.post("document", 1, "Own", null, null);
+      comments.delete(mine.id());
+      assertThatThrownBy(() -> comments.edit(mine.id(), "undelete")).isInstanceOf(QPermissionDeniedException.class);
+   }
+
+   /*******************************************************************************
+    ** Parent and feature permissions.
+    *******************************************************************************/
+   @Test
+   void parentAndFeaturePermissions() throws Exception
+   {
+      assertThatThrownBy(() -> comments.post("document", 3, "secret", null, null)).hasMessage("Not found");
+      assertThatThrownBy(() -> comments.list("document", 3, null, 20)).hasMessage("Not found");
+      QContext.getQSession().getPermissions().remove("document.write");
+      assertThatThrownBy(() -> comments.post("document", 1, "read only", null, null)).isInstanceOf(QPermissionDeniedException.class);
+      QContext.getQSession().withPermissions("document.comment");
+      CommentEntry row = comments.post("document", 1, "explicit grant", null, null);
+      QContext.getQSession().getPermissions().remove("document.comment");
+      assertThat(comments.list("document", 1, null, 20).threads().getFirst().canEdit()).isFalse();
+      assertThatThrownBy(() -> comments.edit(row.id(), "denied")).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> comments.resolve(row.id())).isInstanceOf(QPermissionDeniedException.class);
+      assertThat(follows.follow("document", 1, null, null).notifyOnChange()).isFalse();
+      assertThatThrownBy(() -> follows.follow("document", 3, null, null)).hasMessage("Not found");
+   }
+
+   /*******************************************************************************
+    ** Thread keyset paging uses latest activity.
+    *******************************************************************************/
+   @Test
+   void threadKeysetPagingUsesLatestActivity() throws Exception
+   {
+      CommentEntry first = comments.post("document", 1, "first", null, null);
+      CommentEntry second = comments.post("document", 1, "second", null, null);
+      Instant tie = Instant.parse("2026-01-01T00:00:00Z");
+      for(CommentEntry row : List.of(first, second))
+      {
+         CollaborationRecords.update(CollaborationTables.COMMENT, new QRecord().withValue("id", row.id()).withValue("lastActivityAt", tie));
+      }
+      CommentPage page = comments.list("document", 1, null, 1);
+      assertThat(page.threads()).extracting(CommentEntry::id).containsExactly(second.id());
+      CommentPage next = comments.list("document", 1, page.nextCursor(), 1);
+      assertThat(next.threads()).extracting(CommentEntry::id).containsExactly(first.id());
+      assertThat(next.nextCursor()).isNull();
+      comments.post("document", 1, "new reply", first.id(), null);
+      assertThat(comments.list("document", 1, null, 1).threads().getFirst().id()).isEqualTo(first.id());
+      assertThatThrownBy(() -> comments.list("document", 1, "bad!", 20)).hasMessage("Invalid cursor");
+      assertThatThrownBy(() -> comments.list("document", 1, null, 51)).hasMessageContaining("Limit");
+      assertThatThrownBy(() -> comments.post("document", 1, " ", null, null)).hasMessageContaining("body");
+      assertThatThrownBy(() -> comments.post("document", 1, "a".repeat(20001), null, null)).hasMessageContaining("body");
+      assertThatThrownBy(() -> comments.post("document", 1, "ok", null, "missing")).hasMessage("Unknown field");
+      String mentions = java.util.stream.IntStream.range(0, 51).mapToObj(i -> "@[P](user:u" + i + ")").collect(java.util.stream.Collectors.joining());
+      assertThatThrownBy(() -> comments.post("document", 1, mentions, null, null)).hasMessageContaining("50 users");
+   }
+
+   /*******************************************************************************
+    ** Follow defaults mute and unfollow.
+    *******************************************************************************/
+   @Test
+   void followDefaultsMuteAndUnfollow() throws Exception
+   {
+      assertThat(follows.state("document", 1)).isEmpty();
+      assertThat(follows.follow("document", 1, null, null)).satisfies(f ->
+      {
+         assertThat(f.reason()).isEqualTo("MANUAL");
+         assertThat(f.notifyOnChange()).isTrue();
+         assertThat(f.notifyOnComment()).isTrue();
+      });
+      follows.follow("document", 1, false, false);
+      assertThat(follows.state("document", 1).orElseThrow().notifyOnChange()).isFalse();
+      follows.ensureFollower("bob", "document", 1, "ASSIGNED");
+      assertThat(follows.followers("document", 1)).anySatisfy(f ->
+      {
+         assertThat(f.userId()).isEqualTo("bob");
+         assertThat(f.notifyOnChange()).isTrue();
+      });
+      QRecord bob = CollaborationRecords.query(CollaborationTables.FOLLOW, new QQueryFilter().withCriteria("userId", QCriteriaOperator.EQUALS, "bob")).getFirst();
+      CollaborationRecords.update(CollaborationTables.FOLLOW, new QRecord().withValue("id", bob.getValue("id")).withValue("mutedUntil", Instant.now().plusSeconds(600)));
+      comments.post("document", 1, "Muted", null, null);
+      assertThat(recorder.notifications()).isEmpty();
+      CollaborationRecords.update(CollaborationTables.FOLLOW, new QRecord().withValue("id", bob.getValue("id")).withValue("mutedUntil", Instant.EPOCH));
+      comments.post("document", 1, "Unmuted", null, null);
+      assertThat(recorder.notifications()).singleElement().satisfies(n -> assertThat(n.category()).isEqualTo(CollaborationNotification.Category.FOLLOW));
+      follows.unfollow("document", 1);
+      assertThat(follows.state("document", 1)).isEmpty();
+      follows.unfollow("document", 1);
+   }
+
+   /*******************************************************************************
+    ** People throttle search and mention ranking.
+    *******************************************************************************/
+   @Test
+   void peopleThrottleSearchAndMentionRanking() throws Exception
+   {
+      Instant at = Instant.parse("2026-01-01T00:00:00Z");
+      new PeopleService(Clock.fixed(at, ZoneOffset.UTC)).touch();
+      QContext.getQSession().getUser().setFullName("Changed Alice");
+      new PeopleService(Clock.fixed(at.plusSeconds(599), ZoneOffset.UTC)).touch();
+      assertThat(new PeopleService().search("Alice", 5)).singleElement().satisfies(p -> assertThat(p.displayName()).isEqualTo("Alice Example"));
+      new PeopleService(Clock.fixed(at.plusSeconds(600), ZoneOffset.UTC)).touch();
+      assertThat(new PeopleService().search("changed", 5)).hasSize(1);
+      login("bob");
+      new PeopleService().touch();
+      follows.follow("document", 1, null, null);
+      login("eve");
+      new PeopleService().touch();
+      login("alice");
+      QRecord eve = CollaborationRecords.query(CollaborationTables.USER, new QQueryFilter().withCriteria("userId", QCriteriaOperator.EQUALS, "eve")).getFirst();
+      CollaborationRecords.update(CollaborationTables.USER, new QRecord().withValue("id", eve.getValue("id")).withValue("email", "search@example.invalid"));
+      assertThat(new PeopleService().search("EXAMPLE.INVALID", 50)).singleElement().satisfies(p -> assertThat(p.userId()).isEqualTo("eve"));
+      assertThat(comments.mentionCandidates("document", 1, "").getFirst().person().userId()).isEqualTo("bob");
+      assertThat(comments.mentionCandidates("document", 1, "eve").getFirst().canRead()).contains(false);
+      CollaborationRecords.update(CollaborationTables.USER, new QRecord().withValue("id", eve.getValue("id")).withValue("active", false));
+      assertThat(new PeopleService().search("eve", 50)).isEmpty();
+      assertThatThrownBy(() -> new PeopleService().search("", 51)).hasMessageContaining("Limit");
+   }
+
+   /*******************************************************************************
+    ** Direct writes and parent read restrictions.
+    *******************************************************************************/
+   @Test
+   void directWritesAndParentReadRestrictions() throws Exception
+   {
+      CommentEntry row = comments.post("document", 1, "body", null, null);
+      for(String table : List.of(CollaborationTables.COMMENT, CollaborationTables.COMMENT_REVISION, CollaborationTables.MENTION, CollaborationTables.FOLLOW, CollaborationTables.ACTIVITY))
+      {
+         assertThatThrownBy(() -> new InsertAction().execute(new InsertInput(table).withRecords(List.of(new QRecord())))).isInstanceOf(QPermissionDeniedException.class);
+         assertThatThrownBy(() -> new UpdateAction().execute(new UpdateInput(table).withRecords(List.of(new QRecord().withValue("id", 1))))).isInstanceOf(QPermissionDeniedException.class);
+         assertThatThrownBy(() -> new DeleteAction().execute(new DeleteInput(table).withPrimaryKeys(List.of(1)))).isInstanceOf(QPermissionDeniedException.class);
+      }
+      login("viewer", CollaborationPermissions.VIEW);
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.COMMENT)).getRecords()).hasSize(1);
+      QContext.getQSession().getSecurityKeyValues().clear();
+      QContext.getQSession().withSecurityKeyValue("tenant", "b");
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.COMMENT)).getRecords()).isEmpty();
+      assertThat(new GetAction().execute(new GetInput(CollaborationTables.COMMENT).withPrimaryKey(row.id())).getRecord()).isNull();
+      assertThatThrownBy(() -> new QueryAction().execute(new QueryInput(CollaborationTables.FOLLOW))).isInstanceOf(QPermissionDeniedException.class);
+      QContext.getQSession().getPermissions().remove("document.read");
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.COMMENT)).getRecords()).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Batcher sends one window skips actor and rechecks access.
+    *******************************************************************************/
+   @Test
+   void batcherSendsOneWindowSkipsActorAndRechecksAccess() throws Exception
+   {
+      follows.follow("document", 1, true, true);
+      follows.ensureFollower("bob", "document", 1, "ASSIGNED");
+      Instant at = Instant.parse("2026-01-01T00:00:00Z");
+      FollowChangeBatcher batcher = new FollowChangeBatcher(Clock.fixed(at, ZoneOffset.UTC));
+      batcher.recordChange("document", "1", "alice", Set.of("title"));
+      batcher.recordChange("document", "1", "alice", Set.of("tenant"));
+      assertThat(CollaborationRecords.query(CollaborationTables.FOLLOW_DIGEST, new QQueryFilter())).hasSize(1);
+      admin();
+      new FollowChangeBatcher(Clock.fixed(at.plusSeconds(299), ZoneOffset.UTC)).sendDue();
+      assertThat(recorder.notifications()).isEmpty();
+      new FollowChangeBatcher(Clock.fixed(at.plusSeconds(300), ZoneOffset.UTC)).sendDue();
+      assertThat(recorder.notifications()).singleElement().satisfies(n ->
+      {
+         assertThat(n.recipientUserId()).isEqualTo("bob");
+         assertThat(n.body()).contains("title", "tenant");
+      });
+      new FollowChangeBatcher(Clock.fixed(at.plusSeconds(301), ZoneOffset.UTC)).sendDue();
+      assertThat(recorder.notifications()).hasSize(1);
+      batcher.recordChange("document", "1", "alice", Set.of("title"));
+      sessions.put("bob", session("bob", "b"));
+      new FollowChangeBatcher(Clock.fixed(at.plusSeconds(600), ZoneOffset.UTC)).sendDue();
+      assertThat(recorder.notifications()).hasSize(1);
+      assertThat(CollaborationRecords.query(CollaborationTables.FOLLOW_DIGEST, new QQueryFilter())).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Released listener defers until commit.
+    *******************************************************************************/
+   @Test
+   void releasedListenerDefersUntilCommit() throws Exception
+   {
+      config.withFollowChangeTables(List.of("document"));
+      instance.withRecordChangeListener(new QCodeReference(FollowChangeBatcher.class));
+      follows.ensureFollower("bob", "document", 1, "ASSIGNED");
+      QBackendTransaction tx = new QBackendTransaction();
+      new UpdateAction().execute(new UpdateInput("document").withTransaction(tx).withRecords(List.of(new QRecord().withValue("id", 1).withValue("title", "Updated"))));
+      assertThat(CollaborationRecords.query(CollaborationTables.FOLLOW_DIGEST, new QQueryFilter())).isEmpty();
+      tx.commit();
+      assertThat(CollaborationRecords.query(CollaborationTables.FOLLOW_DIGEST, new QQueryFilter())).hasSize(1);
+      assertThat(new FollowChangeBatcher().appliesTo("document", RecordChangeType.DELETE)).isFalse();
+      assertThat(new FollowChangeBatcher().appliesTo("other", RecordChangeType.UPDATE)).isFalse();
+      assertThatThrownBy(() -> new SendFollowDigestsProcess().run(null, null)).isInstanceOf(QPermissionDeniedException.class);
+      admin();
+      new SendFollowDigestsProcess().run(null, null);
+   }
+
+   /*******************************************************************************
+    ** Bulk follow review and result.
+    *******************************************************************************/
+   @Test
+   @SuppressWarnings("unchecked")
+   void bulkFollowReviewAndResult() throws Exception
+   {
+      FollowProcesses.processesFor("document").forEach(instance::addProcess);
+      new QInstanceValidator().validate(instance);
+      for(String name : List.of("collaborationFollow_document", "collaborationUnfollow_document"))
+      {
+         RunProcessInput input = new RunProcessInput();
+         input.setProcessName(name);
+         input.setFrontendStepBehavior(RunProcessInput.FrontendStepBehavior.BREAK);
+         input.addValue(StreamedETLWithFrontendProcess.FIELD_SOURCE_TABLE, "document");
+         input.addValue(StreamedETLWithFrontendProcess.FIELD_DESTINATION_TABLE, "document");
+         input.addValue(StreamedETLWithFrontendProcess.FIELD_DO_FULL_VALIDATION, true);
+         input.addValue("recordsParam", "recordIds");
+         input.addValue("recordIds", "1,2");
+         RunProcessOutput review = new RunProcessAction().execute(input);
+         assertThat(review.getException()).isEmpty();
+         List<ProcessSummaryLine> lines = (List<ProcessSummaryLine>) review.getValues().get(StreamedETLWithFrontendProcess.FIELD_VALIDATION_SUMMARY);
+         assertThat(lines).anySatisfy(line -> assertThat(line.getCount()).isEqualTo(2));
+         RunProcessInput go = new RunProcessInput();
+         go.setProcessName(name);
+         go.setProcessUUID(review.getProcessUUID());
+         go.setStartAfterStep(StreamedETLWithFrontendProcess.STEP_NAME_REVIEW);
+         go.setFrontendStepBehavior(RunProcessInput.FrontendStepBehavior.SKIP);
+         RunProcessOutput result = new RunProcessAction().execute(go);
+         assertThat((List<ProcessSummaryLine>) result.getValues().get(StreamedETLWithFrontendProcess.FIELD_PROCESS_SUMMARY)).anySatisfy(line -> assertThat(line.getCount()).isEqualTo(2));
+         assertThat(follows.state("document", 1).isPresent()).isEqualTo(name.contains("Follow_"));
+      }
+   }
+
+   /*******************************************************************************
+    ** Metadata schema and real home counts.
+    *******************************************************************************/
+   @Test
+   void metadataSchemaAndRealHomeCounts() throws Exception
+   {
+      var installed = new com.kingsrook.qqq.backend.core.model.metadata.QInstance()
+         .withInstanceDefaultAuthentication(new com.kingsrook.qqq.backend.core.model.metadata.authentication.QAuthenticationMetaData().withName("anonymous").withType(com.kingsrook.qqq.backend.core.model.metadata.QAuthenticationType.FULLY_ANONYMOUS));
+      installed.addBackend(instance.getBackend("memory"));
+      installed.addTable(instance.getTable("document").clone());
+      installed.addSecurityKeyType(instance.getSecurityKeyType("tenant"));
+      installed.addScheduler(new com.kingsrook.qqq.backend.core.model.metadata.scheduleing.simple.SimpleSchedulerMetaData().withName("minute"));
+      CollaborationQBitConfig configured = new CollaborationQBitConfig().withBackendName("memory").withFollowActionTables(List.of("document"))
+         .withFollowChangeTables(List.of("document")).withTagActionTables(List.of("document")).withSchedulerName("minute");
+      new CollaborationQBitProducer().withQBitConfig(configured).produce(installed);
+      assertThat(installed.getProcess("collaborationFollow_document").getLabel()).isEqualTo("Follow");
+      assertThat(installed.getProcess("collaborationUnfollow_document").getLabel()).isEqualTo("Unfollow");
+      assertThat(installed.getRecordChangeListeners()).hasSize(1);
+      assertThat(installed.getProcess("collaborationAddTags_document").getLabel()).isEqualTo("Add tags");
+      assertThat(installed.getProcess("collaborationRemoveTags_document").getLabel()).isEqualTo("Remove tags");
+      assertThat(installed.getProcess(SendFollowDigestsProcess.NAME).getSchedule().getRepeatSeconds()).isEqualTo(60);
+      assertThat(installed.getProcess(SendFollowDigestsProcess.NAME).getIsHidden()).isTrue();
+      String sql = CollaborationSchema.postgresScript(config);
+      for(String table : List.of(CollaborationTables.COMMENT, CollaborationTables.COMMENT_REVISION, CollaborationTables.MENTION,
+         CollaborationTables.FOLLOW, CollaborationTables.ACTIVITY, CollaborationTables.FOLLOW_DIGEST))
+      {
+         assertThat(sql).contains("CREATE TABLE IF NOT EXISTS " + table);
+      }
+      assertThat(sql).contains("ON collaboration_comment (table_name, record_id, create_date)", "ON collaboration_follow_digest (due_at)");
+      comments.post("document", 1, "home", null, null);
+      admin();
+      String html = com.kingsrook.qbits.collaboration.app.CollaborationHome.render(Instant.now().plusSeconds(1));
+      assertThat(html).contains("Comments this week</h3><p>1", "Open threads</h3><p>1", "Followers</h3><p>1");
+      assertThatThrownBy(() -> config.withFollowActionTables(List.of("missing")).validate(instance)).hasMessageContaining("host table");
+   }
+
+   /*******************************************************************************
+    ** Participant ranking precedes the search limit.
+    *******************************************************************************/
+   @Test
+   void participantRankingPrecedesTheSearchLimit() throws Exception
+   {
+      for(int i = 0; i < 55; i++)
+      {
+         CollaborationRecords.insert(CollaborationTables.USER, new QRecord().withValue("userId", "directory" + i)
+            .withValue("displayName", "A Person " + i).withValue("active", true));
+      }
+      login("bob");
+      QContext.getQSession().getUser().setFullName("Z Bob");
+      follows.follow("document", 1, null, null);
+      login("alice");
+      assertThat(comments.mentionCandidates("document", 1, "")).hasSize(50).first().satisfies(candidate -> assertThat(candidate.person().userId()).isEqualTo("bob"));
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/FavoritesServiceTest.java

@@ -0,0 +1,347 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.collaboration.favorites.FavoriteEntry;
+import com.kingsrook.qbits.collaboration.favorites.FavoritesService;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizerInterface;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizers;
+import com.kingsrook.qqq.backend.core.actions.tables.CountAction;
+import com.kingsrook.qqq.backend.core.actions.tables.GetAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrGetInputInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QAppMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.reporting.QReportMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+
+/*******************************************************************************
+ ** Behavioral and security acceptance for favorites, including label batching.
+ *******************************************************************************/
+class FavoritesServiceTest extends PersonalServiceFixture
+{
+   /*******************************************************************************
+    ** Both record and null-record-id targets are idempotent and append in order.
+    *******************************************************************************/
+   @Test
+   void starAndUnstarAreIdempotent() throws Exception
+   {
+      FavoritesService.star("RECORD", "document", "1");
+      FavoritesService.star("RECORD", "document", "1");
+      FavoritesService.star("TABLE", "document", null);
+      FavoritesService.star("TABLE", "document", null);
+      assertThat(FavoritesService.list()).extracting(FavoriteEntry::label).containsExactly("First document", "Documents");
+      assertThat(FavoritesService.list()).extracting(FavoriteEntry::sortOrder).containsExactly(0, 1);
+      assertThat(FavoritesService.list()).extracting(FavoriteEntry::href).containsExactly("/app/document/1/", "/app/document/");
+      FavoritesService.unstar("RECORD", "document", "1");
+      FavoritesService.unstar("RECORD", "document", "1");
+      FavoritesService.unstar("TABLE", "document", null);
+      FavoritesService.unstar("TABLE", "document", null);
+      assertThat(FavoritesService.list()).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** Missing, locked and table-denied records expose exactly the same error.
+    *******************************************************************************/
+   @Test
+   void invisibleAndMissingAreIndistinguishable() throws Exception
+   {
+      for(String id : List.of("3", "999"))
+      {
+         assertThatThrownBy(() -> FavoritesService.star("RECORD", "document", id)).isInstanceOf(QException.class).hasMessage("Not found");
+      }
+      assertThatThrownBy(() -> FavoritesService.star("TABLE", "missing", null)).hasMessage("Not found");
+      instance.setEnforcePermissionsInCoreActions(false);
+      QContext.getQSession().getPermissions().remove("document.read");
+      assertThatThrownBy(() -> FavoritesService.star("RECORD", "document", "1")).hasMessage("Not found");
+      assertThatThrownBy(() -> FavoritesService.star("TABLE", "document", null)).hasMessage("Not found");
+      assertThat(FavoritesService.list()).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** Refresh uses one query, no gets; lock changes redact both label and href.
+    *******************************************************************************/
+   @Test
+   void refreshesLabelsInOneQueryAndRedactsRevokedRecords() throws Exception
+   {
+      FavoritesService.star("RECORD", "document", "1");
+      FavoritesService.star("RECORD", "document", "2");
+      new UpdateAction().execute(new UpdateInput("document").withRecords(List.of(new QRecord().withValue("id", 1).withValue("title", "Renamed"))));
+      ReadCounter.queries = 0;
+      ReadCounter.gets = 0;
+      instance.getTable("document").withCustomizer(TableCustomizers.POST_QUERY_RECORD, new QCodeReference(ReadCounter.class));
+      assertThat(FavoritesService.list()).extracting(FavoriteEntry::label).containsExactly("Renamed", "Second document");
+      assertThat(ReadCounter.queries).isEqualTo(1);
+      assertThat(ReadCounter.gets).isZero();
+      QContext.getQSession().getSecurityKeyValues().put("tenant", List.of("b"));
+      assertThat(FavoritesService.list()).allSatisfy(entry ->
+      {
+         assertThat(entry.available()).isFalse();
+         assertThat(entry.label()).isEqualTo("Unavailable");
+         assertThat(entry.href()).isNull();
+      });
+      FavoritesService.unstar("RECORD", "document", "1");
+      assertThat(FavoritesService.list()).hasSize(1);
+   }
+
+
+
+   /*******************************************************************************
+    ** Direct table reads/writes initialize keys and enforce both sides of a lock.
+    *******************************************************************************/
+   @Test
+   void ownershipAndAdminAccess() throws Exception
+   {
+      FavoritesService.star("TABLE", "document", null);
+      Integer aliceId = FavoritesService.list().getFirst().id();
+      login("bob");
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.FAVORITE)).getRecords()).isEmpty();
+      assertThat(new GetAction().execute(new GetInput(CollaborationTables.FAVORITE).withPrimaryKey(aliceId)).getRecord()).isNull();
+      assertThat(new CountAction().execute(new CountInput(CollaborationTables.FAVORITE)).getCount()).isZero();
+      FavoritesService.star("TABLE", "document", null);
+      QRecord spoof = new QRecord().withValue("userId", "alice").withValue("targetType", "TABLE").withValue("targetName", "other").withValue("sortOrder", 0);
+      assertThat(new InsertAction().execute(new InsertInput(CollaborationTables.FAVORITE).withRecords(List.of(spoof))).getRecords().getFirst().getErrors()).isNotEmpty();
+      Integer bobId = FavoritesService.list().getFirst().id();
+      assertThat(new UpdateAction().execute(new UpdateInput(CollaborationTables.FAVORITE).withRecords(List.of(new QRecord().withValue("id", bobId).withValue("userId", "alice"))))
+         .getRecords().getFirst().getErrors()).isNotEmpty();
+      admin();
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.FAVORITE)).getRecords()).hasSize(2);
+      assertThat(FavoritesService.list()).isEmpty();
+      QContext.getQSession().getPermissions().remove(CollaborationPermissions.ADMIN);
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.FAVORITE)).getRecords()).isEmpty();
+      assertThat(QContext.getQSession().getSecurityKeyValues()).doesNotContainKey(CollaborationSecurity.KEY_USER_ALL_ACCESS);
+   }
+
+
+
+   /*******************************************************************************
+    ** Reordering validates all ownership before writing and can clear a folder.
+    *******************************************************************************/
+   @Test
+   void reorderAndFolders() throws Exception
+   {
+      FavoritesService.star("RECORD", "document", "1");
+      FavoritesService.star("RECORD", "document", "2");
+      List<Integer> ids = FavoritesService.list().stream().map(FavoriteEntry::id).toList();
+      FavoritesService.reorder(List.of(ids.get(1)), Map.of(ids.get(1), "Work"));
+      assertThat(FavoritesService.list()).extracting(FavoriteEntry::id).containsExactly(ids.get(1), ids.get(0));
+      assertThat(FavoritesService.list().getFirst().folder()).isEqualTo("Work");
+      Map<Integer, String> clear = new HashMap<>();
+      clear.put(ids.get(1), null);
+      FavoritesService.reorder(List.of(), clear);
+      assertThat(FavoritesService.list().getFirst().folder()).isNull();
+      assertThatThrownBy(() -> FavoritesService.reorder(List.of(ids.get(0), ids.get(0)), Map.of())).hasMessage("Invalid favorite ids");
+      assertThatThrownBy(() -> FavoritesService.reorder(List.of(), Map.of(ids.get(0), "x".repeat(256)))).hasMessage("Folder is too long");
+      login("bob");
+      assertThatThrownBy(() -> FavoritesService.reorder(ids, Map.of())).hasMessage("Invalid favorite ids");
+      assertThatThrownBy(() -> FavoritesService.reorder(List.of(), Map.of(ids.get(0), "stolen"))).hasMessage("Invalid favorite ids");
+   }
+
+
+
+   /*******************************************************************************
+    ** All metadata types use their core permissions, refresh labels and redact.
+    *******************************************************************************/
+   @Test
+   void metadataTargetsAndRevocation() throws Exception
+   {
+      QPermissionRules rules = new QPermissionRules().withLevel(PermissionLevel.HAS_ACCESS_PERMISSION).withPermissionBaseName("targets");
+      instance.addApp(new QAppMetaData().withName("work").withLabel("Work").withPermissionRules(rules));
+      instance.addProcess(new QProcessMetaData().withName("document.export").withLabel("Export").withPermissionRules(rules));
+      instance.addReport(new QReportMetaData().withName("report").withLabel("Report").withPermissionRules(rules));
+      for(String type : List.of("APP", "PROCESS", "REPORT"))
+      {
+         String name = type.equals("APP") ? "work" : type.equals("PROCESS") ? "document.export" : "report";
+         assertThatThrownBy(() -> FavoritesService.star(type, name, null)).hasMessage("Not found");
+         assertThatThrownBy(() -> FavoritesService.star(type, "missing", null)).hasMessage("Not found");
+      }
+      QContext.getQSession().withPermissions("targets.hasAccess");
+      FavoritesService.star("APP", "work", null);
+      FavoritesService.star("PROCESS", "document.export", null);
+      FavoritesService.star("REPORT", "report", null);
+      FavoritesService.star("TABLE", "document", null);
+      assertThat(FavoritesService.list()).extracting(FavoriteEntry::label).containsExactly("Work", "Export", "Report", "Documents");
+      assertThat(FavoritesService.list().get(1).href()).isEqualTo("/app/document.export/");
+      instance.getApp("work").setLabel("Renamed app");
+      assertThat(FavoritesService.list().getFirst().label()).isEqualTo("Renamed app");
+      QContext.getQSession().getPermissions().clear();
+      assertThat(FavoritesService.list()).allSatisfy(entry -> assertThat(entry.label()).isEqualTo("Unavailable"));
+   }
+
+
+
+   /*******************************************************************************
+    ** Saved views are conditional on the core table and respect its row locks.
+    *******************************************************************************/
+   @Test
+   void savedViews() throws Exception
+   {
+      assertThatThrownBy(() -> FavoritesService.star("SAVED_VIEW", "7", null)).hasMessage("Not found");
+      instance.addTable(new QTableMetaData().withName("savedView").withBackendName("memory").withPrimaryKeyField("id")
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.NOT_PROTECTED))
+         .withField(new QFieldMetaData("id", QFieldType.INTEGER)).withField(new QFieldMetaData("label", QFieldType.STRING))
+         .withField(new QFieldMetaData("tableName", QFieldType.STRING)).withField(new QFieldMetaData("userId", QFieldType.STRING))
+         .withRecordLabelFormatAndFields("%s", "label").withRecordSecurityLock(CollaborationSecurity.ownerLock("userId")));
+      CollaborationSecurity.ensureSessionKeys(instance, QContext.getQSession());
+      new InsertAction().execute(new InsertInput("savedView").withRecords(List.of(new QRecord().withValue("id", 7).withValue("label", "My view")
+         .withValue("tableName", "document").withValue("userId", "alice"))));
+      FavoritesService.star("SAVED_VIEW", "7", null);
+      assertThat(FavoritesService.list().getFirst().label()).isEqualTo("My view");
+      assertThat(FavoritesService.list().getFirst().href()).isEqualTo("/app/document/savedView/7/");
+      login("bob");
+      assertThatThrownBy(() -> FavoritesService.star("SAVED_VIEW", "7", null)).hasMessage("Not found");
+      login("alice");
+      QContext.getQSession().getPermissions().remove("document.read");
+      assertThat(FavoritesService.list().getFirst().label()).isEqualTo("Unavailable");
+   }
+
+
+
+   /*******************************************************************************
+    ** Integer aliases refer to one target; arbitrary string keys are URL-encoded.
+    *******************************************************************************/
+   @Test
+   void canonicalRecordIdsAndEncodedPaths() throws Exception
+   {
+      FavoritesService.star("RECORD", "document", "01");
+      FavoritesService.star("RECORD", "document", 1);
+      assertThat(FavoritesService.list()).extracting(FavoriteEntry::recordId).containsExactly("1");
+      assertThat(FavoritesService.list().getFirst().available()).isTrue();
+      FavoritesService.unstar("RECORD", "document", "001");
+      assertThat(FavoritesService.list()).isEmpty();
+      assertThatThrownBy(() -> FavoritesService.star("RECORD", "document", "invalid")).hasMessage("Not found");
+      instance.addTable(new QTableMetaData().withName("named").withLabel("Named").withBackendName("memory").withPrimaryKeyField("id")
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.NOT_PROTECTED))
+         .withField(new QFieldMetaData("id", QFieldType.STRING)).withRecordLabelFormatAndFields("%s", "id"));
+      new InsertAction().execute(new InsertInput("named").withRecords(List.of(new QRecord().withValue("id", "a/b #?"))));
+      FavoritesService.star("RECORD", "named", "a/b #?");
+      assertThat(FavoritesService.list().getFirst().href()).isEqualTo("/app/named/a%2Fb%20%23%3F/");
+   }
+
+
+
+   /*******************************************************************************
+    ** Deletion has the same unavailable presentation as losing access.
+    *******************************************************************************/
+   @Test
+   void deletedTargetsAndCrossUserWrites() throws Exception
+   {
+      FavoritesService.star("RECORD", "document", "1");
+      FavoritesService.star("TABLE", "document", null);
+      Integer favoriteId = FavoritesService.list().getFirst().id();
+      login("bob");
+      assertThat(new UpdateAction().execute(new UpdateInput(CollaborationTables.FAVORITE)
+         .withRecords(List.of(new QRecord().withValue("id", favoriteId).withValue("folder", "stolen"))))
+         .getRecords().getFirst().getErrors()).isNotEmpty();
+      assertThat(new com.kingsrook.qqq.backend.core.actions.tables.DeleteAction().execute(
+         new com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput(CollaborationTables.FAVORITE).withPrimaryKeys(List.of(favoriteId))).getDeletedRecordCount()).isZero();
+      admin();
+      assertThatThrownBy(() -> FavoritesService.star("RECORD", "document", "3")).hasMessage("Not found");
+      login("alice");
+      PersonalRecords.delete("document", List.of(1));
+      assertThat(FavoritesService.list().getFirst().label()).isEqualTo("Unavailable");
+      instance.getTables().remove("document");
+      assertThat(FavoritesService.list()).allSatisfy(entry ->
+      {
+         assertThat(entry.available()).isFalse();
+         assertThat(entry.label()).isEqualTo("Unavailable");
+         assertThat(entry.href()).isNull();
+      });
+   }
+
+
+
+   /*******************************************************************************
+    ** Bad target shapes and anonymous callers fail before storing data.
+    *******************************************************************************/
+   @Test
+   void rejectsInvalidTargetsAndAnonymousSessions()
+   {
+      assertThatThrownBy(() -> FavoritesService.star("OTHER", "document", null)).hasMessage("Invalid target");
+      assertThatThrownBy(() -> FavoritesService.star("RECORD", "document", null)).hasMessage("Invalid target");
+      assertThatThrownBy(() -> FavoritesService.star("TABLE", "document", "1")).hasMessage("Invalid target");
+      assertThatThrownBy(() -> FavoritesService.star("TABLE", " ", null)).hasMessage("Invalid target");
+      QContext.init(instance, new QSession());
+      assertThatThrownBy(() -> FavoritesService.list()).hasMessageContaining("Sign in");
+      assertThatThrownBy(() -> new QueryAction().execute(new QueryInput(CollaborationTables.FAVORITE))).hasMessageContaining("Sign in");
+   }
+
+
+
+   /*******************************************************************************
+    ** Count actual core reads rather than assuming an implementation batches.
+    *******************************************************************************/
+   public static class ReadCounter implements TableCustomizerInterface
+   {
+      static int queries;
+      static int gets;
+
+
+
+      /*******************************************************************************
+       ** Core calls this for both get and query, after enforcing record locks.
+       *******************************************************************************/
+      @Override
+      public List<QRecord> postQuery(QueryOrGetInputInterface input, List<QRecord> rows)
+      {
+         if(input instanceof QueryInput)
+         {
+            queries++;
+         }
+         else
+         {
+            gets++;
+         }
+         return (rows);
+      }
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/PersonalServiceFixture.java

@@ -0,0 +1,124 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+
+import java.util.List;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.QAuthenticationType;
+import com.kingsrook.qqq.backend.core.model.metadata.QBackendMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.authentication.QAuthenticationMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.security.QSecurityKeyType;
+import com.kingsrook.qqq.backend.core.model.metadata.security.RecordSecurityLock;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QUser;
+import com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryBackendModule;
+import com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryRecordStore;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import static org.assertj.core.api.Assertions.assertThat;
+
+
+/*******************************************************************************
+ ** Memory-backed personal services with a real, independently locked host table.
+ *******************************************************************************/
+public abstract class PersonalServiceFixture
+{
+   protected QInstance instance;
+   protected CollaborationQBitConfig config;
+
+
+
+   /*******************************************************************************
+    ** Every test starts with two visible records and one invisible record.
+    *******************************************************************************/
+   @BeforeEach
+   public void setUp() throws Exception
+   {
+      MemoryRecordStore.getInstance().reset();
+      instance = new QInstance().withInstanceDefaultAuthentication(new QAuthenticationMetaData().withName("anonymous").withType(QAuthenticationType.FULLY_ANONYMOUS));
+      instance.addBackend(new QBackendMetaData().withName("memory").withBackendType(MemoryBackendModule.class));
+      instance.setEnforcePermissionsInCoreActions(true);
+      config = new CollaborationQBitConfig().withBackendName("memory");
+      new CollaborationQBitProducer().withQBitConfig(config).produce(instance);
+      instance.addSecurityKeyType(new QSecurityKeyType().withName("tenant").withAllAccessKeyName("allTenants"));
+      instance.addTable(new QTableMetaData().withName("document").withLabel("Documents").withBackendName("memory").withPrimaryKeyField("id")
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.READ_WRITE_PERMISSIONS))
+         .withField(new QFieldMetaData("id", QFieldType.INTEGER))
+         .withField(new QFieldMetaData("title", QFieldType.STRING))
+         .withField(new QFieldMetaData("tenant", QFieldType.STRING))
+         .withRecordLabelFormatAndFields("%s", "title")
+         .withRecordSecurityLock(new RecordSecurityLock().withFieldName("tenant").withSecurityKeyType("tenant")
+            .withLockScope(RecordSecurityLock.LockScope.READ_AND_WRITE)));
+      login("alice");
+      QContext.getQSession().withSecurityKeyValue("allTenants", true);
+      InsertInput insert = new InsertInput("document").withRecords(List.of(
+         new QRecord().withValue("id", 1).withValue("title", "First document").withValue("tenant", "a"),
+         new QRecord().withValue("id", 2).withValue("title", "Second document").withValue("tenant", "a"),
+         new QRecord().withValue("id", 3).withValue("title", "Secret document").withValue("tenant", "b")));
+      assertThat(new InsertAction().execute(insert).getRecords()).allSatisfy(row -> assertThat(row.getErrors()).isNullOrEmpty());
+      login("alice");
+   }
+
+
+
+   /*******************************************************************************
+    ** No collaboration.view grant: personal services must still work.
+    *******************************************************************************/
+   protected void login(String id, String... extraPermissions)
+   {
+      QContext.init(instance, new QSession().withUser(new QUser().withIdReference(id)).withPermissions("document.read", "document.write")
+         .withPermissions(extraPermissions).withSecurityKeyValue("tenant", "a"));
+   }
+
+
+
+   /*******************************************************************************
+    ** Admin access is independent of ordinary host-table access.
+    *******************************************************************************/
+   protected void admin()
+   {
+      login("admin", CollaborationPermissions.ADMIN);
+   }
+
+
+
+   /*******************************************************************************
+    ** No static context or memory records survive a test.
+    *******************************************************************************/
+   @AfterEach
+   public void tearDown()
+   {
+      QContext.clear();
+      MemoryRecordStore.getInstance().reset();
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/TagsServiceTest.java

@@ -0,0 +1,448 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.io.Serializable;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.collaboration.app.CollaborationHome;
+import com.kingsrook.qbits.collaboration.attachments.AttachmentCleanup;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.tags.TagEntry;
+import com.kingsrook.qbits.collaboration.tags.TagFilterTranslator;
+import com.kingsrook.qbits.collaboration.tags.TagProcesses;
+import com.kingsrook.qbits.collaboration.tags.TagsService;
+import com.kingsrook.qqq.backend.core.actions.processes.RunProcessAction;
+import com.kingsrook.qqq.backend.core.actions.tables.CountAction;
+import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
+import com.kingsrook.qqq.backend.core.actions.tables.GetAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.instances.QInstanceValidator;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLine;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessOutput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QAppMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QAppSection;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QFrontendStepMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QUser;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.StreamedETLWithFrontendProcess;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/*******************************************************************************
+ ** Real QQQ actions exercise tag permissions, persistence, processes and metadata.
+ *******************************************************************************/
+public class TagsServiceTest extends PersonalServiceFixture
+{
+   private final TagsService tags = new TagsService();
+   private final TagFilterTranslator filters = new TagFilterTranslator();
+
+   /*******************************************************************************
+    ** Natural keys are locale-independent and validate after collapsing whitespace.
+    *******************************************************************************/
+   @Test
+   void normalizationAndFreeCreate() throws Exception
+   {
+      assertThat(TagsService.normalize("  Priority:HIGH   today  ")).isEqualTo("priority:high today");
+      assertThat(TagsService.normalize("a".repeat(60))).hasSize(60);
+      assertThatThrownBy(() -> TagsService.normalize("a".repeat(61))).hasMessageContaining("60");
+      assertThatThrownBy(() -> TagsService.normalize(null)).hasMessageContaining("60");
+      assertThatThrownBy(() -> TagsService.normalize("   ")).hasMessageContaining("60");
+      TagEntry tag = tags.create("document", "Urgent", "red");
+      assertThat(tag.name()).isEqualTo("urgent");
+      assertThat(tag.label()).isEqualTo("Urgent");
+      assertThat(tag.color()).isEqualTo("red");
+      assertThat(tag.tableName()).isEqualTo("document");
+      assertThat(tag.approved()).isTrue();
+      assertThat(tag.usageCount()).isZero();
+      assertThat(tags.create("document", " urgent ", null).id()).isEqualTo(tag.id());
+   }
+
+   /*******************************************************************************
+    ** Approval-only never permits applying a pending tag, including its author.
+    *******************************************************************************/
+   @Test
+   void suggestionsAndUnknownLabels() throws Exception
+   {
+      config.withDefaultTagMode("APPROVED_ONLY");
+      TagEntry pending = tags.create("document", "Suggested", null);
+      assertThat(pending.approved()).isFalse();
+      assertThatThrownBy(() -> tags.apply("document", 1, List.of(pending.id()), List.of())).hasMessageContaining("Pick an approved tag");
+      assertThatThrownBy(() -> tags.apply("document", 1, List.of("Unknown"), List.of())).hasMessageContaining("Pick an approved tag");
+      assertThat(rows(CollaborationTables.TAG)).hasSize(1);
+      login("bob");
+      assertThat(tags.vocabulary("document", null, 20)).isEmpty();
+      assertThatThrownBy(() -> tags.create("document", "Suggested", null)).hasMessageContaining("reserved");
+      login("alice", TagsService.MANAGE);
+      assertThat(tags.create("document", "Managed", null).approved()).isTrue();
+      tags.approve(pending.id());
+      tags.apply("document", 1, List.of(pending.id()), List.of());
+      assertThat(tags.tagsFor("document", 1)).extracting(TagEntry::id).containsExactly(pending.id());
+      config.withDefaultTagMode("FREE");
+      tags.apply("document", 2, List.of("New on the fly"), List.of());
+      assertThat(tags.tagsFor("document", 2)).extracting(TagEntry::name).containsExactly("new on the fly");
+   }
+
+   /*******************************************************************************
+    ** Global vocabulary and management demand the explicit permission.
+    *******************************************************************************/
+   @Test
+   void globalsAndManagementPermissions() throws Exception
+   {
+      assertThatThrownBy(() -> tags.create(null, "Global", null)).isInstanceOf(QPermissionDeniedException.class);
+      TagEntry own = tags.create("document", "Local", null);
+      assertThatThrownBy(() -> tags.approve(own.id())).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> tags.delete(own.id())).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> tags.merge(own.id(), own.id())).isInstanceOf(QPermissionDeniedException.class);
+      login("manager", TagsService.MANAGE);
+      TagEntry global = tags.create(null, "Global", null);
+      assertThat(global.tableName()).isNull();
+      assertThat(global.approved()).isTrue();
+      assertThat(tags.vocabulary("document", "glo", null)).extracting(TagEntry::id).containsExactly(global.id());
+   }
+
+   /*******************************************************************************
+    ** Invisible parents return Not found; read-only users need an explicit grant.
+    *******************************************************************************/
+   @Test
+   void parentAndFeatureSecurity() throws Exception
+   {
+      TagEntry tag = tags.create("document", "A", null);
+      assertThatThrownBy(() -> tags.tagsFor("document", 3)).isInstanceOf(QNotFoundException.class).hasMessage("Not found");
+      assertThatThrownBy(() -> tags.apply("document", 3, List.of(tag.id()), List.of())).isInstanceOf(QNotFoundException.class);
+      QContext.init(instance, new QSession().withUser(new QUser().withIdReference("reader")).withPermissions("document.read").withSecurityKeyValue("tenant", "a"));
+      assertThatThrownBy(() -> tags.create("document", "No", null)).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> tags.apply("document", 1, List.of(tag.id()), List.of())).isInstanceOf(QPermissionDeniedException.class);
+      QContext.getQSession().withPermissions("document.tag");
+      tags.create("document", "Granted", null);
+      tags.apply("document", 1, List.of(tag.id()), List.of());
+      assertThat(tags.tagsFor("document", 1)).hasSize(1);
+      assertThatThrownBy(() -> tags.vocabulary("missing", null, 1)).isInstanceOf(QNotFoundException.class);
+      assertThatThrownBy(() -> tags.create("missing", "No", null)).isInstanceOf(QNotFoundException.class);
+   }
+
+   /*******************************************************************************
+    ** Repeated add/remove does not inflate counts or produce duplicate activity.
+    *******************************************************************************/
+   @Test
+   void idempotentAssignmentsCountsAndActivity() throws Exception
+   {
+      TagEntry tag = tags.create("document", "A", null);
+      tags.apply("document", "01", List.of(tag.id(), tag.id()), List.of());
+      tags.apply("document", 1, List.of("A"), null);
+      tags.apply("document", 2, List.of(tag.id()), List.of());
+      assertThat(rows(CollaborationTables.RECORD_TAG)).hasSize(2);
+      assertThat(tags.vocabulary("document", null, 20).getFirst().usageCount()).isEqualTo(2);
+      assertThat(rows(CollaborationTables.ACTIVITY)).extracting(row -> row.getValueString("type")).containsExactly("TAGGED", "TAGGED");
+      assertThat(rows(CollaborationTables.FOLLOW_DIGEST)).isEmpty();
+      tags.apply("document", 1, null, List.of(tag.id()));
+      tags.apply("document", 1, List.of(), List.of("A"));
+      assertThat(tags.tagsFor("document", 1)).isEmpty();
+      assertThat(tags.vocabulary("document", null, 20).getFirst().usageCount()).isEqualTo(1);
+      assertThat(rows(CollaborationTables.ACTIVITY)).hasSize(3);
+   }
+
+   /*******************************************************************************
+    ** TABLE wins over APP then INSTANCE then the code default, with caller restored.
+    *******************************************************************************/
+   @Test
+   void settingsHierarchyReadAsSystem() throws Exception
+   {
+      instance.addApp(new QAppMetaData().withName("work").withLabel("Work").withChild(instance.getTable("document")).withSection(new QAppSection().withName("main").withTables(List.of("document"))));
+      assertThat(tags.mode("document")).isEqualTo("FREE");
+      setting("INSTANCE", "*", "APPROVED_ONLY");
+      assertThat(tags.mode("document")).isEqualTo("APPROVED_ONLY");
+      setting("APP", "work", "FREE");
+      assertThat(tags.mode("document")).isEqualTo("FREE");
+      setting("TABLE", "document", "APPROVED_ONLY");
+      assertThat(tags.create("document", "Pending", null).approved()).isFalse();
+      assertThat(QContext.getQSession().getUser().getIdReference()).isEqualTo("alice");
+      assertThat(QContext.getQSession().hasPermission("collaboration.admin")).isFalse();
+   }
+
+   /*******************************************************************************
+    ** Vocabulary ordering, scope, limits and private suggestions are stable.
+    *******************************************************************************/
+   @Test
+   void vocabularyOrderingScopeAndSuggestions() throws Exception
+   {
+      TagEntry z = tags.create("document", "Zulu", null);
+      TagEntry b = tags.create("document", "Beta", null);
+      TagEntry a = tags.create("document", "Alpha", null);
+      tags.apply("document", 1, List.of(z.id()), List.of());
+      config.withDefaultTagMode("APPROVED_ONLY");
+      TagEntry pending = tags.create("document", "Mine", null);
+      login("bob");
+      tags.create("document", "Other", null);
+      login("alice");
+      assertThat(tags.vocabulary("document", null, 1000)).extracting(TagEntry::id).containsExactly(z.id(), a.id(), b.id(), pending.id());
+      assertThat(tags.vocabulary("document", " ALP ", 10)).extracting(TagEntry::id).containsExactly(a.id());
+      assertThat(tags.vocabulary("document", null, 0)).hasSize(1);
+      assertThat(tags.vocabulary("document", null, 2)).hasSize(2);
+   }
+
+   /*******************************************************************************
+    ** Merge deduplicates assignments, preserves aliases and rejects invalid scope.
+    *******************************************************************************/
+   @Test
+   void mergeDeleteAndParentCleanup() throws Exception
+   {
+      TagEntry source = tags.create("document", "Source", null);
+      TagEntry target = tags.create("document", "Target", null);
+      tags.apply("document", 1, List.of(source.id(), target.id()), List.of());
+      tags.apply("document", 2, List.of(source.id()), List.of());
+      login("manager", TagsService.MANAGE);
+      assertThatThrownBy(() -> tags.merge(source.id(), source.id())).hasMessageContaining("different");
+      TagEntry global = tags.create(null, "Global", null);
+      assertThatThrownBy(() -> tags.merge(global.id(), target.id())).hasMessageContaining("scope");
+      tags.merge(source.id(), target.id());
+      assertThat(tags.tagsFor("document", 1)).extracting(TagEntry::id).containsExactly(target.id());
+      assertThat(tags.tagsFor("document", 2)).extracting(TagEntry::id).containsExactly(target.id());
+      assertThat(tags.vocabulary("document", null, 20)).extracting(TagEntry::id).doesNotContain(source.id());
+      assertThat(rows(CollaborationTables.TAG)).filteredOn(row -> row.getValueInteger("id").equals(source.id()))
+         .singleElement().satisfies(row -> { assertThat(row.getValueInteger("usageCount")).isZero(); assertThat(row.getValueInteger("mergedIntoTagId")).isEqualTo(target.id()); });
+      assertThatThrownBy(() -> tags.create("document", "Source", null)).hasMessageContaining("reserved");
+      new DeleteAction().execute(new DeleteInput("document").withPrimaryKeys(List.of(1)));
+      new AttachmentCleanup().onParentsDeleted("document", List.of(1));
+      new AttachmentCleanup().onParentsDeleted("document", List.of(1));
+      assertThat(tags.vocabulary("document", null, 20).getFirst().usageCount()).isEqualTo(1);
+      tags.delete(target.id());
+      assertThat(rows(CollaborationTables.RECORD_TAG)).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** All translator operators use visible parent ids, with set semantics.
+    *******************************************************************************/
+   @Test
+   void translatorOperators() throws Exception
+   {
+      TagEntry a = tags.create("document", "A", null);
+      TagEntry b = tags.create("document", "B", null);
+      tags.apply("document", 1, List.of(a.id(), b.id()), List.of());
+      tags.apply("document", 2, List.of(a.id()), List.of());
+      assertThat(filters.recordIds("document", "IN", List.of("A"))).containsExactly("1", "2");
+      assertThat(filters.recordIds("document", "IN", List.of(b.id()))).containsExactly("1");
+      assertThat(filters.recordIds("document", "CONTAINS_ALL", List.of(a.id(), b.id(), a.id()))).containsExactly("1");
+      assertThat(filters.recordIds("document", "CONTAINS_ALL", List.of(a.id(), "unknown"))).isEmpty();
+      assertThat(filters.recordIds("document", "NOT_IN", List.of(b.id()))).containsExactly("2");
+      assertThat(filters.recordIds("document", "IS_NOT_BLANK", null)).containsExactly("1", "2");
+      assertThat(filters.recordIds("document", "IS_BLANK", null)).isEmpty();
+      tags.apply("document", 2, List.of(), List.of(a.id()));
+      assertThat(filters.recordIds("document", "IS_BLANK", List.of())).containsExactly("2");
+      assertThat(filters.recordIds("document", "IN", List.of())).isEmpty();
+      assertThat(filters.recordIds("document", "NOT_IN", List.of("unknown"))).containsExactly("1", "2");
+      assertThat(filters.recordIds("document", "CONTAINS_ALL", List.of())).containsExactly("1", "2");
+      assertThatThrownBy(() -> filters.recordIds("document", "LIKE", List.of())).hasMessageContaining("Unsupported");
+   }
+
+   /*******************************************************************************
+    ** Exactly 10,000 is allowed; the next matching id fails instead of truncating.
+    *******************************************************************************/
+   @Test
+   void translatorCap() throws Exception
+   {
+      List<QRecord> parents = new ArrayList<>();
+      for(int id = 4; id <= 10001; id++)
+      {
+         parents.add(new QRecord().withValue("id", id).withValue("tenant", "a"));
+      }
+      new InsertAction().execute(new InsertInput("document").withRecords(parents));
+      assertThat(filters.recordIds("document", "IS_BLANK", null)).hasSize(10000);
+      new InsertAction().execute(new InsertInput("document").withRecords(List.of(new QRecord().withValue("id", 10002).withValue("tenant", "a"))));
+      assertThatThrownBy(() -> filters.recordIds("document", "IS_BLANK", null)).hasMessageContaining("10,000");
+   }
+
+   /*******************************************************************************
+    ** Direct access cannot bypass vocabulary approval or parent lock restrictions.
+    *******************************************************************************/
+   @Test
+   void tableSecurityAndHome() throws Exception
+   {
+      TagEntry tag = tags.create("document", "<Urgent>", null);
+      tags.apply("document", 1, List.of(tag.id()), List.of());
+      config.withDefaultTagMode("APPROVED_ONLY");
+      TagEntry pending = tags.create("document", "Pending", null);
+      login("bob", "collaboration.view");
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.TAG)).getRecords()).hasSize(1);
+      assertThat(new CountAction().execute(new CountInput(CollaborationTables.TAG)).getCount()).isEqualTo(1);
+      assertThatThrownBy(() -> new GetAction().execute(new GetInput(CollaborationTables.TAG).withPrimaryKey(pending.id()))).isInstanceOf(QPermissionDeniedException.class);
+      assertThat(new GetAction().execute(new GetInput(CollaborationTables.TAG).withPrimaryKey(tag.id())).getRecord()).isNotNull();
+      assertThatThrownBy(() -> new InsertAction().execute(new InsertInput(CollaborationTables.TAG).withRecords(List.of(new QRecord())))).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> new UpdateAction().execute(new UpdateInput(CollaborationTables.TAG).withRecords(List.of(new QRecord().withValue("id", tag.id()))))).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> new DeleteAction().execute(new DeleteInput(CollaborationTables.TAG).withPrimaryKeys(List.of(tag.id())))).isInstanceOf(QPermissionDeniedException.class);
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.RECORD_TAG)).getRecords()).hasSize(1);
+      QContext.getQSession().getSecurityKeyValues().put("tenant", List.of("b"));
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.RECORD_TAG)).getRecords()).isEmpty();
+      login("manager", "collaboration.admin", TagsService.MANAGE);
+      String html = CollaborationHome.render(Instant.now());
+      assertThat(html).contains("Vocabulary size: 2", "Pending suggestions: 1", "&lt;Urgent&gt;: 1");
+      assertThat(html).doesNotContain("<Urgent>");
+   }
+
+   /*******************************************************************************
+    ** Metadata, nullable uniqueness and scoped PVS are validated together.
+    *******************************************************************************/
+   @Test
+   void schemaAndMetadata() throws Exception
+   {
+      TagProcesses.processesFor("document").forEach(instance::addProcess);
+      new QInstanceValidator().validate(instance);
+      assertThat(instance.getTable(CollaborationTables.TAG).getSearchFields()).containsExactly("label");
+      assertThat(instance.getTable(CollaborationTables.TAG).getSections()).anySatisfy(section -> assertThat(section.getLabel()).isEqualTo("Record Tags"));
+      assertThat(instance.getPossibleValueSource(CollaborationTables.TAG).getTableName()).isEqualTo(CollaborationTables.TAG);
+      QFrontendStepMetaData pick = (QFrontendStepMetaData) instance.getProcess("collaborationAddTags_document").getStep("tags");
+      assertThat(pick.getFormFields().getFirst().getPossibleValueSourceName()).isEqualTo(CollaborationTables.TAG);
+      assertThat(pick.getComponents().getFirst().getValues().get("multiSelectFields")).isEqualTo(List.of("tags"));
+      assertThat(CollaborationSchema.postgresScript(config)).contains("ON collaboration_tag (table_name, name) NULLS NOT DISTINCT", "ON collaboration_record_tag (table_name, record_id, tag_id)", "usage_count INTEGER NOT NULL", "approved BOOLEAN NOT NULL");
+      assertThatThrownBy(() -> config.withDefaultTagMode("INVALID").validate(instance)).hasMessageContaining("defaultTagMode");
+      config.withDefaultTagMode("FREE").withTagActionTables(List.of("missing"));
+      assertThatThrownBy(() -> config.validate(instance)).hasMessageContaining("host table");
+   }
+
+   /*******************************************************************************
+    ** Bulk actions execute genuine Review and Result steps with idempotent counts.
+    *******************************************************************************/
+   @Test
+   void bulkActionsReviewAndResult() throws Exception
+   {
+      TagProcesses.processesFor("document").forEach(instance::addProcess);
+      TagEntry a = tags.create("document", "A", null);
+      TagEntry b = tags.create("document", "B", null);
+      tags.apply("document", 1, List.of(a.id(), b.id()), List.of());
+      RunProcessOutput review = review("collaborationAddTags_document", "1,2", Map.of(TagProcesses.TAGS, new ArrayList<>(List.of(a.id(), b.id()))));
+      assertThat(lines(review, false)).anySatisfy(line -> { assertThat(line.getCount()).isEqualTo(2); assertThat(line.getPluralFutureMessage()).contains("Add 2 tags"); });
+      assertThat(lines(review, false)).anySatisfy(line -> { assertThat(line.getCount()).isEqualTo(1); assertThat(line.getPluralFutureMessage()).contains("already"); });
+      assertThat(tags.tagsFor("document", 2)).isEmpty();
+      assertThat(lines(finish(review), true)).anySatisfy(line -> assertThat(line.getCount()).isEqualTo(2));
+      assertThat(tags.tagsFor("document", 2)).hasSize(2);
+      finish(review("collaborationRemoveTags_document", "1,2", Map.of(TagProcesses.TAGS, a.id() + "," + b.id())));
+      assertThat(rows(CollaborationTables.RECORD_TAG)).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Management Review counts affected records; Result performs each operation.
+    *******************************************************************************/
+   @Test
+   void managementActionsReviewAndResult() throws Exception
+   {
+      config.withDefaultTagMode("APPROVED_ONLY");
+      TagEntry pending = tags.create("document", "Pending", null);
+      login("manager", TagsService.MANAGE);
+      RunProcessOutput approve = review("collaborationApproveTags", pending.id().toString(), Map.of());
+      assertThat(lines(approve, false)).anySatisfy(line -> assertThat(line.getPluralFutureMessage()).contains("Approve"));
+      finish(approve);
+      tags.apply("document", 1, List.of(pending.id()), List.of());
+      TagEntry target = tags.create("document", "Target", null);
+      RunProcessOutput merge = review("collaborationMergeTags", pending.id().toString(), Map.of(TagProcesses.TARGET, target.id()));
+      finish(merge);
+      assertThat(tags.tagsFor("document", 1)).extracting(TagEntry::id).containsExactly(target.id());
+      RunProcessOutput delete = review("collaborationDeleteTags", target.id().toString(), Map.of());
+      assertThat(lines(delete, false)).anySatisfy(line -> { assertThat(line.getCount()).isEqualTo(1); assertThat(line.getPluralFutureMessage()).contains("lose tag assignments"); });
+      assertThat(lines(finish(delete), true)).anySatisfy(line -> assertThat(line.getPluralPastMessage()).contains("processed"));
+      assertThat(tags.tagsFor("document", 1)).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Persist one scoped feature policy as a trusted fixture setup.
+    *******************************************************************************/
+   private void setting(String scope, String name, String mode) throws Exception
+   {
+      CollaborationRecords.insert(CollaborationTables.FEATURE_SETTING, new QRecord().withValue("scopeType", scope).withValue("scopeName", name)
+         .withValue("feature", "TAGS").withValue("enabled", true).withValue("settings", "{\"mode\":\"" + mode + "\"}"));
+   }
+
+   /*******************************************************************************
+    ** Inspect persistence to assert no hidden writes or duplicate activity.
+    *******************************************************************************/
+   private List<QRecord> rows(String table) throws Exception
+   {
+      return (CollaborationRecords.query(table, new QQueryFilter()));
+   }
+
+   /*******************************************************************************
+    ** Supply picker values and stop at the genuine standard Review screen.
+    *******************************************************************************/
+   private RunProcessOutput review(String name, String records, Map<String, Serializable> values) throws Exception
+   {
+      new QInstanceValidator().validate(instance);
+      RunProcessInput input = new RunProcessInput();
+      input.setProcessName(name);
+      input.addValue("testProcessName", name);
+      input.setFrontendStepBehavior(RunProcessInput.FrontendStepBehavior.BREAK);
+      input.addValue(StreamedETLWithFrontendProcess.FIELD_DO_FULL_VALIDATION, true);
+      input.addValue("recordsParam", "recordIds");
+      input.addValue("recordIds", records);
+      values.forEach(input::addValue);
+      if(instance.getProcess(name).getStep("tags") != null)
+      {
+         RunProcessOutput picker = new RunProcessAction().execute(input);
+         assertThat(picker.getException()).isEmpty();
+         input.setProcessUUID(picker.getProcessUUID());
+         input.setStartAfterStep("tags");
+      }
+      RunProcessOutput output = new RunProcessAction().execute(input);
+      assertThat(output.getException()).isEmpty();
+      return (output);
+   }
+
+   /*******************************************************************************
+    ** Resume the stored process state after Review.
+    *******************************************************************************/
+   private RunProcessOutput finish(RunProcessOutput review) throws Exception
+   {
+      RunProcessInput go = new RunProcessInput();
+      go.setProcessName((String) review.getValues().get("testProcessName"));
+      go.setProcessUUID(review.getProcessUUID());
+      go.setStartAfterStep(StreamedETLWithFrontendProcess.STEP_NAME_REVIEW);
+      go.setFrontendStepBehavior(RunProcessInput.FrontendStepBehavior.SKIP);
+      RunProcessOutput result = new RunProcessAction().execute(go);
+      assertThat(result.getException()).isEmpty();
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Summary values are supplied by the streamed process engine.
+    *******************************************************************************/
+   @SuppressWarnings("unchecked")
+   private List<ProcessSummaryLine> lines(RunProcessOutput output, boolean result)
+   {
+      return ((List<ProcessSummaryLine>) output.getValues().get(result ? StreamedETLWithFrontendProcess.FIELD_PROCESS_SUMMARY : StreamedETLWithFrontendProcess.FIELD_VALIDATION_SUMMARY));
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/TimelineServiceTest.java

@@ -0,0 +1,158 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration;
+
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.timeline.TimelineItem;
+import com.kingsrook.qbits.collaboration.timeline.TimelinePage;
+import com.kingsrook.qbits.collaboration.timeline.TimelineService;
+import com.kingsrook.qqq.backend.core.actions.metadata.personalization.TableMetaDataPersonalizerInterface;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.instances.QInstanceValidator;
+import com.kingsrook.qqq.backend.core.model.actions.metadata.personalization.TableMetaDataPersonalizerInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.audits.AuditsMetaDataProvider;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryRecordStore;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/*******************************************************************************
+ ** Core audit schemas from RC.5, merged with real activity and permission checks.
+ *******************************************************************************/
+public class TimelineServiceTest extends PersonalServiceFixture
+{
+   private final TimelineService timeline = new TimelineService();
+   private final Instant at = Instant.parse("2026-01-01T00:00:00Z");
+
+   /*******************************************************************************
+    ** Audits.
+    *******************************************************************************/
+   @BeforeEach
+   void audits() throws Exception
+   {
+      new AuditsMetaDataProvider().withRecordIdType(QFieldType.STRING).defineAll(instance, "memory", table ->
+         table.withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.READ_WRITE_PERMISSIONS)));
+      new QInstanceValidator().validate(instance);
+      seed("auditTable", new QRecord().withValue("id", 1).withValue("name", "document").withValue("label", "Documents"));
+      seed("auditUser", new QRecord().withValue("id", 1).withValue("name", "Audit Actor"));
+      for(long id = 1; id <= 3; id++)
+      {
+         seed("audit", new QRecord().withValue("id", id).withValue("auditTableId", 1).withValue("auditUserId", 1)
+            .withValue("recordId", "1").withValue("timestamp", id == 3 ? at.plusSeconds(10) : at).withValue("message", "Record changed"));
+      }
+      seed("auditDetail", new QRecord().withValue("id", 1L).withValue("auditId", 2L).withValue("fieldName", "title").withValue("oldValue", "Old").withValue("newValue", "New"));
+      seed("auditDetail", new QRecord().withValue("id", 2L).withValue("auditId", 2L).withValue("fieldName", "tenant").withValue("oldValue", "sensitive old").withValue("newValue", "sensitive new"));
+      for(int id = 1; id <= 3; id++)
+      {
+         CollaborationRecords.insert(CollaborationTables.ACTIVITY, new QRecord().withValue("id", id).withValue("tableName", "document").withValue("recordId", "1")
+            .withValue("at", id == 3 ? at.minusSeconds(10) : at).withValue("actorUserId", "alice").withValue("type", "COMMENTED")
+            .withValue("summary", "Comment added").withValue("refTableName", CollaborationTables.COMMENT).withValue("refId", "1").withValue("parentDeleted", false));
+      }
+      QContext.getQSession().withPermissions("audit.read", "auditTable.read", "auditDetail.read", "auditUser.read");
+   }
+
+   /*******************************************************************************
+    ** Seed audit-only fixture data through the memory backend, which core owns.
+    *******************************************************************************/
+   private void seed(String table, QRecord record) throws Exception
+   {
+      MemoryRecordStore.getInstance().insert(new InsertInput(table).withRecords(List.of(record)), true);
+   }
+
+   /*******************************************************************************
+    ** Merges ties and keyset pages without gaps or duplicates.
+    *******************************************************************************/
+   @Test
+   void mergesTiesAndKeysetPagesWithoutGapsOrDuplicates() throws Exception
+   {
+      TimelinePage first = timeline.timeline("document", 1, null, 2, null);
+      assertThat(first.items()).extracting(TimelineItem::kind).containsExactly("AUDIT", "AUDIT");
+      assertThat(first.items().get(1).details()).hasSize(2);
+      assertThat(first.items().get(1).actorName()).isEqualTo("Audit Actor");
+      assertThat(first.items().get(1).actorUserId()).isNull();
+      List<String> seen = new ArrayList<>();
+      String cursor = null;
+      do
+      {
+         TimelinePage page = timeline.timeline("document", 1, cursor, 1, Set.of());
+         page.items().forEach(item -> seen.add(item.kind() + ":" + item.id()));
+         cursor = page.nextCursor();
+      }
+      while(cursor != null && seen.size() < 10);
+      assertThat(seen).containsExactly("AUDIT:3", "AUDIT:2", "AUDIT:1", "ACTIVITY:2", "ACTIVITY:1", "ACTIVITY:3");
+      assertThat(timeline.timeline("document", 1, null, 50, Set.of("COMMENTED")).items()).hasSize(3);
+      assertThat(timeline.timeline("document", 1, null, 50, Set.of("AUDIT")).items()).hasSize(3);
+      assertThat(timeline.timeline("document", 2, null, 50, null).items()).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Audit read permission and hidden fields apply.
+    *******************************************************************************/
+   @Test
+   void auditReadPermissionAndHiddenFieldsApply() throws Exception
+   {
+      instance.addSupplementalCustomizer(TableMetaDataPersonalizerInterface.CUSTOMIZER_TYPE, new QCodeReference(HideTenant.class));
+      TimelinePage page = timeline.timeline("document", 1, null, 50, null);
+      assertThat(page.items().stream().flatMap(item -> item.details().stream())).singleElement().satisfies(detail ->
+      {
+         assertThat(detail.fieldName()).isEqualTo("title");
+         assertThat(detail.oldValue()).isEqualTo("Old");
+      });
+      QContext.getQSession().getPermissions().remove("audit.read");
+      instance.setEnforcePermissionsInCoreActions(false);
+      assertThat(timeline.timeline("document", 1, null, 50, null).items()).hasSize(3).allSatisfy(item -> assertThat(item.kind()).isEqualTo("ACTIVITY"));
+      assertThatThrownBy(() -> timeline.timeline("document", 3, null, 50, null)).hasMessage("Not found");
+      assertThatThrownBy(() -> timeline.timeline("document", 1, "invalid", 50, null)).hasMessage("Invalid cursor");
+      assertThatThrownBy(() -> timeline.timeline("document", 1, null, 51, null)).hasMessageContaining("Limit");
+      instance.getTables().remove("audit");
+      assertThat(timeline.timeline("document", 1, null, 50, Set.of("AUDIT")).items()).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Real personalizer boundary, like core's audit screen.
+    *******************************************************************************/
+   public static class HideTenant implements TableMetaDataPersonalizerInterface
+   {
+      @Override
+      public QTableMetaData execute(TableMetaDataPersonalizerInput input)
+      {
+         QTableMetaData result = input.getTable().clone();
+         if(result.getName().equals("document"))
+         {
+            result.getFields().remove("tenant");
+         }
+         return (result);
+      }
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/attachments/AttachmentsServiceTest.java

@@ -0,0 +1,529 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.attachments;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.net.URI;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.CollaborationSchema;
+import com.kingsrook.qbits.collaboration.PersonalServiceFixture;
+import com.kingsrook.qbits.collaboration.app.CollaborationHome;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qbits.collaboration.security.ParentRecordAccess;
+import com.kingsrook.qbits.objectstorage.api.PresignGet;
+import com.kingsrook.qbits.objectstorage.api.PutRequest;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizerInterface;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizers;
+import com.kingsrook.qqq.backend.core.actions.processes.RunProcessAction;
+import com.kingsrook.qqq.backend.core.actions.tables.CountAction;
+import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
+import com.kingsrook.qqq.backend.core.actions.tables.GetAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLine;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessOutput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.model.statusmessages.BadInputStatusMessage;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.StreamedETLWithFrontendProcess;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/*******************************************************************************
+ ** Real QQQ memory actions and parent locks, with an in-memory storage boundary.
+ *******************************************************************************/
+public class AttachmentsServiceTest extends PersonalServiceFixture
+{
+   private static AttachmentsService processService;
+   private FakeStorage storage;
+   private AttachmentsService service;
+
+   /*******************************************************************************
+    ** No Docker, network, object-storage grants or collaboration.view needed.
+    *******************************************************************************/
+   @BeforeEach
+   void attachments()
+   {
+      storage = new FakeStorage();
+      service = new AttachmentsService(config, storage);
+   }
+
+   /*******************************************************************************
+    ** Upload, metadata, newest-first list, signed download and deletion round trip.
+    *******************************************************************************/
+   @Test
+   void roundTrip() throws Exception
+   {
+      AttachmentEntry first = upload("../hello.txt", "hello");
+      AttachmentEntry second = upload("C:\\fakepath\\other.txt", "other");
+      assertThat(first.fileName()).isEqualTo("hello.txt");
+      assertThat(first.sizeBytes()).isEqualTo(5L);
+      assertThat(first.sha256()).isEqualTo("2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824");
+      assertThat(first.createdByUserId()).isEqualTo("alice");
+      assertThat(first.canDelete()).isTrue();
+      assertThat(service.list("document", "01")).extracting(AttachmentEntry::id).containsExactly(second.id(), first.id());
+      assertThat(storage.objects.values()).anySatisfy(bytes -> assertThat(new String(bytes, StandardCharsets.UTF_8)).isEqualTo("hello"));
+      assertThat(storage.lastPut.getContentType()).isEqualTo("text/plain");
+      assertThat(storage.lastPut.getContentDisposition()).isEqualTo("inline");
+      assertThat(storage.objects.keySet()).allMatch(key -> key.startsWith("collaboration/attachments/document/1/"));
+      assertThat(service.downloadUrl(first.id(), false).toString()).contains("signed.example");
+      assertThat(storage.lastGet.getTtl()).isEqualTo(Duration.ofMinutes(5));
+      assertThat(storage.lastGet.getDownloadAs()).isEqualTo("hello.txt");
+      service.downloadUrl(first.id(), true);
+      assertThat(storage.lastGet.getDownloadAs()).isNull();
+      assertThat(raw(first.id()).getValue("previewUrl")).isNull();
+      service.delete(List.of(first.id(), first.id()));
+      assertThat(storage.objects).hasSize(1);
+      assertThat(service.list("document", 1)).extracting(AttachmentEntry::id).containsExactly(second.id());
+   }
+
+   /*******************************************************************************
+    ** Both collaboration and bucket size limits are enforced while streaming.
+    *******************************************************************************/
+   @Test
+   void limitsAndExtensions() throws Exception
+   {
+      config.withDefaultMaxBytes(4L);
+      assertThatThrownBy(() -> upload("large.txt", "hello")).hasMessageContaining("size limit");
+      assertThat(storage.objects).isEmpty();
+      assertThat(service.list("document", 1)).isEmpty();
+      upload("exact.txt", "four");
+      config.withDefaultMaxBytes(100L);
+      storage.limit = 2;
+      assertThatThrownBy(() -> upload("bucket.txt", "abc")).hasMessageContaining("size limit of 2");
+      config.withBlockedExtensions(List.of(".EXE"));
+      assertThatThrownBy(() -> upload("bad.exe", "x")).hasMessageContaining("blocked");
+      assertThatThrownBy(() -> upload("..", "x")).hasMessageContaining("Invalid file name");
+      assertThatThrownBy(() -> upload(" ", "x")).hasMessageContaining("file name is required");
+      assertThatThrownBy(() -> service.upload("document", 1, "x", "x".repeat(256), stream("x"), null)).hasMessageContaining("field lengths");
+   }
+
+   /*******************************************************************************
+    ** A locked, missing or table-denied parent always gives the same Not found.
+    *******************************************************************************/
+   @Test
+   void invisibleParents() throws Exception
+   {
+      AttachmentEntry row = upload("visible.txt", "hello");
+      for(String id : List.of("3", "999", "invalid"))
+      {
+         assertThatThrownBy(() -> service.upload("document", id, "a.txt", null, stream("x"), null))
+            .isInstanceOf(QNotFoundException.class).hasMessage("Not found");
+         assertThatThrownBy(() -> service.list("document", id)).hasMessage("Not found");
+      }
+      QContext.getQSession().getSecurityKeyValues().remove("tenant");
+      assertThatThrownBy(() -> service.downloadUrl(row.id(), false)).hasMessage("Not found");
+      assertThatThrownBy(() -> service.delete(List.of(row.id()))).hasMessage("Not found");
+      QContext.getQSession().getPermissions().remove("document.read");
+      assertThatThrownBy(() -> service.list("document", 1)).hasMessage("Not found");
+      assertThatThrownBy(() -> ParentRecordAccess.requireVisibleParent("missing", 1)).hasMessage("Not found");
+      assertThatThrownBy(() -> ParentRecordAccess.requireVisibleParent(CollaborationTables.ATTACHMENT, row.id())).hasMessage("Not found");
+   }
+
+   /*******************************************************************************
+    ** Explicit attach uses the table's permission base and does not require EDIT.
+    *******************************************************************************/
+   @Test
+   void explicitAttachWithoutEdit() throws Exception
+   {
+      QContext.getQSession().getPermissions().remove("document.write");
+      assertThatThrownBy(() -> upload("denied.txt", "x")).isInstanceOf(QPermissionDeniedException.class);
+      QContext.getQSession().withPermissions("document.attach");
+      AttachmentEntry row = upload("allowed.txt", "x");
+      service.delete(List.of(row.id()));
+      instance.getTable("document").getPermissionRules().setPermissionBaseName("documents");
+      QContext.getQSession().withPermissions("documents.read", "documents.attach");
+      upload("custom-base.txt", "x");
+   }
+
+   /*******************************************************************************
+    ** Ownership, moderation, and feature revocation are independent checks.
+    *******************************************************************************/
+   @Test
+   void ownOtherAndAdmin() throws Exception
+   {
+      AttachmentEntry alice = upload("alice.txt", "a");
+      login("bob");
+      AttachmentEntry bob = upload("bob.txt", "b");
+      assertThat(service.list("document", 1)).filteredOn(row -> row.id().equals(alice.id())).extracting(AttachmentEntry::canDelete).containsExactly(false);
+      assertThatThrownBy(() -> service.delete(List.of(bob.id(), alice.id()))).isInstanceOf(QPermissionDeniedException.class);
+      assertThat(storage.objects).hasSize(2);
+      assertThatThrownBy(() -> service.rename(alice.id(), "stolen.txt", null)).isInstanceOf(QPermissionDeniedException.class);
+      QContext.getQSession().getPermissions().remove("document.write");
+      assertThatThrownBy(() -> service.delete(List.of(bob.id()))).isInstanceOf(QPermissionDeniedException.class);
+      admin();
+      QContext.getQSession().getPermissions().remove("document.write");
+      assertThat(service.rename(alice.id(), "renamed.txt", "new description").fileName()).isEqualTo("renamed.txt");
+      assertThat(service.describe(alice.id(), "").description()).isEmpty();
+      service.downloadUrl(alice.id(), false);
+      assertThat(storage.lastGet.getDownloadAs()).isEqualTo("renamed.txt");
+      service.delete(List.of(alice.id(), bob.id()));
+      assertThat(storage.objects).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Direct table writes cannot bypass authorization or the storage lifecycle.
+    *******************************************************************************/
+   @Test
+   void directWritesDeniedAndPanelBypassesBrowseGrant() throws Exception
+   {
+      AttachmentEntry row = upload("ok.txt", "x");
+      assertThatThrownBy(() -> new QueryAction().execute(new QueryInput(CollaborationTables.ATTACHMENT))).isInstanceOf(QPermissionDeniedException.class);
+      assertThat(service.list("document", 1)).hasSize(1);
+      admin();
+      assertThatThrownBy(() -> new InsertAction().execute(new InsertInput(CollaborationTables.ATTACHMENT).withRecords(List.of(new QRecord()))))
+         .isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> new UpdateAction().execute(new UpdateInput(CollaborationTables.ATTACHMENT)
+         .withRecords(List.of(new QRecord().withValue("id", row.id()).withValue("createdByUserId", "admin")))))
+         .isInstanceOf(QPermissionDeniedException.class);
+   }
+
+   /*******************************************************************************
+    ** The real pre-query hook restricts query and count, including an empty IN.
+    *******************************************************************************/
+   @Test
+   void tableReadRestrictionAndPostFiltering() throws Exception
+   {
+      AttachmentEntry visible = upload("visible.txt", "x");
+      QContext.getQSession().withSecurityKeyValue("allTenants", true);
+      service.upload("document", 3, "secret.txt", "text/plain", stream("secret"), null);
+      login("alice", CollaborationPermissions.VIEW);
+      QueryInput query = new QueryInput(CollaborationTables.ATTACHMENT);
+      assertThat(new QueryAction().execute(query).getRecords()).extracting(row -> row.getValueInteger("id")).containsExactly(visible.id());
+      assertThat(query.getFilter().toString()).contains("tableName", "document");
+      assertThat(new CountAction().execute(new CountInput(CollaborationTables.ATTACHMENT)).getCount()).isEqualTo(2);
+      int hiddenId = AttachmentRecords.query(new QQueryFilter().withCriteria("recordId", QCriteriaOperator.EQUALS, "3")).getFirst().getValueInteger("id");
+      assertThat(new GetAction().execute(new GetInput(CollaborationTables.ATTACHMENT).withPrimaryKey(hiddenId)).getRecord()).isNull();
+      QContext.getQSession().getPermissions().remove("document.read");
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.ATTACHMENT)).getRecords()).isEmpty();
+      assertThat(new CountAction().execute(new CountInput(CollaborationTables.ATTACHMENT)).getCount()).isZero();
+   }
+
+   /*******************************************************************************
+    ** Signed previews are generated only after checking visibility and stay virtual.
+    *******************************************************************************/
+   @Test
+   void previews() throws Exception
+   {
+      AttachmentEntry row = upload("photo.png", "image");
+      QRecord visible = raw(row.id());
+      QRecord hidden = new QRecord(visible).withValue("recordId", "3");
+      AttachmentPreviewCustomizer customizer = new AttachmentPreviewCustomizer();
+      List<QRecord> results = customizer.filter(List.of(visible, hidden), false, service);
+      assertThat(results).hasSize(1);
+      assertThat(storage.signatures).hasSize(2);
+      assertThat(results.getFirst().getValueString("previewUrl")).contains("signed.example");
+      assertThat(results.getFirst().getValueString("downloadUrl")).contains("signed.example");
+      assertThat(results.getFirst().getDisplayValue("downloadUrl")).isEqualTo("photo.png");
+      assertThat(results.getFirst().getDisplayValue("downloadUrl:downloadUrlDynamic")).isEqualTo(results.getFirst().getValueString("downloadUrl"));
+      assertThat(visible.getValue("previewUrl")).isNull();
+      assertThat(raw(row.id()).getValue("previewUrl")).isNull();
+      assertThatThrownBy(() -> customizer.filter(List.of(hidden), true, service)).hasMessage("Not found");
+   }
+
+   /*******************************************************************************
+    ** Review is dry, Result is actual, and authority is checked again after Review.
+    *******************************************************************************/
+   @Test
+   void deleteProcessReviewAndResult() throws Exception
+   {
+      AttachmentEntry alice = upload("alice.txt", "a");
+      login("bob");
+      AttachmentEntry bob = upload("bob.txt", "b");
+      DeleteAttachmentsProcess.Review review = new DeleteAttachmentsProcess.Review(service);
+      RunBackendStepOutput reviewed = new RunBackendStepOutput();
+      review.runOnePage(new RunBackendStepInput().withRecords(List.of(raw(alice.id()), raw(bob.id()))), reviewed);
+      assertThat(reviewed.getRecords()).extracting(row -> row.getValueInteger("id")).containsExactly(bob.id());
+      assertThat(storage.objects).hasSize(2);
+      assertThat(review.getProcessSummary(reviewed, false)).hasSize(2);
+      ProcessSummaryLine planned = (ProcessSummaryLine) review.getProcessSummary(reviewed, false).getFirst();
+      assertThat(planned.getCount()).isEqualTo(1);
+      assertThat(planned.getSingularFutureMessage()).contains("will be deleted");
+      DeleteAttachmentsProcess.Delete delete = new DeleteAttachmentsProcess.Delete(service);
+      delete.setTransformStep(review);
+      delete.runOnePage(new RunBackendStepInput().withRecords(reviewed.getRecords()), new RunBackendStepOutput());
+      assertThat(delete.getProcessSummary(new RunBackendStepOutput(), true)).hasSize(2);
+      ProcessSummaryLine result = (ProcessSummaryLine) delete.getProcessSummary(new RunBackendStepOutput(), true).getFirst();
+      assertThat(result.getSingularPastMessage()).isEqualTo("attachment deleted");
+      assertThat(result.getCount()).isEqualTo(1);
+      assertThat(storage.objects).hasSize(1);
+      delete.runOnePage(new RunBackendStepInput().withRecords(List.of(raw(alice.id()))), new RunBackendStepOutput());
+      assertThat(delete.getProcessSummary(new RunBackendStepOutput(), true)).hasSize(3);
+      assertThat(instance.getProcess(DeleteAttachmentsProcess.NAME).getLabel()).isEqualTo("Delete attachments");
+   }
+
+   /*******************************************************************************
+    ** Run the actual streamed ETL through its frontend break and resume boundary.
+    *******************************************************************************/
+   @Test
+   @SuppressWarnings("unchecked")
+   void streamedProcess() throws Exception
+   {
+      login("alice", CollaborationPermissions.VIEW);
+      AttachmentEntry row = upload("streamed.txt", "x");
+      processService = service;
+      instance.getProcess(DeleteAttachmentsProcess.NAME).getBackendStep(StreamedETLWithFrontendProcess.STEP_NAME_EXECUTE)
+         .getInputMetaData().getFieldThrowing(StreamedETLWithFrontendProcess.FIELD_LOAD_CODE).setDefaultValue(new QCodeReference(FakeDelete.class));
+      try
+      {
+         RunProcessInput start = new RunProcessInput();
+         start.setProcessName(DeleteAttachmentsProcess.NAME);
+         start.addValue("recordsParam", "recordIds");
+         start.addValue("recordIds", row.id().toString());
+         start.setFrontendStepBehavior(RunProcessInput.FrontendStepBehavior.BREAK);
+         RunProcessOutput review = new RunProcessAction().execute(start);
+         List<ProcessSummaryLine> reviewLines = (List<ProcessSummaryLine>) review.getValues().get(StreamedETLWithFrontendProcess.FIELD_VALIDATION_SUMMARY);
+         assertThat(reviewLines).anySatisfy(line ->
+         {
+            line.pickMessage(false);
+            assertThat(line.getMessage()).contains("will be deleted");
+            assertThat(line.getCount()).isEqualTo(1);
+         });
+         assertThat(storage.objects).hasSize(1);
+         RunProcessInput go = new RunProcessInput();
+         go.setProcessName(DeleteAttachmentsProcess.NAME);
+         go.setProcessUUID(review.getProcessUUID());
+         go.setStartAfterStep(StreamedETLWithFrontendProcess.STEP_NAME_REVIEW);
+         go.setFrontendStepBehavior(RunProcessInput.FrontendStepBehavior.SKIP);
+         RunProcessOutput result = new RunProcessAction().execute(go);
+         List<ProcessSummaryLine> resultLines = (List<ProcessSummaryLine>) result.getValues().get(StreamedETLWithFrontendProcess.FIELD_PROCESS_SUMMARY);
+         assertThat(resultLines).anySatisfy(line ->
+         {
+            line.pickMessage(true);
+            assertThat(line.getMessage()).isEqualTo("attachment deleted");
+            assertThat(line.getCount()).isEqualTo(1);
+         });
+         assertThat(storage.objects).isEmpty();
+         assertThat(service.list("document", 1)).isEmpty();
+      }
+      finally
+      {
+         processService = null;
+      }
+   }
+
+   /*******************************************************************************
+    ** Only storage changes in the end-to-end process test, via the normal service.
+    *******************************************************************************/
+   public static class FakeDelete extends DeleteAttachmentsProcess.Delete
+   {
+      /*******************************************************************************
+       ** Instantiated by the real process loader.
+       *******************************************************************************/
+      public FakeDelete()
+      {
+         super(processService);
+      }
+   }
+
+   /*******************************************************************************
+    ** Storage failures leave rows for retries; trusted cleanup works after parent deletion.
+    *******************************************************************************/
+   @Test
+   void failuresAndCleanup() throws Exception
+   {
+      AttachmentEntry row = upload("file.txt", "x");
+      storage.failDelete = true;
+      assertThatThrownBy(() -> service.delete(List.of(row.id()))).hasMessage("Storage unavailable");
+      assertThat(service.list("document", 1)).hasSize(1);
+      storage.failDelete = false;
+      new DeleteAction().execute(new DeleteInput("document").withPrimaryKeys(List.of(1)));
+      assertThatThrownBy(() -> service.list("document", 1)).hasMessage("Not found");
+      QContext.getQSession().getPermissions().clear();
+      AttachmentCleanup cleanup = new AttachmentCleanup(service);
+      cleanup.onParentsDeleted("document", List.of());
+      cleanup.onParentsDeleted("document", List.of(1));
+      cleanup.onParentsDeleted("document", List.of(1));
+      assertThat(storage.objects).isEmpty();
+      assertThat(AttachmentRecords.query(new QQueryFilter())).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** A rejected row compensates the put; a broken upload never creates a row.
+    *******************************************************************************/
+   @Test
+   void failedInsertAndInputStream() throws Exception
+   {
+      instance.getTable(CollaborationTables.ATTACHMENT).withCustomizer(TableCustomizers.PRE_INSERT_RECORD, new QCodeReference(RejectInsert.class));
+      assertThatThrownBy(() -> upload("long.txt", "x")).isInstanceOf(QException.class).hasMessageContaining("Could not save attachment");
+      assertThat(storage.objects).isEmpty();
+      assertThat(AttachmentRecords.query(new QQueryFilter())).isEmpty();
+      assertThatThrownBy(() -> service.upload("document", 1, "x", null, new java.io.InputStream()
+      {
+         @Override
+         public int read() throws IOException
+         {
+            throw (new IOException("broken source"));
+         }
+      }, null)).isInstanceOf(QException.class).hasMessageContaining("Could not read attachment");
+      assertThat(storage.objects).isEmpty();
+   }
+
+   /*******************************************************************************
+    ** Exercise the real QQQ per-record validation failure/compensation path.
+    *******************************************************************************/
+   public static class RejectInsert implements TableCustomizerInterface
+   {
+      @Override
+      public List<QRecord> preInsert(InsertInput input, List<QRecord> records, boolean isPreview)
+      {
+         records.forEach(row -> row.withError(new BadInputStatusMessage("Rejected by host validation")));
+         return (records);
+      }
+   }
+
+   /*******************************************************************************
+    ** Real counts and bytes on the home, with explicit approximation and empty state.
+    *******************************************************************************/
+   @Test
+   void homeAndSchema() throws Exception
+   {
+      admin();
+      assertThat(CollaborationHome.render(Instant.now())).contains("Attachments: 0", "No attachments yet.", "Total size (bytes): 0");
+      upload("a.txt", "12345");
+      upload("b.txt", "123");
+      assertThat(CollaborationHome.render(Instant.now())).contains("Attachments: 2", "Total size (bytes): 8", "Approximate totals").doesNotContain("No attachments yet.");
+      String ddl = CollaborationSchema.postgresScript(config);
+      assertThat(ddl).contains("CREATE TABLE IF NOT EXISTS collaboration_attachment", "size_bytes BIGINT", "parent_deleted BOOLEAN DEFAULT FALSE NOT NULL",
+         "ON collaboration_attachment (table_name, record_id)").doesNotContain("preview_url", "download_url");
+      QTableMetaData table = instance.getTable(CollaborationTables.ATTACHMENT);
+      assertThat(table.getField("sizeBytes").getType()).isEqualTo(QFieldType.LONG);
+      assertThat(table.getVirtualField("previewUrl")).isNotNull();
+      assertThat(config.getDefaultMaxBytes()).isEqualTo(104857600L);
+      assertThat(config.getAttachmentsBucketName()).isEqualTo("collaboration");
+      assertThat(config.getBlockedExtensions()).isEmpty();
+      assertThatThrownBy(() -> config.withDefaultMaxBytes(0L).validate(instance)).hasMessageContaining("defaultMaxBytes");
+   }
+
+   /*******************************************************************************
+    ** Short upload helper using the first visible parent.
+    *******************************************************************************/
+   private AttachmentEntry upload(String name, String value) throws QException
+   {
+      return (service.upload("document", 1, name, "text/plain", stream(value), "description"));
+   }
+
+   /*******************************************************************************
+    ** UTF-8 payload.
+    *******************************************************************************/
+   private ByteArrayInputStream stream(String value)
+   {
+      return (new ByteArrayInputStream(value.getBytes(StandardCharsets.UTF_8)));
+   }
+
+   /*******************************************************************************
+    ** Inspect persistence without producing URLs.
+    *******************************************************************************/
+   private QRecord raw(Integer id) throws QException
+   {
+      return (AttachmentRecords.query(new QQueryFilter().withCriteria("id", QCriteriaOperator.EQUALS, id)).getFirst());
+   }
+
+   /*******************************************************************************
+    ** Fake bucket preserving bytes and capturing API requests. No provider emulation.
+    *******************************************************************************/
+   private static class FakeStorage extends AttachmentStorage
+   {
+      private final Map<String, byte[]> objects = new HashMap<>();
+      private final List<PresignGet> signatures = new ArrayList<>();
+      private long limit = Long.MAX_VALUE;
+      private PutRequest lastPut;
+      private PresignGet lastGet;
+      private boolean failDelete;
+
+      @Override
+      public long maxBytes(String name)
+      {
+         return (limit);
+      }
+
+      @Override
+      public void put(String name, PutRequest request)
+      {
+         lastPut = request;
+         try
+         {
+            objects.put(name + "/" + request.getKey(), request.getStream().readAllBytes());
+         }
+         catch(IOException e)
+         {
+            throw (new IllegalStateException(e));
+         }
+      }
+
+      @Override
+      public void delete(String name, String key)
+      {
+         if(failDelete)
+         {
+            throw (new IllegalStateException("Storage unavailable"));
+         }
+         objects.remove(name + "/" + key);
+      }
+
+      @Override
+      public URL presign(String name, PresignGet request)
+      {
+         lastGet = request;
+         signatures.add(request);
+         try
+         {
+            return (URI.create("https://signed.example/" + request.getKey()).toURL());
+         }
+         catch(Exception e)
+         {
+            throw (new IllegalStateException(e));
+         }
+      }
+   }
+}

src/test/java/com/kingsrook/qbits/collaboration/recents/RecentsServiceTest.java

@@ -0,0 +1,298 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.collaboration.recents;
+
+
+import java.time.Clock;
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.util.HashMap;
+import java.util.List;
+import com.kingsrook.qbits.collaboration.CollaborationQBitConfig;
+import com.kingsrook.qbits.collaboration.CollaborationQBitProducer;
+import com.kingsrook.qbits.collaboration.CollaborationSchema;
+import com.kingsrook.qbits.collaboration.CollaborationSecurity;
+import com.kingsrook.qbits.collaboration.PersonalRecords;
+import com.kingsrook.qbits.collaboration.PersonalServiceFixture;
+import com.kingsrook.qbits.collaboration.app.CollaborationHome;
+import com.kingsrook.qbits.collaboration.favorites.FavoriteEntry;
+import com.kingsrook.qbits.collaboration.favorites.FavoritesService;
+import com.kingsrook.qbits.collaboration.model.CollaborationTables;
+import com.kingsrook.qbits.collaboration.permissions.CollaborationPermissions;
+import com.kingsrook.qqq.backend.core.actions.processes.RunProcessAction;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.instances.QInstanceValidator;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.QBackendMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.audits.AuditLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.scheduleing.simple.SimpleSchedulerMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
+import com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryBackendModule;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+
+/*******************************************************************************
+ ** Persisted throttling, visible ordering, bounded retention and summary counts.
+ *******************************************************************************/
+class RecentsServiceTest extends PersonalServiceFixture
+{
+   private static final Instant START = Instant.parse("2026-10-13T12:00:00Z");
+
+
+
+   /*******************************************************************************
+    ** Do not leak an injected clock to another test.
+    *******************************************************************************/
+   @AfterEach
+   void resetClock()
+   {
+      RecentsService.clock = Clock.systemUTC();
+   }
+
+
+
+   /*******************************************************************************
+    ** The exact 60-second boundary updates; 59 seconds does not write anything.
+    *******************************************************************************/
+   @Test
+   void throttlesPerTargetAndUser() throws Exception
+   {
+      at(START);
+      RecentsService.recordView("RECORD", "document", "1");
+      QRecord initial = rows().getFirst();
+      at(START.plusSeconds(59));
+      RecentsService.recordView("RECORD", "document", "1");
+      assertThat(rows().getFirst().getValues()).isEqualTo(initial.getValues());
+      at(START.plusSeconds(60));
+      RecentsService.recordView("RECORD", "document", "1");
+      assertThat(rows()).hasSize(1);
+      assertThat(rows().getFirst().getValueInteger("viewCount")).isEqualTo(2);
+      assertThat(rows().getFirst().getValueInstant("lastViewedAt")).isEqualTo(START.plusSeconds(60));
+      RecentsService.recordView("RECORD", "document", "2");
+      assertThat(rows()).hasSize(2);
+      login("bob");
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.RECENT)).getRecords()).isEmpty();
+      RecentsService.recordView("RECORD", "document", "1");
+      assertThat(rows()).hasSize(1);
+      assertThat(rows().getFirst().getValueInteger("viewCount")).isEqualTo(1);
+      admin();
+      assertThat(new QueryAction().execute(new QueryInput(CollaborationTables.RECENT)).getRecords()).hasSize(3);
+      assertThat(RecentsService.list(50)).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** Null ids also upsert; visibility is checked even inside the throttle window.
+    *******************************************************************************/
+   @Test
+   void tableUpsertAndInvisibleViews() throws Exception
+   {
+      at(START);
+      RecentsService.recordView("TABLE", "document", null);
+      RecentsService.recordView("TABLE", "document", null);
+      assertThat(rows()).hasSize(1);
+      at(START.plusSeconds(61));
+      RecentsService.recordView("TABLE", "document", null);
+      assertThat(rows().getFirst().getValueInteger("viewCount")).isEqualTo(2);
+      assertThatThrownBy(() -> RecentsService.recordView("RECORD", "document", "3")).hasMessage("Not found");
+      RecentsService.recordView("RECORD", "document", "1");
+      QContext.getQSession().getPermissions().remove("document.read");
+      assertThatThrownBy(() -> RecentsService.recordView("RECORD", "document", "1")).hasMessage("Not found");
+      assertThat(RecentsService.list(50)).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** Newest-first ordering is stable; locked rows are dropped before the limit.
+    *******************************************************************************/
+   @Test
+   void limitOrderAndVisibility() throws Exception
+   {
+      at(START);
+      RecentsService.recordView("TABLE", "document", null);
+      at(START.plusSeconds(1));
+      RecentsService.recordView("RECORD", "document", "1");
+      at(START.plusSeconds(2));
+      RecentsService.recordView("RECORD", "document", "2");
+      assertThat(RecentsService.list(2)).extracting(FavoriteEntry::recordId).containsExactly("2", "1");
+      assertThat(RecentsService.list(50)).hasSize(3);
+      QContext.getQSession().getSecurityKeyValues().put("tenant", List.of("b"));
+      assertThat(RecentsService.list(1)).extracting(FavoriteEntry::targetType).containsExactly("TABLE");
+      assertThatThrownBy(() -> RecentsService.list(51)).hasMessage("Limit must be between 1 and 50");
+      assertThatThrownBy(() -> RecentsService.list(0)).hasMessage("Limit must be between 1 and 50");
+      assertThatThrownBy(() -> RecentsService.list(null)).hasMessage("Limit must be between 1 and 50");
+   }
+
+
+
+   /*******************************************************************************
+    ** A page full of unavailable rows must not hide older, accessible targets.
+    *******************************************************************************/
+   @Test
+   void refillsAfterUnavailablePage() throws Exception
+   {
+      at(START);
+      RecentsService.recordView("TABLE", "document", null);
+      for(int i = 0; i < 51; i++)
+      {
+         PersonalRecords.insert(CollaborationTables.RECENT, new QRecord().withValue("userId", "alice").withValue("targetType", "TABLE")
+            .withValue("targetName", "removed" + i).withValue("label", "Old private label").withValue("lastViewedAt", START.plusSeconds(i + 1)).withValue("viewCount", 1));
+      }
+      assertThat(RecentsService.list(50)).extracting(FavoriteEntry::label).containsExactly("Documents");
+   }
+
+
+
+   /*******************************************************************************
+    ** A real backend process keeps newest N independently for each owner.
+    *******************************************************************************/
+   @Test
+   void trimProcessAndExecutionPermission() throws Exception
+   {
+      config.setRecentsPerUser(2);
+      for(String user : List.of("alice", "bob"))
+      {
+         login(user);
+         at(START);
+         RecentsService.recordView("RECORD", "document", "1");
+         at(START.plusSeconds(1));
+         RecentsService.recordView("RECORD", "document", "2");
+         at(START.plusSeconds(2));
+         RecentsService.recordView("TABLE", "document", null);
+      }
+      assertThatThrownBy(() -> new TrimRecentsProcess().run(new RunBackendStepInput(), new RunBackendStepOutput())).hasMessageContaining("collaboration.admin");
+      assertThatThrownBy(() -> new RunProcessAction().execute(new RunProcessInput().withProcessName(TrimRecentsProcess.NAME))).hasMessageContaining("collaboration.admin");
+      admin();
+      new RunProcessAction().execute(new RunProcessInput().withProcessName(TrimRecentsProcess.NAME));
+      assertThat(PersonalRecords.query(CollaborationTables.RECENT, new QQueryFilter())).hasSize(4);
+      for(String user : List.of("alice", "bob"))
+      {
+         login(user);
+         assertThat(RecentsService.list(50)).extracting(FavoriteEntry::recordId).containsExactly(null, "2");
+      }
+      QSystemUserSession system = new QSystemUserSession();
+      QContext.init(instance, system);
+      var before = new HashMap<>(system.getSecurityKeyValues());
+      CollaborationSecurity.applyToSession(instance, system);
+      CollaborationSecurity.ensureSessionKeys(instance, system);
+      assertThat(system.getSecurityKeyValues()).isEqualTo(before);
+      config.setRecentsPerUser(1);
+      new RunProcessAction().execute(new RunProcessInput().withProcessName(TrimRecentsProcess.NAME));
+      assertThat(PersonalRecords.query(CollaborationTables.RECENT, new QQueryFilter())).hasSize(2);
+      assertThat(QContext.getQSession()).isSameAs(system);
+   }
+
+
+
+   /*******************************************************************************
+    ** The daily schedule and metadata remain valid without adding nav processes.
+    *******************************************************************************/
+   @Test
+   void metadataSchemaAndConfiguration() throws Exception
+   {
+      assertThat(new CollaborationQBitConfig().getRecentsPerUser()).isEqualTo(200);
+      assertThat(instance.getProcess(TrimRecentsProcess.NAME).getIsHidden()).isTrue();
+      assertThat(instance.getProcess(TrimRecentsProcess.NAME).getSchedule()).isNull();
+      assertThatThrownBy(() -> config.withRecentsPerUser(0).validate(instance)).hasMessageContaining("recentsPerUser");
+      assertThatThrownBy(() -> config.withRecentsPerUser(null).validate(instance)).hasMessageContaining("recentsPerUser");
+      config.withRecentsPerUser(200);
+      assertThatThrownBy(() -> config.withSchedulerName("missing").validate(instance)).hasMessageContaining("scheduler");
+      instance.addScheduler(new SimpleSchedulerMetaData().withName("daily"));
+      config.withSchedulerName("daily");
+      config.validate(instance);
+      QProcessMetaData scheduled = TrimRecentsProcess.metadata(config);
+      assertThat(scheduled.getSchedule().getSchedulerName()).isEqualTo("daily");
+      assertThat(scheduled.getSchedule().getRepeatSeconds()).isEqualTo(86400);
+      instance.getProcess(TrimRecentsProcess.NAME).setSchedule(scheduled.getSchedule());
+      new QInstanceValidator().validate(instance);
+      for(String table : List.of(CollaborationTables.FAVORITE, CollaborationTables.RECENT))
+      {
+         assertThat(instance.getTable(table).getAuditRules().getAuditLevel()).isEqualTo(AuditLevel.NONE);
+         assertThat(instance.getTable(table).getPermissionRules().getLevel()).isEqualTo(PermissionLevel.NOT_PROTECTED);
+         assertThat(instance.getTable(table).getUniqueKeys().getFirst().getFieldNames()).containsExactly("userId", "targetType", "targetName", "recordId");
+         assertThat(instance.getTable(table).getSections()).extracting(section -> section.getName()).containsExactly("identity", "details", "dates");
+      }
+      assertThat(instance.getApp("collaboration").getChildren()).extracting(child -> child.getName()).doesNotContain(CollaborationTables.FAVORITE, CollaborationTables.RECENT, TrimRecentsProcess.NAME);
+      assertThat(instance.getPossibleValueSource(CollaborationTables.TARGET_TYPE).getEnumValues()).hasSize(6);
+      assertThat(CollaborationSchema.postgresScript(config)).contains("CREATE TABLE IF NOT EXISTS collaboration_favorite", "CREATE TABLE IF NOT EXISTS collaboration_recent",
+         "(user_id, target_type, target_name, record_id) NULLS NOT DISTINCT", "last_viewed_at TIMESTAMPTZ NOT NULL", "view_count INTEGER NOT NULL");
+   }
+
+
+
+   /*******************************************************************************
+    ** Counts use the current user's owner lock and admins see real distinct users.
+    *******************************************************************************/
+   @Test
+   void homeSummaryCounts() throws Exception
+   {
+      at(START);
+      login("alice", CollaborationPermissions.VIEW);
+      FavoritesService.star("TABLE", "document", null);
+      FavoritesService.star("RECORD", "document", "1");
+      RecentsService.recordView("TABLE", "document", null);
+      login("bob", CollaborationPermissions.VIEW);
+      FavoritesService.star("TABLE", "document", null);
+      RecentsService.recordView("TABLE", "document", null);
+      assertThat(CollaborationHome.render(START)).contains("<h3>Favorites</h3><p>Rows: 1</p><p>Distinct users: 1", "<h3>Recently viewed</h3><p>Rows: 1</p><p>Distinct users: 1");
+      admin();
+      assertThat(CollaborationHome.render(START)).contains("<h3>Favorites</h3><p>Rows: 3</p><p>Distinct users: 2", "<h3>Recently viewed</h3><p>Rows: 2</p><p>Distinct users: 2");
+   }
+
+
+
+   /*******************************************************************************
+    ** Freeze the service clock, including exact boundary cases.
+    *******************************************************************************/
+   private void at(Instant instant)
+   {
+      RecentsService.clock = Clock.fixed(instant, ZoneOffset.UTC);
+   }
+
+
+
+   /*******************************************************************************
+    ** Inspect persisted rows for the current owner without altering their values.
+    *******************************************************************************/
+   private List<QRecord> rows() throws Exception
+   {
+      return (PersonalRecords.query(CollaborationTables.RECENT, PersonalRecords.ownFilter()));
+   }
+}