Merge remote-tracking branch 'origin/feature/compare' into feature/watches

Watches evaluate a metric per time bucket as their owner (SPIKE, DROP,
OUT_OF_RANGE, NEW_CATEGORY, NULL_RATE_CREEP with robust baselines) on a
hidden scheduled process, raise and resolve data.analysis.anomaly alerts
through QAlerts, and offer Evaluate now / Enable / Disable record actions
and a preview endpoint (extension 1.3.0). Pivot and crosstab labels are
human (Yes/No, Average Annual Salary). Contingent fields: a watch's saved
analysis depends on its table, table names use the core tables PVS, and
analyzable/excluded fields pick from the chosen table's fields.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,12 +6,32 @@ Following [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [Semantic
 
 ### Added
 
-- `data-analysis` UI API extension 1.0.0: seven session-bound profile, capability, distinct-value, duplicate and run endpoints, typed schemas and a checked OpenAPI fragment.
+- Phase e anomaly watches: owner-locked configuration, validated metrics/detector parameters, complete calendar buckets, five pure detectors, and scheduled evaluation through owner sessions.
+- Core alerts SPI type `data.analysis.anomaly` (core disallows the spec's underscore), stable watch keys, relative drill links, raise/recovery transitions, and persisted outcomes without an alerts implementation.
+- Standard streamed ETL Evaluate now / Enable / Disable record actions and firing-first linked watches on the Analyses home.
+- Read-only watch preview HTTP endpoint, semantic chart/baseline annotations, extension 1.3.0 and regenerated OpenAPI fragment.
+- Detector edge cases, real-row owner/security/alert transition tests, calendar boundary and action tests, and HTTP preview coverage.
+
+- Phase d compare, shift, correlation, scatter and crosstab service operations and HTTP specs; extension version 1.2.0 with typed `DataAnalysis*V1` schemas and regenerated OpenAPI.
+- Pure-Java two-proportion, Welch, chi-square/Cramer V, PSI and Pearson statistics, including regularized incomplete beta/gamma and independent SciPy references.
+- Core-pushed numeric moments and batched correlations, sample trend lines, calendar distribution shifts, category pooling, privacy suppression and exact count drills.
+- Shared memory/H2/PostgreSQL relationship contracts, forced core streamed-fallback checks, batching checks and HTTP authorization/serialization/drill tests.
+
+- Phase c pivot backend and `POST /qbit/data-analysis/tables/{table}/pivot`, extension version 1.1.0, typed schemas and regenerated OpenAPI fragment.
+- Row/column dimensions, calendar/numeric buckets, seven measure operators, sparse cells, exact Other recomputation, totals, privacy suppression and count-equivalent drills.
+- Exposed-join dimensions and measures with READ/FULL checks; filter-only drills for to-one paths and explicit null-drill warnings for to-many paths whose joined-row counts can exceed record counts.
+- Configurable field-access resolver, cached reflective core tier bridge with legacy fallback, FULL-only capabilities/selections/labels, generated-drill protection and field-access cache fingerprints.
+- Shared memory/H2/PostgreSQL pivot contracts, HTTP drills and errors, reflective resolver/fallback and tier-change cache tests.
+
+- Session-bound profile, capability, distinct-value, duplicate and run endpoints, typed schemas and a checked OpenAPI fragment (introduced in extension 1.0.0).
 - Core table-feature permission registration and capability-directed aggregate pushdown, with native sampling and portable streamed fallbacks.
 - HTTP authorization, drill-to-core-count round trips, async polling, served OpenAPI and assistant discovery tests; H2 streamed and native-compatibility contract variants.
 
 ### Changed
 
+- Boolean pivot/crosstab headers now say Yes / No / (Blank). Pivot measures use human labels such as Count, Average Amount, Sum of Amount, Distinct Email, Median Amount and 90th percentile of Amount.
+- Watch DDL includes owner/date fields and last value/message; existing databases need an owner/date backfill before enabling watches.
+
 - Scalable estimates sample each native aggregate without primary-key IN lists, scale counts using observed sample sizes, retain exact population totals and unscaled ratios, and drill over the full population. Portable estimates use one primary-key boundary and report unscaled prefix counts.
 
 - Target QQQ 4.1.0-RC.6; local verification uses `-Dqqq.snapshot.version=4.1.0-DATAANALYSIS-SNAPSHOT`.

README.md

@@ -4,9 +4,9 @@ Statistical analysis and data dives on any QQQ table, filter or saved view: prof
 
 ## What works now
 
-The host API provides column and table profiles, distinct-value pages, duplicate groups, drill-through filters, effective per-table configuration, privacy suppression, and asynchronous exact runs with a persistent per-user cache. Metadata, six visible tables, owner locks, PostgreSQL DDL generation and the Analyses home are also available.
+The host API provides column and table profiles, pivots, comparisons, distribution shifts, correlations, scatter samples, crosstabs, distinct-value pages, duplicate groups, drill-through filters, privacy suppression, and asynchronous exact profile runs with a persistent per-user cache. Metadata, six visible tables, owner locks, PostgreSQL DDL generation and the Analyses home are also available.
 
-Seven HTTP operations are available under `/qqq/v1/qbit/data-analysis`; the Analyze UI is a later phase. Pivots, comparisons, anomalies, saved-analysis execution, scheduling and exports remain later phases.
+Fourteen HTTP operations are available under `/qqq/v1/qbit/data-analysis`; the Analyze UI is a later phase. Pivot and relationship backends are available. Anomaly watches, their scheduled evaluator and alert transitions are available. Saved-analysis execution, scheduled delivery and exports remain later phases.
 
 ## Requirements
 
@@ -47,6 +47,8 @@ QQQ names and physical SQL table names are identical. `backendName` in configura
 
 Only Saved Analyses, Watches, Analysis Settings and Analysis Runs appear in navigation. Schedules, stars and linked watches appear on saved records. Enum PVS cover analysis kind, chart kind, detector, watch state, run status, schedule frequency and format. JSON definitions and results are stored as text. Profile, distinct-value and duplicate requests have typed Java contracts and are validated by the facade.
 
+The four `table_name` fields use core's `tables` possible-value source; an existing host source is preserved. A watch's `saved_id` options are filtered by its selected `table_name`. Analysis Settings' `analyzable_fields` and `excluded_fields` use a custom field picker scoped to the selected table. Core currently has no multi-select PVS field, so these settings use a single PVS with comma-separated TEXT storage (for example, `amount,status`); the configuration resolver continues to parse those lists. Explicit dependency metadata awaits core's `possibleValueSourceDependsOn` support.
+
 ## Permissions
 
 | Permission | Grants |
@@ -138,7 +140,7 @@ Count drills combine an untouched copy of the request filter with their producin
 
 ## HTTP endpoints
 
-Extension `data-analysis` version **1.0.0**, prefix `/qbit/data-analysis` inside `/qqq/v1`:
+Extension `data-analysis` version **1.3.0**, prefix `/qbit/data-analysis` inside `/qqq/v1`:
 
 | Method | Path after `/qqq/v1` | Body or purpose |
 | --- | --- | --- |
@@ -147,12 +149,19 @@ Extension `data-analysis` version **1.0.0**, prefix `/qbit/data-analysis` inside
 | POST | `/qbit/data-analysis/tables/{table}/distinct-values` | `{fieldName, filter, page, pageSize, search}` |
 | POST | `/qbit/data-analysis/tables/{table}/table-profile` | `{filter, fields}` |
 | POST | `/qbit/data-analysis/tables/{table}/duplicates` | `{fields, filter, limit}`; default limit 50, maximum 500 |
+| POST | `/qbit/data-analysis/tables/{table}/pivot` | `{rows, columns, values, filter, showTotals, limitGroups}`; 1–3 row dimensions, 0–2 column dimensions, 1–6 measures |
+| POST | `/qbit/data-analysis/tables/{table}/compare` | `{filterA, filterB, labelA, labelB, fields}`; null filter selects the whole permitted table |
+| POST | `/qbit/data-analysis/tables/{table}/shift` | `{field, dateField, bucket, filter}`; calendar buckets, top 8 categories or quartiles, first/last complete-bucket PSI |
+| POST | `/qbit/data-analysis/tables/{table}/correlation` | `{fields, filter}`; 2–12 distinct numeric fields, pairwise r and n, scatter request per cell |
+| POST | `/qbit/data-analysis/tables/{table}/scatter` | `{xField, yField, filter, limit}`; default/maximum 2000 points and a sample trend line |
+| POST | `/qbit/data-analysis/tables/{table}/crosstab` | `{rowField, columnField, filter, limit}`; default/maximum 20 categories per axis plus Other |
 | POST | `/qbit/data-analysis/runs` | `{operation: COLUMN_PROFILE or TABLE_PROFILE, tableName, request}` returns `{runId, status}` |
 | GET | `/qbit/data-analysis/runs/{runId}` | Status, timestamps, error, typed `columnProfile` or `tableProfile` |
+| POST | `/qbit/data-analysis/watches/{id}/preview` | No body; complete bucket series, `TIME_SERIES` chart with baseline annotations and detector verdict; no writes or alerts |
 
 Every operation uses the request session through `DataAnalysisService`. Capabilities returns 200 with `canAnalyze: false` and no fields when denied. Other permission denials return 403, bad bodies or unavailable fields return 400, and unknown tables return 404. Core middleware supplies plain messages in its standard `{error: message}` JSON envelope. Run rows remain owner-locked.
 
-Requests and drills reuse core's `QueryFilter` JSON shape and schema reference. Versioned `DataAnalysis...V1` schemas cover profiles, metrics, drills, charts, series, points, field summaries, distinct and duplicate results, capabilities and runs. The [OpenAPI fragment](src/main/resources/openapi/qqq-v1/data-analysis.yaml) is checked against regeneration. The deployed `/qqq/v1/openapi.json` and `UiApiInvoker.listOperations()` include all seven operations.
+Requests and drills reuse core's `QueryFilter` JSON shape and schema reference. Versioned `DataAnalysis...V1` schemas cover profiles, metrics, drills, charts, series, points, field summaries, distinct and duplicate results, capabilities and runs. The [OpenAPI fragment](src/main/resources/openapi/qqq-v1/data-analysis.yaml) is checked against regeneration. The deployed `/qqq/v1/openapi.json` and `UiApiInvoker.listOperations()` include all fourteen operations.
 
 Regenerate deliberately after an API change:
 
@@ -160,6 +169,20 @@ Regenerate deliberately after an API change:
 ./mvnw -o -q test -Dtest=DataAnalysisApiTest#contract -Dopenapi.write=true -Dqqq.snapshot.version=4.1.0-DATAANALYSIS-SNAPSHOT
 ```
 
+## Pivot backend and field access
+
+`DataAnalysisService.pivot(PivotRequest)` returns sparse cells indexed into row/column header tuples, aligned totals, typed/formatted metrics, warnings and `asOf`. `COUNT` counts records (including null measure values); other operators require a field. `PERCENTILE` uses continuous interpolation with a fraction from 0 to 1. Calendar buckets use the session timezone. Numeric bins reuse profile nice-edge selection when explicit bounds are omitted; the last interior bin includes its maximum.
+
+The planner first requests count-ordered top-N groups for every dimension (default 50, maximum 200), then dimension counts for privacy/cardinality, one grouped matrix and one aggregate per totals level. Additional aggregates recompute merged Other cells/totals: averages, distinct counts and percentiles cannot safely be combined from displayed cells. Ordinary Other predicates exclude kept values and handle null/empty strings separately. Boolean, temporal and bucketed Other groups use equivalent membership/range predicates for core HTTP compatibility. Cyclic date predicates enumerate observed values through core grouping; memory numeric boundaries reuse the profiles' decimal-scale compatibility helper. Native pivots are exact; bounded core streamed fallback marks partial results as estimates and disables their drills.
+
+`joinTable.field` resolves only through an unambiguous exposed join path. Every table in that path requires READ and the selected field must be FULL; core enforces joins and record locks. The installed data-analysis snapshot does not contain the related-record picker path API, so this implementation uses `getExposedJoins()` and `QueryJoin`. Paths whose every hop is MANY_TO_ONE or ONE_TO_ONE in the analyzed direction support ordinary filter-only drills: core infers the joins from qualified criteria. To-many paths can multiply a base record, so their pivots retain null drills and warn that counts include one row per related table record.
+
+`min_group_size` suppresses rare dimension groups and rare row/column tuples; every measure of a small cell or total is suppressed, including COUNT, with no drill. Totals include the full authorized population. As with existing profiles, separate aggregate calls are not a transactional snapshot.
+
+Hosts can supply `withFieldAnalysisAccessResolver(() -> resolver)`. FULL fields alone appear in capabilities and may be selected. EXACT_MATCH_ONLY and NONE get the same 400 as an unknown field; user-authored filters are passed through for core enforcement. Generated drills using a restricted field (including representative primary keys) are disabled. Related PVS display labels also require FULL access. Exact-run cache identities hash the sorted FULL-field list, the optional core access fingerprint, and related label access.
+
+The default resolver discovers the optional core `fieldaccess.FieldAccessHelper` class and its static methods once. FULL maps to FULL, REVEALABLE to EXACT_MATCH_ONLY, MASKED/HIDDEN to NONE. Without that class, legacy field locks supply FULL/NONE. Replace the reflective calls when the core package ships. Reflection tests use a local stand-in helper rather than shadowing a future real core class at its FQN; the installed snapshot exercises the actual fallback selection. Exact-run persistence continues to support profiles only; pivot results are synchronous.
+
 ## Backend selection
 
 `DataAnalysisService` selects `CoreAnalysisBackend` when the source backend advertises aggregate capabilities, including memory. Supported standard deviation, percentiles, null/blank counts, numeric/date buckets and length statistics execute through core aggregates as the current session. Unsupported primitives delegate to `StandInAnalysisBackend`. Patterns and derived length histograms remain streamed; representative distinct drills and cyclic-date membership use bounded scans.
@@ -172,6 +195,44 @@ Variance, interpolated percentiles, string lengths/shapes, date classification,
 
 Data versions use filtered COUNT plus MAX of a readable modification-date-like field, otherwise MAX(primary key). This is the specified inexpensive invalidation heuristic, not snapshot isolation; updates on a table without a modification timestamp can remain cached until TTL expiry. Concurrent writes can also change drill counts after a profile is produced. Results always retain `asOf`.
 
+## Compare and relationships
+
+All five operations resolve FULL fields before reading source data and use core actions with `PermissionEnforcement.ENFORCE`. Core applies table permissions and record locks. Compare batches numeric COUNT, AVG, VAR_SAMP and quartiles per population; categorical comparisons use a common top-10-plus-Other distribution and pool categories with expected counts below five. Deltas are B minus A, and percent deltas divide by absolute A (null when A is zero). Significance uses a strict p < 0.05 threshold; invalid or privacy-suppressed tests return a plain reason.
+
+Correlation batches all CORR pairs into one aggregate call. Pairwise non-null n values use enforced core count actions, since the current aggregate API has no per-measure filter. Unsupported aggregates use core's bounded streamed fallback; a truncated fallback returns 400 with a request to narrow the filter, rather than publishing a partial significance test. Scatter uses the first N paired records ordered by primary key because the current core QueryInput has no sampling API. Its least-squares line describes that displayed sample. Point drills contain only primary-key equality and are disabled whenever privacy is enabled or the primary key is not FULL.
+
+Shift uses session-timezone calendar buckets. Only buckets whose end has passed enter PSI; categories share one top-8-plus-Other basis, and numeric PSI uses the first complete bucket's quartile boundaries for both populations. Zero shares are floored at 0.000001. PSI is descriptive, not a significance test. Category time series explicitly declare `stacked: true`.
+
+The minimum-group-size guard removes small numeric summaries, suppresses crosstab cells and revealing marginal shares, disables drills on privacy-merged Other groups, and suppresses scatter points below the minimum. Statistical tests and PSI are unavailable when protected values would contribute. No runtime statistics dependency is added; beta/gamma, Welch, chi-square, proportions, PSI and Pearson are pure Java, checked against independently computed SciPy references.
+
+## Anomaly watches
+
+Watches are ordinary owner-locked `data_analysis_watch` rows. Create and edit them through core table CRUD with `data_analysis.watch.read`, `.insert`, `.edit`, and `.delete`. Standard table/record actions **Evaluate now**, **Enable**, and **Disable** use streamed ETL Review and Result summaries. They never appear in navigation. The home lists firing watches first and links to their records.
+
+A watch has `owner_user_id`, `date_field`, `bucket` (`HOUR`, `DAY`, `WEEK`, `MONTH`), `detector`, `parameters_json`, `severity` (`INFO`, `WARNING`, `ERROR`, `CRITICAL`) and `enabled`. It targets either:
+
+- `table_name`, optional core `filter_json`, and `metric_json`, such as `{"operator":"COUNT"}`, `{"operator":"SUM","field":"amount"}`, `{"operator":"AVG","field":"amount"}`, `{"operator":"NULL_SHARE","field":"email"}`, or `{"operator":"CATEGORY_SET","field":"status"}`.
+- `saved_id`: the owner's saved table and filter, with an explicit watch `metric_json` or one saved definition `metric` / single pivot `values` measure. The date field and bucket remain explicit on the watch. Ambiguous saved measures are rejected; saved filters cannot be overridden by `filter_json` on the watch.
+
+Detector parameters are validated by core pre-insert/update customizers, including partial updates. Unknown parameters and invalid metric/detector combinations return clear record errors.
+
+| Detector | Parameters and behavior |
+| --- | --- |
+| SPIKE / DROP | `k=14`, `threshold=3.5`, `relativeChange=0.5`; robust z = `0.6745 * (latest - median) / MAD`, strict directional threshold. With zero MAD, compare relative change against the absolute median. A zero baseline fires only for a nonzero change in the requested direction. |
+| OUT_OF_RANGE | Required `min` and `max`; fire outside the inclusive range. Needs only the latest bucket. |
+| NEW_CATEGORY | `k=14`; requires `CATEGORY_SET`; compare latest categories with the union of previous buckets. Null is excluded from the category set. |
+| NULL_RATE_CREEP | `k=14`, `delta=0.05`, `n=3`; requires `NULL_SHARE`; fire for a rise above the baseline median greater than delta, or `n` consecutive increases (`n+1` values). |
+
+`k` and `n` are bounded to 1–1000. The trailing window contains at most `k+1` complete buckets, excludes the current bucket, and follows the owner's time zone (Monday-based weeks). Leading buckets with no observed rows do not invent history. After the first observed bucket, missing COUNT/SUM/category buckets are zero/empty; AVG and NULL_SHARE with no population are unavailable. Too little history, incomplete streamed results, unavailable fields, and privacy-suppressed buckets never cause a recovery. No suppressed series, categories, values or drills leave the computation. All source reads enforce READ, Analyze, record locks and FULL field access, including filter fields.
+
+`data_analysis_evaluate_watches` is hidden and repeats every 900 seconds when `schedulerName` is configured. Give the scheduler session its standard process permission, `data_analysis_evaluate_watches.hasAccess`. Inventory and status writes use grants restricted to watch rows; source aggregation always switches to the owner. The default integration calls the host authentication module's `createAutomatedSessionForUser`. Hosts can instead configure `withOwnerSessionSupplier(userId -> session)`. The session must identify that owner and include the `data_analysis_user` owner key plus their current permissions. Missing/mismatched sessions record **Owner session unavailable**; there is no system-session fallback. Manual Evaluate now can also evaluate a disabled watch.
+
+A transition from OK to FIRING raises through core `QAlerts`, with the watch record reference and a relative table-query `AlertLink`; recovery resolves the same `data_analysis_watch:<id>` key. The declared type is **`data.analysis.anomaly`**, labelled **Data anomaly**. This spelling is necessary because the supplied core SPI validator rejects the design's `data_analysis.anomaly` underscore. No qbit-alerts dependency is required. With no sink installed, core logs the signal and the watch row still records the outcome. Repeated FIRING/OK evaluations do not send duplicate transitions. Calls are serialized within each runtime; hosts should run this scheduler on one node (cross-node transactional coordination is not provided).
+
+`state`, `alert_key`, `last_evaluated_at`, `last_value` and `last_message` describe the most recent attempt. Skips clear the last value and leave the existing OK/FIRING state intact. Preview uses the requesting viewer's permissions and never updates these fields.
+
+`DataAnalysisSchema.postgresScript(config)` generates the new fields and owner requirement. Existing installations must add `date_field VARCHAR(250)`, `owner_user_id VARCHAR(250)`, `last_value NUMERIC`, and `last_message TEXT`, then backfill each watch's actual owner/date field before making the first two columns NOT NULL and enabling evaluation. The CREATE-IF-NOT-EXISTS generator does not migrate existing tables.
+
 ## Adopting in another app
 
 1. Add a backend, install the producer and run the usual `QInstanceValidator`.
@@ -180,7 +241,7 @@ Data versions use filtered COUNT plus MAX of a readable modification-date-like f
 4. Review per-table include/exclude sets, limits and minimum group sizes before enabling analysis. Integrate Saved Analyses and Watches with host ESB/Quick Search when those optional host features are installed; this scaffold does not add those dependencies.
 5. Use the Analyses home as the owner of analysis data. Other dashboards should link there until saved-analysis widgets are implemented.
 
-Phase **b** profiles, drill-through, runs/cache and HTTP endpoints are implemented. Remaining work: **b** analysis UI; **c** pivots; **d** comparisons and relationships; **e** watch evaluation and alerts; **f** saved-analysis execution, sharing, stars integration, schedules, chart widgets, full home and exports. The current home summarizes stored rows; the host facade executes profiles. The home does not send deliveries.
+Phase **b** profiles, drill-through, runs/cache and HTTP endpoints, phase **c** pivot backend, phase **d** compare/relationships backend, and phase **e** anomaly watches are implemented. Remaining work: **b** analysis UI; **c** pivot UI; **d** comparison/relationship UI; **f** saved-analysis execution, sharing, stars integration, schedules, chart widgets, full home and exports. The current home summarizes stored rows; the host facade executes profiles. The home does not send deliveries.
 
 ## Build
 

src/main/java/com/kingsrook/qbits/dataanalysis/DataAnalysisQBitConfig.java

@@ -26,6 +26,9 @@ import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.function.Supplier;
+import com.kingsrook.qbits.dataanalysis.engine.CoreTierFieldAccessResolver;
+import com.kingsrook.qbits.dataanalysis.engine.FieldAnalysisAccessResolver;
 import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
 import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitConfig;
 
@@ -35,6 +38,8 @@ import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitConfig;
  *******************************************************************************/
 public class DataAnalysisQBitConfig implements QBitConfig
 {
+   private Supplier<FieldAnalysisAccessResolver> fieldAnalysisAccessResolver = CoreTierFieldAccessResolver::defaultResolver;
+   private transient java.util.function.Function<String, com.kingsrook.qqq.backend.core.model.session.QSession> ownerSessionSupplier;
    private String backendName;
    private String schedulerName;
    private String appName = "dataAnalysis";
@@ -387,4 +392,38 @@ public class DataAnalysisQBitConfig implements QBitConfig
       this.tableDefaults = tableDefaults;
       return (this);
    }
+
+   /*******************************************************************************
+    ** Host override for session-aware field analysis access.
+    *******************************************************************************/
+   public Supplier<FieldAnalysisAccessResolver> getFieldAnalysisAccessResolver()
+   {
+      return (fieldAnalysisAccessResolver);
+   }
+
+   /*******************************************************************************
+    ** Configure an instance supplier; each service resolves one policy instance.
+    *******************************************************************************/
+   public DataAnalysisQBitConfig withFieldAnalysisAccessResolver(Supplier<FieldAnalysisAccessResolver> resolver)
+   {
+      this.fieldAnalysisAccessResolver = java.util.Objects.requireNonNull(resolver);
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Optional host adapter for scheduled owner permissions and record-lock keys.
+    *******************************************************************************/
+   public java.util.function.Function<String, com.kingsrook.qqq.backend.core.model.session.QSession> getOwnerSessionSupplier()
+   {
+      return (ownerSessionSupplier);
+   }
+
+   /*******************************************************************************
+    ** Without an adapter, use the host authentication module's automated session.
+    *******************************************************************************/
+   public DataAnalysisQBitConfig withOwnerSessionSupplier(java.util.function.Function<String, com.kingsrook.qqq.backend.core.model.session.QSession> supplier)
+   {
+      ownerSessionSupplier = supplier;
+      return (this);
+   }
 }

src/main/java/com/kingsrook/qbits/dataanalysis/DataAnalysisQBitProducer.java

@@ -29,6 +29,7 @@ import com.kingsrook.qqq.backend.core.model.metadata.permissions.TableFeaturePer
 import com.kingsrook.qqq.backend.core.model.metadata.permissions.TableFeaturePermissionsMetaData;
 import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitMetaData;
 import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitMetaDataProducer;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.TablesPossibleValueSourceMetaDataProvider;
 
 
 /*******************************************************************************
@@ -129,9 +130,20 @@ public class DataAnalysisQBitProducer implements QBitMetaDataProducer<DataAnalys
    public MetaDataProducerMultiOutput produce(QInstance instance) throws QException
    {
       qBitConfig.validate(instance);
+      if(instance.getPossibleValueSource(TablesPossibleValueSourceMetaDataProvider.NAME) == null)
+      {
+         instance.addPossibleValueSource(TablesPossibleValueSourceMetaDataProvider.defineTablesPossibleValueSource(instance));
+      }
       MetaDataProducerMultiOutput output = QBitMetaDataProducer.super.produce(instance);
       output.addSelfToInstance(instance);
       new DataAnalysisRuntime(qBitConfig).addSelfToInstance(instance);
+      com.kingsrook.qqq.backend.core.alerts.AlertsInstanceMetaData.ofOrWithNew(instance).withAlertType(
+         new com.kingsrook.qqq.backend.core.alerts.QAlertTypeMetaData().withName(com.kingsrook.qbits.dataanalysis.watch.WatchEvaluator.ALERT_TYPE)
+            .withLabel("Data anomaly").withSourceName(ARTIFACT_ID).withGroupName("data-analysis")
+            .withDefaultSeverity(com.kingsrook.qqq.backend.core.alerts.AlertSeverity.WARNING)
+            .withResolveMode(com.kingsrook.qqq.backend.core.alerts.ResolveMode.PRODUCER)
+            .withSubjectTableName(com.kingsrook.qbits.dataanalysis.model.DataAnalysisTables.WATCH)
+            .withVisibilityPermission("data_analysis.watch.read"));
       var included = java.util.Set.copyOf(qBitConfig.getIncludeTables());
       var excluded = java.util.Set.copyOf(qBitConfig.getExcludeTables());
       TableFeaturePermissionsMetaData.ofOrWithNew(instance).withPermission(new TableFeaturePermission()

src/main/java/com/kingsrook/qbits/dataanalysis/DataAnalysisRuntime.java

@@ -30,6 +30,7 @@ import com.kingsrook.qqq.backend.core.model.metadata.QSupplementalInstanceMetaDa
 public class DataAnalysisRuntime implements QSupplementalInstanceMetaData
 {
    private final transient DataAnalysisService service;
+   private final transient com.kingsrook.qbits.dataanalysis.watch.WatchEvaluator watches;
 
    /*******************************************************************************
     ** Create a runtime for one configured instance.
@@ -37,6 +38,7 @@ public class DataAnalysisRuntime implements QSupplementalInstanceMetaData
    public DataAnalysisRuntime(DataAnalysisQBitConfig config)
    {
       service = new DataAnalysisService(config);
+      watches = new com.kingsrook.qbits.dataanalysis.watch.WatchEvaluator(config, service);
    }
 
 
@@ -70,4 +72,12 @@ public class DataAnalysisRuntime implements QSupplementalInstanceMetaData
    {
       return (((DataAnalysisRuntime) QContext.getQInstance().getSupplementalMetaData("dataAnalysisRuntime")).getService());
    }
+
+   /*******************************************************************************
+    ** Shared evaluator serializes manual and scheduled watch transitions.
+    *******************************************************************************/
+   public static com.kingsrook.qbits.dataanalysis.watch.WatchEvaluator watches()
+   {
+      return (((DataAnalysisRuntime) QContext.getQInstance().getSupplementalMetaData("dataAnalysisRuntime")).watches);
+   }
 }

src/main/java/com/kingsrook/qbits/dataanalysis/DataAnalysisSchema.java

@@ -83,6 +83,7 @@ public final class DataAnalysisSchema
       {
          case INTEGER -> "INTEGER";
          case LONG -> "BIGINT";
+         case DECIMAL -> "NUMERIC";
          case BOOLEAN -> "BOOLEAN";
          case DATE_TIME -> "TIMESTAMP WITHOUT TIME ZONE";
          case TEXT -> "TEXT";

src/main/java/com/kingsrook/qbits/dataanalysis/DataAnalysisService.java

@@ -21,25 +21,47 @@
 package com.kingsrook.qbits.dataanalysis;
 
 import java.util.List;
+import java.util.Map;
+import java.util.Set;
 import java.util.concurrent.Executor;
 import com.kingsrook.qbits.dataanalysis.engine.AnalysisBackend;
+import com.kingsrook.qbits.dataanalysis.engine.AnalysisDrillGuard;
+import com.kingsrook.qbits.dataanalysis.engine.AnalysisLabels;
 import com.kingsrook.qbits.dataanalysis.engine.AnalysisSecurity;
 import com.kingsrook.qbits.dataanalysis.engine.ColumnProfiler;
+import com.kingsrook.qbits.dataanalysis.engine.ComparisonExplorer;
 import com.kingsrook.qbits.dataanalysis.engine.CoreAnalysisBackend;
 import com.kingsrook.qbits.dataanalysis.engine.DistinctValues;
+import com.kingsrook.qbits.dataanalysis.engine.DrillFilters;
 import com.kingsrook.qbits.dataanalysis.engine.DuplicateFinder;
 import com.kingsrook.qbits.dataanalysis.engine.EffectiveConfigResolver;
+import com.kingsrook.qbits.dataanalysis.engine.FieldAnalysisAccessResolver;
+import com.kingsrook.qbits.dataanalysis.engine.PivotExplorer;
+import com.kingsrook.qbits.dataanalysis.engine.RelationshipExplorer;
+import com.kingsrook.qbits.dataanalysis.engine.ShiftExplorer;
 import com.kingsrook.qbits.dataanalysis.engine.StandInAnalysisBackend;
 import com.kingsrook.qbits.dataanalysis.engine.TableProfiler;
 import com.kingsrook.qbits.dataanalysis.result.AnalysisRequest;
 import com.kingsrook.qbits.dataanalysis.result.Capabilities;
 import com.kingsrook.qbits.dataanalysis.result.ColumnProfile;
 import com.kingsrook.qbits.dataanalysis.result.ColumnProfileRequest;
+import com.kingsrook.qbits.dataanalysis.result.CompareRequest;
+import com.kingsrook.qbits.dataanalysis.result.CompareResult;
+import com.kingsrook.qbits.dataanalysis.result.CorrelationRequest;
+import com.kingsrook.qbits.dataanalysis.result.CorrelationResult;
+import com.kingsrook.qbits.dataanalysis.result.CrosstabRequest;
+import com.kingsrook.qbits.dataanalysis.result.CrosstabResult;
 import com.kingsrook.qbits.dataanalysis.result.DistinctValuesPage;
 import com.kingsrook.qbits.dataanalysis.result.DistinctValuesRequest;
 import com.kingsrook.qbits.dataanalysis.result.DuplicatesRequest;
 import com.kingsrook.qbits.dataanalysis.result.DuplicatesResult;
+import com.kingsrook.qbits.dataanalysis.result.PivotRequest;
+import com.kingsrook.qbits.dataanalysis.result.PivotResult;
 import com.kingsrook.qbits.dataanalysis.result.RunStatus;
+import com.kingsrook.qbits.dataanalysis.result.ScatterRequest;
+import com.kingsrook.qbits.dataanalysis.result.ScatterResult;
+import com.kingsrook.qbits.dataanalysis.result.ShiftRequest;
+import com.kingsrook.qbits.dataanalysis.result.ShiftResult;
 import com.kingsrook.qbits.dataanalysis.result.TableProfile;
 import com.kingsrook.qbits.dataanalysis.result.TableProfileRequest;
 import com.kingsrook.qbits.dataanalysis.run.AnalysisRunService;
@@ -53,6 +75,7 @@ public class DataAnalysisService
 {
    private final EffectiveConfigResolver configs;
    private final AnalysisSecurity security;
+   private final FieldAnalysisAccessResolver fieldAccess;
    private final AnalysisRunService runs;
 
    /*******************************************************************************
@@ -71,7 +94,8 @@ public class DataAnalysisService
    public DataAnalysisService(DataAnalysisQBitConfig config, Executor executor)
    {
       configs = new EffectiveConfigResolver(config);
-      security = new AnalysisSecurity(configs);
+      fieldAccess = config.getFieldAnalysisAccessResolver().get();
+      security = new AnalysisSecurity(configs, fieldAccess);
       runs = new AnalysisRunService(this, executor);
    }
 
@@ -116,7 +140,7 @@ public class DataAnalysisService
    public DistinctValuesPage distinctValues(DistinctValuesRequest request) throws QException
    {
       validate(request);
-      return (new DistinctValues(backend(request.getTableName())).page(request, security.field(request.getTableName(), request.getFieldName()), configs.resolve(request.getTableName())));
+      return (protect(new DistinctValues(backend(request.getTableName()), fieldAccess).page(request, security.field(request.getTableName(), request.getFieldName()), configs.resolve(request.getTableName())), request));
    }
 
 
@@ -127,7 +151,7 @@ public class DataAnalysisService
    public DuplicatesResult duplicates(DuplicatesRequest request) throws QException
    {
       validate(request);
-      return (new DuplicateFinder(backend(request.getTableName())).find(request, configs.resolve(request.getTableName())));
+      return (protect(new DuplicateFinder(backend(request.getTableName())).find(request, configs.resolve(request.getTableName())), request));
    }
 
 
@@ -219,7 +243,7 @@ public class DataAnalysisService
    public ColumnProfile compute(ColumnProfileRequest request, AnalysisBackend backend, AnalysisBackend.Scope scope) throws QException
    {
       validate(request);
-      return (new ColumnProfiler(backend).profile(request, security.field(request.getTableName(), request.getFieldName()), scope, configs.resolve(request.getTableName())));
+      return (protect(new ColumnProfiler(backend, fieldAccess).profile(request, security.field(request.getTableName(), request.getFieldName()), scope, configs.resolve(request.getTableName())), request));
    }
 
 
@@ -232,6 +256,99 @@ public class DataAnalysisService
       validate(request);
       List<QFieldMetaData> fields = security.analyzableFields(request.getTableName()).stream()
          .filter(f -> request.getFields() == null || request.getFields().contains(f.getName())).toList();
-      return (new TableProfiler(backend).profile(request, fields, scope));
+      return (protect(new TableProfiler(backend).profile(request, fields, scope), request));
+   }
+
+   /*******************************************************************************
+    ** Field policy identity is re-evaluated before cache reads and writes.
+    *******************************************************************************/
+   public String fieldAccessFingerprint(String table) throws QException
+   {
+      return (security.accessFingerprint(table));
+   }
+
+   /*******************************************************************************
+    ** Execute a pivot as the current user through core aggregates.
+    *******************************************************************************/
+   public PivotResult pivot(PivotRequest request) throws QException
+   {
+      validate(request);
+      return (new PivotExplorer(security, configs.resolve(request.getTableName())).execute(request));
+   }
+
+   /*******************************************************************************
+    ** Generated primary-key drills also obey the configured field-access seam.
+    *******************************************************************************/
+   private <T> T protect(T result, AnalysisRequest request) throws QException
+   {
+      new AnalysisDrillGuard(Set.copyOf(capabilities(request.getTableName()).getFields()),
+         DrillFilters.restoreTypes(request.getTableName(), request.getFilter())).apply(result);
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Include resolved tiers of related label fields in cache identity.
+    *******************************************************************************/
+   public Map<String, Object> fieldAccessPolicy(String table) throws QException
+   {
+      return (AnalysisLabels.policy(table, fieldAccess));
+   }
+
+   /*******************************************************************************
+    ** Execute compare under the current user's FULL-field and record policy.
+    *******************************************************************************/
+   public CompareResult compare(CompareRequest request) throws QException
+   {
+      validate(request);
+      return (new ComparisonExplorer(security, configs.resolve(request.getTableName()), request.getTableName()).compare(request));
+   }
+
+   /*******************************************************************************
+    ** Execute correlation under the current user's FULL-field and record policy.
+    *******************************************************************************/
+   public CorrelationResult correlation(CorrelationRequest request) throws QException
+   {
+      validate(request);
+      return (new RelationshipExplorer(security, configs.resolve(request.getTableName()), request.getTableName()).correlation(request));
+   }
+
+   /*******************************************************************************
+    ** Execute crosstab under the current user's FULL-field and record policy.
+    *******************************************************************************/
+   public CrosstabResult crosstab(CrosstabRequest request) throws QException
+   {
+      validate(request);
+      return (new RelationshipExplorer(security, configs.resolve(request.getTableName()), request.getTableName()).crosstab(request));
+   }
+
+   /*******************************************************************************
+    ** Execute scatter under the current user's FULL-field and record policy.
+    *******************************************************************************/
+   public ScatterResult scatter(ScatterRequest request) throws QException
+   {
+      validate(request);
+      return (new RelationshipExplorer(security, configs.resolve(request.getTableName()), request.getTableName()).scatter(request));
+   }
+
+   /*******************************************************************************
+    ** Execute shift under the current user's FULL-field and record policy.
+    *******************************************************************************/
+   public ShiftResult shift(ShiftRequest request) throws QException
+   {
+      validate(request);
+      return (new ShiftExplorer(security, configs.resolve(request.getTableName()), request.getTableName()).shift(request));
+   }
+
+   /*******************************************************************************
+    ** Watch aggregates use the same current-user table and FULL-field policy.
+    *******************************************************************************/
+   public com.kingsrook.qbits.dataanalysis.watch.WatchPreview watchPreview(com.kingsrook.qqq.backend.core.model.data.QRecord row, java.time.Instant now) throws QException
+   {
+      var resolved = com.kingsrook.qbits.dataanalysis.watch.WatchRecords.resolve(row);
+      String table = resolved.getValueString("table_name");
+      security.table(table);
+      var definition = com.kingsrook.qbits.dataanalysis.watch.WatchDefinition.parse(resolved);
+      return (new com.kingsrook.qbits.dataanalysis.watch.WatchSeries(security, configs.resolve(table), table)
+         .preview(definition, com.kingsrook.qbits.dataanalysis.watch.WatchRecords.filter(resolved), now));
    }
 }

src/main/java/com/kingsrook/qbits/dataanalysis/api/DataAnalysisApi.java

@@ -28,8 +28,14 @@ import com.kingsrook.qbits.dataanalysis.engine.CoreAnalysisBackend;
 import com.kingsrook.qbits.dataanalysis.result.AnalysisRequest;
 import com.kingsrook.qbits.dataanalysis.result.ChartKind;
 import com.kingsrook.qbits.dataanalysis.result.ColumnProfileRequest;
+import com.kingsrook.qbits.dataanalysis.result.CompareRequest;
+import com.kingsrook.qbits.dataanalysis.result.CorrelationRequest;
+import com.kingsrook.qbits.dataanalysis.result.CrosstabRequest;
 import com.kingsrook.qbits.dataanalysis.result.DistinctValuesRequest;
 import com.kingsrook.qbits.dataanalysis.result.DuplicatesRequest;
+import com.kingsrook.qbits.dataanalysis.result.PivotRequest;
+import com.kingsrook.qbits.dataanalysis.result.ScatterRequest;
+import com.kingsrook.qbits.dataanalysis.result.ShiftRequest;
 import com.kingsrook.qbits.dataanalysis.result.TableProfileRequest;
 import com.kingsrook.qqq.backend.core.context.QContext;
 import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
@@ -51,7 +57,7 @@ import com.kingsrook.qqq.openapi.model.Schema;
 import com.kingsrook.qqq.openapi.model.Type;
 
 /*******************************************************************************
- ** Session-bound profile operations registered only with optional Javalin present.
+ ** Session-bound analysis operations registered only with optional Javalin present.
  *******************************************************************************/
 public class DataAnalysisApi
 {
@@ -70,14 +76,15 @@ public class DataAnalysisApi
     *******************************************************************************/
    public static MiddlewareSpecExtension extension()
    {
-      return (new MiddlewareSpecExtension().withName("data-analysis").withSemanticVersion("1.0.0")
-         .withDescription("Profiles, distinct values, duplicate groups and exact analysis runs as the signed-in user.")
+      return (new MiddlewareSpecExtension().withName("data-analysis").withSemanticVersion("1.3.0")
+         .withDescription("Profiles, pivots, comparisons, distribution shifts, correlations, scatter samples, crosstabs and anomaly watch previews as the signed-in user.")
          .withSpec(CapabilitiesSpec.class).withSpec(ColumnProfileSpec.class).withSpec(DistinctValuesSpec.class)
-         .withSpec(TableProfileSpec.class).withSpec(DuplicatesSpec.class).withSpec(StartRunSpec.class).withSpec(GetRunSpec.class));
+         .withSpec(CompareSpec.class).withSpec(ShiftSpec.class).withSpec(CorrelationSpec.class).withSpec(ScatterSpec.class).withSpec(CrosstabSpec.class)
+         .withSpec(WatchPreviewSpec.class).withSpec(PivotSpec.class).withSpec(TableProfileSpec.class).withSpec(DuplicatesSpec.class).withSpec(StartRunSpec.class).withSpec(GetRunSpec.class));
    }
 
    /*******************************************************************************
-    ** Common schema catalog and path parameters for the seven JSON specs.
+    ** Common schema catalog and path parameters for the analysis JSON specs.
     *******************************************************************************/
    public abstract static class ProfileSpec extends AbstractJsonEndpointSpec
    {
@@ -116,9 +123,9 @@ public class DataAnalysisApi
       @Override
       public List<Parameter> defineRequestParameters()
       {
-         String name = path.contains("{table}") ? "table" : path.contains("{runId}") ? "runId" : null;
+         String name = path.contains("{table}") ? "table" : path.contains("{runId}") ? "runId" : path.contains("{id}") ? "id" : null;
          return (name == null ? List.of() : List.of(new Parameter().withName(name).withIn(In.PATH).withRequired(true)
-            .withDescription(name.equals("table") ? "QQQ table name to analyze." : "Owner-scoped analysis run id.").withSchema(new Schema().withType(Type.STRING))));
+            .withDescription(name.equals("table") ? "QQQ table name to analyze." : "Owner-scoped analysis run or watch id.").withSchema(new Schema().withType(Type.STRING))));
       }
 
       /*******************************************************************************
@@ -184,7 +191,7 @@ public class DataAnalysisApi
             throw new IllegalArgumentException("exact must be a boolean.");
          }
          QQueryFilter filter = body.get("filter") == null ? null : JsonUtils.toObject(JsonUtils.toJson(body.get("filter")), QQueryFilter.class);
-         validateFilter(filter, readable);
+         validateFilter(filter);
          List<String> fields = null;
          if(body.get("fields") != null)
          {
@@ -224,7 +231,7 @@ public class DataAnalysisApi
    /*******************************************************************************
     ** Bad filter fields fail before any aggregate or cached result is consulted.
     *******************************************************************************/
-   private static void validateFilter(QQueryFilter filter, List<String> readable)
+   private static void validateFilter(QQueryFilter filter)
    {
       if(filter == null)
       {
@@ -232,13 +239,12 @@ public class DataAnalysisApi
       }
       for(var criterion : filter.getCriteria())
       {
-         if(criterion.getOperator() == null || !readable.contains(criterion.getFieldName())
-            || criterion.getOtherFieldName() != null && !readable.contains(criterion.getOtherFieldName()))
+         if(criterion.getOperator() == null || criterion.getFieldName() == null)
          {
             throw new IllegalArgumentException("Choose readable filter fields and a valid operator.");
          }
       }
-      filter.getSubFilters().forEach(sub -> validateFilter(sub, readable));
+      filter.getSubFilters().forEach(sub -> validateFilter(sub));
    }
 
    /*******************************************************************************
@@ -504,4 +510,284 @@ public class DataAnalysisApi
       };
       return (result);
    }
+
+   /*******************************************************************************
+    ** Group records by row and column dimensions.
+    *******************************************************************************/
+   public static class PivotSpec extends ProfileSpec
+   {
+      /*******************************************************************************
+       ** Publish assistant-friendly grouping and measure capabilities.
+       *******************************************************************************/
+      public PivotSpec()
+      {
+         super("/tables/{table}/pivot", HttpMethod.POST, "Explore a pivot table",
+            "Group records by up to 3 row and 2 column fields (with date or numeric buckets) and compute counts, sums, averages, min/max, distinct counts or percentiles per cell; every cell has a drill-through filter.", "PivotRequest", "Pivot");
+      }
+
+      /*******************************************************************************
+       ** Strict body validation precedes the session-bound engine.
+       *******************************************************************************/
+      @Override
+      protected Object handle(JsonInput input) throws Exception
+      {
+         String tableName = input.getPathParam("table");
+         table(tableName);
+         DataAnalysisRuntime.service().capabilities(tableName);
+         PivotRequest pivot;
+         try
+         {
+            Map<String, Object> body = input.getBody();
+            integer(body, "limitGroups", 50, 1, 200);
+            if(body.containsKey("showTotals") && !(body.get("showTotals") instanceof Boolean))
+            {
+               throw new IllegalArgumentException("showTotals must be a boolean.");
+            }
+            for(String axis : List.of("rows", "columns"))
+            {
+               if(body.containsKey(axis))
+               {
+                  if(!(body.get(axis) instanceof List<?> dimensions))
+                  {
+                     throw new IllegalArgumentException("Dimensions must be arrays.");
+                  }
+                  for(Object dimension : dimensions)
+                  {
+                     if(!(dimension instanceof Map<?, ?> map) || !(map.get("field") instanceof String))
+                     {
+                        throw new IllegalArgumentException("Each dimension requires a field name.");
+                     }
+                     if(map.get("numericBins") instanceof Map<?, ?> bins)
+                     {
+                        Object count = bins.get("count");
+                        if(count != null && (!(count instanceof Number number) || number.doubleValue() != number.intValue()))
+                        {
+                           throw new IllegalArgumentException("Bin count must be an integer.");
+                        }
+                     }
+                  }
+               }
+            }
+            if(!(body.get("values") instanceof List<?> values) || values.stream().anyMatch(v -> !(v instanceof Map<?, ?> m)
+               || !(m.get("operator") instanceof String) || m.get("field") != null && !(m.get("field") instanceof String)))
+            {
+               throw new IllegalArgumentException("Measures require an operator and optional field name.");
+            }
+            pivot = JsonUtils.toObject(JsonUtils.toJson(body), PivotRequest.class).withTableName(tableName);
+            validateFilter(pivot.getFilter());
+         }
+         catch(Exception e)
+         {
+            throw new QBadRequestException("Invalid pivot request.");
+         }
+         return (transport(DataAnalysisRuntime.service().pivot(pivot), DataAnalysisSchemas.DataAnalysisPivotV1.class));
+      }
+   }
+
+   /*******************************************************************************
+    ** Strict JSON types before Jackson conversion; engine validates FULL fields.
+    *******************************************************************************/
+   private static <T> T relationshipRequest(String tableName, Map<String, Object> body, Class<T> type) throws Exception
+   {
+      table(tableName);
+      DataAnalysisRuntime.service().capabilities(tableName);
+      try
+      {
+         for(String name : List.of("field", "dateField", "bucket", "xField", "yField", "rowField", "columnField", "labelA", "labelB"))
+         {
+            if(body.containsKey(name) && !(body.get(name) instanceof String))
+            {
+               throw new IllegalArgumentException("Expected a field name or label.");
+            }
+         }
+         if(body.containsKey("fields") && (!(body.get("fields") instanceof List<?> fields) || fields.stream().anyMatch(f -> !(f instanceof String))))
+         {
+            throw new IllegalArgumentException("Expected an array of field names.");
+         }
+         if(body.containsKey("limit"))
+         {
+            integer(body, "limit", 2000, 1, type == CrosstabRequest.class ? 20 : 2000);
+         }
+         for(String name : List.of("filter", "filterA", "filterB"))
+         {
+            Object filter = body.get(name);
+            if(filter != null)
+            {
+               if(!(filter instanceof Map<?, ?>))
+               {
+                  throw new IllegalArgumentException("Expected a query filter object.");
+               }
+               validateFilter(JsonUtils.toObject(JsonUtils.toJson(filter), QQueryFilter.class));
+            }
+         }
+         return (JsonUtils.toObject(JsonUtils.toJson(body), type));
+      }
+      catch(Exception e)
+      {
+         throw new QBadRequestException("Invalid relationship request.");
+      }
+   }
+
+   /*******************************************************************************
+    ** Compare filtered A with filtered B (null means the whole permitted table). Return means, medians or category shares, B-minus-A deltas, valid significance tests and count-equivalent drills. Only FULL fields are accepted.
+    *******************************************************************************/
+   public static class CompareSpec extends ProfileSpec
+   {
+      /*******************************************************************************
+       ** Public constructor for endpoint and assistant discovery.
+       *******************************************************************************/
+      public CompareSpec()
+      {
+         super("/tables/{table}/compare", HttpMethod.POST, "Compare two populations",
+            "Compare filtered A with filtered B (null means the whole permitted table). Return means, medians or category shares, B-minus-A deltas, valid significance tests and count-equivalent drills. Only FULL fields are accepted.", "CompareRequest", "Compare");
+      }
+
+      /*******************************************************************************
+       ** Execute with the calling session and versioned transport contract.
+       *******************************************************************************/
+      @Override
+      protected Object handle(JsonInput input) throws Exception
+      {
+         String tableName = input.getPathParam("table");
+         CompareRequest request = relationshipRequest(tableName, input.getBody(), CompareRequest.class).withTableName(tableName);
+         return (transport(DataAnalysisRuntime.service().compare(request), RelationshipSchemas.DataAnalysisCompareV1.class));
+      }
+   }
+
+   /*******************************************************************************
+    ** Compare category shares or numeric quartiles across session-timezone calendar buckets. Compute descriptive PSI between the first and last complete nonempty buckets using fixed categories or baseline quartile bins.
+    *******************************************************************************/
+   public static class ShiftSpec extends ProfileSpec
+   {
+      /*******************************************************************************
+       ** Public constructor for endpoint and assistant discovery.
+       *******************************************************************************/
+      public ShiftSpec()
+      {
+         super("/tables/{table}/shift", HttpMethod.POST, "Measure distribution shift over time",
+            "Compare category shares or numeric quartiles across session-timezone calendar buckets. Compute descriptive PSI between the first and last complete nonempty buckets using fixed categories or baseline quartile bins.", "ShiftRequest", "Shift");
+      }
+
+      /*******************************************************************************
+       ** Execute with the calling session and versioned transport contract.
+       *******************************************************************************/
+      @Override
+      protected Object handle(JsonInput input) throws Exception
+      {
+         String tableName = input.getPathParam("table");
+         ShiftRequest request = relationshipRequest(tableName, input.getBody(), ShiftRequest.class).withTableName(tableName);
+         return (transport(DataAnalysisRuntime.service().shift(request), RelationshipSchemas.DataAnalysisShiftV1.class));
+      }
+   }
+
+   /*******************************************************************************
+    ** Compute a Pearson correlation matrix for 2 to 12 distinct FULL numeric fields, using paired non-null records. Every cell includes n and parameters for the scatter endpoint; core pushes down CORR or uses bounded streaming.
+    *******************************************************************************/
+   public static class CorrelationSpec extends ProfileSpec
+   {
+      /*******************************************************************************
+       ** Public constructor for endpoint and assistant discovery.
+       *******************************************************************************/
+      public CorrelationSpec()
+      {
+         super("/tables/{table}/correlation", HttpMethod.POST, "Find numeric relationships",
+            "Compute a Pearson correlation matrix for 2 to 12 distinct FULL numeric fields, using paired non-null records. Every cell includes n and parameters for the scatter endpoint; core pushes down CORR or uses bounded streaming.", "CorrelationRequest", "Correlation");
+      }
+
+      /*******************************************************************************
+       ** Execute with the calling session and versioned transport contract.
+       *******************************************************************************/
+      @Override
+      protected Object handle(JsonInput input) throws Exception
+      {
+         String tableName = input.getPathParam("table");
+         CorrelationRequest request = relationshipRequest(tableName, input.getBody(), CorrelationRequest.class).withTableName(tableName);
+         return (transport(DataAnalysisRuntime.service().correlation(request), RelationshipSchemas.DataAnalysisCorrelationV1.class));
+      }
+   }
+
+   /*******************************************************************************
+    ** Return at most 2000 paired numeric points as the user, ordered by primary key when core query sampling is unavailable, plus a least-squares line fitted to the sample. Privacy disables individual drills and suppresses small populations.
+    *******************************************************************************/
+   public static class ScatterSpec extends ProfileSpec
+   {
+      /*******************************************************************************
+       ** Public constructor for endpoint and assistant discovery.
+       *******************************************************************************/
+      public ScatterSpec()
+      {
+         super("/tables/{table}/scatter", HttpMethod.POST, "Inspect a numeric relationship",
+            "Return at most 2000 paired numeric points as the user, ordered by primary key when core query sampling is unavailable, plus a least-squares line fitted to the sample. Privacy disables individual drills and suppresses small populations.", "ScatterRequest", "Scatter");
+      }
+
+      /*******************************************************************************
+       ** Execute with the calling session and versioned transport contract.
+       *******************************************************************************/
+      @Override
+      protected Object handle(JsonInput input) throws Exception
+      {
+         String tableName = input.getPathParam("table");
+         ScatterRequest request = relationshipRequest(tableName, input.getBody(), ScatterRequest.class).withTableName(tableName);
+         return (transport(DataAnalysisRuntime.service().scatter(request), RelationshipSchemas.DataAnalysisScatterV1.class));
+      }
+   }
+
+   /*******************************************************************************
+    ** Count combinations of two FULL fields with row and column shares, up to 20 categories per axis plus Other. Test independence using chi-square and Cramer V after pooling low expected counts; privacy suppresses small cells and their drills.
+    *******************************************************************************/
+   public static class CrosstabSpec extends ProfileSpec
+   {
+      /*******************************************************************************
+       ** Public constructor for endpoint and assistant discovery.
+       *******************************************************************************/
+      public CrosstabSpec()
+      {
+         super("/tables/{table}/crosstab", HttpMethod.POST, "Cross-tabulate two fields",
+            "Count combinations of two FULL fields with row and column shares, up to 20 categories per axis plus Other. Test independence using chi-square and Cramer V after pooling low expected counts; privacy suppresses small cells and their drills.", "CrosstabRequest", "Crosstab");
+      }
+
+      /*******************************************************************************
+       ** Execute with the calling session and versioned transport contract.
+       *******************************************************************************/
+      @Override
+      protected Object handle(JsonInput input) throws Exception
+      {
+         String tableName = input.getPathParam("table");
+         CrosstabRequest request = relationshipRequest(tableName, input.getBody(), CrosstabRequest.class).withTableName(tableName);
+         return (transport(DataAnalysisRuntime.service().crosstab(request), RelationshipSchemas.DataAnalysisCrosstabV1.class));
+      }
+   }
+
+   /*******************************************************************************
+    ** Read-only watch preview; standard table endpoints own watch CRUD.
+    *******************************************************************************/
+   public static class WatchPreviewSpec extends ProfileSpec
+   {
+      /*******************************************************************************
+       ** Publish a side-effect-free detector preview for a saved watch.
+       *******************************************************************************/
+      public WatchPreviewSpec()
+      {
+         super("/watches/{id}/preview", HttpMethod.POST, "Preview an anomaly watch",
+            "Compute complete time buckets and a detector verdict under the signed-in user's READ, Analyze and FULL-field permissions. Includes a baseline band annotation. Does not update the watch or raise alerts.", null, "WatchPreview");
+      }
+
+      /*******************************************************************************
+       ** Missing or inaccessible watch ids return the same not-found response.
+       *******************************************************************************/
+      @Override
+      protected Object handle(JsonInput input) throws Exception
+      {
+         Integer id;
+         try
+         {
+            id = Integer.valueOf(input.getPathParam("id"));
+         }
+         catch(NumberFormatException e)
+         {
+            throw new QBadRequestException("Watch id must be an integer.");
+         }
+         return (transport(DataAnalysisRuntime.watches().preview(id, java.time.Instant.now()), WatchSchemas.DataAnalysisWatchPreviewV1.class));
+      }
+   }
 }

src/main/java/com/kingsrook/qbits/dataanalysis/api/DataAnalysisSchemas.java

@@ -106,6 +106,16 @@ public class DataAnalysisSchemas
       result.put("DataAnalysisLimitsV1", new DataAnalysisLimitsV1().toSchema());
       result.put("DataAnalysisStartRunRequestV1", new DataAnalysisStartRunRequestV1().toSchema());
       result.put("DataAnalysisRunStartedV1", new DataAnalysisRunStartedV1().toSchema());
+      result.put("DataAnalysisPivotRequestV1", new DataAnalysisPivotRequestV1().toSchema());
+      result.put("DataAnalysisPivotDimensionV1", new DataAnalysisPivotDimensionV1().toSchema());
+      result.put("DataAnalysisPivotNumericBinsV1", new DataAnalysisPivotNumericBinsV1().toSchema());
+      result.put("DataAnalysisPivotMeasureV1", new DataAnalysisPivotMeasureV1().toSchema());
+      result.put("DataAnalysisPivotHeaderV1", new DataAnalysisPivotHeaderV1().toSchema());
+      result.put("DataAnalysisPivotMeasureInfoV1", new DataAnalysisPivotMeasureInfoV1().toSchema());
+      result.put("DataAnalysisPivotCellV1", new DataAnalysisPivotCellV1().toSchema());
+      result.put("DataAnalysisPivotV1", new DataAnalysisPivotV1().toSchema());
+      result.putAll(RelationshipSchemas.components());
+      result.putAll(WatchSchemas.components());
       return (result);
    }
 
@@ -173,6 +183,9 @@ public class DataAnalysisSchemas
       @OpenAPIDescription("Semantic field kind: NUMERIC, DATE, DATE_TIME, TEXT, BOOLEAN or CATEGORY.")
       public ChartKind kind;
 
+      @OpenAPIDescription("Stack category series to a total share of one when true.")
+      public Boolean stacked;
+
       @OpenAPIDescription("Alternatives.")
       public List<ChartKind> alternatives;
 
@@ -195,6 +208,7 @@ public class DataAnalysisSchemas
       public Schema toSchema()
       {
          Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("stacked", new Schema().withType(Type.BOOLEAN).withNullable(true).withDescription("Stack category series to a total share of one when true."));
          properties.put("kind", new Schema().withType(Type.STRING).withEnumValues(java.util.Arrays.stream(ChartKind.values()).map(Enum::name).toList()).withDescription("Semantic field kind: NUMERIC, DATE, DATE_TIME, TEXT, BOOLEAN or CATEGORY.").withNullable(true));
          properties.put("alternatives", new Schema().withType(Type.ARRAY).withItems(new Schema().withType(Type.STRING).withEnumValues(java.util.Arrays.stream(ChartKind.values()).map(Enum::name).toList())).withDescription("Alternatives.").withNullable(true));
          properties.put("x", ref("DataAnalysisAxisV1").withDescription("X.").withNullable(true));
@@ -1146,4 +1160,281 @@ public class DataAnalysisSchemas
          return (new Schema().withType(Type.OBJECT).withNullable(true).withProperties(properties));
       }
    }
+
+   /*******************************************************************************
+    ** Nested arrays share the same explicit schema construction.
+    *******************************************************************************/
+   private static Schema array(Schema items)
+   {
+      return (new Schema().withType(Type.ARRAY).withItems(items));
+   }
+
+   /*******************************************************************************
+    ** PivotRequest version 1 transport contract.
+    *******************************************************************************/
+   public static class DataAnalysisPivotRequestV1 implements ToSchema
+   {
+      @OpenAPIDescription("User query filter, passed through for core enforcement.")
+      public QQueryFilter filter;
+
+      @OpenAPIDescription("One to three row dimensions.")
+      public List<DataAnalysisPivotDimensionV1> rows;
+
+      @OpenAPIDescription("Zero to two column dimensions; defaults to empty.")
+      public List<DataAnalysisPivotDimensionV1> columns;
+
+      @OpenAPIDescription("One to six measures.")
+      public List<DataAnalysisPivotMeasureV1> values;
+
+      @OpenAPIDescription("Include row, column and grand totals; defaults to true.")
+      public Boolean showTotals;
+
+      @OpenAPIDescription("Kept groups per dimension; default 50, maximum 200.")
+      public Integer limitGroups;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone extension contract.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("filter", ref("QueryFilter").withDescription("User query filter, passed through for core enforcement."));
+         properties.put("rows", array(ref("DataAnalysisPivotDimensionV1")).withDescription("One to three row dimensions."));
+         properties.put("columns", array(ref("DataAnalysisPivotDimensionV1")).withDescription("Zero to two column dimensions; defaults to empty."));
+         properties.put("values", array(ref("DataAnalysisPivotMeasureV1")).withDescription("One to six measures."));
+         properties.put("showTotals", new Schema().withType(Type.BOOLEAN).withDescription("Include row, column and grand totals; defaults to true."));
+         properties.put("limitGroups", new Schema().withType(Type.INTEGER).withDescription("Kept groups per dimension; default 50, maximum 200."));
+         return (new RequiredSchema(List.of("rows", "values")).withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** PivotDimension version 1 transport contract.
+    *******************************************************************************/
+   public static class DataAnalysisPivotDimensionV1 implements ToSchema
+   {
+      @OpenAPIDescription("FULL field name, optionally joinTable.field through an exposed join.")
+      public String field;
+
+      @OpenAPIDescription("Optional calendar or cyclic bucket in the session timezone.")
+      public String dateBucket;
+
+      @OpenAPIDescription("Optional equal-width numeric bins; mutually exclusive with dateBucket.")
+      public DataAnalysisPivotNumericBinsV1 numericBins;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone extension contract.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("field", new Schema().withType(Type.STRING).withDescription("FULL field name, optionally joinTable.field through an exposed join."));
+         properties.put("dateBucket", new Schema().withType(Type.STRING).withEnumValues(List.of("YEAR", "QUARTER", "MONTH", "WEEK", "DAY", "HOUR", "DAY_OF_WEEK", "HOUR_OF_DAY")).withDescription("Optional calendar or cyclic bucket in the session timezone."));
+         properties.put("numericBins", ref("DataAnalysisPivotNumericBinsV1").withDescription("Optional equal-width numeric bins; mutually exclusive with dateBucket."));
+         return (new RequiredSchema(List.of("field")).withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** PivotNumericBins version 1 transport contract.
+    *******************************************************************************/
+   public static class DataAnalysisPivotNumericBinsV1 implements ToSchema
+   {
+      @OpenAPIDescription("Number of bins, 1–200; defaults to 20.")
+      public Integer count;
+
+      @OpenAPIDescription("Optional explicit lower bound; otherwise a nice enclosing edge.")
+      public BigDecimal min;
+
+      @OpenAPIDescription("Optional explicit upper bound; final interior bin includes this value.")
+      public BigDecimal max;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone extension contract.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("count", new Schema().withType(Type.INTEGER).withDescription("Number of bins, 1–200; defaults to 20."));
+         properties.put("min", new Schema().withType(Type.NUMBER).withDescription("Optional explicit lower bound; otherwise a nice enclosing edge."));
+         properties.put("max", new Schema().withType(Type.NUMBER).withDescription("Optional explicit upper bound; final interior bin includes this value."));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** PivotMeasure version 1 transport contract.
+    *******************************************************************************/
+   public static class DataAnalysisPivotMeasureV1 implements ToSchema
+   {
+      @OpenAPIDescription("Aggregate operator. COUNT counts records, including null values.")
+      public String operator;
+
+      @OpenAPIDescription("FULL field to aggregate; optional for COUNT.")
+      public String field;
+
+      @OpenAPIDescription("PERCENTILE only: percentile_cont fraction from 0 to 1.")
+      public BigDecimal percentile;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone extension contract.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("operator", new Schema().withType(Type.STRING).withEnumValues(List.of("COUNT", "SUM", "AVG", "MIN", "MAX", "COUNT_DISTINCT", "PERCENTILE")).withDescription("Aggregate operator. COUNT counts records, including null values."));
+         properties.put("field", new Schema().withType(Type.STRING).withDescription("FULL field to aggregate; optional for COUNT."));
+         properties.put("percentile", new Schema().withType(Type.NUMBER).withDescription("PERCENTILE only: percentile_cont fraction from 0 to 1."));
+         return (new RequiredSchema(List.of("operator")).withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** PivotHeader version 1 transport contract.
+    *******************************************************************************/
+   public static class DataAnalysisPivotHeaderV1 implements ToSchema
+   {
+      @OpenAPIDescription("Typed group key; null for a blank group or Other.")
+      public Serializable value;
+
+      @OpenAPIDescription("Display label, including Other (k groups).")
+      public String label;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone extension contract.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("value", new Schema().withNullable(true).withDescription("Typed group key; null for a blank group or Other."));
+         properties.put("label", new Schema().withType(Type.STRING).withDescription("Display label, including Other (k groups)."));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** PivotMeasureInfo version 1 transport contract.
+    *******************************************************************************/
+   public static class DataAnalysisPivotMeasureInfoV1 implements ToSchema
+   {
+      @OpenAPIDescription("Stable measure key by request position.")
+      public String key;
+
+      @OpenAPIDescription("Display label.")
+      public String label;
+
+      @OpenAPIDescription("Semantic metric type.")
+      public ValueType valueType;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone extension contract.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("key", new Schema().withType(Type.STRING).withDescription("Stable measure key by request position."));
+         properties.put("label", new Schema().withType(Type.STRING).withDescription("Display label."));
+         properties.put("valueType", new Schema().withType(Type.STRING).withEnumValues(java.util.Arrays.stream(ValueType.values()).map(Enum::name).toList()).withDescription("Semantic metric type."));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** PivotCell version 1 transport contract.
+    *******************************************************************************/
+   public static class DataAnalysisPivotCellV1 implements ToSchema
+   {
+      @OpenAPIDescription("Zero-based index in rowHeaders.")
+      public Integer rowIndex;
+
+      @OpenAPIDescription("Zero-based index in columnHeaders.")
+      public Integer columnIndex;
+
+      @OpenAPIDescription("Metrics in requested measure order; suppressed metrics have no value or drill.")
+      public List<DataAnalysisMetricV1> values;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone extension contract.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("rowIndex", new Schema().withType(Type.INTEGER).withDescription("Zero-based index in rowHeaders."));
+         properties.put("columnIndex", new Schema().withType(Type.INTEGER).withDescription("Zero-based index in columnHeaders."));
+         properties.put("values", array(ref("DataAnalysisMetricV1")).withDescription("Metrics in requested measure order; suppressed metrics have no value or drill."));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** Pivot version 1 transport contract.
+    *******************************************************************************/
+   public static class DataAnalysisPivotV1 implements ToSchema
+   {
+      @OpenAPIDescription("Row header tuples in cell-index order.")
+      public List<List<DataAnalysisPivotHeaderV1>> rowHeaders;
+
+      @OpenAPIDescription("Column header tuples; an empty tuple represents no column dimensions.")
+      public List<List<DataAnalysisPivotHeaderV1>> columnHeaders;
+
+      @OpenAPIDescription("Measure metadata in request order.")
+      public List<DataAnalysisPivotMeasureInfoV1> measures;
+
+      @OpenAPIDescription("Sparse cells; absent combinations are not materialized.")
+      public List<DataAnalysisPivotCellV1> cells;
+
+      @OpenAPIDescription("Metric tuples aligned with rowHeaders; empty when totals disabled.")
+      public List<List<DataAnalysisMetricV1>> rowTotals;
+
+      @OpenAPIDescription("Metric tuples aligned with columnHeaders; empty when totals disabled.")
+      public List<List<DataAnalysisMetricV1>> columnTotals;
+
+      @OpenAPIDescription("Grand-total metrics; empty when totals disabled.")
+      public List<DataAnalysisMetricV1> grandTotals;
+
+      @OpenAPIDescription("Row groups were merged into Other.")
+      public Boolean truncatedRows;
+
+      @OpenAPIDescription("Column groups were merged into Other.")
+      public Boolean truncatedColumns;
+
+      @OpenAPIDescription("True when bounded streamed fallback produced a partial result.")
+      public Boolean estimate;
+
+      @OpenAPIDescription("Privacy, partial-result and joined-drill limitations.")
+      public List<String> warnings;
+
+      @OpenAPIDescription("UTC timestamp of computation.")
+      public String asOf;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone extension contract.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("rowHeaders", array(array(ref("DataAnalysisPivotHeaderV1"))).withDescription("Row header tuples in cell-index order."));
+         properties.put("columnHeaders", array(array(ref("DataAnalysisPivotHeaderV1"))).withDescription("Column header tuples; an empty tuple represents no column dimensions."));
+         properties.put("measures", array(ref("DataAnalysisPivotMeasureInfoV1")).withDescription("Measure metadata in request order."));
+         properties.put("cells", array(ref("DataAnalysisPivotCellV1")).withDescription("Sparse cells; absent combinations are not materialized."));
+         properties.put("rowTotals", array(array(ref("DataAnalysisMetricV1"))).withDescription("Metric tuples aligned with rowHeaders; empty when totals disabled."));
+         properties.put("columnTotals", array(array(ref("DataAnalysisMetricV1"))).withDescription("Metric tuples aligned with columnHeaders; empty when totals disabled."));
+         properties.put("grandTotals", array(ref("DataAnalysisMetricV1")).withDescription("Grand-total metrics; empty when totals disabled."));
+         properties.put("truncatedRows", new Schema().withType(Type.BOOLEAN).withDescription("Row groups were merged into Other."));
+         properties.put("truncatedColumns", new Schema().withType(Type.BOOLEAN).withDescription("Column groups were merged into Other."));
+         properties.put("estimate", new Schema().withType(Type.BOOLEAN).withDescription("True when bounded streamed fallback produced a partial result."));
+         properties.put("warnings", array(new Schema().withType(Type.STRING)).withDescription("Privacy, partial-result and joined-drill limitations."));
+         properties.put("asOf", new Schema().withType(Type.STRING).withDescription("UTC timestamp of computation."));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
 }

src/main/java/com/kingsrook/qbits/dataanalysis/api/RelationshipSchemas.java

@@ -0,0 +1,663 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.api;
+
+import java.io.Serializable;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.middleware.javalin.schemabuilder.ToSchema;
+import com.kingsrook.qqq.middleware.javalin.schemabuilder.annotations.OpenAPIDescription;
+import com.kingsrook.qqq.openapi.model.Schema;
+import com.kingsrook.qqq.openapi.model.Type;
+
+/*******************************************************************************
+ ** Explicit version-one contracts for compare and relationships.
+ *******************************************************************************/
+public class RelationshipSchemas
+{
+   /*******************************************************************************
+    ** Register every referenced response and request component.
+    *******************************************************************************/
+   public static Map<String, Schema> components()
+   {
+      Map<String, Schema> result = new LinkedHashMap<>();
+      result.put("DataAnalysisCompareRequestV1", new DataAnalysisCompareRequestV1().toSchema());
+      result.put("DataAnalysisShiftRequestV1", new DataAnalysisShiftRequestV1().toSchema());
+      result.put("DataAnalysisCorrelationRequestV1", new DataAnalysisCorrelationRequestV1().toSchema());
+      result.put("DataAnalysisScatterRequestV1", new DataAnalysisScatterRequestV1().toSchema());
+      result.put("DataAnalysisCrosstabRequestV1", new DataAnalysisCrosstabRequestV1().toSchema());
+      result.put("DataAnalysisSignificanceV1", new DataAnalysisSignificanceV1().toSchema());
+      result.put("DataAnalysisComparisonSideV1", new DataAnalysisComparisonSideV1().toSchema());
+      result.put("DataAnalysisComparisonValueV1", new DataAnalysisComparisonValueV1().toSchema());
+      result.put("DataAnalysisFieldComparisonV1", new DataAnalysisFieldComparisonV1().toSchema());
+      result.put("DataAnalysisCompareV1", new DataAnalysisCompareV1().toSchema());
+      result.put("DataAnalysisShiftBucketV1", new DataAnalysisShiftBucketV1().toSchema());
+      result.put("DataAnalysisShiftV1", new DataAnalysisShiftV1().toSchema());
+      result.put("DataAnalysisCorrelationCellV1", new DataAnalysisCorrelationCellV1().toSchema());
+      result.put("DataAnalysisCorrelationV1", new DataAnalysisCorrelationV1().toSchema());
+      result.put("DataAnalysisTrendLineV1", new DataAnalysisTrendLineV1().toSchema());
+      result.put("DataAnalysisScatterV1", new DataAnalysisScatterV1().toSchema());
+      result.put("DataAnalysisCrosstabCellV1", new DataAnalysisCrosstabCellV1().toSchema());
+      result.put("DataAnalysisCrosstabV1", new DataAnalysisCrosstabV1().toSchema());
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Reuse the common metric, filter and chart contracts.
+    *******************************************************************************/
+   private static Schema ref(String name)
+   {
+      return (new Schema().withRef("#/components/schemas/" + name));
+   }
+
+   /*******************************************************************************
+    ** CompareRequest version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisCompareRequestV1 implements ToSchema
+   {
+      @OpenAPIDescription("Population A filter; null selects the whole permitted table.")
+      public QQueryFilter filterA;
+
+      @OpenAPIDescription("Population B filter; null selects the whole permitted table.")
+      public QQueryFilter filterB;
+
+      @OpenAPIDescription("Display name of population A; default A.")
+      public String labelA;
+
+      @OpenAPIDescription("Display name of population B; default B.")
+      public String labelB;
+
+      @OpenAPIDescription("Distinct FULL fields to analyze; correlation requires 2 to 12 numeric fields.")
+      public List<String> fields;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("filterA", ref("QueryFilter").withDescription("Population A filter; null selects the whole permitted table.").withNullable(true));
+         properties.put("filterB", ref("QueryFilter").withDescription("Population B filter; null selects the whole permitted table.").withNullable(true));
+         properties.put("labelA", new Schema().withType(Type.STRING).withDescription("Display name of population A; default A."));
+         properties.put("labelB", new Schema().withType(Type.STRING).withDescription("Display name of population B; default B."));
+         properties.put("fields", new Schema().withType(Type.ARRAY).withItems(new Schema().withType(Type.STRING)).withDescription("Distinct FULL fields to analyze; correlation requires 2 to 12 numeric fields."));
+         return (new DataAnalysisSchemas.RequiredSchema(List.of("fields")).withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** ShiftRequest version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisShiftRequestV1 implements ToSchema
+   {
+      @OpenAPIDescription("Current-user query filter; record locks and core field rules apply.")
+      public QQueryFilter filter;
+
+      @OpenAPIDescription("FULL field whose distribution is compared over time.")
+      public String field;
+
+      @OpenAPIDescription("FULL DATE or DATE_TIME field for session-timezone calendar buckets.")
+      public String dateField;
+
+      @OpenAPIDescription("Calendar unit: HOUR, DAY, WEEK, MONTH, QUARTER or YEAR; default MONTH.")
+      public String bucket;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("filter", ref("QueryFilter").withDescription("Current-user query filter; record locks and core field rules apply.").withNullable(true));
+         properties.put("field", new Schema().withType(Type.STRING).withDescription("FULL field whose distribution is compared over time."));
+         properties.put("dateField", new Schema().withType(Type.STRING).withDescription("FULL DATE or DATE_TIME field for session-timezone calendar buckets."));
+         properties.put("bucket", new Schema().withType(Type.STRING).withDescription("Calendar unit: HOUR, DAY, WEEK, MONTH, QUARTER or YEAR; default MONTH."));
+         return (new DataAnalysisSchemas.RequiredSchema(List.of("field", "dateField")).withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** CorrelationRequest version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisCorrelationRequestV1 implements ToSchema
+   {
+      @OpenAPIDescription("Current-user query filter; record locks and core field rules apply.")
+      public QQueryFilter filter;
+
+      @OpenAPIDescription("Distinct FULL fields to analyze; correlation requires 2 to 12 numeric fields.")
+      public List<String> fields;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("filter", ref("QueryFilter").withDescription("Current-user query filter; record locks and core field rules apply.").withNullable(true));
+         properties.put("fields", new Schema().withType(Type.ARRAY).withItems(new Schema().withType(Type.STRING)).withDescription("Distinct FULL fields to analyze; correlation requires 2 to 12 numeric fields."));
+         return (new DataAnalysisSchemas.RequiredSchema(List.of("fields")).withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** ScatterRequest version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisScatterRequestV1 implements ToSchema
+   {
+      @OpenAPIDescription("Table for the scatter link; route parameter takes precedence.")
+      public String tableName;
+
+      @OpenAPIDescription("Compatibility flag; scatter always returns the bounded sample.")
+      public Boolean exact;
+      @OpenAPIDescription("Current-user query filter; record locks and core field rules apply.")
+      public QQueryFilter filter;
+
+      @OpenAPIDescription("FULL numeric field on the x axis.")
+      public String xField;
+
+      @OpenAPIDescription("FULL numeric field on the y axis.")
+      public String yField;
+
+      @OpenAPIDescription("Maximum sample points (1 to 2000, default 2000) or kept crosstab categories per axis (1 to 20, default 20).")
+      public Integer limit;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("tableName", new Schema().withType(Type.STRING).withDescription("Table for the scatter link; route parameter takes precedence.").withNullable(true));
+         properties.put("exact", new Schema().withType(Type.BOOLEAN).withDescription("Compatibility flag; scatter always returns the bounded sample.").withNullable(true));
+         properties.put("filter", ref("QueryFilter").withDescription("Current-user query filter; record locks and core field rules apply.").withNullable(true));
+         properties.put("xField", new Schema().withType(Type.STRING).withDescription("FULL numeric field on the x axis."));
+         properties.put("yField", new Schema().withType(Type.STRING).withDescription("FULL numeric field on the y axis."));
+         properties.put("limit", new Schema().withType(Type.INTEGER).withDescription("Maximum sample points (1 to 2000, default 2000) or kept crosstab categories per axis (1 to 20, default 20)."));
+         return (new DataAnalysisSchemas.RequiredSchema(List.of("xField", "yField")).withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** CrosstabRequest version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisCrosstabRequestV1 implements ToSchema
+   {
+      @OpenAPIDescription("Current-user query filter; record locks and core field rules apply.")
+      public QQueryFilter filter;
+
+      @OpenAPIDescription("FULL field defining crosstab rows.")
+      public String rowField;
+
+      @OpenAPIDescription("FULL field defining crosstab columns.")
+      public String columnField;
+
+      @OpenAPIDescription("Maximum sample points (1 to 2000, default 2000) or kept crosstab categories per axis (1 to 20, default 20).")
+      public Integer limit;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("filter", ref("QueryFilter").withDescription("Current-user query filter; record locks and core field rules apply.").withNullable(true));
+         properties.put("rowField", new Schema().withType(Type.STRING).withDescription("FULL field defining crosstab rows."));
+         properties.put("columnField", new Schema().withType(Type.STRING).withDescription("FULL field defining crosstab columns."));
+         properties.put("limit", new Schema().withType(Type.INTEGER).withDescription("Maximum sample points (1 to 2000, default 2000) or kept crosstab categories per axis (1 to 20, default 20)."));
+         return (new DataAnalysisSchemas.RequiredSchema(List.of("rowField", "columnField")).withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** Significance version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisSignificanceV1 implements ToSchema
+   {
+      @OpenAPIDescription("Test.")
+      public String test;
+
+      @OpenAPIDescription("Statistic.")
+      public Double statistic;
+
+      @OpenAPIDescription("Degrees of freedom; null when undefined.")
+      public Double df;
+
+      @OpenAPIDescription("Two-sided p-value; p >= 0.05 is never significant.")
+      public Double pValue;
+
+      @OpenAPIDescription("Whether all test validity and privacy requirements hold.")
+      public Boolean applicable;
+
+      @OpenAPIDescription("Plain-language result or reason the statistic is not applicable.")
+      public String sentence;
+
+      @OpenAPIDescription("Cramer association strength computed on the pooled contingency table; null when invalid.")
+      public Double cramersV;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("test", new Schema().withType(Type.STRING).withDescription("Test.").withNullable(true));
+         properties.put("statistic", new Schema().withType(Type.NUMBER).withDescription("Statistic.").withNullable(true));
+         properties.put("df", new Schema().withType(Type.NUMBER).withDescription("Degrees of freedom; null when undefined.").withNullable(true));
+         properties.put("pValue", new Schema().withType(Type.NUMBER).withDescription("Two-sided p-value; p >= 0.05 is never significant.").withNullable(true));
+         properties.put("applicable", new Schema().withType(Type.BOOLEAN).withDescription("Whether all test validity and privacy requirements hold.").withNullable(true));
+         properties.put("sentence", new Schema().withType(Type.STRING).withDescription("Plain-language result or reason the statistic is not applicable.").withNullable(true));
+         properties.put("cramersV", new Schema().withType(Type.NUMBER).withDescription("Cramer association strength computed on the pooled contingency table; null when invalid.").withNullable(true));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** ComparisonSide version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisComparisonSideV1 implements ToSchema
+   {
+      @OpenAPIDescription("Label.")
+      public String label;
+
+      @OpenAPIDescription("Typed metrics with exact population drills unless privacy suppresses them.")
+      public List<DataAnalysisSchemas.DataAnalysisMetricV1> metrics;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("label", new Schema().withType(Type.STRING).withDescription("Label.").withNullable(true));
+         properties.put("metrics", new Schema().withType(Type.ARRAY).withItems(ref("DataAnalysisMetricV1")).withDescription("Typed metrics with exact population drills unless privacy suppresses them.").withNullable(true));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** ComparisonValue version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisComparisonValueV1 implements ToSchema
+   {
+      @OpenAPIDescription("Value.")
+      public Serializable value;
+
+      @OpenAPIDescription("Label.")
+      public String label;
+
+      @OpenAPIDescription("Side a.")
+      public DataAnalysisComparisonSideV1 sideA;
+
+      @OpenAPIDescription("Side b.")
+      public DataAnalysisComparisonSideV1 sideB;
+
+      @OpenAPIDescription("B minus A, in original units (share differences are fractions).")
+      public DataAnalysisSchemas.DataAnalysisMetricV1 delta;
+
+      @OpenAPIDescription("(B minus A) divided by absolute A, a fraction; null at a zero baseline.")
+      public DataAnalysisSchemas.DataAnalysisMetricV1 percentDelta;
+
+      @OpenAPIDescription("Test assumptions, two-sided p-value, degrees of freedom and plain-language conclusion.")
+      public DataAnalysisSignificanceV1 significance;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("value", new Schema().withDescription("Value.").withNullable(true));
+         properties.put("label", new Schema().withType(Type.STRING).withDescription("Label.").withNullable(true));
+         properties.put("sideA", ref("DataAnalysisComparisonSideV1").withDescription("Side a.").withNullable(true));
+         properties.put("sideB", ref("DataAnalysisComparisonSideV1").withDescription("Side b.").withNullable(true));
+         properties.put("delta", ref("DataAnalysisMetricV1").withDescription("B minus A, in original units (share differences are fractions).").withNullable(true));
+         properties.put("percentDelta", ref("DataAnalysisMetricV1").withDescription("(B minus A) divided by absolute A, a fraction; null at a zero baseline.").withNullable(true));
+         properties.put("significance", ref("DataAnalysisSignificanceV1").withDescription("Test assumptions, two-sided p-value, degrees of freedom and plain-language conclusion.").withNullable(true));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** FieldComparison version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisFieldComparisonV1 implements ToSchema
+   {
+      @OpenAPIDescription("FULL field whose distribution is compared over time.")
+      public String field;
+
+      @OpenAPIDescription("Values.")
+      public List<DataAnalysisComparisonValueV1> values;
+
+      @OpenAPIDescription("Test assumptions, two-sided p-value, degrees of freedom and plain-language conclusion.")
+      public DataAnalysisSignificanceV1 significance;
+
+      @OpenAPIDescription("Semantic series; category comparisons are grouped and category time series are stacked.")
+      public DataAnalysisSchemas.DataAnalysisChartV1 chart;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("field", new Schema().withType(Type.STRING).withDescription("FULL field whose distribution is compared over time.").withNullable(true));
+         properties.put("values", new Schema().withType(Type.ARRAY).withItems(ref("DataAnalysisComparisonValueV1")).withDescription("Values.").withNullable(true));
+         properties.put("significance", ref("DataAnalysisSignificanceV1").withDescription("Test assumptions, two-sided p-value, degrees of freedom and plain-language conclusion.").withNullable(true));
+         properties.put("chart", ref("DataAnalysisChartV1").withDescription("Semantic series; category comparisons are grouped and category time series are stacked.").withNullable(true));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** CompareResult version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisCompareV1 implements ToSchema
+   {
+      @OpenAPIDescription("Distinct FULL fields to analyze; correlation requires 2 to 12 numeric fields.")
+      public List<DataAnalysisFieldComparisonV1> fields;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("fields", new Schema().withType(Type.ARRAY).withItems(ref("DataAnalysisFieldComparisonV1")).withDescription("Distinct FULL fields to analyze; correlation requires 2 to 12 numeric fields.").withNullable(true));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** ShiftBucket version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisShiftBucketV1 implements ToSchema
+   {
+      @OpenAPIDescription("Value.")
+      public Serializable value;
+
+      @OpenAPIDescription("Label.")
+      public String label;
+
+      @OpenAPIDescription("True when the calendar bucket end has passed in the session timezone.")
+      public Boolean complete;
+
+      @OpenAPIDescription("Typed metrics with exact population drills unless privacy suppresses them.")
+      public List<DataAnalysisSchemas.DataAnalysisMetricV1> metrics;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("value", new Schema().withDescription("Value.").withNullable(true));
+         properties.put("label", new Schema().withType(Type.STRING).withDescription("Label.").withNullable(true));
+         properties.put("complete", new Schema().withType(Type.BOOLEAN).withDescription("True when the calendar bucket end has passed in the session timezone.").withNullable(true));
+         properties.put("metrics", new Schema().withType(Type.ARRAY).withItems(ref("DataAnalysisMetricV1")).withDescription("Typed metrics with exact population drills unless privacy suppresses them.").withNullable(true));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** ShiftResult version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisShiftV1 implements ToSchema
+   {
+      @OpenAPIDescription("Buckets.")
+      public List<DataAnalysisShiftBucketV1> buckets;
+
+      @OpenAPIDescription("Population stability index, null when inapplicable; zero shares are floored at 0.000001.")
+      public DataAnalysisSchemas.DataAnalysisMetricV1 psi;
+
+      @OpenAPIDescription("Plain-language result or reason the statistic is not applicable.")
+      public String sentence;
+
+      @OpenAPIDescription("Semantic series; category comparisons are grouped and category time series are stacked.")
+      public DataAnalysisSchemas.DataAnalysisChartV1 chart;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("buckets", new Schema().withType(Type.ARRAY).withItems(ref("DataAnalysisShiftBucketV1")).withDescription("Buckets.").withNullable(true));
+         properties.put("psi", ref("DataAnalysisMetricV1").withDescription("Population stability index, null when inapplicable; zero shares are floored at 0.000001.").withNullable(true));
+         properties.put("sentence", new Schema().withType(Type.STRING).withDescription("Plain-language result or reason the statistic is not applicable.").withNullable(true));
+         properties.put("chart", ref("DataAnalysisChartV1").withDescription("Semantic series; category comparisons are grouped and category time series are stacked.").withNullable(true));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** CorrelationCell version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisCorrelationCellV1 implements ToSchema
+   {
+      @OpenAPIDescription("FULL numeric field on the x axis.")
+      public String xField;
+
+      @OpenAPIDescription("FULL numeric field on the y axis.")
+      public String yField;
+
+      @OpenAPIDescription("Pairwise non-null population count; null when privacy suppresses it.")
+      public Long n;
+
+      @OpenAPIDescription("Pearson correlation; null for insufficient data, zero variance or privacy suppression.")
+      public Double r;
+
+      @OpenAPIDescription("POST the included parameters to the table scatter endpoint.")
+      public DataAnalysisScatterRequestV1 scatter;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("xField", new Schema().withType(Type.STRING).withDescription("FULL numeric field on the x axis.").withNullable(true));
+         properties.put("yField", new Schema().withType(Type.STRING).withDescription("FULL numeric field on the y axis.").withNullable(true));
+         properties.put("n", new Schema().withType(Type.INTEGER).withDescription("Pairwise non-null population count; null when privacy suppresses it.").withNullable(true));
+         properties.put("r", new Schema().withType(Type.NUMBER).withDescription("Pearson correlation; null for insufficient data, zero variance or privacy suppression.").withNullable(true));
+         properties.put("scatter", ref("DataAnalysisScatterRequestV1").withDescription("POST the included parameters to the table scatter endpoint.").withNullable(true));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** CorrelationResult version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisCorrelationV1 implements ToSchema
+   {
+      @OpenAPIDescription("Distinct FULL fields to analyze; correlation requires 2 to 12 numeric fields.")
+      public List<String> fields;
+
+      @OpenAPIDescription("Cells.")
+      public List<DataAnalysisCorrelationCellV1> cells;
+
+      @OpenAPIDescription("Semantic series; category comparisons are grouped and category time series are stacked.")
+      public DataAnalysisSchemas.DataAnalysisChartV1 chart;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("fields", new Schema().withType(Type.ARRAY).withItems(new Schema().withType(Type.STRING)).withDescription("Distinct FULL fields to analyze; correlation requires 2 to 12 numeric fields.").withNullable(true));
+         properties.put("cells", new Schema().withType(Type.ARRAY).withItems(ref("DataAnalysisCorrelationCellV1")).withDescription("Cells.").withNullable(true));
+         properties.put("chart", ref("DataAnalysisChartV1").withDescription("Semantic series; category comparisons are grouped and category time series are stacked.").withNullable(true));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** TrendLine version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisTrendLineV1 implements ToSchema
+   {
+      @OpenAPIDescription("Slope.")
+      public Double slope;
+
+      @OpenAPIDescription("Intercept.")
+      public Double intercept;
+
+      @OpenAPIDescription("Pearson correlation; null for insufficient data, zero variance or privacy suppression.")
+      public Double r;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("slope", new Schema().withType(Type.NUMBER).withDescription("Slope.").withNullable(true));
+         properties.put("intercept", new Schema().withType(Type.NUMBER).withDescription("Intercept.").withNullable(true));
+         properties.put("r", new Schema().withType(Type.NUMBER).withDescription("Pearson correlation; null for insufficient data, zero variance or privacy suppression.").withNullable(true));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** ScatterResult version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisScatterV1 implements ToSchema
+   {
+      @OpenAPIDescription("Pairwise non-null population count; null when privacy suppresses it.")
+      public Long n;
+
+      @OpenAPIDescription("Number of displayed paired records.")
+      public Integer sampleSize;
+
+      @OpenAPIDescription("Sampling method; core query currently uses a deterministic primary-key prefix.")
+      public String sampling;
+
+      @OpenAPIDescription("Points.")
+      public List<DataAnalysisSchemas.DataAnalysisPointV1> points;
+
+      @OpenAPIDescription("Least-squares slope, intercept and r fitted to the displayed sample.")
+      public DataAnalysisTrendLineV1 trend;
+
+      @OpenAPIDescription("Semantic series; category comparisons are grouped and category time series are stacked.")
+      public DataAnalysisSchemas.DataAnalysisChartV1 chart;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("n", new Schema().withType(Type.INTEGER).withDescription("Pairwise non-null population count; null when privacy suppresses it.").withNullable(true));
+         properties.put("sampleSize", new Schema().withType(Type.INTEGER).withDescription("Number of displayed paired records.").withNullable(true));
+         properties.put("sampling", new Schema().withType(Type.STRING).withDescription("Sampling method; core query currently uses a deterministic primary-key prefix.").withNullable(true));
+         properties.put("points", new Schema().withType(Type.ARRAY).withItems(ref("DataAnalysisPointV1")).withDescription("Points.").withNullable(true));
+         properties.put("trend", ref("DataAnalysisTrendLineV1").withDescription("Least-squares slope, intercept and r fitted to the displayed sample.").withNullable(true));
+         properties.put("chart", ref("DataAnalysisChartV1").withDescription("Semantic series; category comparisons are grouped and category time series are stacked.").withNullable(true));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** CrosstabCell version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisCrosstabCellV1 implements ToSchema
+   {
+      @OpenAPIDescription("Row index.")
+      public Integer rowIndex;
+
+      @OpenAPIDescription("Column index.")
+      public Integer columnIndex;
+
+      @OpenAPIDescription("Cell count with its exact drill, or a suppressed metric.")
+      public DataAnalysisSchemas.DataAnalysisMetricV1 count;
+
+      @OpenAPIDescription("Cell count divided by row total; suppressed if it could disclose a hidden cell.")
+      public DataAnalysisSchemas.DataAnalysisMetricV1 rowShare;
+
+      @OpenAPIDescription("Cell count divided by column total; suppressed if it could disclose a hidden cell.")
+      public DataAnalysisSchemas.DataAnalysisMetricV1 columnShare;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("rowIndex", new Schema().withType(Type.INTEGER).withDescription("Row index.").withNullable(true));
+         properties.put("columnIndex", new Schema().withType(Type.INTEGER).withDescription("Column index.").withNullable(true));
+         properties.put("count", ref("DataAnalysisMetricV1").withDescription("Cell count with its exact drill, or a suppressed metric.").withNullable(true));
+         properties.put("rowShare", ref("DataAnalysisMetricV1").withDescription("Cell count divided by row total; suppressed if it could disclose a hidden cell.").withNullable(true));
+         properties.put("columnShare", ref("DataAnalysisMetricV1").withDescription("Cell count divided by column total; suppressed if it could disclose a hidden cell.").withNullable(true));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** CrosstabResult version-one transport model.
+    *******************************************************************************/
+   public static class DataAnalysisCrosstabV1 implements ToSchema
+   {
+      @OpenAPIDescription("Rows.")
+      public List<DataAnalysisSchemas.DataAnalysisPivotHeaderV1> rows;
+
+      @OpenAPIDescription("Columns.")
+      public List<DataAnalysisSchemas.DataAnalysisPivotHeaderV1> columns;
+
+      @OpenAPIDescription("Cells.")
+      public List<DataAnalysisCrosstabCellV1> cells;
+
+      @OpenAPIDescription("Test assumptions, two-sided p-value, degrees of freedom and plain-language conclusion.")
+      public DataAnalysisSignificanceV1 significance;
+
+      /*******************************************************************************
+       ** Explicit references preserve the standalone OpenAPI fragment.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("rows", new Schema().withType(Type.ARRAY).withItems(ref("DataAnalysisPivotHeaderV1")).withDescription("Rows.").withNullable(true));
+         properties.put("columns", new Schema().withType(Type.ARRAY).withItems(ref("DataAnalysisPivotHeaderV1")).withDescription("Columns.").withNullable(true));
+         properties.put("cells", new Schema().withType(Type.ARRAY).withItems(ref("DataAnalysisCrosstabCellV1")).withDescription("Cells.").withNullable(true));
+         properties.put("significance", ref("DataAnalysisSignificanceV1").withDescription("Test assumptions, two-sided p-value, degrees of freedom and plain-language conclusion.").withNullable(true));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/api/WatchSchemas.java

@@ -0,0 +1,126 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.api;
+
+import java.io.Serializable;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qqq.middleware.javalin.schemabuilder.ToSchema;
+import com.kingsrook.qqq.openapi.model.Schema;
+import com.kingsrook.qqq.openapi.model.Type;
+
+/*******************************************************************************
+ ** Standalone watch preview contracts referencing the existing chart and drill.
+ *******************************************************************************/
+public class WatchSchemas
+{
+   /*******************************************************************************
+    ** Register every referenced version-one watch response component.
+    *******************************************************************************/
+   public static Map<String, Schema> components()
+   {
+      return (Map.of("DataAnalysisWatchPreviewV1", new DataAnalysisWatchPreviewV1().toSchema(),
+         "DataAnalysisWatchBucketV1", new DataAnalysisWatchBucketV1().toSchema(),
+         "DataAnalysisWatchVerdictV1", new DataAnalysisWatchVerdictV1().toSchema()));
+   }
+
+   /*******************************************************************************
+    ** One complete bucket; suppressed series never expose categories or drills.
+    *******************************************************************************/
+   public static class DataAnalysisWatchBucketV1 implements ToSchema
+   {
+      public Serializable start;
+      public Double value;
+      public List<String> categories;
+      public DataAnalysisSchemas.DataAnalysisDrillV1 drill;
+
+      /*******************************************************************************
+       ** Explicit nullable types and component references.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("start", new Schema().withType(Type.STRING).withDescription("Calendar date or hour-start instant in the user's time zone."));
+         properties.put("value", new Schema().withType(Type.NUMBER).withNullable(true));
+         properties.put("categories", new Schema().withType(Type.ARRAY).withItems(new Schema().withType(Type.STRING)));
+         properties.put("drill", new Schema().withRef("#/components/schemas/DataAnalysisDrillV1").withNullable(true));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** Unevaluated means no state change; baseline bounds describe the annotation.
+    *******************************************************************************/
+   public static class DataAnalysisWatchVerdictV1 implements ToSchema
+   {
+      public Boolean evaluated;
+      public Boolean firing;
+      public Double value;
+      public Double baseline;
+      public Double baselineLow;
+      public Double baselineHigh;
+      public String message;
+      public DataAnalysisSchemas.DataAnalysisDrillV1 drill;
+
+      /*******************************************************************************
+       ** Carry numeric baseline bounds as well as the plain-English explanation.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("evaluated", new Schema().withType(Type.BOOLEAN).withDescription("False for insufficient history or privacy suppression; must not resolve an alert."));
+         properties.put("firing", new Schema().withType(Type.BOOLEAN));
+         for(String field : List.of("value", "baseline", "baselineLow", "baselineHigh"))
+         {
+            properties.put(field, new Schema().withType(Type.NUMBER).withNullable(true));
+         }
+         properties.put("message", new Schema().withType(Type.STRING));
+         properties.put("drill", new Schema().withRef("#/components/schemas/DataAnalysisDrillV1").withNullable(true));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+
+   /*******************************************************************************
+    ** Complete preview, using the same semantic chart as other analysis endpoints.
+    *******************************************************************************/
+   public static class DataAnalysisWatchPreviewV1 implements ToSchema
+   {
+      public List<DataAnalysisWatchBucketV1> series;
+      public DataAnalysisSchemas.DataAnalysisChartV1 chart;
+      public DataAnalysisWatchVerdictV1 verdict;
+
+      /*******************************************************************************
+       ** Stable references let clients vendor this fragment without middleware.
+       *******************************************************************************/
+      @Override
+      public Schema toSchema()
+      {
+         Map<String, Schema> properties = new LinkedHashMap<>();
+         properties.put("series", new Schema().withType(Type.ARRAY).withItems(new Schema().withRef("#/components/schemas/DataAnalysisWatchBucketV1")));
+         properties.put("chart", new Schema().withRef("#/components/schemas/DataAnalysisChartV1").withDescription("TIME_SERIES with baseline band annotations."));
+         properties.put("verdict", new Schema().withRef("#/components/schemas/DataAnalysisWatchVerdictV1"));
+         return (new Schema().withType(Type.OBJECT).withProperties(properties));
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/app/DataAnalysisHome.java

@@ -158,6 +158,27 @@ public class DataAnalysisHome extends AbstractWidgetRenderer
          {
             html.append("<p>No watches yet.</p>");
          }
+         QueryInput watches = new QueryInput(DataAnalysisTables.WATCH).withShouldFetchHeavyFields(true)
+            .withFilter(new QQueryFilter().withOrderBy(new QFilterOrderBy("state", true)).withOrderBy(new QFilterOrderBy("id", false)).withLimit(5));
+         watches.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+         List<QRecord> recent = new QueryAction().execute(watches).getRecords();
+         if(!recent.isEmpty())
+         {
+            html.append("<ul>");
+            for(QRecord watch : recent)
+            {
+               String path = QContext.getQInstance().getTablePath(DataAnalysisTables.WATCH) + "/" + watch.getValueInteger("id");
+               html.append("<li><a href=\"").append(escape(path)).append("\">")
+                  .append(escape(words(watch.getValueString("state")))).append(" &middot; ")
+                  .append(escape(words(watch.getValueString("detector")))).append("</a>");
+               if(watch.getValueString("last_message") != null)
+               {
+                  html.append(" — ").append(escape(watch.getValueString("last_message")));
+               }
+               html.append("</li>");
+            }
+            html.append("</ul>");
+         }
          link(html, DataAnalysisTables.WATCH);
       }
       else

src/main/java/com/kingsrook/qbits/dataanalysis/engine/AnalysisDrillGuard.java

@@ -0,0 +1,168 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.util.Set;
+import com.kingsrook.qbits.dataanalysis.result.CandidateKey;
+import com.kingsrook.qbits.dataanalysis.result.Chart;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfile;
+import com.kingsrook.qbits.dataanalysis.result.DateProfile;
+import com.kingsrook.qbits.dataanalysis.result.DistinctValuesPage;
+import com.kingsrook.qbits.dataanalysis.result.Drill;
+import com.kingsrook.qbits.dataanalysis.result.DuplicatesResult;
+import com.kingsrook.qbits.dataanalysis.result.FieldSummary;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.NumericProfile;
+import com.kingsrook.qbits.dataanalysis.result.Point;
+import com.kingsrook.qbits.dataanalysis.result.Series;
+import com.kingsrook.qbits.dataanalysis.result.TableProfile;
+import com.kingsrook.qbits.dataanalysis.result.TextProfile;
+import com.kingsrook.qbits.dataanalysis.result.ValueCount;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+
+/*******************************************************************************
+ ** Final defense for profile-generated drills, including representative primary
+ ** keys and prefix bounds. User-authored predicates remain intact; unsafe generated
+ ** drills are disabled rather than broadened by removing their conditions.
+ *******************************************************************************/
+public class AnalysisDrillGuard
+{
+   private final Set<String> fields;
+   private final String original;
+
+   /*******************************************************************************
+    ** Resolve FULL fields once per completed result.
+    *******************************************************************************/
+   public AnalysisDrillGuard(Set<String> fields, QQueryFilter original)
+   {
+      this.fields = fields;
+      this.original = JsonUtils.toJson(DrillFilters.copy(original));
+   }
+
+   /*******************************************************************************
+    ** Visit only typed result containers, never the caller's query.
+    *******************************************************************************/
+   public void apply(Object value)
+   {
+      if(value instanceof Iterable<?> list)
+      {
+         list.forEach(this::apply);
+      }
+      else if(value instanceof Metric metric)
+      {
+         metric.withDrill(permitted(metric.getDrill()));
+      }
+      else if(value instanceof ValueCount count)
+      {
+         count.withDrill(permitted(count.getDrill()));
+      }
+      else if(value instanceof Point point)
+      {
+         point.withDrill(permitted(point.getDrill()));
+      }
+      else if(value instanceof CandidateKey key)
+      {
+         key.withDrill(permitted(key.getDrill()));
+      }
+      else if(value instanceof ColumnProfile profile)
+      {
+         apply(profile.getCounts());
+         apply(profile.getTopValues());
+         apply(profile.getBooleans());
+         apply(profile.getNumeric());
+         apply(profile.getDates());
+         apply(profile.getText());
+         apply(profile.getChart());
+      }
+      else if(value instanceof NumericProfile profile)
+      {
+         apply(profile.getMetrics());
+         apply(profile.getHistogram());
+         apply(profile.getOutliers());
+      }
+      else if(value instanceof DateProfile profile)
+      {
+         apply(profile.getMetrics());
+         apply(profile.getBuckets());
+         apply(profile.getGaps());
+         apply(profile.getDayOfWeek());
+         apply(profile.getHourOfDay());
+      }
+      else if(value instanceof TextProfile profile)
+      {
+         apply(profile.getMetrics());
+         apply(profile.getHistogram());
+         apply(profile.getPatterns());
+      }
+      else if(value instanceof TableProfile profile)
+      {
+         apply(profile.getRowCount());
+         apply(profile.getFields());
+         apply(profile.getCandidateKeys());
+         apply(profile.getHeatmap());
+      }
+      else if(value instanceof FieldSummary field)
+      {
+         apply(field.getNulls());
+         apply(field.getBlanks());
+      }
+      else if(value instanceof Chart chart)
+      {
+         apply(chart.getSeries());
+      }
+      else if(value instanceof Series series)
+      {
+         apply(series.getPoints());
+      }
+      else if(value instanceof DistinctValuesPage page)
+      {
+         apply(page.getValues());
+      }
+      else if(value instanceof DuplicatesResult result)
+      {
+         apply(result.getGroups());
+      }
+   }
+
+   /*******************************************************************************
+    ** Preserve count equivalence by removing the entire unsafe drill.
+    *******************************************************************************/
+   private Drill permitted(Drill drill)
+   {
+      return (drill == null || safe(drill.getFilter()) ? drill : null);
+   }
+
+   /*******************************************************************************
+    ** An exact copy of a user subtree is exempt from analysis field restrictions.
+    *******************************************************************************/
+   private boolean safe(QQueryFilter filter)
+   {
+      if(original.equals(JsonUtils.toJson(DrillFilters.copy(filter))))
+      {
+         return (true);
+      }
+      return (filter.getCriteria().stream().allMatch(c -> fields.contains(c.getFieldName())
+         && (c.getOtherFieldName() == null || fields.contains(c.getOtherFieldName()))
+         && (c.getFieldFunction() == null || fields.contains(c.getFieldFunction().getFieldName())))
+         && filter.getSubFilters().stream().allMatch(this::safe));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/AnalysisLabels.java

@@ -25,7 +25,6 @@ import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Set;
 import com.kingsrook.qqq.backend.core.actions.metadata.personalization.TableMetaDataPersonalizerAction;
-import com.kingsrook.qqq.backend.core.actions.permissions.FieldSecurityLockHelper;
 import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
 import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
 import com.kingsrook.qqq.backend.core.actions.values.QPossibleValueTranslator;
@@ -64,7 +63,7 @@ public final class AnalysisLabels
     *******************************************************************************/
    public static String translate(QFieldMetaData field, Serializable value) throws QException
    {
-      return (translate(field, value, new LinkedHashSet<>()));
+      return (translate(field, value, CoreTierFieldAccessResolver.defaultResolver()));
    }
 
 
@@ -72,12 +71,24 @@ public final class AnalysisLabels
    /*******************************************************************************
     ** Resolve nested PVS label fields without invoking core's trusted lookup path.
     *******************************************************************************/
-   private static String translate(QFieldMetaData field, Serializable value, Set<String> visited) throws QException
+   public static String translate(QFieldMetaData field, Serializable value, FieldAnalysisAccessResolver access) throws QException
+   {
+      return (translate(field, value, new LinkedHashSet<>(), access));
+   }
+
+   /*******************************************************************************
+    ** Resolve nested labels only through FULL fields under the host policy.
+    *******************************************************************************/
+   private static String translate(QFieldMetaData field, Serializable value, Set<String> visited, FieldAnalysisAccessResolver access) throws QException
    {
       if(value == null)
       {
          return (null);
       }
+      if(field.getType() == com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType.BOOLEAN)
+      {
+         return (com.kingsrook.qqq.backend.core.utils.ValueUtils.getValueAsBoolean(value) ? "Yes" : "No");
+      }
       String fallback = value.toString();
       QPossibleValueSource source = QContext.getQInstance().getPossibleValueSource(field.getPossibleValueSourceName());
       if(source == null || visited.size() >= 8 || !visited.add(source.getName()))
@@ -98,7 +109,7 @@ public final class AnalysisLabels
          List<String> labelFields = original.getRecordLabelFields() == null ? List.of() : original.getRecordLabelFields();
          for(String labelField : labelFields)
          {
-            if(!table.getFields().containsKey(labelField) || !FieldSecurityLockHelper.isFieldAccessible(table.getField(labelField)))
+            if(!table.getFields().containsKey(labelField) || access.resolve(table, table.getField(labelField)) != FieldAnalysisAccess.FULL)
             {
                return (fallback);
             }
@@ -119,7 +130,7 @@ public final class AnalysisLabels
             QFieldMetaData labelMetadata = table.getField(labelField);
             if(labelMetadata.getPossibleValueSourceName() != null)
             {
-               record.withDisplayValue(labelField, translate(labelMetadata, record.getValue(labelField), visited));
+               record.withDisplayValue(labelField, translate(labelMetadata, record.getValue(labelField), visited, access));
             }
          }
          String label = QValueFormatter.formatRecordLabel(table, record);
@@ -144,6 +155,14 @@ public final class AnalysisLabels
     ** host changing field/record locks cannot release older translated labels.
     *******************************************************************************/
    public static java.util.Map<String, Object> policy(String tableName) throws QException
+   {
+      return (policy(tableName, CoreTierFieldAccessResolver.defaultResolver()));
+   }
+
+   /*******************************************************************************
+    ** Include host-resolved tiers of related labels in the exact-run identity.
+    *******************************************************************************/
+   public static java.util.Map<String, Object> policy(String tableName, FieldAnalysisAccessResolver access) throws QException
    {
       java.util.Map<String, Object> result = new java.util.TreeMap<>();
       java.util.ArrayDeque<String> pending = new java.util.ArrayDeque<>();
@@ -160,6 +179,7 @@ public final class AnalysisLabels
          QTableMetaData table = TableMetaDataPersonalizerAction.execute(input, true);
          java.util.Map<String, Object> entry = new java.util.TreeMap<>();
          entry.put("fields", table.getFields());
+         entry.put("fullFields", table.getFields().values().stream().filter(f -> access.resolve(table, f) == FieldAnalysisAccess.FULL).map(QFieldMetaData::getName).sorted().toList());
          entry.put("locks", table.getRecordSecurityLocks());
          entry.put("labelFields", table.getRecordLabelFields());
          entry.put("labelFormat", table.getRecordLabelFormat());

src/main/java/com/kingsrook/qbits/dataanalysis/engine/AnalysisSecurity.java

@@ -20,19 +20,21 @@
 
 package com.kingsrook.qbits.dataanalysis.engine;
 
+import java.io.Serializable;
 import java.util.List;
 import com.kingsrook.qbits.dataanalysis.permissions.DataAnalysisPermissions;
 import com.kingsrook.qqq.backend.core.actions.metadata.personalization.TableMetaDataPersonalizerAction;
-import com.kingsrook.qqq.backend.core.actions.permissions.FieldSecurityLockHelper;
 import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
 import com.kingsrook.qqq.backend.core.actions.permissions.PermissionsHelper;
 import com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType;
 import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
 import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
 import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
 
 /*******************************************************************************
  ** Fail closed before any source-table computation, including cache retrieval.
@@ -40,17 +42,27 @@ import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
 public class AnalysisSecurity
 {
    private final EffectiveConfigResolver configs;
+   private final FieldAnalysisAccessResolver fieldAccess;
 
    /*******************************************************************************
     ** Use the runtime's configuration policy.
     *******************************************************************************/
    public AnalysisSecurity(EffectiveConfigResolver configs)
    {
-      this.configs = configs;
+      this(configs, CoreTierFieldAccessResolver.defaultResolver());
    }
 
 
 
+   /*******************************************************************************
+    ** Bind the host field policy.
+    *******************************************************************************/
+   public AnalysisSecurity(EffectiveConfigResolver configs, FieldAnalysisAccessResolver fieldAccess)
+   {
+      this.configs = configs;
+      this.fieldAccess = fieldAccess;
+   }
+
    /*******************************************************************************
     ** Explicit enforcement is independent of the instance's default switch.
     *******************************************************************************/
@@ -76,7 +88,7 @@ public class AnalysisSecurity
    {
       QTableMetaData table = table(name);
       EffectiveConfig c = configs.resolve(name);
-      return (table.getFields().values().stream().filter(FieldSecurityLockHelper::isFieldAccessible)
+      return (table.getFields().values().stream().filter(f -> fieldAccess.resolve(table, f) == FieldAnalysisAccess.FULL)
          .filter(f -> c.getAnalyzableFields().isEmpty() || c.getAnalyzableFields().contains(f.getName()))
          .filter(f -> !c.getExcludedFields().contains(f.getName())).toList());
    }
@@ -89,6 +101,50 @@ public class AnalysisSecurity
    public QFieldMetaData field(String table, String field) throws QException
    {
       return (analyzableFields(table).stream().filter(f -> f.getName().equals(field)).findFirst()
-         .orElseThrow(() -> new QPermissionDeniedException("Analysis is unavailable for this field.")));
+         .orElseThrow(() -> new QBadRequestException("Unknown analysis field.")));
+   }
+
+   /*******************************************************************************
+    ** Core fingerprint plus the sorted FULL-field list, hashed by the run identity.
+    *******************************************************************************/
+   public String accessFingerprint(String table) throws QException
+   {
+      return (fieldAccess.getAccessFingerprint() + ":" + JsonUtils.toJson(analyzableFields(table).stream().map(QFieldMetaData::getName).sorted().toList()));
+   }
+
+   /*******************************************************************************
+    ** Check a joined field without requiring the related table analyze permission.
+    *******************************************************************************/
+   public QFieldMetaData joinedField(String tableName, String fieldName) throws QException
+   {
+      QTableMetaData table = joinedTable(tableName);
+      QFieldMetaData field = table.getFields().get(fieldName);
+      if(field == null || fieldAccess.resolve(table, field) != FieldAnalysisAccess.FULL)
+      {
+         throw new QBadRequestException("Unknown analysis field.");
+      }
+      return (field);
+   }
+
+   /*******************************************************************************
+    ** Display labels use the same policy as the selected pivot field.
+    *******************************************************************************/
+   public String label(QFieldMetaData field, Serializable value) throws QException
+   {
+      return (AnalysisLabels.translate(field, value, fieldAccess));
+   }
+
+   /*******************************************************************************
+    ** Each intermediate exposed-join table requires READ, without analyze rights.
+    *******************************************************************************/
+   public QTableMetaData joinedTable(String tableName) throws QException
+   {
+      QueryInput input = new QueryInput(tableName);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      if(QContext.getQInstance().getTable(tableName) == null || !PermissionsHelper.hasTablePermission(input, tableName, TablePermissionSubType.READ))
+      {
+         throw new QBadRequestException("Unknown analysis field.");
+      }
+      return (TableMetaDataPersonalizerAction.execute(input, true));
    }
 }

src/main/java/com/kingsrook/qbits/dataanalysis/engine/ColumnProfiler.java

@@ -48,13 +48,23 @@ import com.kingsrook.qqq.backend.core.utils.ValueUtils;
 public class ColumnProfiler
 {
    private final AnalysisBackend backend;
+   private final FieldAnalysisAccessResolver fieldAccess;
 
    /*******************************************************************************
     ** The backend can be replaced when core's new operators ship.
     *******************************************************************************/
    public ColumnProfiler(AnalysisBackend backend)
+   {
+      this(backend, CoreTierFieldAccessResolver.defaultResolver());
+   }
+
+   /*******************************************************************************
+    ** Bind the host field policy for possible-value labels.
+    *******************************************************************************/
+   public ColumnProfiler(AnalysisBackend backend, FieldAnalysisAccessResolver fieldAccess)
    {
       this.backend = backend;
+      this.fieldAccess = fieldAccess;
    }
 
 
@@ -82,7 +92,7 @@ public class ColumnProfiler
       }
       result.getCounts().add(ProfileSupport.count("distinct", counts.distinct(), table, drillFilter, counts.distinctFilter()));
       result.getCounts().add(ProfileSupport.metric("uniqueness", counts.uniqueness(), ValueType.PERCENT));
-      result.withTopValues(ProfileSupport.values(table, drillFilter, field, backend.topValues(table, filter, name, 20, 0, null), rows));
+      result.withTopValues(ProfileSupport.values(table, drillFilter, field, backend.topValues(table, filter, name, 20, 0, null), rows, fieldAccess));
       QFieldType type = field.getType();
       if(type == QFieldType.INTEGER || type == QFieldType.LONG || type == QFieldType.DECIMAL)
       {

src/main/java/com/kingsrook/qbits/dataanalysis/engine/ComparisonExplorer.java

@@ -0,0 +1,254 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.math.BigDecimal;
+import java.math.MathContext;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.dataanalysis.result.ChartKind;
+import com.kingsrook.qbits.dataanalysis.result.CompareRequest;
+import com.kingsrook.qbits.dataanalysis.result.CompareResult;
+import com.kingsrook.qbits.dataanalysis.result.ComparisonSide;
+import com.kingsrook.qbits.dataanalysis.result.ComparisonValue;
+import com.kingsrook.qbits.dataanalysis.result.FieldComparison;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.Point;
+import com.kingsrook.qbits.dataanalysis.result.Series;
+import com.kingsrook.qbits.dataanalysis.result.ValueType;
+import com.kingsrook.qbits.dataanalysis.stats.Statistics;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.Aggregate;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+/*******************************************************************************
+ ** Two populations share category boundaries and exact producing predicates.
+ *******************************************************************************/
+public class ComparisonExplorer extends RelationshipSupport
+{
+   /*******************************************************************************
+    ** Bind request-local policy without modifying session metadata.
+    *******************************************************************************/
+   public ComparisonExplorer(AnalysisSecurity security, EffectiveConfig config, String table)
+   {
+      super(security, config, table);
+   }
+
+   /*******************************************************************************
+    ** Resolve every field before issuing source queries.
+    *******************************************************************************/
+   public CompareResult compare(CompareRequest request) throws QException
+   {
+      if(request.getFields() == null || request.getFields().isEmpty() || request.getFields().size() > 100
+         || request.getFields().stream().distinct().count() != request.getFields().size())
+      {
+         throw new QBadRequestException("Choose 1 to 100 distinct analysis fields.");
+      }
+      for(String field : request.getFields())
+      {
+         full(field);
+      }
+      CompareResult result = new CompareResult();
+      for(String field : request.getFields())
+      {
+         result.getFields().add(numeric(full(field)) ? numericComparison(request, field) : categoryComparison(request, field));
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** All moments and quartiles are computed together by core, including VAR_SAMP.
+    *******************************************************************************/
+   protected Map<String, BigDecimal> moments(String field, QQueryFilter filter) throws QException
+   {
+      Map<String, Aggregate> measures = new LinkedHashMap<>();
+      measures.put("count", measure(field, AggregateOperator.COUNT));
+      measures.put("mean", measure(field, AggregateOperator.AVG));
+      measures.put("variance", measure(field, AggregateOperator.VAR_SAMP));
+      measures.put("min", measure(field, AggregateOperator.MIN));
+      measures.put("max", measure(field, AggregateOperator.MAX));
+      for(int p : List.of(25, 50, 75))
+      {
+         measures.put("p" + p, measure(field, AggregateOperator.PERCENTILE_CONT).withPercentile(BigDecimal.valueOf(p, 2)));
+      }
+      var row = summarize(filter, new ArrayList<>(measures.values()));
+      Map<String, BigDecimal> result = new LinkedHashMap<>();
+      measures.forEach((name, aggregate) -> result.put(name, decimal(row.getAggregateValues().get(aggregate))));
+      result.putIfAbsent("count", BigDecimal.ZERO);
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Two BOX series retain all five summary values; mean and median get drills.
+    *******************************************************************************/
+   private FieldComparison numericComparison(CompareRequest request, String field) throws QException
+   {
+      Map<String, BigDecimal> a = moments(field, request.getFilterA());
+      Map<String, BigDecimal> b = moments(field, request.getFilterB());
+      long nA = a.get("count").longValue();
+      long nB = b.get("count").longValue();
+      ComparisonSide sideA = numericSide(field, request.getLabelA(), request.getFilterA(), a);
+      ComparisonSide sideB = numericSide(field, request.getLabelB(), request.getFilterB(), b);
+      ComparisonValue value = new ComparisonValue().withSideA(sideA).withSideB(sideB).withLabel(field);
+      boolean hidden = nA < config.getMinGroupSize() || nB < config.getMinGroupSize();
+      if(!hidden)
+      {
+         deltas(value, a.get("mean"), b.get("mean"));
+      }
+      Statistics.Result test = hidden ? Statistics.unavailable("Welch's t-test", "privacy guard")
+         : Statistics.welch(nA, number(a, "mean"), number(a, "variance"), nB, number(b, "mean"), number(b, "variance"));
+      return (new FieldComparison().withField(field).withValues(List.of(value)).withSignificance(significance(test))
+         .withChart(chart(ChartKind.BOX, List.of(box(sideA), box(sideB)), "Two box summaries; delta is B minus A.")));
+   }
+
+   /*******************************************************************************
+    ** Null moments remain invalid test inputs rather than becoming zero variance.
+    *******************************************************************************/
+   private static double number(Map<String, BigDecimal> values, String key)
+   {
+      return (values.get(key) == null ? Double.NaN : values.get(key).doubleValue());
+   }
+
+   /*******************************************************************************
+    ** Count means non-null numeric records; every summary drills to that set.
+    *******************************************************************************/
+   protected ComparisonSide numericSide(String field, String label, QQueryFilter filter, Map<String, BigDecimal> values)
+   {
+      ComparisonSide result = new ComparisonSide().withLabel(label);
+      for(String key : List.of("count", "mean", "min", "p25", "p50", "p75", "max"))
+      {
+         String name = key.equals("p50") ? "median" : key;
+         result.getMetrics().add(metric(name, values.get(key), key.equals("count") ? ValueType.COUNT : ValueType.DECIMAL, filter, DrillFilters.nonNull(field, false)));
+      }
+      guard(result.getMetrics(), values.get("count").longValue());
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Only guarded summary metrics enter charts.
+    *******************************************************************************/
+   private Series box(ComparisonSide side)
+   {
+      Series series = new Series().withName(side.getLabel());
+      side.getMetrics().stream().filter(m -> !List.of("count", "mean").contains(m.getKey()) && m.getValue() != null)
+         .forEach(m -> series.getPoints().add(new Point().withX(m.getKey()).withY(decimal(m.getValue())).withLabel(m.getLabel()).withDrill(m.getDrill())));
+      return (series);
+   }
+
+   /*******************************************************************************
+    ** Top ten across the union gives both populations the same categories.
+    ** Expected counts below five pool into Other before display and inference.
+    *******************************************************************************/
+   private FieldComparison categoryComparison(CompareRequest request, String field) throws QException
+   {
+      QQueryFilter union = request.getFilterA() == null || request.getFilterB() == null ? null
+         : new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR).withSubFilter(DrillFilters.copy(request.getFilterA())).withSubFilter(DrillFilters.copy(request.getFilterB()));
+      long nA = size(request.getFilterA());
+      long nB = size(request.getFilterB());
+      List<Category> kept = new ArrayList<>();
+      List<Category> other = new ArrayList<>();
+      boolean privateOther = false;
+      for(Category category : categories(field, union, 10))
+      {
+         long a = size(DrillFilters.and(request.getFilterA(), category.condition()));
+         long b = size(DrillFilters.and(request.getFilterB(), category.condition()));
+         boolean hidden = category.privateGroup() || a < config.getMinGroupSize() || b < config.getMinGroupSize();
+         double pooled = nA + nB == 0 ? 0 : (double) (a + b) / (nA + nB);
+         if(hidden || Math.min(nA * pooled, nB * pooled) < 5 || category.label().equals("Other") && category.value() == null)
+         {
+            other.add(category);
+            privateOther |= hidden;
+         }
+         else
+         {
+            kept.add(category);
+         }
+      }
+      if(!other.isEmpty())
+      {
+         kept.add(merge(other, privateOther));
+      }
+      double[][] counts = new double[2][kept.size()];
+      FieldComparison result = new FieldComparison().withField(field);
+      Series seriesA = new Series().withName(request.getLabelA());
+      Series seriesB = new Series().withName(request.getLabelB());
+      for(int i = 0; i < kept.size(); i++)
+      {
+         Category category = kept.get(i);
+         long a = size(DrillFilters.and(request.getFilterA(), category.condition()));
+         long b = size(DrillFilters.and(request.getFilterB(), category.condition()));
+         counts[0][i] = a;
+         counts[1][i] = b;
+         ComparisonSide sideA = categorySide(request.getLabelA(), request.getFilterA(), category, a, nA);
+         ComparisonSide sideB = categorySide(request.getLabelB(), request.getFilterB(), category, b, nB);
+         ComparisonValue value = new ComparisonValue().withValue(category.value()).withLabel(category.label()).withSideA(sideA).withSideB(sideB);
+         boolean hidden = a < config.getMinGroupSize() || b < config.getMinGroupSize();
+         if(!hidden)
+         {
+            deltas(value, ProfileSupport.share(a, nA), ProfileSupport.share(b, nB));
+         }
+         value.withSignificance(significance(hidden || category.privateGroup() ? Statistics.unavailable("Two-proportion z-test", "privacy guard") : Statistics.proportions(a, nA, b, nB)));
+         result.getValues().add(value);
+         categoryPoint(seriesA, category, sideA);
+         categoryPoint(seriesB, category, sideB);
+      }
+      result.withSignificance(significance(privateOther ? Statistics.unavailable("Chi-square homogeneity", "privacy guard") : Statistics.chiSquare(counts, true)));
+      return (result.withChart(chart(ChartKind.BAR, List.of(seriesA, seriesB), "Grouped bars; delta is B minus A. Low expected counts are merged into Other.")));
+   }
+
+   /*******************************************************************************
+    ** Sensitive merged categories reveal no predicate or original value.
+    *******************************************************************************/
+   private ComparisonSide categorySide(String label, QQueryFilter filter, Category category, long n, long total)
+   {
+      ComparisonSide side = new ComparisonSide().withLabel(label).withMetrics(List.of(metric("count", n, ValueType.COUNT, filter, category.condition()),
+         metric("share", ProfileSupport.share(n, total), ValueType.PERCENT, filter, category.condition())));
+      if(category.privateGroup())
+      {
+         side.getMetrics().forEach(m -> m.withDrill(null));
+      }
+      guard(side.getMetrics(), n);
+      return (side);
+   }
+
+   /*******************************************************************************
+    ** Charts reflect only released count metrics.
+    *******************************************************************************/
+   private void categoryPoint(Series series, Category category, ComparisonSide side)
+   {
+      Metric count = side.getMetrics().getFirst();
+      series.getPoints().add(new Point().withX(category.label()).withLabel(category.label()).withY(decimal(count.getValue())).withDrill(count.getDrill()));
+   }
+
+   /*******************************************************************************
+    ** Percent delta is a fraction relative to |A|; zero baseline is undefined.
+    *******************************************************************************/
+   private void deltas(ComparisonValue value, BigDecimal a, BigDecimal b)
+   {
+      BigDecimal delta = a == null || b == null ? null : b.subtract(a);
+      value.withDelta(ProfileSupport.metric("delta", delta, ValueType.DECIMAL));
+      value.withPercentDelta(ProfileSupport.metric("percentDelta", delta == null || a.signum() == 0 ? null : delta.divide(a.abs(), MathContext.DECIMAL128), ValueType.PERCENT));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/CoreTierFieldAccessResolver.java

@@ -0,0 +1,118 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.lang.reflect.Method;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Optional core bridge: replace with direct calls once QQQ ships the fieldaccess package.
+ ** Class and method discovery happen once; invocation failures fail closed.
+ *******************************************************************************/
+public class CoreTierFieldAccessResolver implements FieldAnalysisAccessResolver
+{
+   private static final CoreTierFieldAccessResolver DEFAULT = discover();
+   private final Method tier;
+   private final Method fingerprint;
+
+   /*******************************************************************************
+    ** Bind discovered static methods once.
+    *******************************************************************************/
+   public CoreTierFieldAccessResolver(Class<?> helper) throws ReflectiveOperationException
+   {
+      tier = helper.getMethod("getTier", QTableMetaData.class, String.class);
+      Method optional;
+      try
+      {
+         optional = helper.getMethod("getAccessFingerprint");
+      }
+      catch(NoSuchMethodException e)
+      {
+         optional = null;
+      }
+      fingerprint = optional;
+   }
+
+   /*******************************************************************************
+    ** Resolve the optional class once per class loader.
+    *******************************************************************************/
+   private static CoreTierFieldAccessResolver discover()
+   {
+      try
+      {
+         return (new CoreTierFieldAccessResolver(Class.forName("com.kingsrook.qqq.backend.core.actions.permissions.fieldaccess.FieldAccessHelper")));
+      }
+      catch(ClassNotFoundException e)
+      {
+         return (null);
+      }
+      catch(ReflectiveOperationException e)
+      {
+         throw new ExceptionInInitializerError(e);
+      }
+   }
+
+   /*******************************************************************************
+    ** Use legacy locks only when the core helper class is absent.
+    *******************************************************************************/
+   public static FieldAnalysisAccessResolver defaultResolver()
+   {
+      return (DEFAULT == null ? new FieldSecurityLockFieldAccessResolver() : DEFAULT);
+   }
+
+   /*******************************************************************************
+    ** Unknown tiers and invocation failures never grant analysis rights.
+    *******************************************************************************/
+   @Override
+   public FieldAnalysisAccess resolve(QTableMetaData table, QFieldMetaData field)
+   {
+      try
+      {
+         return (switch(String.valueOf(tier.invoke(null, table, field.getName())))
+         {
+            case "FULL" -> FieldAnalysisAccess.FULL;
+            case "REVEALABLE" -> FieldAnalysisAccess.EXACT_MATCH_ONLY;
+            default -> FieldAnalysisAccess.NONE;
+         });
+      }
+      catch(ReflectiveOperationException e)
+      {
+         return (FieldAnalysisAccess.NONE);
+      }
+   }
+
+   /*******************************************************************************
+    ** A broken fingerprint prevents cache reuse rather than returning stale data.
+    *******************************************************************************/
+   @Override
+   public String getAccessFingerprint()
+   {
+      try
+      {
+         return (fingerprint == null ? "" : (String) fingerprint.invoke(null));
+      }
+      catch(ReflectiveOperationException e)
+      {
+         throw new IllegalStateException("Could not resolve field access fingerprint.", e);
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/DistinctValues.java

@@ -34,13 +34,23 @@ import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
 public class DistinctValues
 {
    private final AnalysisBackend backend;
+   private final FieldAnalysisAccessResolver fieldAccess;
 
    /*******************************************************************************
     ** Bind primitive operations.
     *******************************************************************************/
    public DistinctValues(AnalysisBackend backend)
+   {
+      this(backend, CoreTierFieldAccessResolver.defaultResolver());
+   }
+
+   /*******************************************************************************
+    ** Bind the host field policy for possible-value labels.
+    *******************************************************************************/
+   public DistinctValues(AnalysisBackend backend, FieldAnalysisAccessResolver fieldAccess)
    {
       this.backend = backend;
+      this.fieldAccess = fieldAccess;
    }
 
 
@@ -60,7 +70,7 @@ public class DistinctValues
       boolean wholeListing = config.getMinGroupSize() > 0 || request.getSearch() != null && !request.getSearch().isBlank();
       int fetch = wholeListing ? Math.max(1, config.getMaxRows()) : request.getPageSize() + 1;
       List<ValueCount> values = ProfileSupport.values(request.getTableName(), scope.filter(), field,
-         backend.topValues(request.getTableName(), scope.filter(), field.getName(), fetch, wholeListing ? 0 : offset, request.getSearch()), scope.rowsScanned());
+         backend.topValues(request.getTableName(), scope.filter(), field.getName(), fetch, wholeListing ? 0 : offset, request.getSearch()), scope.rowsScanned(), fieldAccess);
       long totalDistinct = wholeListing ? values.stream().filter(v -> v.getValue() != null).count()
          : backend.fieldCounts(request.getTableName(), scope.filter(), List.of(field.getName())).get(field.getName()).distinct();
       values = new MinGroupSizeGuard(config.getMinGroupSize()).groups(values);

src/main/java/com/kingsrook/qbits/dataanalysis/engine/FieldAnalysisAccess.java

@@ -0,0 +1,29 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+/*******************************************************************************
+ ** Analysis access is stricter than the ability to submit an exact query.
+ *******************************************************************************/
+public enum FieldAnalysisAccess
+{
+   FULL, EXACT_MATCH_ONLY, NONE
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/FieldAnalysisAccessResolver.java

@@ -0,0 +1,43 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Resolve the current user's analysis rights without exposing protected values.
+ *******************************************************************************/
+public interface FieldAnalysisAccessResolver
+{
+   /*******************************************************************************
+    ** Only FULL fields may contribute generated analysis predicates.
+    *******************************************************************************/
+   FieldAnalysisAccess resolve(QTableMetaData table, QFieldMetaData field);
+
+   /*******************************************************************************
+    ** Optional core policy fingerprint supplements the FULL-field list hash.
+    *******************************************************************************/
+   default String getAccessFingerprint()
+   {
+      return ("");
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/FieldSecurityLockFieldAccessResolver.java

@@ -0,0 +1,42 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import com.kingsrook.qqq.backend.core.actions.permissions.FieldSecurityLockHelper;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Legacy lock adapter. The core tier API (qbit-secured-data) will map REVEALABLE
+ ** to EXACT_MATCH_ONLY, MASKED/HIDDEN without filter rights to NONE, and
+ ** MASKED/HIDDEN with filter rights to FULL.
+ *******************************************************************************/
+public class FieldSecurityLockFieldAccessResolver implements FieldAnalysisAccessResolver
+{
+   /*******************************************************************************
+    ** Keep the legacy lock enforcement when core tiers are not installed.
+    *******************************************************************************/
+   @Override
+   public FieldAnalysisAccess resolve(QTableMetaData table, QFieldMetaData field)
+   {
+      return (FieldSecurityLockHelper.isFieldAccessible(field) ? FieldAnalysisAccess.FULL : FieldAnalysisAccess.NONE);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/MetricLabels.java

@@ -30,6 +30,8 @@ import com.kingsrook.qbits.dataanalysis.result.ValueType;
 public final class MetricLabels
 {
    private static final Map<String, String> LABELS = Map.ofEntries(
+      Map.entry("count", "Count"), Map.entry("delta", "Difference"), Map.entry("percentDelta", "Percent change"),
+      Map.entry("psi", "Population stability index"), Map.entry("rowShare", "Row share"), Map.entry("columnShare", "Column share"),
       Map.entry("rows", "Rows"), Map.entry("nonNull", "Non-empty"), Map.entry("nulls", "Nulls"),
       Map.entry("blanks", "Blanks"), Map.entry("distinct", "Distinct values"), Map.entry("uniqueness", "Uniqueness"),
       Map.entry("completeness", "Completeness"), Map.entry("share", "Share"),

src/main/java/com/kingsrook/qbits/dataanalysis/engine/MinGroupSizeGuard.java

@@ -143,4 +143,16 @@ public class MinGroupSizeGuard
          profile.getText().withHistogram(groups(profile.getText().getHistogram())).withPatterns(groups(profile.getText().getPatterns()));
       }
    }
+
+   /*******************************************************************************
+    ** Small pivot cells suppress every measure, including count, with no drill.
+    *******************************************************************************/
+   public void pivotMetrics(List<Metric> metrics, long rows)
+   {
+      if(rows < minimum)
+      {
+         metrics.forEach(m -> m.withValue(null).withFormatted(null).withDrill(null).withSuppressed(true)
+            .withSuppressedReason("Hidden: fewer than " + minimum + " records"));
+      }
+   }
 }

src/main/java/com/kingsrook/qbits/dataanalysis/engine/NiceBins.java

@@ -33,6 +33,14 @@ public record NiceBins(BigDecimal low, BigDecimal high, int count)
     ** Select the closest 10..25-bin enclosure from 1, 2, 2.5 and 5 times powers of ten.
     *******************************************************************************/
    public static NiceBins covering(BigDecimal low, BigDecimal high)
+   {
+      return (covering(low, high, 20));
+   }
+
+   /*******************************************************************************
+    ** Choose readable enclosing edges for a requested pivot bin count.
+    *******************************************************************************/
+   public static NiceBins covering(BigDecimal low, BigDecimal high, int target)
    {
       BigDecimal span = high.subtract(low);
       if(span.signum() == 0)
@@ -41,7 +49,7 @@ public record NiceBins(BigDecimal low, BigDecimal high, int count)
          low = low.subtract(span.divide(BigDecimal.valueOf(2)));
          high = high.add(span.divide(BigDecimal.valueOf(2)));
       }
-      int exponent = span.precision() - span.scale() - 2;
+      int exponent = span.precision() - span.scale() - Integer.toString(target).length();
       NiceBins best = null;
       for(int power = exponent - 2; power <= exponent + 2; power++)
       {
@@ -51,7 +59,7 @@ public record NiceBins(BigDecimal low, BigDecimal high, int count)
             BigDecimal first = low.divide(step, 0, RoundingMode.FLOOR).multiply(step);
             BigDecimal last = high.divide(step, 0, RoundingMode.CEILING).multiply(step);
             int count = last.subtract(first).divide(step).intValueExact();
-            if(count >= 10 && count <= 25 && (best == null || Math.abs(count - 20) < Math.abs(best.count() - 20)))
+            if(count >= Math.max(1, target / 2) && count <= Math.max(2, target * 5 / 4) && (best == null || Math.abs(count - target) < Math.abs(best.count() - target)))
             {
                best = new NiceBins(first, last, count);
             }

src/main/java/com/kingsrook/qbits/dataanalysis/engine/PivotExplorer.java

@@ -0,0 +1,642 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import java.math.MathContext;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.PivotCell;
+import com.kingsrook.qbits.dataanalysis.result.PivotDimension;
+import com.kingsrook.qbits.dataanalysis.result.PivotHeader;
+import com.kingsrook.qbits.dataanalysis.result.PivotMeasure;
+import com.kingsrook.qbits.dataanalysis.result.PivotMeasureInfo;
+import com.kingsrook.qbits.dataanalysis.result.PivotRequest;
+import com.kingsrook.qbits.dataanalysis.result.PivotResult;
+import com.kingsrook.qbits.dataanalysis.result.ValueType;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.AggregateAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.Aggregate;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateResult;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.DateBucket;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.DateBucketUnit;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.GroupBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.NumericBucket;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.QFilterOrderByAggregate;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryJoin;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.joins.JoinType;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.ExposedJoin;
+import com.kingsrook.qqq.backend.core.utils.ValueUtils;
+import com.kingsrook.qqq.backend.core.utils.aggregates.AggregateAnalysis;
+
+/*******************************************************************************
+ ** Request-local pivot planner. Core executes every aggregate with ENFORCE.
+ ** Merged cells are re-aggregated so non-additive measures remain exact.
+ *******************************************************************************/
+public class PivotExplorer
+{
+   private final AnalysisSecurity security;
+   private final EffectiveConfig config;
+   private final List<QueryJoin> joins = new ArrayList<>();
+   private final LinkedHashSet<String> toManyTables = new LinkedHashSet<>();
+   private final LinkedHashSet<String> multiHopTables = new LinkedHashSet<>();
+   private PivotRequest request;
+   private Aggregate count;
+   private final List<Aggregate> measures = new ArrayList<>();
+   private final List<PivotMeasureInfo> measureInfo = new ArrayList<>();
+   private boolean partial;
+
+   /*******************************************************************************
+    ** Bind the current user's policy and bounded streamed fallback.
+    *******************************************************************************/
+   public PivotExplorer(AnalysisSecurity security, EffectiveConfig config)
+   {
+      this.security = security;
+      this.config = config;
+   }
+
+   /*******************************************************************************
+    ** One slot is a visible group or the exact complement of the kept groups.
+    *******************************************************************************/
+   private record Slot(Serializable value, String label, QQueryFilter condition, boolean other)
+   {
+   }
+
+   /*******************************************************************************
+    ** Dimension state owns predicates, so no generated filter names hidden fields.
+    *******************************************************************************/
+   private record Dimension(GroupBy group, QFieldMetaData field, Map<Serializable, Slot> kept, Map<Serializable, Long> counts, Slot other)
+   {
+      /*******************************************************************************
+       ** Return the kept group, Other, or null for a privacy-suppressed group.
+       *******************************************************************************/
+      Slot slot(Serializable value, int minimum)
+      {
+         return (counts.getOrDefault(value, 0L) < minimum ? null : kept.getOrDefault(value, other));
+      }
+   }
+
+   /*******************************************************************************
+    ** Validate the complete plan before any source computation.
+    *******************************************************************************/
+   public PivotResult execute(PivotRequest request) throws QException
+   {
+      this.request = request;
+      validate();
+      String primaryKey = QContext.getQInstance().getTable(request.getTableName()).getPrimaryKeyField();
+      count = new Aggregate(primaryKey, AggregateOperator.COUNT).withFieldType(QFieldType.INTEGER);
+      List<PivotDimension> requested = new ArrayList<>(request.getRows());
+      requested.addAll(request.getColumns());
+      List<QFieldMetaData> fields = new ArrayList<>();
+      for(PivotDimension dimension : requested)
+      {
+         fields.add(resolve(dimension.getField()));
+      }
+      for(int i = 0; i < request.getValues().size(); i++)
+      {
+         prepareMeasure(request.getValues().get(i), i);
+      }
+      List<Dimension> dimensions = new ArrayList<>();
+      for(int i = 0; i < requested.size(); i++)
+      {
+         dimensions.add(dimension(requested.get(i), fields.get(i)));
+      }
+      int rowCount = request.getRows().size();
+      List<Dimension> rows = dimensions.subList(0, rowCount);
+      List<Dimension> columns = dimensions.subList(rowCount, dimensions.size());
+      PivotResult result = new PivotResult().withAsOf(Instant.now()).withMeasures(measureInfo)
+         .withTruncatedRows(rows.stream().anyMatch(d -> d.other() != null))
+         .withTruncatedColumns(columns.stream().anyMatch(d -> d.other() != null));
+      Map<List<Slot>, List<Metric>> matrix = level(dimensions);
+      Map<List<Slot>, List<Metric>> rowTotals = request.getShowTotals() || config.getMinGroupSize() > 0 ? level(rows) : Map.of();
+      Map<List<Slot>, List<Metric>> columnTotals = request.getShowTotals() || config.getMinGroupSize() > 0 ? level(columns) : Map.of();
+      List<List<Slot>> rowKeys = new ArrayList<>();
+      List<List<Slot>> columnKeys = new ArrayList<>();
+      for(var entry : matrix.entrySet())
+      {
+         List<Slot> row = List.copyOf(entry.getKey().subList(0, rowCount));
+         List<Slot> column = List.copyOf(entry.getKey().subList(rowCount, dimensions.size()));
+         if(config.getMinGroupSize() > 0 && (rowTotals.getOrDefault(row, List.of()).stream().allMatch(m -> m.getSuppressed())
+            || columnTotals.getOrDefault(column, List.of()).stream().allMatch(m -> m.getSuppressed())))
+         {
+            continue;
+         }
+         if(!rowKeys.contains(row))
+         {
+            rowKeys.add(row);
+         }
+         if(!columnKeys.contains(column))
+         {
+            columnKeys.add(column);
+         }
+         result.getCells().add(new PivotCell().withRowIndex(rowKeys.indexOf(row)).withColumnIndex(columnKeys.indexOf(column)).withValues(entry.getValue()));
+      }
+      result.withRowHeaders(headers(rowKeys)).withColumnHeaders(headers(columnKeys));
+      if(request.getShowTotals())
+      {
+         rowKeys.forEach(key -> result.getRowTotals().add(rowTotals.getOrDefault(key, List.of())));
+         columnKeys.forEach(key -> result.getColumnTotals().add(columnTotals.getOrDefault(key, List.of())));
+         result.withGrandTotals(level(List.of()).getOrDefault(List.of(), List.of()));
+      }
+      for(String tableName : toManyTables)
+      {
+         result.getWarnings().add("Counts include one row per related " + QContext.getQInstance().getTable(tableName).getLabel()
+            + "; drill-through is not available for this dimension.");
+      }
+      for(String tableName : multiHopTables)
+      {
+         result.getWarnings().add("Drill-through is not available for fields reached through more than one join (" + QContext.getQInstance().getTable(tableName).getLabel() + ").");
+      }
+      if(config.getMinGroupSize() > 0)
+      {
+         result.getWarnings().add("Groups below " + config.getMinGroupSize() + " records are omitted; small cells and totals are suppressed.");
+      }
+      if(partial)
+      {
+         result.withEstimate(true);
+         result.getWarnings().add("Partial pivot: the streamed row limit was reached. Drills are disabled because aggregates may cover different prefixes.");
+         result.getCells().forEach(c -> disableDrills(c.getValues()));
+         result.getRowTotals().forEach(this::disableDrills);
+         result.getColumnTotals().forEach(this::disableDrills);
+         disableDrills(result.getGrandTotals());
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Reject invalid shapes and types before aggregate execution.
+    *******************************************************************************/
+   private void validate() throws QException
+   {
+      if(request.getRows() == null || request.getRows().isEmpty() || request.getRows().size() > 3
+         || request.getColumns() == null || request.getColumns().size() > 2 || request.getValues() == null
+         || request.getValues().isEmpty() || request.getValues().size() > 6 || request.getShowTotals() == null
+         || request.getLimitGroups() == null || request.getLimitGroups() < 1 || request.getLimitGroups() > 200)
+      {
+         throw new QBadRequestException("Choose 1�3 row dimensions, 0�2 column dimensions, 1�6 measures and a group limit from 1 to 200.");
+      }
+      List<PivotDimension> dimensions = new ArrayList<>(request.getRows());
+      dimensions.addAll(request.getColumns());
+      LinkedHashSet<String> names = new LinkedHashSet<>();
+      for(PivotDimension dimension : dimensions)
+      {
+         if(dimension == null || dimension.getField() == null || !names.add(dimension.getField()))
+         {
+            throw new QBadRequestException("Choose distinct dimension fields.");
+         }
+         QFieldMetaData field = resolve(dimension.getField());
+         var bins = dimension.getNumericBins();
+         if(dimension.getDateBucket() != null && (bins != null || field.getType() != QFieldType.DATE && field.getType() != QFieldType.DATE_TIME)
+            || bins != null && (!numeric(field) || bins.getCount() == null || bins.getCount() < 1 || bins.getCount() > 200
+               || bins.getMin() != null && bins.getMax() != null && bins.getMin().compareTo(bins.getMax()) >= 0))
+         {
+            throw new QBadRequestException("Buckets must match the field type; numeric bins require 1�200 bins and min < max.");
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Only exposed, unambiguous paths may introduce a joined field.
+    ** The installed snapshot has no related-record picker join-path helper.
+    *******************************************************************************/
+   private QFieldMetaData resolve(String name) throws QException
+   {
+      if(name == null || !name.contains("."))
+      {
+         return (security.field(request.getTableName(), name));
+      }
+      String[] parts = name.split("\\.", -1);
+      var table = QContext.getQInstance().getTable(request.getTableName());
+      List<ExposedJoin> exposed = table.getExposedJoins() == null ? List.of() : table.getExposedJoins();
+      List<ExposedJoin> paths = exposed.stream().filter(j -> j.getJoinTable().equals(parts[0])).toList();
+      if(parts.length != 2 || paths.size() != 1 || paths.getFirst().getJoinPath() == null || paths.getFirst().getJoinPath().isEmpty())
+      {
+         throw new QBadRequestException("Unknown analysis field.");
+      }
+      String current = table.getName();
+      boolean toOne = true;
+      for(String joinName : paths.getFirst().getJoinPath())
+      {
+         var metadata = QContext.getQInstance().getJoin(joinName);
+         if(metadata == null || !current.equals(metadata.getLeftTable()) && !current.equals(metadata.getRightTable()))
+         {
+            throw new QBadRequestException("Unknown analysis field.");
+         }
+         String next = current.equals(metadata.getLeftTable()) ? metadata.getRightTable() : metadata.getLeftTable();
+         JoinType type = metadata.getType();
+         if(type != null && current.equals(metadata.getRightTable()))
+         {
+            type = type.flip();
+         }
+         toOne &= type == JoinType.MANY_TO_ONE || type == JoinType.ONE_TO_ONE;
+         security.joinedTable(next);
+         QueryJoin existing = joins.stream().filter(j -> next.equals(j.getJoinTable())).findFirst().orElse(null);
+         if(existing == null)
+         {
+            joins.add(new QueryJoin(current, next).withJoinMetaData(metadata));
+         }
+         else if(!existing.getJoinMetaData().getName().equals(joinName))
+         {
+            throw new QBadRequestException("Ambiguous analysis join path.");
+         }
+         current = next;
+      }
+      if(!current.equals(parts[0]))
+      {
+         throw new QBadRequestException("Unknown analysis field.");
+      }
+      if(!toOne)
+      {
+         toManyTables.add(current);
+      }
+      else if(paths.getFirst().getJoinPath().size() > 1)
+      {
+         ///////////////////////////////////////////////////////////////////////////////
+         // counts are per record, but core's implicit joins for a multi-hop filter     //
+         // do not reproduce them on every backend yet (memory counts differ), so no   //
+         // drill until that is fixed in core                                          //
+         ///////////////////////////////////////////////////////////////////////////////
+         multiHopTables.add(current);
+      }
+      return (security.joinedField(parts[0], parts[1]));
+   }
+
+   /*******************************************************************************
+    ** Count records even when a supplied COUNT field is nullable.
+    *******************************************************************************/
+   private void prepareMeasure(PivotMeasure measure, int index) throws QException
+   {
+      if(measure == null || measure.getOperator() == null)
+      {
+         throw new QBadRequestException("Choose a measure operator.");
+      }
+      QFieldMetaData field = measure.getField() == null && measure.getOperator() == PivotMeasure.Operator.COUNT ? null : resolve(measure.getField());
+      PivotMeasure.Operator operator = measure.getOperator();
+      if((operator == PivotMeasure.Operator.SUM || operator == PivotMeasure.Operator.AVG || operator == PivotMeasure.Operator.PERCENTILE) && !numeric(field)
+         || operator == PivotMeasure.Operator.PERCENTILE && (measure.getPercentile() == null || measure.getPercentile().signum() < 0 || measure.getPercentile().compareTo(BigDecimal.ONE) > 0)
+         || operator != PivotMeasure.Operator.PERCENTILE && measure.getPercentile() != null)
+      {
+         throw new QBadRequestException("Numeric measures require a numeric field; percentile must be between 0 and 1.");
+      }
+      Aggregate aggregate = operator == PivotMeasure.Operator.COUNT ? count : new Aggregate(measure.getField(),
+         operator == PivotMeasure.Operator.PERCENTILE ? AggregateOperator.PERCENTILE_CONT : AggregateOperator.valueOf(operator.name()));
+      if(operator == PivotMeasure.Operator.PERCENTILE)
+      {
+         aggregate.withPercentile(measure.getPercentile());
+      }
+      if(operator == PivotMeasure.Operator.COUNT_DISTINCT)
+      {
+         aggregate.withFieldType(QFieldType.INTEGER);
+      }
+      measures.add(aggregate);
+      ValueType type = operator == PivotMeasure.Operator.COUNT || operator == PivotMeasure.Operator.COUNT_DISTINCT ? ValueType.COUNT
+         : numeric(field) ? ValueType.DECIMAL : field.getType() == QFieldType.DATE ? ValueType.DATE : field.getType() == QFieldType.DATE_TIME ? ValueType.DATE_TIME : ValueType.TEXT;
+      measureInfo.add(new PivotMeasureInfo().withKey("value" + index).withLabel(measureLabel(measure, field)).withValueType(type));
+   }
+
+   /*******************************************************************************
+    ** Human measure labels shared by headers, totals and cells.
+    *******************************************************************************/
+   private static String measureLabel(PivotMeasure measure, QFieldMetaData field)
+   {
+      String label = field == null ? "" : field.getLabel();
+      return (switch(measure.getOperator())
+      {
+         case COUNT -> "Count";
+         case AVG -> "Average " + label;
+         case SUM -> "Sum of " + label;
+         case COUNT_DISTINCT -> "Distinct " + label;
+         case MIN -> "Minimum " + label;
+         case MAX -> "Maximum " + label;
+         case PERCENTILE -> measure.getPercentile().compareTo(new BigDecimal("0.5")) == 0 ? "Median " + label
+            : ordinal(measure.getPercentile().multiply(BigDecimal.valueOf(100))) + " percentile of " + label;
+      });
+   }
+
+   /*******************************************************************************
+    ** English ordinal suffixes, including the eleventh through thirteenth.
+    *******************************************************************************/
+   private static String ordinal(BigDecimal value)
+   {
+      int number = value.intValue();
+      String suffix = number % 100 >= 11 && number % 100 <= 13 ? "th" : switch(number % 10)
+      {
+         case 1 -> "st";
+         case 2 -> "nd";
+         case 3 -> "rd";
+         default -> "th";
+      };
+      return (value.stripTrailingZeros().toPlainString() + suffix);
+   }
+
+   /*******************************************************************************
+    ** Numeric buckets and moments accept the same numeric QQQ field types.
+    *******************************************************************************/
+   private static boolean numeric(QFieldMetaData field)
+   {
+      return (field != null && (field.getType() == QFieldType.INTEGER || field.getType() == QFieldType.LONG || field.getType() == QFieldType.DECIMAL));
+   }
+
+   /*******************************************************************************
+    ** Select top groups first, then collect cardinality and privacy counts.
+    *******************************************************************************/
+   private Dimension dimension(PivotDimension requested, QFieldMetaData field) throws QException
+   {
+      GroupBy group = new GroupBy(field.getType(), requested.getField());
+      if(requested.getDateBucket() != null)
+      {
+         group.withBucket(new DateBucket(requested.getDateBucket()));
+      }
+      if(requested.getNumericBins() != null)
+      {
+         var bins = requested.getNumericBins();
+         BigDecimal low = bins.getMin();
+         BigDecimal high = bins.getMax();
+         if(low == null || high == null)
+         {
+            Aggregate min = new Aggregate(requested.getField(), AggregateOperator.MIN);
+            Aggregate max = new Aggregate(requested.getField(), AggregateOperator.MAX);
+            var extrema = aggregate(List.of(), request.getFilter(), List.of(min, max), null);
+            Serializable first = extrema.isEmpty() ? null : extrema.getFirst().getAggregateValues().get(min);
+            Serializable last = extrema.isEmpty() ? null : extrema.getFirst().getAggregateValues().get(max);
+            NiceBins nice = NiceBins.covering(first == null ? BigDecimal.ZERO : new BigDecimal(first.toString()), last == null ? BigDecimal.ONE : new BigDecimal(last.toString()), bins.getCount());
+            low = low == null ? nice.low() : low;
+            high = high == null ? nice.high() : high;
+         }
+         if(low.compareTo(high) >= 0)
+         {
+            throw new QBadRequestException("Numeric bin min must be below max.");
+         }
+         group.withBucket(new NumericBucket(low, high, bins.getCount()));
+      }
+      List<AggregateResult> top = aggregate(List.of(group), request.getFilter(), List.of(count), request.getLimitGroups());
+      List<AggregateResult> all = aggregate(List.of(group), request.getFilter(), List.of(count), null);
+      Map<Serializable, Long> counts = new LinkedHashMap<>();
+      all.forEach(r -> counts.put(r.getGroupByValues().get(group), count(r)));
+      Map<Serializable, Slot> kept = new LinkedHashMap<>();
+      for(AggregateResult row : top)
+      {
+         Serializable value = row.getGroupByValues().get(group);
+         if(count(row) >= config.getMinGroupSize())
+         {
+            kept.put(value, new Slot(value, label(group, field, value), condition(group, field, value), false));
+         }
+      }
+      List<Serializable> remaining = counts.keySet().stream().filter(v -> !kept.containsKey(v) && counts.get(v) >= config.getMinGroupSize()).toList();
+      Slot other = null;
+      if(!remaining.isEmpty())
+      {
+         QQueryFilter predicate;
+         if(group.getBucket() == null && field.getType() != QFieldType.BOOLEAN && config.getMinGroupSize() == 0 && !kept.containsKey("") && kept.keySet().stream().noneMatch(v -> v instanceof Instant || v instanceof LocalDate))
+         {
+            List<Serializable> values = kept.keySet().stream().filter(Objects::nonNull).toList();
+            predicate = values.isEmpty() ? new QQueryFilter() : new QQueryFilter().withCriteria(group.getFieldName(), QCriteriaOperator.NOT_IN, values);
+            predicate = DrillFilters.and(predicate, DrillFilters.nonNull(group.getFieldName(), field.getType().isStringLike()));
+            if(!kept.containsKey(null))
+            {
+               predicate = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR).withSubFilter(predicate).withSubFilter(DrillFilters.nulls(group.getFieldName(), field.getType().isStringLike()));
+            }
+            if(field.getType().isStringLike())
+            {
+               predicate = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR).withSubFilter(predicate).withSubFilter(DrillFilters.value(group.getFieldName(), "", true));
+            }
+         }
+         else
+         {
+            predicate = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR);
+            for(Serializable value : remaining)
+            {
+               predicate.withSubFilter(condition(group, field, value));
+            }
+         }
+         other = new Slot(null, "Other (" + remaining.size() + " groups)", predicate, true);
+      }
+      return (new Dimension(group, field, kept, counts, other));
+   }
+
+   /*******************************************************************************
+    ** Native group keys are displayed as labels without changing filter operands.
+    *******************************************************************************/
+   private String label(GroupBy group, QFieldMetaData field, Serializable value) throws QException
+   {
+      if(value == null)
+      {
+         return ("(Blank)");
+      }
+      if(group.getBucket() instanceof DateBucket date)
+      {
+         return (AnalysisFormatting.dateBucket(value, AnalysisBackend.DateUnit.valueOf(date.getUnit().name()), ValueUtils.getSessionOrInstanceZoneId()));
+      }
+      if(group.getBucket() instanceof NumericBucket bins)
+      {
+         BigDecimal[] edges = edges(bins, ((Number) value).intValue());
+         return (AnalysisFormatting.interval(field, edges[0], edges[1]));
+      }
+      return (security.label(field, value));
+   }
+
+   /*******************************************************************************
+    ** Match core's final closed numeric bin and exterior bins.
+    *******************************************************************************/
+   private static BigDecimal[] edges(NumericBucket bins, int index)
+   {
+      BigDecimal width = bins.getMax().subtract(bins.getMin()).divide(BigDecimal.valueOf(bins.getCount()), MathContext.DECIMAL128);
+      return (new BigDecimal[] { index == 0 ? null : index > bins.getCount() ? bins.getMax() : bins.getMin().add(width.multiply(BigDecimal.valueOf(index - 1))),
+         index == 0 ? bins.getMin() : index > bins.getCount() ? null : index == bins.getCount() ? bins.getMax() : bins.getMin().add(width.multiply(BigDecimal.valueOf(index))) });
+   }
+
+   /*******************************************************************************
+    ** Calendar and numeric predicates use core bucket boundaries in the session zone.
+    *******************************************************************************/
+   private QQueryFilter condition(GroupBy group, QFieldMetaData field, Serializable value) throws QException
+   {
+      String name = group.getFieldName();
+      if(value == null || group.getBucket() == null)
+      {
+         return (DrillFilters.value(name, value, field.getType().isStringLike()));
+      }
+      if(group.getBucket() instanceof NumericBucket bins)
+      {
+         int index = ((Number) value).intValue();
+         BigDecimal[] edges = edges(bins, index);
+         if(StandInAnalysisBackend.isMemory(request.getTableName()) && index <= bins.getCount())
+         {
+            GroupBy raw = new GroupBy(field.getType(), name);
+            List<BigDecimal> members = aggregate(List.of(raw), request.getFilter(), List.of(count), null).stream()
+               .map(r -> r.getGroupByValues().get(raw)).filter(Objects::nonNull).map(v -> new BigDecimal(v.toString())).toList();
+            return (new StandInAnalysisBackend(config).numericRange(request.getTableName(), name, members, edges[0], edges[1], index == bins.getCount()));
+         }
+         return (index > bins.getCount() ? DrillFilters.condition(name, QCriteriaOperator.GREATER_THAN, bins.getMax())
+            : DrillFilters.range(name, edges[0], edges[1], index == bins.getCount()));
+      }
+      DateBucketUnit unit = ((DateBucket) group.getBucket()).getUnit();
+      if(unit == DateBucketUnit.HOUR)
+      {
+         Instant start = ValueUtils.getValueAsInstant(value);
+         return (DrillFilters.range(name, start, start.plusSeconds(3600), false));
+      }
+      if(unit == DateBucketUnit.DAY_OF_WEEK || unit == DateBucketUnit.HOUR_OF_DAY)
+      {
+         GroupBy raw = new GroupBy(field.getType(), name);
+         List<Serializable> members = aggregate(List.of(raw), request.getFilter(), List.of(count), null).stream().map(r -> r.getGroupByValues().get(raw))
+            .filter(v -> Objects.equals(AggregateAnalysis.bucket(v, group.getBucket(), ValueUtils.getSessionOrInstanceZoneId()), value)).toList();
+         return (DrillFilters.in(name, members));
+      }
+      LocalDate start = ValueUtils.getValueAsLocalDate(value);
+      LocalDate end = switch(unit)
+      {
+         case YEAR -> start.plusYears(1);
+         case QUARTER -> start.plusMonths(3);
+         case MONTH -> start.plusMonths(1);
+         case WEEK -> start.plusWeeks(1);
+         default -> start.plusDays(1);
+      };
+      return (DrillFilters.dateRange(name, start, end, field.getType() == QFieldType.DATE_TIME, ValueUtils.getSessionOrInstanceZoneId()));
+   }
+
+   /*******************************************************************************
+    ** A level is the full matrix, row totals, column totals or grand totals.
+    *******************************************************************************/
+   private Map<List<Slot>, List<Metric>> level(List<Dimension> dimensions) throws QException
+   {
+      List<Aggregate> requested = new ArrayList<>(measures);
+      if(!requested.contains(count))
+      {
+         requested.add(count);
+      }
+      Map<List<Slot>, List<AggregateResult>> grouped = new LinkedHashMap<>();
+      List<AggregateResult> aggregates = aggregate(dimensions.stream().map(Dimension::group).toList(), request.getFilter(), requested, null);
+      if(dimensions.isEmpty() && aggregates.isEmpty())
+      {
+         AggregateResult empty = new AggregateResult();
+         requested.forEach(a -> empty.withAggregateValue(a, a.getOperator() == AggregateOperator.COUNT || a.getOperator() == AggregateOperator.COUNT_DISTINCT ? 0L : null));
+         aggregates = List.of(empty);
+      }
+      for(AggregateResult row : aggregates)
+      {
+         List<Slot> key = new ArrayList<>();
+         for(Dimension dimension : dimensions)
+         {
+            key.add(dimension.slot(row.getGroupByValues().get(dimension.group()), config.getMinGroupSize()));
+         }
+         if(!key.contains(null))
+         {
+            grouped.computeIfAbsent(key, ignored -> new ArrayList<>()).add(row);
+         }
+      }
+      Map<List<Slot>, List<Metric>> result = new LinkedHashMap<>();
+      for(var entry : grouped.entrySet())
+      {
+         QQueryFilter predicate = new QQueryFilter();
+         entry.getKey().forEach(slot -> predicate.withSubFilter(slot.condition()));
+         AggregateResult row = entry.getValue().getFirst();
+         if(entry.getKey().stream().anyMatch(Slot::other))
+         {
+            var merged = aggregate(List.of(), DrillFilters.and(request.getFilter(), predicate), requested, null);
+            if(merged.isEmpty())
+            {
+               continue;
+            }
+            row = merged.getFirst();
+         }
+         List<Metric> values = new ArrayList<>();
+         for(int i = 0; i < measures.size(); i++)
+         {
+            PivotMeasureInfo info = measureInfo.get(i);
+            Serializable value = row.getAggregateValues().get(measures.get(i));
+            Metric metric = new Metric().withKey(info.getKey()).withLabel(info.getLabel()).withValueType(info.getValueType()).withValue(value)
+               .withFormatted(AnalysisFormatting.scalar(info.getKey(), value, info.getValueType()));
+            if(toManyTables.isEmpty() && multiHopTables.isEmpty())
+            {
+               metric.withDrill(DrillFilters.drill(request.getTableName(), request.getFilter(), predicate));
+            }
+            values.add(metric);
+         }
+         new MinGroupSizeGuard(config.getMinGroupSize()).pivotMetrics(values, count(row));
+         result.put(entry.getKey(), values);
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Count is always present, even when the user selects only non-count measures.
+    *******************************************************************************/
+   private long count(AggregateResult row)
+   {
+      Object value = row.getAggregateValues().get(count);
+      return (value == null ? 0 : ((Number) value).longValue());
+   }
+
+   /*******************************************************************************
+    ** Core owns SQL pushdown, joins, record locks, field locks and bounded fallback.
+    *******************************************************************************/
+   private List<AggregateResult> aggregate(List<GroupBy> groups, QQueryFilter filter, List<Aggregate> aggregates, Integer limit) throws QException
+   {
+      QQueryFilter query = DrillFilters.restoreTypes(request.getTableName(), filter);
+      if(limit != null)
+      {
+         query.withOrderBy(new QFilterOrderByAggregate(count, false));
+      }
+      AggregateInput input = new AggregateInput(request.getTableName()).withFilter(query).withQueryJoins(joins.stream().map(QueryJoin::clone).toList())
+         .withAllowStreamedFallback(true).withStreamedRowLimit(config.getMaxRows()).withLimit(limit);
+      groups.forEach(input::withGroupBy);
+      new LinkedHashSet<>(aggregates).forEach(input::withAggregate);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      var output = new AggregateAction().execute(input);
+      partial |= output.getTruncated();
+      return (limit == null ? output.getResults() : output.getResults().stream().sorted(java.util.Comparator.comparingLong(this::count).reversed()
+         .thenComparing(r -> String.valueOf(r.getGroupByValues().values()))).limit(limit).toList());
+   }
+
+   /*******************************************************************************
+    ** Header tuples retain typed values; Other is distinguished by its label.
+    *******************************************************************************/
+   private static List<List<PivotHeader>> headers(List<List<Slot>> keys)
+   {
+      return (keys.stream().map(key -> key.stream().map(slot -> new PivotHeader().withValue(slot.value()).withLabel(slot.label())).toList()).toList());
+   }
+
+   /*******************************************************************************
+    ** Partial numbers must never claim an exact drill equivalence.
+    *******************************************************************************/
+   private void disableDrills(List<Metric> metrics)
+   {
+      metrics.forEach(m -> m.withDrill(null).withEstimate(true));
+   }
+}
+

src/main/java/com/kingsrook/qbits/dataanalysis/engine/ProfileSupport.java

@@ -108,6 +108,15 @@ public final class ProfileSupport
     ** PVS translations run as the current user; drill values always remain ids.
     *******************************************************************************/
    public static List<ValueCount> values(String table, QQueryFilter filter, QFieldMetaData field, List<AnalysisBackend.GroupCount> groups, long total) throws QException
+   {
+      return (values(table, filter, field, groups, total, CoreTierFieldAccessResolver.defaultResolver()));
+   }
+
+   /*******************************************************************************
+    ** Host field policy applies to related display labels as well as source values.
+    *******************************************************************************/
+   public static List<ValueCount> values(String table, QQueryFilter filter, QFieldMetaData field, List<AnalysisBackend.GroupCount> groups, long total,
+      FieldAnalysisAccessResolver access) throws QException
    {
       List<ValueCount> result = new ArrayList<>();
       for(AnalysisBackend.GroupCount group : groups)
@@ -115,7 +124,7 @@ public final class ProfileSupport
          String label = group.label();
          if(field != null && field.getPossibleValueSourceName() != null && group.value() != null)
          {
-            String translated = AnalysisLabels.translate(field, group.value());
+            String translated = AnalysisLabels.translate(field, group.value(), access);
             if(translated != null)
             {
                label = translated;

src/main/java/com/kingsrook/qbits/dataanalysis/engine/RelationshipExplorer.java

@@ -0,0 +1,255 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.math.BigDecimal;
+import java.util.ArrayList;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Set;
+import com.kingsrook.qbits.dataanalysis.result.ChartKind;
+import com.kingsrook.qbits.dataanalysis.result.CorrelationCell;
+import com.kingsrook.qbits.dataanalysis.result.CorrelationRequest;
+import com.kingsrook.qbits.dataanalysis.result.CorrelationResult;
+import com.kingsrook.qbits.dataanalysis.result.CrosstabCell;
+import com.kingsrook.qbits.dataanalysis.result.CrosstabRequest;
+import com.kingsrook.qbits.dataanalysis.result.CrosstabResult;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.PivotHeader;
+import com.kingsrook.qbits.dataanalysis.result.Point;
+import com.kingsrook.qbits.dataanalysis.result.ScatterRequest;
+import com.kingsrook.qbits.dataanalysis.result.ScatterResult;
+import com.kingsrook.qbits.dataanalysis.result.Series;
+import com.kingsrook.qbits.dataanalysis.result.TrendLine;
+import com.kingsrook.qbits.dataanalysis.result.ValueType;
+import com.kingsrook.qbits.dataanalysis.stats.Statistics;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.Aggregate;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+/*******************************************************************************
+ ** Pairwise correlation, bounded scatter samples and guarded contingency tables.
+ *******************************************************************************/
+public class RelationshipExplorer extends RelationshipSupport
+{
+   /*******************************************************************************
+    ** Each operation has its own execution state and policy snapshot.
+    *******************************************************************************/
+   public RelationshipExplorer(AnalysisSecurity security, EffectiveConfig config, String table)
+   {
+      super(security, config, table);
+   }
+
+   /*******************************************************************************
+    ** All unique CORR pairs share one aggregate call, including streamed fallback.
+    ** Pair counts use core CountAction because Aggregate has no per-measure filter.
+    *******************************************************************************/
+   public CorrelationResult correlation(CorrelationRequest request) throws QException
+   {
+      List<String> fields = request.getFields();
+      if(fields == null || fields.size() < 2 || fields.size() > 12 || new LinkedHashSet<>(fields).size() != fields.size())
+      {
+         throw new QBadRequestException("Choose 2 to 12 distinct numeric fields.");
+      }
+      for(String field : fields)
+      {
+         requireNumeric(field);
+      }
+      List<Aggregate> aggregates = new ArrayList<>();
+      for(int i = 0; i < fields.size(); i++)
+      {
+         for(int j = i; j < fields.size(); j++)
+         {
+            aggregates.add(measure(fields.get(i), AggregateOperator.CORR).withOtherFieldName(fields.get(j)));
+         }
+      }
+      var values = summarize(request.getFilter(), aggregates).getAggregateValues();
+      CorrelationResult result = new CorrelationResult().withFields(List.copyOf(fields));
+      List<Series> series = new ArrayList<>();
+      for(int i = 0; i < fields.size(); i++)
+      {
+         String x = fields.get(i);
+         Series row = new Series().withName(x);
+         for(int j = 0; j < fields.size(); j++)
+         {
+            String y = fields.get(j);
+            Aggregate key = measure(fields.get(Math.min(i, j)), AggregateOperator.CORR).withOtherFieldName(fields.get(Math.max(i, j)));
+            BigDecimal value = decimal(values.get(key));
+            long n = size(paired(request.getFilter(), x, y));
+            boolean hidden = n < config.getMinGroupSize();
+            Double r = hidden || n < 2 || value == null ? null : value.doubleValue();
+            result.getCells().add(new CorrelationCell().withXField(x).withYField(y).withN(hidden ? null : n).withR(r)
+               .withScatter(hidden ? null : new ScatterRequest().withTableName(table).withXField(x).withYField(y).withFilter(DrillFilters.copy(request.getFilter()))));
+            row.getPoints().add(new Point().withX(y).withY(r == null ? null : BigDecimal.valueOf(r)).withLabel(x + " / " + y));
+         }
+         series.add(row);
+      }
+      return (result.withChart(chart(ChartKind.HEATMAP, series, "Pearson r; each cell includes its paired non-null count and scatter request.")));
+   }
+
+   /*******************************************************************************
+    ** QueryInput has no sampling API. Fetch the first N paired records by primary
+    ** key as the user, with core-enforced record locks and a maximum of 2,000.
+    *******************************************************************************/
+   public ScatterResult scatter(ScatterRequest request) throws QException
+   {
+      requireNumeric(request.getXField());
+      requireNumeric(request.getYField());
+      if(request.getLimit() == null || request.getLimit() < 1 || request.getLimit() > 2000)
+      {
+         throw new QBadRequestException("Scatter limit must be from 1 to 2000.");
+      }
+      String x = request.getXField();
+      String y = request.getYField();
+      String pk = primaryKey(table);
+      QQueryFilter filter = paired(request.getFilter(), x, y);
+      long n = size(filter);
+      ScatterResult result = new ScatterResult().withN(n).withSampling("First N paired records by primary key").withSampleSize(0);
+      if(n < config.getMinGroupSize())
+      {
+         return (result.withN(null).withChart(chart(ChartKind.SCATTER, List.of(), "Hidden: fewer than " + config.getMinGroupSize() + " paired records.")));
+      }
+      Set<String> selected = new LinkedHashSet<>(List.of(x, y));
+      boolean drill = config.getMinGroupSize() == 0 && security.analyzableFields(table).stream().anyMatch(f -> f.getName().equals(pk));
+      if(drill)
+      {
+         selected.add(pk);
+      }
+      var records = rows(table, filter, selected, request.getLimit());
+      double[] xs = new double[records.size()];
+      double[] ys = new double[records.size()];
+      for(int i = 0; i < records.size(); i++)
+      {
+         var record = records.get(i);
+         BigDecimal xv = decimal(record.getValue(x));
+         BigDecimal yv = decimal(record.getValue(y));
+         xs[i] = xv.doubleValue();
+         ys[i] = yv.doubleValue();
+         result.getPoints().add(new Point().withX(xv).withY(yv).withDrill(drill ? DrillFilters.drill(table, null,
+            DrillFilters.condition(pk, QCriteriaOperator.EQUALS, record.getValue(pk))) : null));
+      }
+      result.withSampleSize(records.size()).withTrend(trend(xs, ys));
+      Series points = new Series().withName("Sample").withPoints(result.getPoints());
+      Series line = new Series().withName("Least-squares trend");
+      if(result.getTrend() != null)
+      {
+         double low = java.util.Arrays.stream(xs).min().orElseThrow();
+         double high = java.util.Arrays.stream(xs).max().orElseThrow();
+         for(double value : new double[] {low, high})
+         {
+            line.getPoints().add(new Point().withX(BigDecimal.valueOf(value)).withY(BigDecimal.valueOf(result.getTrend().getIntercept() + result.getTrend().getSlope() * value)));
+         }
+      }
+      return (result.withChart(chart(ChartKind.SCATTER, List.of(points, line), "Trend describes the displayed sample, not the full population.")));
+   }
+
+   /*******************************************************************************
+    ** Centered least squares remains stable when coordinates have large offsets.
+    *******************************************************************************/
+   private TrendLine trend(double[] x, double[] y)
+   {
+      if(x.length < 2)
+      {
+         return (null);
+      }
+      double meanX = java.util.Arrays.stream(x).average().orElseThrow();
+      double meanY = java.util.Arrays.stream(y).average().orElseThrow();
+      double xx = 0;
+      double xy = 0;
+      for(int i = 0; i < x.length; i++)
+      {
+         xx += (x[i] - meanX) * (x[i] - meanX);
+         xy += (x[i] - meanX) * (y[i] - meanY);
+      }
+      return (xx == 0 ? null : new TrendLine().withSlope(xy / xx).withIntercept(meanY - xy / xx * meanX).withR(Statistics.pearson(x, y)));
+   }
+
+   /*******************************************************************************
+    ** Cell counts include zero combinations. Suppression also removes shares
+    ** that could reconstruct a hidden cell from a known marginal total.
+    *******************************************************************************/
+   public CrosstabResult crosstab(CrosstabRequest request) throws QException
+   {
+      full(request.getRowField());
+      full(request.getColumnField());
+      if(request.getRowField().equals(request.getColumnField()) || request.getLimit() == null || request.getLimit() < 1 || request.getLimit() > 20)
+      {
+         throw new QBadRequestException("Choose distinct crosstab fields and a limit from 1 to 20.");
+      }
+      List<Category> rows = categories(request.getRowField(), request.getFilter(), request.getLimit());
+      List<Category> columns = categories(request.getColumnField(), request.getFilter(), request.getLimit());
+      long[] rowTotals = new long[rows.size()];
+      long[] columnTotals = new long[columns.size()];
+      boolean[] hiddenRows = new boolean[rows.size()];
+      boolean[] hiddenColumns = new boolean[columns.size()];
+      double[][] counts = new double[rows.size()][columns.size()];
+      boolean hidden = false;
+      for(int i = 0; i < rows.size(); i++)
+      {
+         for(int j = 0; j < columns.size(); j++)
+         {
+            long n = size(DrillFilters.and(request.getFilter(), DrillFilters.and(rows.get(i).condition(), columns.get(j).condition())));
+            counts[i][j] = n;
+            rowTotals[i] += n;
+            columnTotals[j] += n;
+            if(n < config.getMinGroupSize())
+            {
+               hidden = true;
+               hiddenRows[i] = true;
+               hiddenColumns[j] = true;
+            }
+         }
+      }
+      CrosstabResult result = new CrosstabResult().withRows(rows.stream().map(c -> new PivotHeader().withValue(c.value()).withLabel(c.label())).toList())
+         .withColumns(columns.stream().map(c -> new PivotHeader().withValue(c.value()).withLabel(c.label())).toList());
+      for(int i = 0; i < rows.size(); i++)
+      {
+         for(int j = 0; j < columns.size(); j++)
+         {
+            long n = (long) counts[i][j];
+            QQueryFilter condition = DrillFilters.and(rows.get(i).condition(), columns.get(j).condition());
+            Metric count = metric("count", n, ValueType.COUNT, request.getFilter(), condition);
+            Metric rowShare = metric("rowShare", ProfileSupport.share(n, rowTotals[i]), ValueType.PERCENT, request.getFilter(), condition);
+            Metric columnShare = metric("columnShare", ProfileSupport.share(n, columnTotals[j]), ValueType.PERCENT, request.getFilter(), condition);
+            List<Metric> metrics = List.of(count, rowShare, columnShare);
+            if(rows.get(i).privateGroup() || columns.get(j).privateGroup())
+            {
+               metrics.forEach(m -> m.withDrill(null));
+               hidden = true;
+            }
+            guard(metrics, n);
+            if(hiddenRows[i])
+            {
+               guard(List.of(rowShare), 0);
+            }
+            if(hiddenColumns[j])
+            {
+               guard(List.of(columnShare), 0);
+            }
+            result.getCells().add(new CrosstabCell().withRowIndex(i).withColumnIndex(j).withCount(count).withRowShare(rowShare).withColumnShare(columnShare));
+         }
+      }
+      return (result.withSignificance(significance(hidden ? Statistics.unavailable("Chi-square independence", "privacy guard") : Statistics.chiSquare(counts, false))));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/RelationshipSupport.java

@@ -0,0 +1,241 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.List;
+import com.kingsrook.qbits.dataanalysis.result.Chart;
+import com.kingsrook.qbits.dataanalysis.result.ChartKind;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.Series;
+import com.kingsrook.qbits.dataanalysis.result.Significance;
+import com.kingsrook.qbits.dataanalysis.result.ValueType;
+import com.kingsrook.qbits.dataanalysis.stats.Statistics;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.AggregateAction;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.Aggregate;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateResult;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.GroupBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+
+/*******************************************************************************
+ ** Shared core execution and semantic output for request-local relationships.
+ *******************************************************************************/
+public class RelationshipSupport extends StandInAnalysisBackend
+{
+   protected final AnalysisSecurity security;
+   protected final String table;
+
+   /*******************************************************************************
+    ** A bucket retains exact membership; privacy buckets intentionally lack drills.
+    *******************************************************************************/
+   protected record Category(Serializable value, String label, QQueryFilter condition, boolean privateGroup)
+   {
+   }
+
+   /*******************************************************************************
+    ** Bind the caller's already-authorized table and current policy.
+    *******************************************************************************/
+   public RelationshipSupport(AnalysisSecurity security, EffectiveConfig config, String table)
+   {
+      super(config);
+      this.security = security;
+      this.table = table;
+   }
+
+   /*******************************************************************************
+    ** Core owns pushdown and bounded fallback. Never label a partial test exact.
+    *******************************************************************************/
+   @Override
+   protected List<AggregateResult> aggregate(AggregateInput input) throws QException
+   {
+      input.withFilter(DrillFilters.restoreTypes(table, input.getFilter())).withAllowStreamedFallback(true).withStreamedRowLimit(config.getMaxRows());
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      var output = new AggregateAction().execute(input);
+      if(Boolean.TRUE.equals(output.getTruncated()))
+      {
+         throw new QBadRequestException("Analysis exceeds the streamed row limit; narrow the filter.");
+      }
+      return (output.getResults());
+   }
+
+   /*******************************************************************************
+    ** All named fields, including PVS numerics, must pass the FULL resolver first.
+    *******************************************************************************/
+   protected QFieldMetaData full(String name) throws QException
+   {
+      return (security.field(table, name));
+   }
+
+   /*******************************************************************************
+    ** PVS identifiers are categorical even when their storage type is numeric.
+    *******************************************************************************/
+   protected boolean numeric(QFieldMetaData field)
+   {
+      return (field.getPossibleValueSourceName() == null && List.of(QFieldType.INTEGER, QFieldType.LONG, QFieldType.DECIMAL).contains(field.getType()));
+   }
+
+   /*******************************************************************************
+    ** Reject strings and categorical identifiers before computing relationships.
+    *******************************************************************************/
+   protected void requireNumeric(String name) throws QException
+   {
+      if(!numeric(full(name)))
+      {
+         throw new QBadRequestException("Choose numeric analysis fields.");
+      }
+   }
+
+   /*******************************************************************************
+    ** Typed aggregate keys must match keys returned by all backend implementations.
+    *******************************************************************************/
+   protected Aggregate measure(String field, AggregateOperator operator)
+   {
+      Aggregate aggregate = new Aggregate(field, operator);
+      return (aggregate.withFieldType(com.kingsrook.qqq.backend.core.utils.aggregates.AggregateAnalysis.resultType(aggregate, field(table, field).getType())));
+   }
+
+   /*******************************************************************************
+    ** Scalar summaries have one result; empty populations have null numeric values.
+    *******************************************************************************/
+   protected AggregateResult summarize(QQueryFilter filter, List<Aggregate> measures) throws QException
+   {
+      AggregateInput input = new AggregateInput(table).withFilter(DrillFilters.copy(filter));
+      measures.forEach(input::withAggregate);
+      List<AggregateResult> results = aggregate(input);
+      return (results.isEmpty() ? new AggregateResult() : results.getFirst());
+   }
+
+   /*******************************************************************************
+    ** Exact row count uses the core count action with the caller's record locks.
+    *******************************************************************************/
+   protected long size(QQueryFilter filter) throws QException
+   {
+      return (count(table, filter));
+   }
+
+   /*******************************************************************************
+    ** Count and scalar drills preserve the caller's original OR predicates.
+    *******************************************************************************/
+   protected Metric metric(String key, Serializable value, ValueType type, QQueryFilter filter, QQueryFilter condition)
+   {
+      return (ProfileSupport.metric(key.startsWith("category") ? type == ValueType.COUNT ? "count" : "share" : key, value, type).withKey(key).withDrill(DrillFilters.drill(table, filter, condition)));
+   }
+
+   /*******************************************************************************
+    ** Apply the stricter cell guard to remove both values and membership drills.
+    *******************************************************************************/
+   protected void guard(List<Metric> metrics, long n)
+   {
+      new MinGroupSizeGuard(config.getMinGroupSize()).pivotMetrics(metrics, n);
+   }
+
+   /*******************************************************************************
+    ** Group identities are typed; null and empty string remain distinct.
+    *******************************************************************************/
+   protected List<Category> categories(String field, QQueryFilter filter, int limit) throws QException
+   {
+      QFieldMetaData metadata = full(field);
+      GroupBy group = new GroupBy(metadata);
+      Aggregate count = measure(primaryKey(table), AggregateOperator.COUNT);
+      List<AggregateResult> groups = new ArrayList<>(aggregate(new AggregateInput(table).withFilter(DrillFilters.copy(filter)).withGroupBy(group).withAggregate(count)));
+      groups.sort(Comparator.<AggregateResult>comparingLong(r -> ((Number) r.getAggregateValues().get(count)).longValue()).reversed()
+         .thenComparing(r -> String.valueOf(r.getGroupByValues().get(group))));
+      List<Category> result = new ArrayList<>();
+      List<Category> other = new ArrayList<>();
+      boolean privacy = false;
+      for(AggregateResult row : groups)
+      {
+         Serializable value = row.getGroupByValues().get(group);
+         long n = ((Number) row.getAggregateValues().get(count)).longValue();
+         boolean hidden = n < config.getMinGroupSize();
+         Category category = new Category(value, hidden ? "Other" : value == null ? "(Blank)" : security.label(metadata, value),
+            DrillFilters.value(field, value, metadata.getType() == QFieldType.STRING), hidden);
+         if(hidden || result.size() >= limit)
+         {
+            other.add(category);
+            privacy |= hidden;
+         }
+         else
+         {
+            result.add(category);
+         }
+      }
+      if(!other.isEmpty())
+      {
+         result.add(merge(other, privacy));
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** An explicit union avoids null-sensitive NOT IN semantics for Other.
+    *******************************************************************************/
+   protected Category merge(List<Category> categories, boolean privacy)
+   {
+      QQueryFilter condition = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR);
+      categories.forEach(c -> condition.withSubFilter(c.condition()));
+      return (new Category(null, "Other", condition, privacy));
+   }
+
+   /*******************************************************************************
+    ** Keep the math package free of QQQ and JSON dependencies.
+    *******************************************************************************/
+   protected Significance significance(Statistics.Result result)
+   {
+      return (new Significance().withTest(result.test()).withStatistic(result.statistic()).withDf(result.df()).withPValue(result.pValue())
+         .withApplicable(result.applicable()).withSentence(result.sentence()).withCramersV(result.cramersV()));
+   }
+
+   /*******************************************************************************
+    ** Scalar conversion preserves null instead of leaking non-finite JSON numbers.
+    *******************************************************************************/
+   protected static BigDecimal decimal(Object value)
+   {
+      return (value == null ? null : new BigDecimal(value.toString()));
+   }
+
+   /*******************************************************************************
+    ** Shared chart shape with a deliberate grouping/stacking annotation.
+    *******************************************************************************/
+   protected Chart chart(ChartKind kind, List<Series> series, String annotation)
+   {
+      return (new Chart().withKind(kind).withSeries(series).withAnnotations(List.of(annotation)));
+   }
+
+   /*******************************************************************************
+    ** Correlation and regression exclude rows missing either numeric coordinate.
+    *******************************************************************************/
+   protected QQueryFilter paired(QQueryFilter filter, String x, String y)
+   {
+      return (DrillFilters.and(filter, DrillFilters.condition(x, QCriteriaOperator.IS_NOT_BLANK).withCriteria(y, QCriteriaOperator.IS_NOT_BLANK)));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/ShiftExplorer.java

@@ -0,0 +1,213 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.ZoneId;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.dataanalysis.result.ChartKind;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.Point;
+import com.kingsrook.qbits.dataanalysis.result.Series;
+import com.kingsrook.qbits.dataanalysis.result.ShiftBucket;
+import com.kingsrook.qbits.dataanalysis.result.ShiftRequest;
+import com.kingsrook.qbits.dataanalysis.result.ShiftResult;
+import com.kingsrook.qbits.dataanalysis.result.ValueType;
+import com.kingsrook.qbits.dataanalysis.stats.Statistics;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.DateBucket;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.DateBucketUnit;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.GroupBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.utils.ValueUtils;
+
+/*******************************************************************************
+ ** Distribution drift with stable categories or fixed baseline quartile bins.
+ *******************************************************************************/
+public class ShiftExplorer extends ComparisonExplorer
+{
+   /*******************************************************************************
+    ** Bind the same core and privacy policy as compare.
+    *******************************************************************************/
+   public ShiftExplorer(AnalysisSecurity security, EffectiveConfig config, String table)
+   {
+      super(security, config, table);
+   }
+
+   /*******************************************************************************
+    ** One calendar bucket with exact boundaries and whether its end has passed.
+    *******************************************************************************/
+   private record Bucket(Serializable start, QQueryFilter condition, boolean complete)
+   {
+   }
+
+   /*******************************************************************************
+    ** First and last complete nonempty buckets define the descriptive PSI.
+    *******************************************************************************/
+   public ShiftResult shift(ShiftRequest request) throws QException
+   {
+      var field = full(request.getField());
+      var date = full(request.getDateField());
+      DateBucketUnit unit;
+      try
+      {
+         unit = DateBucketUnit.valueOf(request.getBucket());
+      }
+      catch(RuntimeException e)
+      {
+         throw new QBadRequestException("Choose a calendar bucket.");
+      }
+      if(!List.of(QFieldType.DATE, QFieldType.DATE_TIME).contains(date.getType()) || unit == DateBucketUnit.DAY_OF_WEEK
+         || unit == DateBucketUnit.HOUR_OF_DAY || unit == DateBucketUnit.HOUR && date.getType() != QFieldType.DATE_TIME)
+      {
+         throw new QBadRequestException("Choose a date field and a calendar bucket from HOUR to YEAR.");
+      }
+      GroupBy group = new GroupBy(date).withBucket(new DateBucket(unit));
+      var aggregate = measure(primaryKey(table), AggregateOperator.COUNT);
+      var grouped = aggregate(new AggregateInput(table).withFilter(DrillFilters.copy(request.getFilter())).withGroupBy(group).withAggregate(aggregate));
+      List<Bucket> buckets = grouped.stream().map(r -> r.getGroupByValues().get(group)).filter(java.util.Objects::nonNull)
+         .sorted(Comparator.comparing(Object::toString)).map(start -> bucket(request.getDateField(), start, unit, date.getType())).toList();
+      if(buckets.size() > 2000)
+      {
+         throw new QBadRequestException("Choose a larger time bucket; at most 2000 buckets are supported.");
+      }
+      ShiftResult result = new ShiftResult();
+      List<Series> series = new ArrayList<>();
+      List<double[]> complete = new ArrayList<>();
+      boolean numeric = numeric(field);
+      List<Category> categories = numeric ? List.of() : categories(request.getField(), request.getFilter(), 8);
+      Map<String, BigDecimal> baseline = null;
+      boolean privateData = false;
+      if(numeric)
+      {
+         for(String name : List.of("p25", "median", "p75"))
+         {
+            series.add(new Series().withName(name));
+         }
+      }
+      else
+      {
+         for(Category category : categories)
+         {
+            series.add(new Series().withName(category.label()));
+         }
+      }
+      for(Bucket bucket : buckets)
+      {
+         QQueryFilter filter = DrillFilters.and(request.getFilter(), bucket.condition());
+         long n = size(filter);
+         ShiftBucket output = new ShiftBucket().withValue(bucket.start()).withLabel(bucket.start().toString()).withComplete(bucket.complete());
+         double[] counts;
+         if(numeric)
+         {
+            Map<String, BigDecimal> moments = moments(request.getField(), filter);
+            long nonNull = moments.get("count").longValue();
+            if(baseline == null && bucket.complete())
+            {
+               baseline = moments;
+            }
+            output.withMetrics(numericSide(request.getField(), output.getLabel(), filter, moments).getMetrics());
+            counts = baseline == null || baseline.get("count").signum() == 0 ? new double[0] : numericCounts(request.getField(), filter, baseline);
+            privateData |= nonNull < config.getMinGroupSize();
+            for(int i = 0; i < series.size(); i++)
+            {
+               String key = series.get(i).getName();
+               Metric metric = output.getMetrics().stream().filter(m -> m.getKey().equals(key)).findFirst().orElseThrow();
+               series.get(i).getPoints().add(new Point().withX(bucket.start()).withY(decimal(metric.getValue())).withDrill(metric.getDrill()));
+            }
+         }
+         else
+         {
+            counts = new double[categories.size()];
+            for(int i = 0; i < categories.size(); i++)
+            {
+               Category category = categories.get(i);
+               long count = size(DrillFilters.and(filter, category.condition()));
+               counts[i] = count;
+               Metric countMetric = metric("category" + i + "Count", count, ValueType.COUNT, filter, category.condition()).withLabel(category.label());
+               Metric share = metric("category" + i + "Share", ProfileSupport.share(count, n), ValueType.PERCENT, filter, category.condition()).withLabel(category.label());
+               List<Metric> metrics = List.of(countMetric, share);
+               guard(metrics, count);
+               if(category.privateGroup())
+               {
+                  metrics.forEach(m -> m.withDrill(null));
+               }
+               privateData |= category.privateGroup() || count < config.getMinGroupSize();
+               output.getMetrics().addAll(metrics);
+               series.get(i).getPoints().add(new Point().withX(bucket.start()).withY(decimal(share.getValue())).withLabel(category.label()).withDrill(share.getDrill()));
+            }
+         }
+         result.getBuckets().add(output);
+         if(bucket.complete())
+         {
+            complete.add(counts);
+         }
+      }
+      Double psi = !privateData && complete.size() >= 2 && java.util.Arrays.stream(complete.getFirst()).sum() >= 2
+         && java.util.Arrays.stream(complete.getLast()).sum() >= 2 ? Statistics.psi(complete.getFirst(), complete.getLast()) : null;
+      result.withPsi(ProfileSupport.metric("psi", psi, ValueType.DECIMAL));
+      result.withSentence(psi == null ? "Not applicable: " + (privateData ? "privacy guard" : "two complete buckets with at least two values are required")
+         : "The first and last complete buckets have a population stability index of " + BigDecimal.valueOf(psi).setScale(3, java.math.RoundingMode.HALF_UP) + ".");
+      return (result.withChart(chart(ChartKind.TIME_SERIES, series, numeric ? "Numeric quartiles; PSI uses fixed first-complete-bucket quartile boundaries."
+         : "Stacked category shares. PSI floors zero shares at 0.000001; it is not a significance test.").withStacked(!numeric)));
+   }
+
+   /*******************************************************************************
+    ** Calendar boundaries use the session zone, including daylight-saving days.
+    *******************************************************************************/
+   private Bucket bucket(String field, Serializable value, DateBucketUnit unit, QFieldType type)
+   {
+      ZoneId zone = ValueUtils.getSessionOrInstanceZoneId();
+      if(unit == DateBucketUnit.HOUR)
+      {
+         Instant start = ValueUtils.getValueAsInstant(value);
+         Instant end = start.plusSeconds(3600);
+         return (new Bucket(start, DrillFilters.range(field, start, end, false), !end.isAfter(Instant.now())));
+      }
+      LocalDate start = ValueUtils.getValueAsLocalDate(value);
+      LocalDate end = next(start, DateUnit.valueOf(unit.name()));
+      return (new Bucket(start, DrillFilters.dateRange(field, start, end, type == QFieldType.DATE_TIME, zone), !end.atStartOfDay(zone).toInstant().isAfter(Instant.now())));
+   }
+
+   /*******************************************************************************
+    ** Both populations use identical, half-open quartile ranges with infinite tails.
+    *******************************************************************************/
+   private double[] numericCounts(String field, QQueryFilter filter, Map<String, BigDecimal> baseline) throws QException
+   {
+      BigDecimal[] edges = {null, baseline.get("p25"), baseline.get("p50"), baseline.get("p75"), null};
+      double[] counts = new double[4];
+      for(int i = 0; i < 4; i++)
+      {
+         counts[i] = size(DrillFilters.and(filter, DrillFilters.range(field, edges[i], edges[i + 1], false)));
+      }
+      return (counts);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/metadata/WatchProcesses.java

@@ -0,0 +1,93 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.metadata;
+
+import java.util.List;
+import com.kingsrook.qbits.dataanalysis.DataAnalysisQBitConfig;
+import com.kingsrook.qbits.dataanalysis.model.DataAnalysisTables;
+import com.kingsrook.qbits.dataanalysis.processes.WatchActions;
+import com.kingsrook.qqq.backend.core.model.metadata.MetaDataProducerMultiOutput;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QBackendStepMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.processes.QProcessMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitComponentMetaDataProducer;
+import com.kingsrook.qqq.backend.core.model.metadata.scheduleing.QScheduleMetaData;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.ExtractViaQueryStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.StreamedETLWithFrontendProcess;
+
+/*******************************************************************************
+ ** Watch record actions and one hidden scheduled process, never app children.
+ *******************************************************************************/
+public class WatchProcesses extends QBitComponentMetaDataProducer<MetaDataProducerMultiOutput, DataAnalysisQBitConfig>
+{
+   /*******************************************************************************
+    ** Build after the watch table has been registered.
+    *******************************************************************************/
+   @Override
+   public int getSortOrder()
+   {
+      return (200);
+   }
+
+   /*******************************************************************************
+    ** Component scanning also encounters unconfigured producers.
+    *******************************************************************************/
+   @Override
+   public boolean isEnabled()
+   {
+      return (getQBitConfig() != null);
+   }
+
+   /*******************************************************************************
+    ** Ordinary core actions provide selected records, Review, and Result screens.
+    *******************************************************************************/
+   @Override
+   public MetaDataProducerMultiOutput produce(QInstance instance)
+   {
+      MetaDataProducerMultiOutput output = new MetaDataProducerMultiOutput();
+      for(String name : List.of(WatchActions.EVALUATE, WatchActions.ENABLE, WatchActions.DISABLE))
+      {
+         String label = WatchActions.EVALUATE.equals(name) ? "Evaluate now" : WatchActions.ENABLE.equals(name) ? "Enable" : "Disable";
+         QProcessMetaData process = StreamedETLWithFrontendProcess.processMetaDataBuilder()
+            .withName(name).withLabel(label).withIcon(new QIcon("notifications_active"))
+            .withTableName(DataAnalysisTables.WATCH).withSourceTable(DataAnalysisTables.WATCH).withDestinationTable(DataAnalysisTables.WATCH)
+            .withExtractStepClass(ExtractViaQueryStep.class).withTransformStepClass(WatchActions.Review.class).withLoadStepClass(WatchActions.Result.class)
+            .withSupportsFullValidation(true).withDoFullValidation(true).withMinInputRecords(1)
+            .withPreviewMessage("Review the selected watches.").getProcessMetaData();
+         // Table READ/EDIT and owner locks are enforced by extraction and both steps.
+         process.withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.NOT_PROTECTED));
+         output.add(process);
+      }
+      QProcessMetaData scheduled = new QProcessMetaData().withName(WatchActions.SCHEDULED).withLabel("Evaluate watches").withIsHidden(true)
+         .withPermissionRules(new QPermissionRules().withLevel(PermissionLevel.HAS_ACCESS_PERMISSION).withPermissionBaseName(WatchActions.SCHEDULED))
+         .withStep(new QBackendStepMetaData().withName("run").withCode(new QCodeReference(WatchActions.Scheduled.class)));
+      if(getQBitConfig().getSchedulerName() != null)
+      {
+         scheduled.withSchedule(new QScheduleMetaData().withSchedulerName(getQBitConfig().getSchedulerName()).withRepeatSeconds(900).withInitialDelaySeconds(900));
+      }
+      output.add(scheduled);
+      return (output);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/model/DataAnalysisFieldPossibleValueProvider.java

@@ -0,0 +1,112 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.dataanalysis.model;
+
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import com.kingsrook.qqq.backend.core.actions.values.QCustomPossibleValueProvider;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.model.actions.values.SearchPossibleValueSourceInput;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValue;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.utils.CollectionUtils;
+import com.kingsrook.qqq.backend.core.utils.StringUtils;
+import com.kingsrook.qqq.backend.core.utils.ValueUtils;
+
+
+/*******************************************************************************
+ ** Fields of the table selected in the settings form. Core has no multi-select
+ ** PVS field yet; settings retain their comma-separated TEXT representation.
+ *******************************************************************************/
+public class DataAnalysisFieldPossibleValueProvider implements QCustomPossibleValueProvider<String>
+{
+   public static final String NAME = "data_analysis_fields";
+
+
+
+   /*******************************************************************************
+    ** Without form values the table is unknown; preserve names, including CSV lists.
+    *******************************************************************************/
+   @Override
+   public QPossibleValue<String> getPossibleValue(Serializable idValue)
+   {
+      String name = ValueUtils.getValueAsString(idValue);
+      return (name == null ? null : new QPossibleValue<>(name, name));
+   }
+
+
+
+   /*******************************************************************************
+    ** Offer only fields of the selected table, honoring search text and id lookups.
+    *******************************************************************************/
+   @Override
+   public List<QPossibleValue<String>> search(SearchPossibleValueSourceInput input)
+   {
+      List<QPossibleValue<String>> values = new ArrayList<>();
+      QTableMetaData table = resolveTable(input.getOtherValues());
+      if(table == null)
+      {
+         return (values);
+      }
+      for(QFieldMetaData field : table.getFields().values())
+      {
+         String label = field.getLabel() == null ? field.getName() : field.getLabel();
+         QPossibleValue<String> value = new QPossibleValue<>(field.getName(), label + " (" + field.getName() + ")");
+         if(CollectionUtils.nullSafeHasContents(input.getIdList()))
+         {
+            if(input.getIdList().stream().anyMatch(id -> value.getId().equals(ValueUtils.getValueAsString(id))))
+            {
+               values.add(value);
+            }
+         }
+         else
+         {
+            String term = input.getSearchTerm();
+            if(!StringUtils.hasContent(term) || value.getLabel().toLowerCase(Locale.ROOT).contains(term.toLowerCase(Locale.ROOT)))
+            {
+               values.add(value);
+            }
+         }
+      }
+      return (values);
+   }
+
+
+
+   /*******************************************************************************
+    ** Resolve the table from the frontend form values, never from the config table.
+    *******************************************************************************/
+   private QTableMetaData resolveTable(Map<String, Serializable> otherValues)
+   {
+      if(otherValues == null || QContext.getQInstance() == null)
+      {
+         return (null);
+      }
+      String tableName = ValueUtils.getValueAsString(otherValues.get("table_name"));
+      return (StringUtils.hasContent(tableName) ? QContext.getQInstance().getTable(tableName) : null);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/model/DataAnalysisTables.java

@@ -29,8 +29,12 @@ import com.kingsrook.qbits.dataanalysis.DataAnalysisQBitConfig;
 import com.kingsrook.qbits.dataanalysis.permissions.DataAnalysisPermissions;
 import com.kingsrook.qqq.backend.core.actions.dashboard.widgets.ChildRecordListRenderer;
 import com.kingsrook.qqq.backend.core.instances.QInstanceEnricher;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterCriteria;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
 import com.kingsrook.qqq.backend.core.model.metadata.audits.AuditLevel;
 import com.kingsrook.qqq.backend.core.model.metadata.audits.QAuditRules;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
 import com.kingsrook.qqq.backend.core.model.metadata.dashboard.QWidgetMetaData;
 import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
 import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
@@ -49,6 +53,7 @@ import com.kingsrook.qqq.backend.core.model.metadata.tables.ExposedJoin;
 import com.kingsrook.qqq.backend.core.model.metadata.tables.QFieldSection;
 import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
 import com.kingsrook.qqq.backend.core.model.metadata.tables.SectionFactory;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.TablesPossibleValueSourceMetaDataProvider;
 import com.kingsrook.qqq.backend.core.model.metadata.tables.Tier;
 import com.kingsrook.qqq.backend.core.model.metadata.tables.UniqueKey;
 
@@ -111,10 +116,15 @@ public final class DataAnalysisTables
    public static List<QPossibleValueSource> possibleValueSources()
    {
       List<QPossibleValueSource> sources = new ArrayList<>();
+      sources.add(new QPossibleValueSource().withName(DataAnalysisFieldPossibleValueProvider.NAME)
+         .withType(QPossibleValueSourceType.CUSTOM).withIdType(QFieldType.STRING)
+         .withCustomCodeReference(new QCodeReference(DataAnalysisFieldPossibleValueProvider.class)));
       sources.add(enumSource("kind", "COLUMN_PROFILE", "TABLE_PROFILE", "PIVOT", "COMPARE", "CORRELATION", "CROSSTAB", "SHIFT"));
       sources.add(enumSource("chart_kind", "HISTOGRAM", "BOX", "BAR", "PARETO", "TIME_SERIES", "SCATTER", "HEATMAP"));
       sources.add(enumSource("detector", "SPIKE", "DROP", "OUT_OF_RANGE", "NEW_CATEGORY", "NULL_RATE_CREEP"));
       sources.add(enumSource("watch_state", "OK", "FIRING"));
+      sources.add(enumSource("watch_bucket", "HOUR", "DAY", "WEEK", "MONTH"));
+      sources.add(enumSource("watch_severity", "INFO", "WARNING", "ERROR", "CRITICAL"));
       sources.add(enumSource("run_status", "RUNNING", "COMPLETE", "FAILED"));
       sources.add(enumSource("schedule_frequency", "DAILY", "WEEKLY", "MONTHLY"));
       sources.add(enumSource("schedule_format", "HTML_SUMMARY", "CSV", "XLSX"));
@@ -205,14 +215,16 @@ public final class DataAnalysisTables
       List<QTableMetaData> tables = new ArrayList<>();
       tables.add(base(config, TABLE_CONFIG, "Analysis Settings", "settings", "data_analysis.settings")
          .withRecordLabelFormatAndFields("%s", "table_name")
-         .withField(field("table_name", QFieldType.STRING).withIsRequired(true))
+         .withField(field("table_name", QFieldType.STRING).withPossibleValueSourceName(TablesPossibleValueSourceMetaDataProvider.NAME).withIsRequired(true))
          .withField(field("enabled", QFieldType.BOOLEAN).withDefaultValue(true))
          .withField(field("max_rows", QFieldType.INTEGER))
          .withField(field("sample_threshold_rows", QFieldType.INTEGER))
          .withField(field("sample_rows", QFieldType.INTEGER))
          .withField(field("min_group_size", QFieldType.INTEGER))
-         .withField(field("analyzable_fields", QFieldType.TEXT))
-         .withField(field("excluded_fields", QFieldType.TEXT))
+         // add possibleValueSourceDependsOn("table_name") once core has it
+         .withField(field("analyzable_fields", QFieldType.TEXT).withPossibleValueSourceName(DataAnalysisFieldPossibleValueProvider.NAME))
+         // add possibleValueSourceDependsOn("table_name") once core has it
+         .withField(field("excluded_fields", QFieldType.TEXT).withPossibleValueSourceName(DataAnalysisFieldPossibleValueProvider.NAME))
          .withField(field("cache_ttl_minutes", QFieldType.INTEGER))
          .withAuditRules(new QAuditRules().withAuditLevel(AuditLevel.FIELD))
          .withUniqueKey(new UniqueKey("table_name")));
@@ -220,7 +232,7 @@ public final class DataAnalysisTables
          .withRecordLabelFormatAndFields("%s", "name")
          .withField(field("name", QFieldType.STRING).withIsRequired(true))
          .withField(field("description", QFieldType.TEXT))
-         .withField(field("table_name", QFieldType.STRING).withIsRequired(true))
+         .withField(field("table_name", QFieldType.STRING).withPossibleValueSourceName(TablesPossibleValueSourceMetaDataProvider.NAME).withIsRequired(true))
          .withField(field("filter_json", QFieldType.TEXT))
          .withField(field("kind", QFieldType.STRING).withPossibleValueSourceName("data_analysis_kind").withIsRequired(true))
          .withField(field("definition_json", QFieldType.TEXT).withIsRequired(true))
@@ -252,21 +264,31 @@ public final class DataAnalysisTables
          .withRecordSecurityLock(ownerLock(SAVED + ".owner_user_id").withJoinNameChain(List.of(joinName(SCHEDULE)))));
       tables.add(base(config, WATCH, "Watches", "notifications_active", "data_analysis.watch")
          .withRecordLabelFormatAndFields("%s", "detector")
-         .withField(field("saved_id", QFieldType.INTEGER).withPossibleValueSourceName("data_analysis_saved"))
-         .withField(field("table_name", QFieldType.STRING))
+         .withField(field("saved_id", QFieldType.INTEGER).withPossibleValueSourceName("data_analysis_saved")
+            .withPossibleValueSourceFilter(new QQueryFilter(new QFilterCriteria("table_name", QCriteriaOperator.EQUALS, "${input.table_name}"))))
+         .withField(field("table_name", QFieldType.STRING).withPossibleValueSourceName(TablesPossibleValueSourceMetaDataProvider.NAME))
          .withField(field("filter_json", QFieldType.TEXT))
          .withField(field("metric_json", QFieldType.TEXT))
          .withField(field("detector", QFieldType.STRING).withPossibleValueSourceName("data_analysis_detector").withIsRequired(true))
          .withField(field("parameters_json", QFieldType.TEXT))
-         .withField(field("bucket", QFieldType.STRING))
-         .withField(field("severity", QFieldType.STRING))
+         .withField(field("date_field", QFieldType.STRING).withIsRequired(true))
+         .withField(field("bucket", QFieldType.STRING).withDefaultValue("DAY").withIsRequired(true).withPossibleValueSourceName("data_analysis_watch_bucket"))
+         .withField(field("severity", QFieldType.STRING).withDefaultValue("WARNING").withIsRequired(true).withPossibleValueSourceName("data_analysis_watch_severity"))
+         .withField(field("owner_user_id", QFieldType.STRING).withIsRequired(true))
          .withField(field("enabled", QFieldType.BOOLEAN).withDefaultValue(false))
-         .withField(field("last_evaluated_at", QFieldType.DATE_TIME))
-         .withField(field("state", QFieldType.STRING).withDefaultValue("OK").withPossibleValueSourceName("data_analysis_watch_state"))
-         .withField(field("alert_key", QFieldType.STRING)));
+         .withField(field("last_evaluated_at", QFieldType.DATE_TIME).withIsEditable(false))
+         .withField(field("last_value", QFieldType.DECIMAL).withIsEditable(false))
+         .withField(field("last_message", QFieldType.TEXT).withIsEditable(false))
+         .withField(field("state", QFieldType.STRING).withDefaultValue("OK").withIsEditable(false).withPossibleValueSourceName("data_analysis_watch_state"))
+         .withField(field("alert_key", QFieldType.STRING).withIsEditable(false))
+         .withRecordSecurityLock(ownerLock("owner_user_id"))
+         .withCustomizer(com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizers.PRE_INSERT_RECORD,
+            new com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference(com.kingsrook.qbits.dataanalysis.watch.WatchCustomizer.class))
+         .withCustomizer(com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizers.PRE_UPDATE_RECORD,
+            new com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference(com.kingsrook.qbits.dataanalysis.watch.WatchCustomizer.class)));
       tables.add(base(config, RUN, "Analysis Runs", "history", "data_analysis.run")
          .withRecordLabelFormatAndFields("%s", "operation")
-         .withField(field("table_name", QFieldType.STRING).withIsRequired(true))
+         .withField(field("table_name", QFieldType.STRING).withPossibleValueSourceName(TablesPossibleValueSourceMetaDataProvider.NAME).withIsRequired(true))
          .withField(field("operation", QFieldType.STRING).withIsRequired(true))
          .withField(field("request_hash", QFieldType.STRING))
          .withField(field("filter_hash", QFieldType.STRING))

src/main/java/com/kingsrook/qbits/dataanalysis/processes/WatchActions.java

@@ -0,0 +1,186 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.processes;
+
+import java.time.Instant;
+import java.util.ArrayList;
+import com.kingsrook.qbits.dataanalysis.DataAnalysisRuntime;
+import com.kingsrook.qbits.dataanalysis.model.DataAnalysisTables;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionsHelper;
+import com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType;
+import com.kingsrook.qqq.backend.core.actions.processes.BackendStep;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLine;
+import com.kingsrook.qqq.backend.core.model.actions.processes.ProcessSummaryLineInterface;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.Status;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.AbstractLoadStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.AbstractTransformStep;
+import com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.ProcessSummaryProviderInterface;
+
+/*******************************************************************************
+ ** Ordinary streamed ETL Review/Result steps; no custom forms or navigation.
+ *******************************************************************************/
+public final class WatchActions
+{
+   public static final String EVALUATE = "data_analysis_watch_evaluate";
+   public static final String ENABLE = "data_analysis_watch_enable";
+   public static final String DISABLE = "data_analysis_watch_disable";
+   public static final String SCHEDULED = "data_analysis_evaluate_watches";
+
+   /*******************************************************************************
+    ** Steps only.
+    *******************************************************************************/
+   private WatchActions()
+   {
+   }
+
+   /*******************************************************************************
+    ** Preview selected records without evaluating or mutating them.
+    *******************************************************************************/
+   public static class Review extends AbstractTransformStep implements ProcessSummaryProviderInterface
+   {
+      private final ArrayList<ProcessSummaryLineInterface> lines = new ArrayList<>();
+
+      /*******************************************************************************
+       ** Extract runs as caller; enforce EDIT before promising any action.
+       *******************************************************************************/
+      @Override
+      public void runOnePage(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         if(!PermissionsHelper.hasTablePermission(new UpdateInput(DataAnalysisTables.WATCH), DataAnalysisTables.WATCH, TablePermissionSubType.EDIT))
+         {
+            throw new QPermissionDeniedException("Watch editing is unavailable.");
+         }
+         String verb = verb(input.getProcessName());
+         for(QRecord record : input.getRecords())
+         {
+            lines.add(new ProcessSummaryLine(Status.INFO, null, "Watch " + record.getValueString("id") + " (" + record.getValueString("detector") + ") will be " + verb + "."));
+            output.addRecord(record);
+         }
+      }
+
+      /*******************************************************************************
+       ** Standard summary lines are rendered by the core Review screen.
+       *******************************************************************************/
+      @Override
+      public ArrayList<ProcessSummaryLineInterface> getProcessSummary(RunBackendStepOutput output, boolean result)
+      {
+         return (result ? new ArrayList<>() : lines);
+      }
+   }
+
+   /*******************************************************************************
+    ** Apply selected records and report exact evaluated/firing/OK/skipped counts.
+    *******************************************************************************/
+   public static class Result extends AbstractLoadStep implements ProcessSummaryProviderInterface
+   {
+      private int done;
+      private int firing;
+      private int ok;
+      private String process;
+      private final ArrayList<ProcessSummaryLineInterface> failures = new ArrayList<>();
+
+      /*******************************************************************************
+       ** Re-read and authorize each id when executing after Review.
+       *******************************************************************************/
+      @Override
+      public void runOnePage(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         process = input.getProcessName();
+         verb(process);
+         for(QRecord record : input.getRecords())
+         {
+            try
+            {
+               if(EVALUATE.equals(process))
+               {
+                  var verdict = DataAnalysisRuntime.watches().evaluate(record.getValue("id"), Instant.now());
+                  if(!verdict.evaluated())
+                  {
+                     failures.add(new ProcessSummaryLine(Status.WARNING, null, "Watch " + record.getValueString("id") + " skipped: " + verdict.message()));
+                     continue;
+                  }
+                  firing += verdict.firing() ? 1 : 0;
+                  ok += verdict.firing() ? 0 : 1;
+               }
+               else
+               {
+                  DataAnalysisRuntime.watches().setEnabled(record.getValue("id"), ENABLE.equals(process));
+               }
+               done++;
+               output.addRecord(record);
+            }
+            catch(QException e)
+            {
+               failures.add(new ProcessSummaryLine(Status.ERROR, null, "Watch " + record.getValueString("id") + " failed: " + e.getMessage()));
+            }
+         }
+      }
+
+      /*******************************************************************************
+       ** Counts span all streamed pages, so the Result screen is a true total.
+       *******************************************************************************/
+      @Override
+      public ArrayList<ProcessSummaryLineInterface> getProcessSummary(RunBackendStepOutput output, boolean result)
+      {
+         ArrayList<ProcessSummaryLineInterface> lines = new ArrayList<>();
+         String message = done + (done == 1 ? " watch " : " watches ") + (EVALUATE.equals(process) ? "evaluated: " + firing + " firing, " + ok + " OK"
+            : ENABLE.equals(process) ? "enabled" : "disabled");
+         lines.add(new ProcessSummaryLine(Status.OK, null, message));
+         lines.addAll(failures);
+         return (lines);
+      }
+   }
+
+   /*******************************************************************************
+    ** Scheduler invokes a hidden backend-only process every fifteen minutes.
+    *******************************************************************************/
+   public static class Scheduled implements BackendStep
+   {
+      /*******************************************************************************
+       ** Store the real count of successfully evaluated enabled watches.
+       *******************************************************************************/
+      @Override
+      public void run(RunBackendStepInput input, RunBackendStepOutput output) throws QException
+      {
+         output.addValue("count", DataAnalysisRuntime.watches().evaluateEnabled(Instant.now()));
+      }
+   }
+
+   /*******************************************************************************
+    ** Reject unknown processes instead of silently choosing a mutation.
+    *******************************************************************************/
+   private static String verb(String process) throws QException
+   {
+      return (switch(process)
+      {
+         case EVALUATE -> "evaluated";
+         case ENABLE -> "enabled";
+         case DISABLE -> "disabled";
+         default -> throw new QException("Unknown watch action.");
+      });
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/Chart.java

@@ -33,6 +33,7 @@ import com.fasterxml.jackson.annotation.JsonAutoDetect;
 public class Chart implements Serializable
 {
    private ChartKind kind;
+   private Boolean stacked;
    private List<ChartKind> alternatives = List.of();
    private Axis x;
    private Axis y;
@@ -164,4 +165,21 @@ public class Chart implements Serializable
       this.annotations = annotations;
       return (this);
    }
+
+   /*******************************************************************************
+    ** Whether category series should stack to a total share of one.
+    *******************************************************************************/
+   public Boolean getStacked()
+   {
+      return (stacked);
+   }
+
+   /*******************************************************************************
+    ** Declare stacked shares explicitly rather than relying on chart prose.
+    *******************************************************************************/
+   public Chart withStacked(Boolean stacked)
+   {
+      this.stacked = stacked;
+      return (this);
+   }
 }

src/main/java/com/kingsrook/qbits/dataanalysis/result/CompareRequest.java

@@ -0,0 +1,213 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+/*******************************************************************************
+ ** Typed CompareRequest contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class CompareRequest implements AnalysisRequest
+{
+   private String tableName;
+   private QQueryFilter filter;
+   private Boolean exact = true;
+   private QQueryFilter filterA;
+   private QQueryFilter filterB;
+   private String labelA = "A";
+   private String labelB = "B";
+   private List<String> fields;
+
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   @Override
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public CompareRequest withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for filter.
+    *******************************************************************************/
+   @Override
+   public QQueryFilter getFilter()
+   {
+      return (filter);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for filter.
+    *******************************************************************************/
+   public CompareRequest withFilter(QQueryFilter filter)
+   {
+      this.filter = filter;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for exact.
+    *******************************************************************************/
+   @Override
+   public Boolean getExact()
+   {
+      return (exact);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for exact.
+    *******************************************************************************/
+   public CompareRequest withExact(Boolean exact)
+   {
+      this.exact = exact;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for filterA.
+    *******************************************************************************/
+   public QQueryFilter getFilterA()
+   {
+      return (filterA);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for filterA.
+    *******************************************************************************/
+   public CompareRequest withFilterA(QQueryFilter filterA)
+   {
+      this.filterA = filterA;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for filterB.
+    *******************************************************************************/
+   public QQueryFilter getFilterB()
+   {
+      return (filterB);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for filterB.
+    *******************************************************************************/
+   public CompareRequest withFilterB(QQueryFilter filterB)
+   {
+      this.filterB = filterB;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for labelA.
+    *******************************************************************************/
+   public String getLabelA()
+   {
+      return (labelA);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for labelA.
+    *******************************************************************************/
+   public CompareRequest withLabelA(String labelA)
+   {
+      this.labelA = labelA;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for labelB.
+    *******************************************************************************/
+   public String getLabelB()
+   {
+      return (labelB);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for labelB.
+    *******************************************************************************/
+   public CompareRequest withLabelB(String labelB)
+   {
+      this.labelB = labelB;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for fields.
+    *******************************************************************************/
+   public List<String> getFields()
+   {
+      return (fields);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for fields.
+    *******************************************************************************/
+   public CompareRequest withFields(List<String> fields)
+   {
+      this.fields = fields;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/CompareResult.java

@@ -0,0 +1,55 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed CompareResult contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class CompareResult implements Serializable
+{
+   private List<FieldComparison> fields = new java.util.ArrayList<>();
+
+
+
+   /*******************************************************************************
+    ** Getter for fields.
+    *******************************************************************************/
+   public List<FieldComparison> getFields()
+   {
+      return (fields);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for fields.
+    *******************************************************************************/
+   public CompareResult withFields(List<FieldComparison> fields)
+   {
+      this.fields = fields;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/ComparisonSide.java

@@ -0,0 +1,77 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed ComparisonSide contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class ComparisonSide implements Serializable
+{
+   private String label;
+   private List<Metric> metrics = new java.util.ArrayList<>();
+
+
+
+   /*******************************************************************************
+    ** Getter for label.
+    *******************************************************************************/
+   public String getLabel()
+   {
+      return (label);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for label.
+    *******************************************************************************/
+   public ComparisonSide withLabel(String label)
+   {
+      this.label = label;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for metrics.
+    *******************************************************************************/
+   public List<Metric> getMetrics()
+   {
+      return (metrics);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for metrics.
+    *******************************************************************************/
+   public ComparisonSide withMetrics(List<Metric> metrics)
+   {
+      this.metrics = metrics;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/ComparisonValue.java

@@ -0,0 +1,186 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed ComparisonValue contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class ComparisonValue implements Serializable
+{
+   private Serializable value;
+   private String label;
+   private ComparisonSide sideA;
+   private ComparisonSide sideB;
+   private Metric delta;
+   private Metric percentDelta;
+   private Significance significance;
+
+
+
+   /*******************************************************************************
+    ** Getter for value.
+    *******************************************************************************/
+   public Serializable getValue()
+   {
+      return (value);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for value.
+    *******************************************************************************/
+   public ComparisonValue withValue(Serializable value)
+   {
+      this.value = value;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for label.
+    *******************************************************************************/
+   public String getLabel()
+   {
+      return (label);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for label.
+    *******************************************************************************/
+   public ComparisonValue withLabel(String label)
+   {
+      this.label = label;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for sideA.
+    *******************************************************************************/
+   public ComparisonSide getSideA()
+   {
+      return (sideA);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for sideA.
+    *******************************************************************************/
+   public ComparisonValue withSideA(ComparisonSide sideA)
+   {
+      this.sideA = sideA;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for sideB.
+    *******************************************************************************/
+   public ComparisonSide getSideB()
+   {
+      return (sideB);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for sideB.
+    *******************************************************************************/
+   public ComparisonValue withSideB(ComparisonSide sideB)
+   {
+      this.sideB = sideB;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for delta.
+    *******************************************************************************/
+   public Metric getDelta()
+   {
+      return (delta);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for delta.
+    *******************************************************************************/
+   public ComparisonValue withDelta(Metric delta)
+   {
+      this.delta = delta;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for percentDelta.
+    *******************************************************************************/
+   public Metric getPercentDelta()
+   {
+      return (percentDelta);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for percentDelta.
+    *******************************************************************************/
+   public ComparisonValue withPercentDelta(Metric percentDelta)
+   {
+      this.percentDelta = percentDelta;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for significance.
+    *******************************************************************************/
+   public Significance getSignificance()
+   {
+      return (significance);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for significance.
+    *******************************************************************************/
+   public ComparisonValue withSignificance(Significance significance)
+   {
+      this.significance = significance;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/CorrelationCell.java

@@ -0,0 +1,142 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed CorrelationCell contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class CorrelationCell implements Serializable
+{
+   private String xField;
+   private String yField;
+   private Long n;
+   private Double r;
+   private ScatterRequest scatter;
+
+
+
+   /*******************************************************************************
+    ** Getter for xField.
+    *******************************************************************************/
+   public String getXField()
+   {
+      return (xField);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for xField.
+    *******************************************************************************/
+   public CorrelationCell withXField(String xField)
+   {
+      this.xField = xField;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for yField.
+    *******************************************************************************/
+   public String getYField()
+   {
+      return (yField);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for yField.
+    *******************************************************************************/
+   public CorrelationCell withYField(String yField)
+   {
+      this.yField = yField;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for n.
+    *******************************************************************************/
+   public Long getN()
+   {
+      return (n);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for n.
+    *******************************************************************************/
+   public CorrelationCell withN(Long n)
+   {
+      this.n = n;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for r.
+    *******************************************************************************/
+   public Double getR()
+   {
+      return (r);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for r.
+    *******************************************************************************/
+   public CorrelationCell withR(Double r)
+   {
+      this.r = r;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for scatter.
+    *******************************************************************************/
+   public ScatterRequest getScatter()
+   {
+      return (scatter);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for scatter.
+    *******************************************************************************/
+   public CorrelationCell withScatter(ScatterRequest scatter)
+   {
+      this.scatter = scatter;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/CorrelationRequest.java

@@ -0,0 +1,125 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+/*******************************************************************************
+ ** Typed CorrelationRequest contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class CorrelationRequest implements AnalysisRequest
+{
+   private String tableName;
+   private QQueryFilter filter;
+   private Boolean exact = true;
+   private List<String> fields;
+
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   @Override
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public CorrelationRequest withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for filter.
+    *******************************************************************************/
+   @Override
+   public QQueryFilter getFilter()
+   {
+      return (filter);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for filter.
+    *******************************************************************************/
+   public CorrelationRequest withFilter(QQueryFilter filter)
+   {
+      this.filter = filter;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for exact.
+    *******************************************************************************/
+   @Override
+   public Boolean getExact()
+   {
+      return (exact);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for exact.
+    *******************************************************************************/
+   public CorrelationRequest withExact(Boolean exact)
+   {
+      this.exact = exact;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for fields.
+    *******************************************************************************/
+   public List<String> getFields()
+   {
+      return (fields);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for fields.
+    *******************************************************************************/
+   public CorrelationRequest withFields(List<String> fields)
+   {
+      this.fields = fields;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/CorrelationResult.java

@@ -0,0 +1,99 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed CorrelationResult contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class CorrelationResult implements Serializable
+{
+   private List<String> fields;
+   private List<CorrelationCell> cells = new java.util.ArrayList<>();
+   private Chart chart;
+
+
+
+   /*******************************************************************************
+    ** Getter for fields.
+    *******************************************************************************/
+   public List<String> getFields()
+   {
+      return (fields);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for fields.
+    *******************************************************************************/
+   public CorrelationResult withFields(List<String> fields)
+   {
+      this.fields = fields;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for cells.
+    *******************************************************************************/
+   public List<CorrelationCell> getCells()
+   {
+      return (cells);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for cells.
+    *******************************************************************************/
+   public CorrelationResult withCells(List<CorrelationCell> cells)
+   {
+      this.cells = cells;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for chart.
+    *******************************************************************************/
+   public Chart getChart()
+   {
+      return (chart);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for chart.
+    *******************************************************************************/
+   public CorrelationResult withChart(Chart chart)
+   {
+      this.chart = chart;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/CrosstabCell.java

@@ -0,0 +1,142 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed CrosstabCell contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class CrosstabCell implements Serializable
+{
+   private Integer rowIndex;
+   private Integer columnIndex;
+   private Metric count;
+   private Metric rowShare;
+   private Metric columnShare;
+
+
+
+   /*******************************************************************************
+    ** Getter for rowIndex.
+    *******************************************************************************/
+   public Integer getRowIndex()
+   {
+      return (rowIndex);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for rowIndex.
+    *******************************************************************************/
+   public CrosstabCell withRowIndex(Integer rowIndex)
+   {
+      this.rowIndex = rowIndex;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for columnIndex.
+    *******************************************************************************/
+   public Integer getColumnIndex()
+   {
+      return (columnIndex);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for columnIndex.
+    *******************************************************************************/
+   public CrosstabCell withColumnIndex(Integer columnIndex)
+   {
+      this.columnIndex = columnIndex;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for count.
+    *******************************************************************************/
+   public Metric getCount()
+   {
+      return (count);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for count.
+    *******************************************************************************/
+   public CrosstabCell withCount(Metric count)
+   {
+      this.count = count;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for rowShare.
+    *******************************************************************************/
+   public Metric getRowShare()
+   {
+      return (rowShare);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for rowShare.
+    *******************************************************************************/
+   public CrosstabCell withRowShare(Metric rowShare)
+   {
+      this.rowShare = rowShare;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for columnShare.
+    *******************************************************************************/
+   public Metric getColumnShare()
+   {
+      return (columnShare);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for columnShare.
+    *******************************************************************************/
+   public CrosstabCell withColumnShare(Metric columnShare)
+   {
+      this.columnShare = columnShare;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/CrosstabRequest.java

@@ -0,0 +1,168 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+/*******************************************************************************
+ ** Typed CrosstabRequest contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class CrosstabRequest implements AnalysisRequest
+{
+   private String tableName;
+   private QQueryFilter filter;
+   private Boolean exact = true;
+   private String rowField;
+   private String columnField;
+   private Integer limit = 20;
+
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   @Override
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public CrosstabRequest withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for filter.
+    *******************************************************************************/
+   @Override
+   public QQueryFilter getFilter()
+   {
+      return (filter);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for filter.
+    *******************************************************************************/
+   public CrosstabRequest withFilter(QQueryFilter filter)
+   {
+      this.filter = filter;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for exact.
+    *******************************************************************************/
+   @Override
+   public Boolean getExact()
+   {
+      return (exact);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for exact.
+    *******************************************************************************/
+   public CrosstabRequest withExact(Boolean exact)
+   {
+      this.exact = exact;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for rowField.
+    *******************************************************************************/
+   public String getRowField()
+   {
+      return (rowField);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for rowField.
+    *******************************************************************************/
+   public CrosstabRequest withRowField(String rowField)
+   {
+      this.rowField = rowField;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for columnField.
+    *******************************************************************************/
+   public String getColumnField()
+   {
+      return (columnField);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for columnField.
+    *******************************************************************************/
+   public CrosstabRequest withColumnField(String columnField)
+   {
+      this.columnField = columnField;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for limit.
+    *******************************************************************************/
+   public Integer getLimit()
+   {
+      return (limit);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for limit.
+    *******************************************************************************/
+   public CrosstabRequest withLimit(Integer limit)
+   {
+      this.limit = limit;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/CrosstabResult.java

@@ -0,0 +1,121 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed CrosstabResult contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class CrosstabResult implements Serializable
+{
+   private List<PivotHeader> rows = new java.util.ArrayList<>();
+   private List<PivotHeader> columns = new java.util.ArrayList<>();
+   private List<CrosstabCell> cells = new java.util.ArrayList<>();
+   private Significance significance;
+
+
+
+   /*******************************************************************************
+    ** Getter for rows.
+    *******************************************************************************/
+   public List<PivotHeader> getRows()
+   {
+      return (rows);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for rows.
+    *******************************************************************************/
+   public CrosstabResult withRows(List<PivotHeader> rows)
+   {
+      this.rows = rows;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for columns.
+    *******************************************************************************/
+   public List<PivotHeader> getColumns()
+   {
+      return (columns);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for columns.
+    *******************************************************************************/
+   public CrosstabResult withColumns(List<PivotHeader> columns)
+   {
+      this.columns = columns;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for cells.
+    *******************************************************************************/
+   public List<CrosstabCell> getCells()
+   {
+      return (cells);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for cells.
+    *******************************************************************************/
+   public CrosstabResult withCells(List<CrosstabCell> cells)
+   {
+      this.cells = cells;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for significance.
+    *******************************************************************************/
+   public Significance getSignificance()
+   {
+      return (significance);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for significance.
+    *******************************************************************************/
+   public CrosstabResult withSignificance(Significance significance)
+   {
+      this.significance = significance;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/FieldComparison.java

@@ -0,0 +1,121 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed FieldComparison contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class FieldComparison implements Serializable
+{
+   private String field;
+   private List<ComparisonValue> values = new java.util.ArrayList<>();
+   private Significance significance;
+   private Chart chart;
+
+
+
+   /*******************************************************************************
+    ** Getter for field.
+    *******************************************************************************/
+   public String getField()
+   {
+      return (field);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for field.
+    *******************************************************************************/
+   public FieldComparison withField(String field)
+   {
+      this.field = field;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for values.
+    *******************************************************************************/
+   public List<ComparisonValue> getValues()
+   {
+      return (values);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for values.
+    *******************************************************************************/
+   public FieldComparison withValues(List<ComparisonValue> values)
+   {
+      this.values = values;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for significance.
+    *******************************************************************************/
+   public Significance getSignificance()
+   {
+      return (significance);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for significance.
+    *******************************************************************************/
+   public FieldComparison withSignificance(Significance significance)
+   {
+      this.significance = significance;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for chart.
+    *******************************************************************************/
+   public Chart getChart()
+   {
+      return (chart);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for chart.
+    *******************************************************************************/
+   public FieldComparison withChart(Chart chart)
+   {
+      this.chart = chart;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/PivotCell.java

@@ -0,0 +1,89 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed PivotCell contract.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class PivotCell implements Serializable
+{
+   private Integer rowIndex;
+   private Integer columnIndex;
+   private List<Metric> values = new ArrayList<>();
+
+
+   /*******************************************************************************
+    ** Getter for rowIndex.
+    *******************************************************************************/
+   public Integer getRowIndex()
+   {
+      return (rowIndex);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for rowIndex.
+    *******************************************************************************/
+   public PivotCell withRowIndex(Integer rowIndex)
+   {
+      this.rowIndex = rowIndex;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for columnIndex.
+    *******************************************************************************/
+   public Integer getColumnIndex()
+   {
+      return (columnIndex);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for columnIndex.
+    *******************************************************************************/
+   public PivotCell withColumnIndex(Integer columnIndex)
+   {
+      this.columnIndex = columnIndex;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for values.
+    *******************************************************************************/
+   public List<Metric> getValues()
+   {
+      return (values);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for values.
+    *******************************************************************************/
+   public PivotCell withValues(List<Metric> values)
+   {
+      this.values = values;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/PivotDimension.java

@@ -0,0 +1,88 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.DateBucketUnit;
+
+/*******************************************************************************
+ ** Typed PivotDimension contract.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class PivotDimension implements Serializable
+{
+   private String field;
+   private DateBucketUnit dateBucket;
+   private PivotNumericBins numericBins;
+
+
+   /*******************************************************************************
+    ** Getter for field.
+    *******************************************************************************/
+   public String getField()
+   {
+      return (field);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for field.
+    *******************************************************************************/
+   public PivotDimension withField(String field)
+   {
+      this.field = field;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for dateBucket.
+    *******************************************************************************/
+   public DateBucketUnit getDateBucket()
+   {
+      return (dateBucket);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for dateBucket.
+    *******************************************************************************/
+   public PivotDimension withDateBucket(DateBucketUnit dateBucket)
+   {
+      this.dateBucket = dateBucket;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for numericBins.
+    *******************************************************************************/
+   public PivotNumericBins getNumericBins()
+   {
+      return (numericBins);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for numericBins.
+    *******************************************************************************/
+   public PivotDimension withNumericBins(PivotNumericBins numericBins)
+   {
+      this.numericBins = numericBins;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/PivotHeader.java

@@ -0,0 +1,69 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed PivotHeader contract.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class PivotHeader implements Serializable
+{
+   private Serializable value;
+   private String label;
+
+
+   /*******************************************************************************
+    ** Getter for value.
+    *******************************************************************************/
+   public Serializable getValue()
+   {
+      return (value);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for value.
+    *******************************************************************************/
+   public PivotHeader withValue(Serializable value)
+   {
+      this.value = value;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for label.
+    *******************************************************************************/
+   public String getLabel()
+   {
+      return (label);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for label.
+    *******************************************************************************/
+   public PivotHeader withLabel(String label)
+   {
+      this.label = label;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/PivotMeasure.java

@@ -0,0 +1,95 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed PivotMeasure contract.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class PivotMeasure implements Serializable
+{
+   private Operator operator;
+   private String field;
+   private BigDecimal percentile;
+
+   /*******************************************************************************
+    ** Supported pivot measures. COUNT counts records, regardless of field nulls.
+    *******************************************************************************/
+   public enum Operator
+   {
+      COUNT, SUM, AVG, MIN, MAX, COUNT_DISTINCT, PERCENTILE
+   }
+
+   /*******************************************************************************
+    ** Getter for operator.
+    *******************************************************************************/
+   public Operator getOperator()
+   {
+      return (operator);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for operator.
+    *******************************************************************************/
+   public PivotMeasure withOperator(Operator operator)
+   {
+      this.operator = operator;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for field.
+    *******************************************************************************/
+   public String getField()
+   {
+      return (field);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for field.
+    *******************************************************************************/
+   public PivotMeasure withField(String field)
+   {
+      this.field = field;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for percentile.
+    *******************************************************************************/
+   public BigDecimal getPercentile()
+   {
+      return (percentile);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for percentile.
+    *******************************************************************************/
+   public PivotMeasure withPercentile(BigDecimal percentile)
+   {
+      this.percentile = percentile;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/PivotMeasureInfo.java

@@ -0,0 +1,87 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed PivotMeasureInfo contract.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class PivotMeasureInfo implements Serializable
+{
+   private String key;
+   private String label;
+   private ValueType valueType;
+
+
+   /*******************************************************************************
+    ** Getter for key.
+    *******************************************************************************/
+   public String getKey()
+   {
+      return (key);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for key.
+    *******************************************************************************/
+   public PivotMeasureInfo withKey(String key)
+   {
+      this.key = key;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for label.
+    *******************************************************************************/
+   public String getLabel()
+   {
+      return (label);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for label.
+    *******************************************************************************/
+   public PivotMeasureInfo withLabel(String label)
+   {
+      this.label = label;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for valueType.
+    *******************************************************************************/
+   public ValueType getValueType()
+   {
+      return (valueType);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for valueType.
+    *******************************************************************************/
+   public PivotMeasureInfo withValueType(ValueType valueType)
+   {
+      this.valueType = valueType;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/PivotNumericBins.java

@@ -0,0 +1,88 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed PivotNumericBins contract.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class PivotNumericBins implements Serializable
+{
+   private Integer count = 20;
+   private BigDecimal min;
+   private BigDecimal max;
+
+
+   /*******************************************************************************
+    ** Getter for count.
+    *******************************************************************************/
+   public Integer getCount()
+   {
+      return (count);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for count.
+    *******************************************************************************/
+   public PivotNumericBins withCount(Integer count)
+   {
+      this.count = count;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for min.
+    *******************************************************************************/
+   public BigDecimal getMin()
+   {
+      return (min);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for min.
+    *******************************************************************************/
+   public PivotNumericBins withMin(BigDecimal min)
+   {
+      this.min = min;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for max.
+    *******************************************************************************/
+   public BigDecimal getMax()
+   {
+      return (max);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for max.
+    *******************************************************************************/
+   public PivotNumericBins withMax(BigDecimal max)
+   {
+      this.max = max;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/PivotRequest.java

@@ -0,0 +1,182 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.util.ArrayList;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+/*******************************************************************************
+ ** Typed PivotRequest contract.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class PivotRequest implements AnalysisRequest
+{
+   private String tableName;
+   private QQueryFilter filter;
+   private Boolean exact = true;
+   private List<PivotDimension> rows = new ArrayList<>();
+   private List<PivotDimension> columns = new ArrayList<>();
+   private List<PivotMeasure> values = new ArrayList<>();
+   private Boolean showTotals = true;
+   private Integer limitGroups = 50;
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   @Override
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public PivotRequest withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for filter.
+    *******************************************************************************/
+   @Override
+   public QQueryFilter getFilter()
+   {
+      return (filter);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for filter.
+    *******************************************************************************/
+   public PivotRequest withFilter(QQueryFilter filter)
+   {
+      this.filter = filter;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for exact.
+    *******************************************************************************/
+   @Override
+   public Boolean getExact()
+   {
+      return (exact);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for exact.
+    *******************************************************************************/
+   public PivotRequest withExact(Boolean exact)
+   {
+      this.exact = exact;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for rows.
+    *******************************************************************************/
+   public List<PivotDimension> getRows()
+   {
+      return (rows);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for rows.
+    *******************************************************************************/
+   public PivotRequest withRows(List<PivotDimension> rows)
+   {
+      this.rows = rows;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for columns.
+    *******************************************************************************/
+   public List<PivotDimension> getColumns()
+   {
+      return (columns);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for columns.
+    *******************************************************************************/
+   public PivotRequest withColumns(List<PivotDimension> columns)
+   {
+      this.columns = columns;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for values.
+    *******************************************************************************/
+   public List<PivotMeasure> getValues()
+   {
+      return (values);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for values.
+    *******************************************************************************/
+   public PivotRequest withValues(List<PivotMeasure> values)
+   {
+      this.values = values;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for showTotals.
+    *******************************************************************************/
+   public Boolean getShowTotals()
+   {
+      return (showTotals);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for showTotals.
+    *******************************************************************************/
+   public PivotRequest withShowTotals(Boolean showTotals)
+   {
+      this.showTotals = showTotals;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for limitGroups.
+    *******************************************************************************/
+   public Integer getLimitGroups()
+   {
+      return (limitGroups);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for limitGroups.
+    *******************************************************************************/
+   public PivotRequest withLimitGroups(Integer limitGroups)
+   {
+      this.limitGroups = limitGroups;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/PivotResult.java

@@ -0,0 +1,252 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed PivotResult contract.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class PivotResult implements Serializable
+{
+   private List<List<PivotHeader>> rowHeaders = new ArrayList<>();
+   private List<List<PivotHeader>> columnHeaders = new ArrayList<>();
+   private List<PivotMeasureInfo> measures = new ArrayList<>();
+   private List<PivotCell> cells = new ArrayList<>();
+   private List<List<Metric>> rowTotals = new ArrayList<>();
+   private List<List<Metric>> columnTotals = new ArrayList<>();
+   private List<Metric> grandTotals = new ArrayList<>();
+   private Boolean truncatedRows = false;
+   private Boolean truncatedColumns = false;
+   private Boolean estimate = false;
+   private List<String> warnings = new ArrayList<>();
+   private Instant asOf;
+
+
+   /*******************************************************************************
+    ** Getter for rowHeaders.
+    *******************************************************************************/
+   public List<List<PivotHeader>> getRowHeaders()
+   {
+      return (rowHeaders);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for rowHeaders.
+    *******************************************************************************/
+   public PivotResult withRowHeaders(List<List<PivotHeader>> rowHeaders)
+   {
+      this.rowHeaders = rowHeaders;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for columnHeaders.
+    *******************************************************************************/
+   public List<List<PivotHeader>> getColumnHeaders()
+   {
+      return (columnHeaders);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for columnHeaders.
+    *******************************************************************************/
+   public PivotResult withColumnHeaders(List<List<PivotHeader>> columnHeaders)
+   {
+      this.columnHeaders = columnHeaders;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for measures.
+    *******************************************************************************/
+   public List<PivotMeasureInfo> getMeasures()
+   {
+      return (measures);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for measures.
+    *******************************************************************************/
+   public PivotResult withMeasures(List<PivotMeasureInfo> measures)
+   {
+      this.measures = measures;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for cells.
+    *******************************************************************************/
+   public List<PivotCell> getCells()
+   {
+      return (cells);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for cells.
+    *******************************************************************************/
+   public PivotResult withCells(List<PivotCell> cells)
+   {
+      this.cells = cells;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for rowTotals.
+    *******************************************************************************/
+   public List<List<Metric>> getRowTotals()
+   {
+      return (rowTotals);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for rowTotals.
+    *******************************************************************************/
+   public PivotResult withRowTotals(List<List<Metric>> rowTotals)
+   {
+      this.rowTotals = rowTotals;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for columnTotals.
+    *******************************************************************************/
+   public List<List<Metric>> getColumnTotals()
+   {
+      return (columnTotals);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for columnTotals.
+    *******************************************************************************/
+   public PivotResult withColumnTotals(List<List<Metric>> columnTotals)
+   {
+      this.columnTotals = columnTotals;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for grandTotals.
+    *******************************************************************************/
+   public List<Metric> getGrandTotals()
+   {
+      return (grandTotals);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for grandTotals.
+    *******************************************************************************/
+   public PivotResult withGrandTotals(List<Metric> grandTotals)
+   {
+      this.grandTotals = grandTotals;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for truncatedRows.
+    *******************************************************************************/
+   public Boolean getTruncatedRows()
+   {
+      return (truncatedRows);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for truncatedRows.
+    *******************************************************************************/
+   public PivotResult withTruncatedRows(Boolean truncatedRows)
+   {
+      this.truncatedRows = truncatedRows;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for truncatedColumns.
+    *******************************************************************************/
+   public Boolean getTruncatedColumns()
+   {
+      return (truncatedColumns);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for truncatedColumns.
+    *******************************************************************************/
+   public PivotResult withTruncatedColumns(Boolean truncatedColumns)
+   {
+      this.truncatedColumns = truncatedColumns;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for estimate.
+    *******************************************************************************/
+   public Boolean getEstimate()
+   {
+      return (estimate);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for estimate.
+    *******************************************************************************/
+   public PivotResult withEstimate(Boolean estimate)
+   {
+      this.estimate = estimate;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for warnings.
+    *******************************************************************************/
+   public List<String> getWarnings()
+   {
+      return (warnings);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for warnings.
+    *******************************************************************************/
+   public PivotResult withWarnings(List<String> warnings)
+   {
+      this.warnings = warnings;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for asOf.
+    *******************************************************************************/
+   public Instant getAsOf()
+   {
+      return (asOf);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for asOf.
+    *******************************************************************************/
+   public PivotResult withAsOf(Instant asOf)
+   {
+      this.asOf = asOf;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/ScatterRequest.java

@@ -0,0 +1,168 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+/*******************************************************************************
+ ** Typed ScatterRequest contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class ScatterRequest implements AnalysisRequest
+{
+   private String tableName;
+   private QQueryFilter filter;
+   private Boolean exact = true;
+   private String xField;
+   private String yField;
+   private Integer limit = 2000;
+
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   @Override
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public ScatterRequest withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for filter.
+    *******************************************************************************/
+   @Override
+   public QQueryFilter getFilter()
+   {
+      return (filter);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for filter.
+    *******************************************************************************/
+   public ScatterRequest withFilter(QQueryFilter filter)
+   {
+      this.filter = filter;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for exact.
+    *******************************************************************************/
+   @Override
+   public Boolean getExact()
+   {
+      return (exact);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for exact.
+    *******************************************************************************/
+   public ScatterRequest withExact(Boolean exact)
+   {
+      this.exact = exact;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for xField.
+    *******************************************************************************/
+   public String getXField()
+   {
+      return (xField);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for xField.
+    *******************************************************************************/
+   public ScatterRequest withXField(String xField)
+   {
+      this.xField = xField;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for yField.
+    *******************************************************************************/
+   public String getYField()
+   {
+      return (yField);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for yField.
+    *******************************************************************************/
+   public ScatterRequest withYField(String yField)
+   {
+      this.yField = yField;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for limit.
+    *******************************************************************************/
+   public Integer getLimit()
+   {
+      return (limit);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for limit.
+    *******************************************************************************/
+   public ScatterRequest withLimit(Integer limit)
+   {
+      this.limit = limit;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/ScatterResult.java

@@ -0,0 +1,165 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed ScatterResult contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class ScatterResult implements Serializable
+{
+   private Long n;
+   private Integer sampleSize;
+   private String sampling;
+   private List<Point> points = new java.util.ArrayList<>();
+   private TrendLine trend;
+   private Chart chart;
+
+
+
+   /*******************************************************************************
+    ** Getter for n.
+    *******************************************************************************/
+   public Long getN()
+   {
+      return (n);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for n.
+    *******************************************************************************/
+   public ScatterResult withN(Long n)
+   {
+      this.n = n;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for sampleSize.
+    *******************************************************************************/
+   public Integer getSampleSize()
+   {
+      return (sampleSize);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for sampleSize.
+    *******************************************************************************/
+   public ScatterResult withSampleSize(Integer sampleSize)
+   {
+      this.sampleSize = sampleSize;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for sampling.
+    *******************************************************************************/
+   public String getSampling()
+   {
+      return (sampling);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for sampling.
+    *******************************************************************************/
+   public ScatterResult withSampling(String sampling)
+   {
+      this.sampling = sampling;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for points.
+    *******************************************************************************/
+   public List<Point> getPoints()
+   {
+      return (points);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for points.
+    *******************************************************************************/
+   public ScatterResult withPoints(List<Point> points)
+   {
+      this.points = points;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for trend.
+    *******************************************************************************/
+   public TrendLine getTrend()
+   {
+      return (trend);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for trend.
+    *******************************************************************************/
+   public ScatterResult withTrend(TrendLine trend)
+   {
+      this.trend = trend;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for chart.
+    *******************************************************************************/
+   public Chart getChart()
+   {
+      return (chart);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for chart.
+    *******************************************************************************/
+   public ScatterResult withChart(Chart chart)
+   {
+      this.chart = chart;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/ShiftBucket.java

@@ -0,0 +1,121 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed ShiftBucket contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class ShiftBucket implements Serializable
+{
+   private Serializable value;
+   private String label;
+   private Boolean complete = false;
+   private List<Metric> metrics = new java.util.ArrayList<>();
+
+
+
+   /*******************************************************************************
+    ** Getter for value.
+    *******************************************************************************/
+   public Serializable getValue()
+   {
+      return (value);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for value.
+    *******************************************************************************/
+   public ShiftBucket withValue(Serializable value)
+   {
+      this.value = value;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for label.
+    *******************************************************************************/
+   public String getLabel()
+   {
+      return (label);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for label.
+    *******************************************************************************/
+   public ShiftBucket withLabel(String label)
+   {
+      this.label = label;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for complete.
+    *******************************************************************************/
+   public Boolean getComplete()
+   {
+      return (complete);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for complete.
+    *******************************************************************************/
+   public ShiftBucket withComplete(Boolean complete)
+   {
+      this.complete = complete;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for metrics.
+    *******************************************************************************/
+   public List<Metric> getMetrics()
+   {
+      return (metrics);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for metrics.
+    *******************************************************************************/
+   public ShiftBucket withMetrics(List<Metric> metrics)
+   {
+      this.metrics = metrics;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/ShiftRequest.java

@@ -0,0 +1,168 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+/*******************************************************************************
+ ** Typed ShiftRequest contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class ShiftRequest implements AnalysisRequest
+{
+   private String tableName;
+   private QQueryFilter filter;
+   private Boolean exact = true;
+   private String field;
+   private String dateField;
+   private String bucket = "MONTH";
+
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   @Override
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public ShiftRequest withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for filter.
+    *******************************************************************************/
+   @Override
+   public QQueryFilter getFilter()
+   {
+      return (filter);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for filter.
+    *******************************************************************************/
+   public ShiftRequest withFilter(QQueryFilter filter)
+   {
+      this.filter = filter;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for exact.
+    *******************************************************************************/
+   @Override
+   public Boolean getExact()
+   {
+      return (exact);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for exact.
+    *******************************************************************************/
+   public ShiftRequest withExact(Boolean exact)
+   {
+      this.exact = exact;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for field.
+    *******************************************************************************/
+   public String getField()
+   {
+      return (field);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for field.
+    *******************************************************************************/
+   public ShiftRequest withField(String field)
+   {
+      this.field = field;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for dateField.
+    *******************************************************************************/
+   public String getDateField()
+   {
+      return (dateField);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for dateField.
+    *******************************************************************************/
+   public ShiftRequest withDateField(String dateField)
+   {
+      this.dateField = dateField;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for bucket.
+    *******************************************************************************/
+   public String getBucket()
+   {
+      return (bucket);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for bucket.
+    *******************************************************************************/
+   public ShiftRequest withBucket(String bucket)
+   {
+      this.bucket = bucket;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/ShiftResult.java

@@ -0,0 +1,121 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed ShiftResult contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class ShiftResult implements Serializable
+{
+   private List<ShiftBucket> buckets = new java.util.ArrayList<>();
+   private Metric psi;
+   private String sentence;
+   private Chart chart;
+
+
+
+   /*******************************************************************************
+    ** Getter for buckets.
+    *******************************************************************************/
+   public List<ShiftBucket> getBuckets()
+   {
+      return (buckets);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for buckets.
+    *******************************************************************************/
+   public ShiftResult withBuckets(List<ShiftBucket> buckets)
+   {
+      this.buckets = buckets;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for psi.
+    *******************************************************************************/
+   public Metric getPsi()
+   {
+      return (psi);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for psi.
+    *******************************************************************************/
+   public ShiftResult withPsi(Metric psi)
+   {
+      this.psi = psi;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for sentence.
+    *******************************************************************************/
+   public String getSentence()
+   {
+      return (sentence);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for sentence.
+    *******************************************************************************/
+   public ShiftResult withSentence(String sentence)
+   {
+      this.sentence = sentence;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for chart.
+    *******************************************************************************/
+   public Chart getChart()
+   {
+      return (chart);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for chart.
+    *******************************************************************************/
+   public ShiftResult withChart(Chart chart)
+   {
+      this.chart = chart;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/Significance.java

@@ -0,0 +1,186 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed Significance contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class Significance implements Serializable
+{
+   private String test;
+   private Double statistic;
+   private Double df;
+   private Double pValue;
+   private Boolean applicable = false;
+   private String sentence;
+   private Double cramersV;
+
+
+
+   /*******************************************************************************
+    ** Getter for test.
+    *******************************************************************************/
+   public String getTest()
+   {
+      return (test);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for test.
+    *******************************************************************************/
+   public Significance withTest(String test)
+   {
+      this.test = test;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for statistic.
+    *******************************************************************************/
+   public Double getStatistic()
+   {
+      return (statistic);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for statistic.
+    *******************************************************************************/
+   public Significance withStatistic(Double statistic)
+   {
+      this.statistic = statistic;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for df.
+    *******************************************************************************/
+   public Double getDf()
+   {
+      return (df);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for df.
+    *******************************************************************************/
+   public Significance withDf(Double df)
+   {
+      this.df = df;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for pValue.
+    *******************************************************************************/
+   public Double getPValue()
+   {
+      return (pValue);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for pValue.
+    *******************************************************************************/
+   public Significance withPValue(Double pValue)
+   {
+      this.pValue = pValue;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for applicable.
+    *******************************************************************************/
+   public Boolean getApplicable()
+   {
+      return (applicable);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for applicable.
+    *******************************************************************************/
+   public Significance withApplicable(Boolean applicable)
+   {
+      this.applicable = applicable;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for sentence.
+    *******************************************************************************/
+   public String getSentence()
+   {
+      return (sentence);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for sentence.
+    *******************************************************************************/
+   public Significance withSentence(String sentence)
+   {
+      this.sentence = sentence;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for cramersV.
+    *******************************************************************************/
+   public Double getCramersV()
+   {
+      return (cramersV);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for cramersV.
+    *******************************************************************************/
+   public Significance withCramersV(Double cramersV)
+   {
+      this.cramersV = cramersV;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/TrendLine.java

@@ -0,0 +1,98 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed TrendLine contract for comparison and relationship analysis.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+public class TrendLine implements Serializable
+{
+   private Double slope;
+   private Double intercept;
+   private Double r;
+
+
+
+   /*******************************************************************************
+    ** Getter for slope.
+    *******************************************************************************/
+   public Double getSlope()
+   {
+      return (slope);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for slope.
+    *******************************************************************************/
+   public TrendLine withSlope(Double slope)
+   {
+      this.slope = slope;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for intercept.
+    *******************************************************************************/
+   public Double getIntercept()
+   {
+      return (intercept);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for intercept.
+    *******************************************************************************/
+   public TrendLine withIntercept(Double intercept)
+   {
+      this.intercept = intercept;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for r.
+    *******************************************************************************/
+   public Double getR()
+   {
+      return (r);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for r.
+    *******************************************************************************/
+   public TrendLine withR(Double r)
+   {
+      this.r = r;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/run/AnalysisRunService.java

@@ -441,7 +441,8 @@ public class AnalysisRunService
       identity.put("zone", ValueUtils.getSessionOrInstanceZoneId().getId());
       identity.put("config", service.getConfigResolver().resolve(request.getTableName()));
       identity.put("fields", service.capabilities(request.getTableName()).getFields().stream().sorted().toList());
-      identity.put("policy", com.kingsrook.qbits.dataanalysis.engine.AnalysisLabels.policy(request.getTableName()));
+      identity.put("fieldAccess", digest(service.fieldAccessFingerprint(request.getTableName())));
+      identity.put("policy", service.fieldAccessPolicy(request.getTableName()));
       identity.put("backendVariants", QContext.getQSession().getBackendVariants());
       try
       {

src/main/java/com/kingsrook/qbits/dataanalysis/stats/SpecialFunctions.java

@@ -0,0 +1,179 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.stats;
+
+/*******************************************************************************
+ ** Regularized beta and gamma using convergent series and continued fractions.
+ ** Lanczos log-gamma keeps products in log space; tails are evaluated directly.
+ *******************************************************************************/
+public final class SpecialFunctions
+{
+   private static final double EPSILON = 1e-14;
+   private static final double TINY = 1e-300;
+   private static final int ITERATIONS = 10000;
+
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private SpecialFunctions()
+   {
+   }
+
+   /*******************************************************************************
+    ** Student t cumulative distribution, with symmetry around zero.
+    *******************************************************************************/
+   public static double studentTCdf(double t, double df)
+   {
+      double tail = beta(df / (df + t * t), df / 2, 0.5) / 2;
+      return (t < 0 ? tail : 1 - tail);
+   }
+
+   /*******************************************************************************
+    ** Chi-square CDF; significance tests use gammaQ directly to retain tiny tails.
+    *******************************************************************************/
+   public static double chiSquareCdf(double x, double df)
+   {
+      return (1 - gammaQ(df / 2, x / 2));
+   }
+
+   /*******************************************************************************
+    ** Lanczos approximation, reflected below one half.
+    *******************************************************************************/
+   public static double logGamma(double z)
+   {
+      double[] coefficients = {676.5203681218851, -1259.1392167224028, 771.3234287776531, -176.6150291621406,
+         12.507343278686905, -0.13857109526572012, 9.984369578019572e-6, 1.5056327351493116e-7};
+      if(z < 0.5)
+      {
+         return (Math.log(Math.PI) - Math.log(Math.sin(Math.PI * z)) - logGamma(1 - z));
+      }
+      double x = 0.99999999999980993;
+      for(int i = 0; i < coefficients.length; i++)
+      {
+         x += coefficients[i] / (z + i);
+      }
+      double t = z + 6.5;
+      return (0.5 * Math.log(2 * Math.PI) + (z - 0.5) * Math.log(t) - t + Math.log(x));
+   }
+
+   /*******************************************************************************
+    ** Regularized incomplete beta I_x(a,b), with symmetry for stable tails.
+    *******************************************************************************/
+   public static double beta(double x, double a, double b)
+   {
+      if(x <= 0 || x >= 1)
+      {
+         return (x <= 0 ? 0 : 1);
+      }
+      double factor = Math.exp(logGamma(a + b) - logGamma(a) - logGamma(b) + a * Math.log(x) + b * Math.log1p(-x));
+      return (clamp(x < (a + 1) / (a + b + 2) ? factor * betaFraction(x, a, b) / a : 1 - factor * betaFraction(1 - x, b, a) / b));
+   }
+
+   /*******************************************************************************
+    ** Modified Lentz evaluation of the incomplete beta continued fraction.
+    *******************************************************************************/
+   private static double betaFraction(double x, double a, double b)
+   {
+      double c = 1;
+      double d = 1 / nonzero(1 - (a + b) * x / (a + 1));
+      double h = d;
+      for(int m = 1; m <= ITERATIONS; m++)
+      {
+         double aa = m * (b - m) * x / ((a + 2 * m - 1) * (a + 2 * m));
+         d = 1 / nonzero(1 + aa * d);
+         c = nonzero(1 + aa / c);
+         h *= d * c;
+         aa = -(a + m) * (a + b + m) * x / ((a + 2 * m) * (a + 2 * m + 1));
+         d = 1 / nonzero(1 + aa * d);
+         c = nonzero(1 + aa / c);
+         double delta = d * c;
+         h *= delta;
+         if(Math.abs(delta - 1) < EPSILON)
+         {
+            return (h);
+         }
+      }
+      throw new ArithmeticException("Incomplete beta did not converge");
+   }
+
+   /*******************************************************************************
+    ** Upper regularized gamma Q(a,x), the chi-square survival probability.
+    *******************************************************************************/
+   public static double gammaQ(double a, double x)
+   {
+      if(x <= 0)
+      {
+         return (1);
+      }
+      double factor = Math.exp(-x + a * Math.log(x) - logGamma(a));
+      if(x < a + 1)
+      {
+         double term = 1 / a;
+         double sum = term;
+         for(int n = 1; n <= ITERATIONS; n++)
+         {
+            term *= x / (a + n);
+            sum += term;
+            if(Math.abs(term) < Math.abs(sum) * EPSILON)
+            {
+               return (clamp(1 - sum * factor));
+            }
+         }
+      }
+      else
+      {
+         double b = x + 1 - a;
+         double c = 1 / TINY;
+         double d = 1 / nonzero(b);
+         double h = d;
+         for(int n = 1; n <= ITERATIONS; n++)
+         {
+            double an = -n * (n - a);
+            b += 2;
+            d = 1 / nonzero(an * d + b);
+            c = nonzero(b + an / c);
+            double delta = d * c;
+            h *= delta;
+            if(Math.abs(delta - 1) < EPSILON)
+            {
+               return (clamp(factor * h));
+            }
+         }
+      }
+      throw new ArithmeticException("Incomplete gamma did not converge");
+   }
+
+   /*******************************************************************************
+    ** Avoid divisions by zero without changing the sign of a fraction term.
+    *******************************************************************************/
+   private static double nonzero(double value)
+   {
+      return (Math.abs(value) < TINY ? Math.copySign(TINY, value) : value);
+   }
+
+   /*******************************************************************************
+    ** Roundoff cannot create a probability outside its domain.
+    *******************************************************************************/
+   private static double clamp(double value)
+   {
+      return (Math.max(0, Math.min(1, value)));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/stats/Statistics.java

@@ -0,0 +1,286 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.stats;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Locale;
+
+/*******************************************************************************
+ ** Dependency-free statistical tests. All tests use two-sided 5% significance.
+ *******************************************************************************/
+public final class Statistics
+{
+   /*******************************************************************************
+    ** Non-applicable results never contain NaN, infinity or an invented p-value.
+    *******************************************************************************/
+   public record Result(String test, Double statistic, Double df, Double pValue, boolean applicable, String sentence, Double cramersV)
+   {
+   }
+
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private Statistics()
+   {
+   }
+
+   /*******************************************************************************
+    ** Explain failed assumptions without claiming a negative test result.
+    *******************************************************************************/
+   public static Result unavailable(String test, String reason)
+   {
+      return (new Result(test, null, null, null, false, "Not applicable: " + reason, null));
+   }
+
+   /*******************************************************************************
+    ** The strict comparison deliberately excludes p equal to 0.05.
+    *******************************************************************************/
+   public static String sentence(double p)
+   {
+      String formatted = p < 0.001 ? String.format(Locale.ROOT, "%.3g", p)
+         : java.math.BigDecimal.valueOf(p).setScale(p < 0.01 ? 3 : 2, java.math.RoundingMode.HALF_UP).stripTrailingZeros().toPlainString();
+      return ((p < 0.05 ? "A and B differ" : "No significant difference") + " (p = " + formatted + ")");
+   }
+
+   /*******************************************************************************
+    ** Pooled standard error under equal proportions; require expected counts >= 5.
+    *******************************************************************************/
+   public static Result proportions(long successesA, long nA, long successesB, long nB)
+   {
+      String test = "Two-proportion z-test";
+      if(nA < 2 || nB < 2)
+      {
+         return (unavailable(test, "too few records"));
+      }
+      if(successesA < 0 || successesB < 0 || successesA > nA || successesB > nB)
+      {
+         return (unavailable(test, "invalid counts"));
+      }
+      double pooled = ((double) successesA + successesB) / ((double) nA + nB);
+      if(Math.min(Math.min(nA * pooled, nA * (1 - pooled)), Math.min(nB * pooled, nB * (1 - pooled))) < 5)
+      {
+         return (unavailable(test, "expected counts below 5"));
+      }
+      double z = ((double) successesA / nA - (double) successesB / nB) / Math.sqrt(pooled * (1 - pooled) * (1.0 / nA + 1.0 / nB));
+      double p = SpecialFunctions.gammaQ(0.5, z * z / 2);
+      return (new Result(test, z, null, p, true, sentence(p), null));
+   }
+
+   /*******************************************************************************
+    ** Welch-Satterthwaite degrees of freedom from sample (ddof=1) variances.
+    *******************************************************************************/
+   public static Result welch(long nA, double meanA, double varianceA, long nB, double meanB, double varianceB)
+   {
+      String test = "Welch's t-test";
+      if(nA < 2 || nB < 2)
+      {
+         return (unavailable(test, "too few records"));
+      }
+      if(!Double.isFinite(meanA) || !Double.isFinite(meanB) || !Double.isFinite(varianceA) || !Double.isFinite(varianceB) || varianceA < 0 || varianceB < 0)
+      {
+         return (unavailable(test, "invalid numeric summary"));
+      }
+      double a = varianceA / nA;
+      double b = varianceB / nB;
+      if(a + b == 0)
+      {
+         return (unavailable(test, "both groups have zero variance"));
+      }
+      double t = (meanA - meanB) / Math.sqrt(a + b);
+      double df = (a + b) * (a + b) / (a * a / (nA - 1) + b * b / (nB - 1));
+      double p = SpecialFunctions.beta(df / (df + t * t), df / 2, 0.5);
+      return (new Result(test, t, df, p, true, sentence(p), null));
+   }
+
+   /*******************************************************************************
+    ** Pearson chi-square without Yates correction; low expected categories pool
+    ** into Other. Homogeneity preserves sample rows; independence pools both axes.
+    *******************************************************************************/
+   public static Result chiSquare(double[][] observed, boolean homogeneity)
+   {
+      String test = homogeneity ? "Chi-square homogeneity" : "Chi-square independence";
+      if(observed == null || observed.length < 2 || observed[0] == null || observed[0].length < 2)
+      {
+         return (unavailable(test, "a table of at least 2 by 2 is required"));
+      }
+      int columns = observed[0].length;
+      for(double[] row : observed)
+      {
+         if(row == null || row.length != columns || Arrays.stream(row).anyMatch(v -> !Double.isFinite(v) || v < 0))
+         {
+            return (unavailable(test, "invalid counts"));
+         }
+         if(Arrays.stream(row).sum() < 2)
+         {
+            return (unavailable(test, "too few records"));
+         }
+      }
+      double[][] table = poolColumns(observed);
+      if(!homogeneity)
+      {
+         table = transpose(poolColumns(transpose(table)));
+         double[][] rowFirst = poolColumns(transpose(poolColumns(transpose(observed))));
+         if(validExpected(rowFirst) && (!validExpected(table) || rowFirst.length * rowFirst[0].length > table.length * table[0].length))
+         {
+            table = rowFirst;
+         }
+      }
+      if(table.length < 2 || table[0].length < 2)
+      {
+         return (unavailable(test, "too few categories after merging expected counts below 5 into Other"));
+      }
+      double[] rows = Arrays.stream(table).mapToDouble(r -> Arrays.stream(r).sum()).toArray();
+      double[] cols = Arrays.stream(transpose(table)).mapToDouble(r -> Arrays.stream(r).sum()).toArray();
+      double total = Arrays.stream(rows).sum();
+      double statistic = 0;
+      for(int i = 0; i < rows.length; i++)
+      {
+         for(int j = 0; j < cols.length; j++)
+         {
+            double expected = rows[i] * cols[j] / total;
+            if(expected < 5)
+            {
+               return (unavailable(test, "expected counts below 5 after merging into Other"));
+            }
+            statistic += Math.pow(table[i][j] - expected, 2) / expected;
+         }
+      }
+      double df = (rows.length - 1.0) * (cols.length - 1.0);
+      double p = SpecialFunctions.gammaQ(df / 2, statistic / 2);
+      double v = Math.sqrt(statistic / (total * Math.min(rows.length - 1, cols.length - 1)));
+      return (new Result(test, statistic, df, p, true, sentence(p), v));
+   }
+
+   /*******************************************************************************
+    ** Rare rows must not force every column into Other when row pooling alone
+    ** would suffice. Prefer the valid pooling order retaining more categories.
+    *******************************************************************************/
+   private static boolean validExpected(double[][] table)
+   {
+      double[] rows = Arrays.stream(table).mapToDouble(r -> Arrays.stream(r).sum()).toArray();
+      double[] columns = Arrays.stream(transpose(table)).mapToDouble(r -> Arrays.stream(r).sum()).toArray();
+      return (rows.length >= 2 && columns.length >= 2
+         && Arrays.stream(rows).min().orElse(0) * Arrays.stream(columns).min().orElse(0) / Arrays.stream(rows).sum() >= 5);
+   }
+
+   /*******************************************************************************
+    ** Pool all categories with any expected count below five into one final column.
+    *******************************************************************************/
+   private static double[][] poolColumns(double[][] table)
+   {
+      double[] rows = Arrays.stream(table).mapToDouble(r -> Arrays.stream(r).sum()).toArray();
+      double total = Arrays.stream(rows).sum();
+      List<Integer> kept = new ArrayList<>();
+      List<Integer> other = new ArrayList<>();
+      for(int j = 0; j < table[0].length; j++)
+      {
+         double sum = 0;
+         for(double[] row : table)
+         {
+            sum += row[j];
+         }
+         double column = sum;
+         (Arrays.stream(rows).anyMatch(r -> r * column / total < 5) ? other : kept).add(j);
+      }
+      double[][] result = new double[rows.length][kept.size() + (other.isEmpty() ? 0 : 1)];
+      for(int i = 0; i < rows.length; i++)
+      {
+         for(int j = 0; j < kept.size(); j++)
+         {
+            result[i][j] = table[i][kept.get(j)];
+         }
+         for(int j : other)
+         {
+            result[i][kept.size()] += table[i][j];
+         }
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Transposition lets independence apply the same pooling rule to both axes.
+    *******************************************************************************/
+   private static double[][] transpose(double[][] input)
+   {
+      double[][] result = new double[input[0].length][input.length];
+      for(int i = 0; i < input.length; i++)
+      {
+         for(int j = 0; j < input[i].length; j++)
+         {
+            result[j][i] = input[i][j];
+         }
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Normalize counts to shares; floor zero shares at 1e-6 for finite PSI.
+    ** This descriptive index is not a p-value or a significance test.
+    *******************************************************************************/
+   public static Double psi(double[] first, double[] last)
+   {
+      if(first == null || last == null || first.length == 0 || first.length != last.length
+         || Arrays.stream(first).anyMatch(v -> !Double.isFinite(v) || v < 0) || Arrays.stream(last).anyMatch(v -> !Double.isFinite(v) || v < 0))
+      {
+         return (null);
+      }
+      double a = Arrays.stream(first).sum();
+      double b = Arrays.stream(last).sum();
+      if(a <= 0 || b <= 0)
+      {
+         return (null);
+      }
+      double result = 0;
+      for(int i = 0; i < first.length; i++)
+      {
+         double x = Math.max(1e-6, first[i] / a);
+         double y = Math.max(1e-6, last[i] / b);
+         result += (y - x) * Math.log(y / x);
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Centered covariance avoids cancellation for large offsets; null on constants.
+    *******************************************************************************/
+   public static Double pearson(double[] x, double[] y)
+   {
+      if(x == null || y == null || x.length < 2 || x.length != y.length
+         || Arrays.stream(x).anyMatch(v -> !Double.isFinite(v)) || Arrays.stream(y).anyMatch(v -> !Double.isFinite(v)))
+      {
+         return (null);
+      }
+      double meanX = Arrays.stream(x).average().orElseThrow();
+      double meanY = Arrays.stream(y).average().orElseThrow();
+      double xx = 0;
+      double yy = 0;
+      double xy = 0;
+      for(int i = 0; i < x.length; i++)
+      {
+         xx += (x[i] - meanX) * (x[i] - meanX);
+         yy += (y[i] - meanY) * (y[i] - meanY);
+         xy += (x[i] - meanX) * (y[i] - meanY);
+      }
+      return (xx == 0 || yy == 0 ? null : Math.max(-1, Math.min(1, xy / Math.sqrt(xx * yy))));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/watch/WatchBucket.java

@@ -0,0 +1,32 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.watch;
+
+import java.io.Serializable;
+import java.util.Set;
+import com.kingsrook.qbits.dataanalysis.result.Drill;
+
+/*******************************************************************************
+ ** One complete calendar bucket, ordered oldest first for detector input.
+ *******************************************************************************/
+public record WatchBucket(Serializable start, Double value, Set<String> categories, Drill drill)
+{
+}

src/main/java/com/kingsrook/qbits/dataanalysis/watch/WatchCustomizer.java

@@ -0,0 +1,97 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.watch;
+
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Optional;
+import java.util.Set;
+import com.kingsrook.qbits.dataanalysis.model.DataAnalysisTables;
+import com.kingsrook.qbits.dataanalysis.permissions.DataAnalysisPermissions;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizerInterface;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.statusmessages.BadInputStatusMessage;
+
+/*******************************************************************************
+ ** Validate standard table CRUD, including partial updates and owner changes.
+ *******************************************************************************/
+public class WatchCustomizer implements TableCustomizerInterface
+{
+   private static final Set<String> CONFIGURATION = Set.of("saved_id", "table_name", "filter_json", "metric_json", "date_field", "bucket",
+      "detector", "parameters_json", "severity", "owner_user_id", "enabled");
+
+   /*******************************************************************************
+    ** Validate every inserted watch, including disabled drafts.
+    *******************************************************************************/
+   @Override
+   public List<QRecord> preInsert(InsertInput input, List<QRecord> records, boolean preview) throws QException
+   {
+      for(QRecord record : records)
+      {
+         validate(record, record);
+      }
+      return (records);
+   }
+
+   /*******************************************************************************
+    ** Merge partial patches with the stored row before checking detector parameters.
+    *******************************************************************************/
+   @Override
+   public List<QRecord> preUpdate(UpdateInput input, List<QRecord> records, boolean preview, Optional<List<QRecord>> oldRecords) throws QException
+   {
+      for(QRecord record : records)
+      {
+         if(record.getValues().keySet().stream().noneMatch(CONFIGURATION::contains))
+         {
+            continue;
+         }
+         QRecord old = WatchRecords.get(DataAnalysisTables.WATCH, record.getValue("id"));
+         QRecord merged = new QRecord(old);
+         merged.getValues().putAll(record.getValues());
+         validate(record, merged);
+      }
+      return (records);
+   }
+
+   /*******************************************************************************
+    ** Record-level messages are shown by normal core insert/update screens.
+    *******************************************************************************/
+   private void validate(QRecord output, QRecord merged)
+   {
+      try
+      {
+         String owner = merged.getValueString("owner_user_id");
+         var session = QContext.getQSession();
+         WatchDefinition.require(owner != null && !owner.isBlank(), "owner_user_id is required.");
+         WatchDefinition.require(session != null && (session.hasPermission(DataAnalysisPermissions.ADMIN)
+            || session.getUser() != null && owner.equals(session.getUser().getIdReference())), "Only an administrator may assign another watch owner.");
+         WatchDefinition.parse(WatchRecords.resolve(merged));
+      }
+      catch(QException e)
+      {
+         output.addError(new BadInputStatusMessage(e.getMessage()));
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/watch/WatchDefinition.java

@@ -0,0 +1,152 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.watch;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import com.kingsrook.qqq.backend.core.alerts.AlertSeverity;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+
+/*******************************************************************************
+ ** Validated watch configuration; JSON accepts only documented, typed parameters.
+ *******************************************************************************/
+public record WatchDefinition(String detector, String metric, String field, String dateField, String bucket,
+   Integer k, Double threshold, Double relativeChange, Double min, Double max, Double delta, Integer n)
+{
+   /*******************************************************************************
+    ** Parse a definition after resolving an optional saved analysis.
+    *******************************************************************************/
+   public static WatchDefinition parse(QRecord row) throws QBadRequestException
+   {
+      String detector = row.getValueString("detector");
+      require(List.of("SPIKE", "DROP", "OUT_OF_RANGE", "NEW_CATEGORY", "NULL_RATE_CREEP").contains(detector == null ? "" : detector), "Choose a supported detector.");
+      Map<String, Object> metric = object(row.getValueString("metric_json"), "metric_json");
+      require(metric.keySet().stream().allMatch(Set.of("operator", "field")::contains), "metric_json accepts operator and field only.");
+      String operator = string(metric.get("operator"));
+      String field = string(metric.get("field"));
+      require(List.of("COUNT", "SUM", "AVG", "NULL_SHARE", "CATEGORY_SET").contains(operator == null ? "" : operator), "Metric operator must be COUNT, SUM, AVG, NULL_SHARE or CATEGORY_SET.");
+      require("COUNT".equals(operator) || field != null && !field.isBlank(), "This metric requires a field.");
+      require("NEW_CATEGORY".equals(detector) == "CATEGORY_SET".equals(operator), "NEW_CATEGORY requires CATEGORY_SET; other detectors require a numeric metric.");
+      require(!"NULL_RATE_CREEP".equals(detector) || "NULL_SHARE".equals(operator), "NULL_RATE_CREEP requires NULL_SHARE.");
+      String date = row.getValueString("date_field");
+      String bucket = row.getValueString("bucket");
+      require(date != null && !date.isBlank(), "Choose a date field.");
+      require(List.of("HOUR", "DAY", "WEEK", "MONTH").contains(bucket == null ? "" : bucket), "Bucket must be HOUR, DAY, WEEK or MONTH.");
+      try
+      {
+         AlertSeverity.valueOf(row.getValueString("severity"));
+      }
+      catch(RuntimeException e)
+      {
+         throw new QBadRequestException("Choose a valid alert severity.");
+      }
+      Map<String, Object> parameters = object(row.getValueString("parameters_json"), "parameters_json");
+      Set<String> allowed = switch(detector)
+      {
+         case "SPIKE", "DROP" -> Set.of("k", "threshold", "relativeChange");
+         case "OUT_OF_RANGE" -> Set.of("k", "min", "max");
+         case "NULL_RATE_CREEP" -> Set.of("k", "delta", "n");
+         default -> Set.of("k");
+      };
+      require(allowed.containsAll(parameters.keySet()), "Unsupported parameter for " + detector + ". Allowed: " + String.join(", ", allowed.stream().sorted().toList()) + ".");
+      int k = integer(parameters, "k", 14, 1, 1000);
+      int n = integer(parameters, "n", 3, 1, 1000);
+      double threshold = number(parameters, "threshold", 3.5);
+      double relative = number(parameters, "relativeChange", 0.5);
+      double delta = number(parameters, "delta", 0.05);
+      require(threshold > 0, "threshold must be positive.");
+      require(relative >= 0, "relativeChange must be non-negative (0.5 means 50%).");
+      require(delta >= 0 && delta <= 1, "delta must be between 0 and 1.");
+      Double min = parameters.containsKey("min") ? number(parameters, "min", 0) : null;
+      Double max = parameters.containsKey("max") ? number(parameters, "max", 0) : null;
+      require(!"OUT_OF_RANGE".equals(detector) || min != null && max != null && min <= max, "OUT_OF_RANGE requires min and max with min <= max.");
+      return (new WatchDefinition(detector, operator, field, date, bucket, k, threshold, relative, min, max, delta, n));
+   }
+
+   /*******************************************************************************
+    ** Strict JSON objects keep malformed definitions out of standard CRUD.
+    *******************************************************************************/
+   @SuppressWarnings("unchecked")
+   public static Map<String, Object> object(String json, String name) throws QBadRequestException
+   {
+      try
+      {
+         Object value = JsonUtils.toObject(json == null || json.isBlank() ? "{}" : json, Object.class);
+         if(value instanceof Map<?, ?> map)
+         {
+            return ((Map<String, Object>) map);
+         }
+      }
+      catch(Exception expected)
+      {
+         // Report a stable validation error, without echoing stored JSON.
+      }
+      throw new QBadRequestException(name + " must be a JSON object.");
+   }
+
+   /*******************************************************************************
+    ** Numeric values must be finite JSON numbers, never coerced strings.
+    *******************************************************************************/
+   private static double number(Map<String, Object> values, String key, double fallback) throws QBadRequestException
+   {
+      if(!values.containsKey(key))
+      {
+         return (fallback);
+      }
+      require(values.get(key) instanceof Number, key + " must be a number.");
+      double value = ((Number) values.get(key)).doubleValue();
+      require(Double.isFinite(value), key + " must be finite.");
+      return (value);
+   }
+
+   /*******************************************************************************
+    ** Bound work and reject fractional window sizes.
+    *******************************************************************************/
+   private static int integer(Map<String, Object> values, String key, int fallback, int min, int max) throws QBadRequestException
+   {
+      double value = number(values, key, fallback);
+      require(value == Math.rint(value) && value >= min && value <= max, key + " must be an integer from " + min + " to " + max + ".");
+      return ((int) value);
+   }
+
+   /*******************************************************************************
+    ** Optional strings still reject incompatible scalar types.
+    *******************************************************************************/
+   private static String string(Object value) throws QBadRequestException
+   {
+      require(value == null || value instanceof String, "Metric operator and field must be strings.");
+      return ((String) value);
+   }
+
+   /*******************************************************************************
+    ** Clear errors shared by table validation and preview.
+    *******************************************************************************/
+   public static void require(boolean valid, String message) throws QBadRequestException
+   {
+      if(!valid)
+      {
+         throw new QBadRequestException(message);
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/watch/WatchDetectors.java

@@ -0,0 +1,131 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.watch;
+
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import com.kingsrook.qbits.dataanalysis.engine.AnalysisFormatting;
+
+/*******************************************************************************
+ ** Pure detectors over complete buckets, with no context, queries or side effects.
+ *******************************************************************************/
+public final class WatchDetectors
+{
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private WatchDetectors()
+   {
+   }
+
+   /*******************************************************************************
+    ** Compare the latest value to the preceding k complete buckets.
+    *******************************************************************************/
+   public static WatchVerdict evaluate(WatchDefinition definition, List<WatchBucket> series, String label)
+   {
+      int k = definition.k();
+      if(series.isEmpty() || !"OUT_OF_RANGE".equals(definition.detector()) && series.size() < k + 1)
+      {
+         return (WatchVerdict.skipped("Not enough history."));
+      }
+      WatchBucket latest = series.getLast();
+      List<WatchBucket> history = series.subList(Math.max(0, series.size() - k - 1), series.size() - 1);
+      if("NEW_CATEGORY".equals(definition.detector()))
+      {
+         Set<String> previous = new HashSet<>();
+         history.forEach(bucket -> previous.addAll(bucket.categories()));
+         long added = latest.categories().stream().filter(value -> !previous.contains(value)).count();
+         return (new WatchVerdict(true, added > 0, (double) latest.categories().size(), (double) previous.size(), null, null,
+            label + (added > 0 ? " has " + added + " new " + (added == 1 ? "category." : "categories.") : " has no new categories."), latest.drill()));
+      }
+      if(latest.value() == null || !Double.isFinite(latest.value()) || !"OUT_OF_RANGE".equals(definition.detector()) && history.stream().anyMatch(bucket -> bucket.value() == null || !Double.isFinite(bucket.value())))
+      {
+         return (WatchVerdict.skipped("Not enough history: a bucket has no numeric value."));
+      }
+      double x = latest.value();
+      double[] values = history.stream().filter(bucket -> bucket.value() != null && Double.isFinite(bucket.value())).mapToDouble(WatchBucket::value).sorted().toArray();
+      Double baseline = values.length == 0 ? null : median(values);
+      Double low = values.length == 0 ? null : values[0];
+      Double high = values.length == 0 ? null : values[values.length - 1];
+      boolean firing;
+      switch(definition.detector())
+      {
+         case "SPIKE", "DROP" ->
+         {
+            double mad = median(java.util.Arrays.stream(values).map(value -> Math.abs(value - baseline)).sorted().toArray());
+            double change = x - baseline;
+            double score = mad == 0 ? baseline == 0 ? Math.signum(change) * (change == 0 ? 0 : Double.POSITIVE_INFINITY)
+               : change / Math.abs(baseline) : 0.6745 * change / mad;
+            double threshold = mad == 0 ? definition.relativeChange() : definition.threshold();
+            firing = "SPIKE".equals(definition.detector()) ? score > threshold : score < -threshold;
+         }
+         case "OUT_OF_RANGE" ->
+         {
+            low = definition.min();
+            high = definition.max();
+            firing = x < low || x > high;
+         }
+         case "NULL_RATE_CREEP" -> firing = x - baseline > definition.delta() || rising(series, definition.n());
+         default -> throw new IllegalArgumentException("Unsupported numeric detector.");
+      }
+      String verb = firing ? "DROP".equals(definition.detector()) ? " dropped to " : "SPIKE".equals(definition.detector())
+         || "NULL_RATE_CREEP".equals(definition.detector()) ? " rose to " : " is out of range at " : " is ";
+      String band = low == null ? "" : " (" + ("OUT_OF_RANGE".equals(definition.detector()) ? "expected " : "usual ") + format(low) + "–" + format(high) + ")";
+      return (new WatchVerdict(true, firing, x, baseline, low, high, label + verb + format(x) + band + ".", latest.drill()));
+   }
+
+   /*******************************************************************************
+    ** n consecutive rises require n+1 values, including the latest bucket.
+    *******************************************************************************/
+   private static boolean rising(List<WatchBucket> series, int n)
+   {
+      if(series.size() <= n)
+      {
+         return (false);
+      }
+      for(int i = series.size() - n; i < series.size(); i++)
+      {
+         if(series.get(i).value() <= series.get(i - 1).value())
+         {
+            return (false);
+         }
+      }
+      return (true);
+   }
+
+   /*******************************************************************************
+    ** Median of a sorted non-empty array, including even-sized baselines.
+    *******************************************************************************/
+   private static double median(double[] values)
+   {
+      int middle = values.length / 2;
+      return (values.length % 2 == 0 ? values[middle - 1] / 2 + values[middle] / 2 : values[middle]);
+   }
+
+   /*******************************************************************************
+    ** Compact English numeric labels with no scientific notation.
+    *******************************************************************************/
+   private static String format(double value)
+   {
+      return (AnalysisFormatting.number(value, 3));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/watch/WatchEvaluator.java

@@ -0,0 +1,236 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.watch;
+
+import java.io.Serializable;
+import java.time.Instant;
+import java.util.List;
+import java.util.Objects;
+import com.kingsrook.qbits.dataanalysis.DataAnalysisQBitConfig;
+import com.kingsrook.qbits.dataanalysis.DataAnalysisService;
+import com.kingsrook.qbits.dataanalysis.engine.DrillFilters;
+import com.kingsrook.qbits.dataanalysis.model.DataAnalysisTables;
+import com.kingsrook.qbits.dataanalysis.permissions.DataAnalysisPermissions;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionsHelper;
+import com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.alerts.AlertLink;
+import com.kingsrook.qqq.backend.core.alerts.AlertRecordRef;
+import com.kingsrook.qqq.backend.core.alerts.AlertSeverity;
+import com.kingsrook.qqq.backend.core.alerts.AlertSignal;
+import com.kingsrook.qqq.backend.core.alerts.QAlerts;
+import com.kingsrook.qqq.backend.core.context.CapturedContext;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QUser;
+import com.kingsrook.qqq.backend.core.modules.authentication.QAuthenticationModuleDispatcher;
+
+/*******************************************************************************
+ ** Transition watches through the core alerts SPI, computing exclusively as owner.
+ *******************************************************************************/
+public class WatchEvaluator
+{
+   public static final String ALERT_TYPE = "data.analysis.anomaly";
+   private final DataAnalysisQBitConfig config;
+   private final DataAnalysisService service;
+
+   /*******************************************************************************
+    ** One evaluator per instance serializes scheduled and manual transitions.
+    *******************************************************************************/
+   public WatchEvaluator(DataAnalysisQBitConfig config, DataAnalysisService service)
+   {
+      this.config = config;
+      this.service = service;
+   }
+
+   /*******************************************************************************
+    ** Preview uses the viewer's rights, never the saved owner's cached data.
+    *******************************************************************************/
+   public WatchPreview preview(Serializable id, Instant now) throws QException
+   {
+      return (service.watchPreview(WatchRecords.get(DataAnalysisTables.WATCH, id), now));
+   }
+
+   /*******************************************************************************
+    ** Manual evaluation first requires the caller's read and edit rights.
+    *******************************************************************************/
+   public synchronized WatchVerdict evaluate(Serializable id, Instant now) throws QException
+   {
+      requireEdit();
+      QRecord row = WatchRecords.get(DataAnalysisTables.WATCH, id);
+      WatchVerdict verdict = asOwner(row, now);
+      store(row, verdict, now);
+      return (verdict);
+   }
+
+   /*******************************************************************************
+    ** Only watch inventory/status use maintenance grants, never source data.
+    *******************************************************************************/
+   public synchronized Integer evaluateEnabled(Instant now) throws QException
+   {
+      QSession maintenance = new QSession().withUser(new QUser().withIdReference("data-analysis-scheduler"))
+         .withPermissions("data_analysis.watch.read", "data_analysis.watch.edit")
+         .withSecurityKeyValue(DataAnalysisPermissions.ADMIN, true);
+      if(QContext.getQSession().getBackendVariants() != null)
+      {
+         maintenance.setBackendVariants(new java.util.HashMap<>(QContext.getQSession().getBackendVariants()));
+      }
+      int[] count = {0};
+      QContext.withTemporaryContext(new CapturedContext(QContext.getQInstance(), maintenance), () ->
+      {
+         QueryInput input = new QueryInput(DataAnalysisTables.WATCH).withShouldFetchHeavyFields(true)
+            .withFilter(DrillFilters.condition("enabled", QCriteriaOperator.EQUALS, true));
+         input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+         for(QRecord row : new QueryAction().execute(input).getRecords())
+         {
+            WatchVerdict verdict = evaluate(row.getValue("id"), now);
+            if(verdict.evaluated())
+            {
+               count[0]++;
+            }
+         }
+      });
+      return (count[0]);
+   }
+
+   /*******************************************************************************
+    ** An unavailable or mismatched host session must never fall back to system.
+    *******************************************************************************/
+   private WatchVerdict asOwner(QRecord row, Instant now)
+   {
+      String owner = row.getValueString("owner_user_id");
+      QSession session;
+      try
+      {
+         session = config.getOwnerSessionSupplier() == null
+            ? new QAuthenticationModuleDispatcher().getQModule(QContext.getQInstance().getAuthentication()).createAutomatedSessionForUser(QContext.getQInstance(), owner)
+            : config.getOwnerSessionSupplier().apply(owner);
+      }
+      catch(Exception e)
+      {
+         return (WatchVerdict.skipped("Owner session unavailable"));
+      }
+      if(owner == null || session == null || session.getUser() == null || !Objects.equals(owner, session.getUser().getIdReference())
+         || session.getSecurityKeyValues() == null || !session.getSecurityKeyValues().getOrDefault(DataAnalysisTables.USER_KEY, List.of()).contains(owner))
+      {
+         return (WatchVerdict.skipped("Owner session unavailable"));
+      }
+      WatchVerdict[] verdict = new WatchVerdict[1];
+      try
+      {
+         QContext.withTemporaryContext(new CapturedContext(QContext.getQInstance(), session), () ->
+         {
+            QRecord owned = WatchRecords.get(DataAnalysisTables.WATCH, row.getValue("id"));
+            verdict[0] = service.watchPreview(owned, now).verdict();
+         });
+         return (verdict[0]);
+      }
+      catch(QPermissionDeniedException e)
+      {
+         return (WatchVerdict.skipped("Owner lacks READ or Analyze access to the watched table."));
+      }
+      catch(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException e)
+      {
+         return (WatchVerdict.skipped("Watch evaluation unavailable: " + e.getMessage()));
+      }
+      catch(Exception e)
+      {
+         return (WatchVerdict.skipped("Watch evaluation unavailable; check the saved analysis and source configuration."));
+      }
+   }
+
+   /*******************************************************************************
+    ** Persist first; only successful evaluated transitions notify the alerts SPI.
+    *******************************************************************************/
+   private void store(QRecord row, WatchVerdict verdict, Instant now) throws QException
+   {
+      String key = "data_analysis_watch:" + row.getValue("id");
+      boolean wasFiring = "FIRING".equals(row.getValueString("state"));
+      QRecord patch = new QRecord().withValue("id", row.getValue("id")).withValue("last_evaluated_at", now)
+         .withValue("last_value", verdict.value()).withValue("last_message", verdict.message());
+      if(verdict.evaluated())
+      {
+         patch.withValue("state", verdict.firing() ? "FIRING" : "OK").withValue("alert_key", key);
+      }
+      update(patch);
+      if(!verdict.evaluated() || wasFiring == verdict.firing())
+      {
+         return;
+      }
+      if(verdict.firing())
+      {
+         AlertSignal signal = new AlertSignal(ALERT_TYPE).withDedupKey(key).withSeverity(AlertSeverity.valueOf(row.getValueString("severity")))
+            .withTitle("Data anomaly").withSummary(verdict.message()).withRecordRef(AlertRecordRef.of(DataAnalysisTables.WATCH, row.getValue("id")));
+         if(verdict.drill() != null)
+         {
+            signal.withLink(AlertLink.toTable(verdict.drill().getTableName(), verdict.drill().getFilter(), "View matching records"));
+         }
+         QAlerts.raise(signal);
+      }
+      else
+      {
+         QAlerts.resolve(ALERT_TYPE, key, verdict.message());
+      }
+   }
+
+   /*******************************************************************************
+    ** Enable and disable selected owner-locked rows through standard core updates.
+    *******************************************************************************/
+   public void setEnabled(Serializable id, Boolean enabled) throws QException
+   {
+      requireEdit();
+      WatchRecords.get(DataAnalysisTables.WATCH, id);
+      update(new QRecord().withValue("id", id).withValue("enabled", enabled));
+   }
+
+   /*******************************************************************************
+    ** Never count an unsuccessful core update as an evaluated watch.
+    *******************************************************************************/
+   private static void update(QRecord record) throws QException
+   {
+      UpdateInput input = new UpdateInput(DataAnalysisTables.WATCH).withRecords(List.of(record));
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      QRecord stored = new UpdateAction().execute(input).getRecords().getFirst();
+      if(stored.getErrors() != null && !stored.getErrors().isEmpty())
+      {
+         throw new QException("Watch could not be updated: " + stored.getErrors().getFirst().getMessage());
+      }
+   }
+
+   /*******************************************************************************
+    ** Public mutation entry points enforce table permission before source queries.
+    *******************************************************************************/
+   private static void requireEdit() throws QPermissionDeniedException
+   {
+      if(!PermissionsHelper.hasTablePermission(new UpdateInput(DataAnalysisTables.WATCH), DataAnalysisTables.WATCH, TablePermissionSubType.EDIT))
+      {
+         throw new QPermissionDeniedException("Watch editing is unavailable.");
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/watch/WatchPreview.java

@@ -0,0 +1,31 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.watch;
+
+import java.util.List;
+import com.kingsrook.qbits.dataanalysis.result.Chart;
+
+/*******************************************************************************
+ ** Read-only preview with a semantic time series and detector explanation.
+ *******************************************************************************/
+public record WatchPreview(List<WatchBucket> series, Chart chart, WatchVerdict verdict)
+{
+}

src/main/java/com/kingsrook/qbits/dataanalysis/watch/WatchRecords.java

@@ -0,0 +1,141 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.watch;
+
+import java.io.Serializable;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.dataanalysis.engine.DrillFilters;
+import com.kingsrook.qbits.dataanalysis.model.DataAnalysisTables;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+
+/*******************************************************************************
+ ** Watch and saved-definition reads always use the active user's core permissions.
+ *******************************************************************************/
+public final class WatchRecords
+{
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private WatchRecords()
+   {
+   }
+
+   /*******************************************************************************
+    ** Fetch heavy JSON with record locks; missing and inaccessible ids look alike.
+    *******************************************************************************/
+   public static QRecord get(String table, Serializable id) throws QException
+   {
+      QueryInput input = new QueryInput(table).withShouldFetchHeavyFields(true)
+         .withFilter(DrillFilters.condition("id", QCriteriaOperator.EQUALS, id).withLimit(1));
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      List<QRecord> records = new QueryAction().execute(input).getRecords();
+      if(records.isEmpty())
+      {
+         throw new QNotFoundException("Watch or saved analysis is unavailable.");
+      }
+      return (records.getFirst());
+   }
+
+   /*******************************************************************************
+    ** Saved pivots provide one measure; explicit watch metrics can also be used.
+    *******************************************************************************/
+   public static QRecord resolve(QRecord row) throws QException
+   {
+      boolean saved = row.getValue("saved_id") != null;
+      WatchDefinition.require(saved != (row.getValueString("table_name") != null && !row.getValueString("table_name").isBlank()), "Choose either saved_id or table_name.");
+      QRecord result = new QRecord(row);
+      if(saved)
+      {
+         WatchDefinition.require(row.getValueString("filter_json") == null || row.getValueString("filter_json").isBlank(), "Saved watches use the saved analysis filter; omit filter_json.");
+         QRecord analysis = get(DataAnalysisTables.SAVED, row.getValue("saved_id"));
+         result.withValue("table_name", analysis.getValue("table_name")).withValue("filter_json", analysis.getValue("filter_json"));
+         Map<String, Object> definition = WatchDefinition.object(analysis.getValueString("definition_json"), "Saved definition");
+         if(result.getValueString("metric_json") == null || result.getValueString("metric_json").isBlank())
+         {
+            Object metric = definition.get("metric");
+            if(metric == null && definition.get("values") instanceof List<?> values && values.size() == 1)
+            {
+               metric = values.getFirst();
+            }
+            WatchDefinition.require(metric != null, "Saved analysis needs one COUNT, SUM or AVG measure, or an explicit watch metric_json.");
+            Map<String, Object> selected = new LinkedHashMap<>(WatchDefinition.object(JsonUtils.toJson(metric), "Saved metric"));
+            if(selected.get("percentile") == null)
+            {
+               selected.remove("percentile");
+            }
+            result.withValue("metric_json", JsonUtils.toJson(selected));
+         }
+         if(result.getValueString("filter_json") == null && definition.get("filter") != null)
+         {
+            result.withValue("filter_json", JsonUtils.toJson(definition.get("filter")));
+         }
+      }
+      filter(result);
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Reject invalid filter JSON rather than silently broadening the watch.
+    *******************************************************************************/
+   public static QQueryFilter filter(QRecord row) throws QBadRequestException
+   {
+      String json = row.getValueString("filter_json");
+      if(json == null || json.isBlank())
+      {
+         return (new QQueryFilter());
+      }
+      WatchDefinition.object(json, "filter_json");
+      try
+      {
+         QQueryFilter filter = JsonUtils.toObject(json, QQueryFilter.class);
+         validateFilter(filter);
+         return (filter);
+      }
+      catch(Exception e)
+      {
+         throw new QBadRequestException("filter_json must contain a valid core query filter.");
+      }
+   }
+
+   /*******************************************************************************
+    ** Invalid operators and null criteria are never interpreted as empty filters.
+    *******************************************************************************/
+   private static void validateFilter(QQueryFilter filter)
+   {
+      if(filter == null || filter.getCriteria() == null || filter.getSubFilters() == null
+         || filter.getCriteria().stream().anyMatch(c -> c == null || c.getOperator() == null || c.getFieldName() == null))
+      {
+         throw new IllegalArgumentException("Invalid filter.");
+      }
+      filter.getSubFilters().forEach(WatchRecords::validateFilter);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/watch/WatchSeries.java

@@ -0,0 +1,278 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.watch;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import java.time.Instant;
+import java.time.ZonedDateTime;
+import java.time.temporal.ChronoUnit;
+import java.time.temporal.TemporalAdjusters;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import com.kingsrook.qbits.dataanalysis.engine.AnalysisSecurity;
+import com.kingsrook.qbits.dataanalysis.engine.DrillFilters;
+import com.kingsrook.qbits.dataanalysis.engine.EffectiveConfig;
+import com.kingsrook.qbits.dataanalysis.engine.RelationshipSupport;
+import com.kingsrook.qbits.dataanalysis.result.Axis;
+import com.kingsrook.qbits.dataanalysis.result.Chart;
+import com.kingsrook.qbits.dataanalysis.result.ChartKind;
+import com.kingsrook.qbits.dataanalysis.result.Point;
+import com.kingsrook.qbits.dataanalysis.result.Series;
+import com.kingsrook.qbits.dataanalysis.result.ValueType;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.Aggregate;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateResult;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.DateBucket;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.DateBucketUnit;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.GroupBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.utils.ValueUtils;
+
+/*******************************************************************************
+ ** Exact core date-bucket aggregates under the active user's FULL-field policy.
+ *******************************************************************************/
+public class WatchSeries extends RelationshipSupport
+{
+   /*******************************************************************************
+    ** Bind request-local policy and core streamed limits.
+    *******************************************************************************/
+   public WatchSeries(AnalysisSecurity security, EffectiveConfig config, String table)
+   {
+      super(security, config, table);
+   }
+
+   /*******************************************************************************
+    ** Evaluate only complete buckets; reject partial or privacy-suppressed data.
+    *******************************************************************************/
+   public WatchPreview preview(WatchDefinition definition, QQueryFilter filter, Instant now) throws QException
+   {
+      var date = full(definition.dateField());
+      WatchDefinition.require(date.getType() == QFieldType.DATE || date.getType() == QFieldType.DATE_TIME, "Choose a DATE or DATE_TIME field.");
+      WatchDefinition.require(!"HOUR".equals(definition.bucket()) || date.getType() == QFieldType.DATE_TIME, "HOUR requires a DATE_TIME field.");
+      if(definition.field() != null)
+      {
+         full(definition.field());
+      }
+      if(List.of("SUM", "AVG").contains(definition.metric()))
+      {
+         requireNumeric(definition.field());
+      }
+      validateFilter(filter);
+      ZonedDateTime end = boundary(now, definition.bucket());
+      ZonedDateTime start = move(end, definition.bucket(), -definition.k() - 1);
+      QQueryFilter window = DrillFilters.drill(table, filter, range(definition.dateField(), date.getType(), start, end)).getFilter();
+      GroupBy dateGroup = new GroupBy(date).withBucket(new DateBucket(DateBucketUnit.valueOf(definition.bucket())));
+      Aggregate count = measure(primaryKey(table), AggregateOperator.COUNT);
+      Aggregate metric = switch(definition.metric())
+      {
+         case "SUM" -> measure(definition.field(), AggregateOperator.SUM);
+         case "AVG" -> measure(definition.field(), AggregateOperator.AVG);
+         case "NULL_SHARE" -> measure(definition.field(), AggregateOperator.COUNT_NULL);
+         default -> count;
+      };
+      Aggregate nonNull = List.of("SUM", "AVG").contains(definition.metric()) ? measure(definition.field(), AggregateOperator.COUNT) : count;
+      AggregateInput input = new AggregateInput(table).withFilter(window).withGroupBy(dateGroup).withAggregate(count);
+      if(metric != count)
+      {
+         input.withAggregate(metric);
+      }
+      if(nonNull != count)
+      {
+         input.withAggregate(nonNull);
+      }
+      GroupBy category = "CATEGORY_SET".equals(definition.metric()) ? new GroupBy(full(definition.field())) : null;
+      if(category != null)
+      {
+         input.withGroupBy(category);
+      }
+      Map<String, List<AggregateResult>> grouped = new LinkedHashMap<>();
+      for(AggregateResult row : aggregate(input))
+      {
+         grouped.computeIfAbsent(key(row.getGroupByValues().get(dateGroup), definition.bucket()), ignored -> new ArrayList<>()).add(row);
+      }
+      List<WatchBucket> buckets = new ArrayList<>();
+      boolean seen = false;
+      for(ZonedDateTime at = start; at.isBefore(end); at = move(at, definition.bucket(), 1))
+      {
+         Serializable value = "HOUR".equals(definition.bucket()) ? at.toInstant() : at.toLocalDate();
+         List<AggregateResult> rows = grouped.getOrDefault(key(value, definition.bucket()), List.of());
+         seen |= !rows.isEmpty();
+         if(!seen)
+         {
+            continue;
+         }
+         long size = rows.stream().mapToLong(row -> ((Number) row.getAggregateValues().get(count)).longValue()).sum();
+         if(size < config.getMinGroupSize())
+         {
+            return (skipped("Privacy guard: a bucket is below the minimum group size."));
+         }
+         Set<String> categories = new LinkedHashSet<>();
+         if(category != null)
+         {
+            for(AggregateResult row : rows)
+            {
+               if(((Number) row.getAggregateValues().get(count)).longValue() < config.getMinGroupSize())
+               {
+                  return (skipped("Privacy guard: a category is below the minimum group size."));
+               }
+               Serializable member = row.getGroupByValues().get(category);
+               if(member != null)
+               {
+                  categories.add(member.toString());
+               }
+            }
+         }
+         if(nonNull != count && !rows.isEmpty() && ((Number) rows.getFirst().getAggregateValues().get(nonNull)).longValue() < config.getMinGroupSize())
+         {
+            return (skipped("Privacy guard: too few non-null values."));
+         }
+         Object raw = rows.isEmpty() ? null : rows.getFirst().getAggregateValues().get(metric);
+         if("NULL_SHARE".equals(definition.metric()) && raw != null)
+         {
+            long nulls = ((Number) raw).longValue();
+            if(nulls > 0 && nulls < config.getMinGroupSize() || size - nulls > 0 && size - nulls < config.getMinGroupSize())
+            {
+               return (skipped("Privacy guard: too few null or non-null values."));
+            }
+         }
+         Double number = switch(definition.metric())
+         {
+            case "COUNT" -> (double) size;
+            case "CATEGORY_SET" -> (double) categories.size();
+            case "NULL_SHARE" -> size == 0 ? null : ((Number) raw).doubleValue() / size;
+            case "SUM" -> rows.isEmpty() ? 0.0 : raw == null ? null : ((Number) raw).doubleValue();
+            default -> raw == null ? null : ((Number) raw).doubleValue();
+         };
+         buckets.add(new WatchBucket(value, number, categories, DrillFilters.drill(table, filter,
+            range(definition.dateField(), date.getType(), at, move(at, definition.bucket(), 1)))));
+      }
+      String label = switch(definition.metric())
+      {
+         case "COUNT" -> security.table(table).getLabel();
+         case "NULL_SHARE" -> "Null share of " + full(definition.field()).getLabel();
+         case "CATEGORY_SET" -> full(definition.field()).getLabel();
+         default -> ("SUM".equals(definition.metric()) ? "Sum of " : "Average ") + full(definition.field()).getLabel();
+      };
+      label += " per " + definition.bucket().toLowerCase(java.util.Locale.ROOT);
+      WatchVerdict verdict = WatchDetectors.evaluate(definition, buckets, label);
+      List<Point> points = buckets.stream().map(bucket -> new Point().withX(bucket.start())
+         .withY(bucket.value() == null ? null : BigDecimal.valueOf(bucket.value())).withDrill(bucket.drill())).toList();
+      List<String> annotations = new ArrayList<>();
+      if(verdict.baselineLow() != null)
+      {
+         annotations.add("Baseline band: " + verdict.baselineLow() + " to " + verdict.baselineHigh() + ".");
+      }
+      annotations.add(verdict.message());
+      Chart chart = new Chart().withKind(ChartKind.TIME_SERIES)
+         .withX(new Axis().withField(definition.dateField()).withLabel(date.getLabel()).withValueType(date.getType() == QFieldType.DATE ? ValueType.DATE : ValueType.DATE_TIME))
+         .withY(new Axis().withLabel(label).withValueType("NULL_SHARE".equals(definition.metric()) ? ValueType.PERCENT : ValueType.DECIMAL))
+         .withSeries(List.of(new Series().withName(label).withPoints(points))).withAnnotations(annotations);
+      return (new WatchPreview(buckets, chart, verdict));
+   }
+
+   /*******************************************************************************
+    ** No suppressed values, categories or drill predicates leave this computation.
+    *******************************************************************************/
+   public static WatchPreview skipped(String message)
+   {
+      return (new WatchPreview(List.of(), new Chart().withKind(ChartKind.TIME_SERIES).withAnnotations(List.of(message)), WatchVerdict.skipped(message)));
+   }
+
+   /*******************************************************************************
+    ** User-authored watch filters must also use FULL fields only.
+    *******************************************************************************/
+   private void validateFilter(QQueryFilter filter) throws QException
+   {
+      if(filter == null)
+      {
+         return;
+      }
+      for(var criterion : filter.getCriteria())
+      {
+         if(criterion.getFieldName() != null)
+         {
+            full(criterion.getFieldName());
+         }
+         if(criterion.getFieldFunction() != null)
+         {
+            full(criterion.getFieldFunction().getFieldName());
+         }
+      }
+      for(QQueryFilter child : filter.getSubFilters())
+      {
+         validateFilter(child);
+      }
+   }
+
+   /*******************************************************************************
+    ** Calendar boundaries follow the owner's time zone, including DST changes.
+    *******************************************************************************/
+   private static ZonedDateTime boundary(Instant now, String bucket)
+   {
+      ZonedDateTime local = now.atZone(ValueUtils.getSessionOrInstanceZoneId());
+      return (switch(bucket)
+      {
+         case "HOUR" -> local.truncatedTo(ChronoUnit.HOURS);
+         case "WEEK" -> local.toLocalDate().with(TemporalAdjusters.previousOrSame(java.time.DayOfWeek.MONDAY)).atStartOfDay(local.getZone());
+         case "MONTH" -> local.toLocalDate().withDayOfMonth(1).atStartOfDay(local.getZone());
+         default -> local.toLocalDate().atStartOfDay(local.getZone());
+      });
+   }
+
+   /*******************************************************************************
+    ** Advance on the calendar, rather than treating every day as 24 hours.
+    *******************************************************************************/
+   private static ZonedDateTime move(ZonedDateTime at, String bucket, int count)
+   {
+      return (switch(bucket)
+      {
+         case "HOUR" -> at.plusHours(count);
+         case "WEEK" -> at.plusWeeks(count);
+         case "MONTH" -> at.plusMonths(count);
+         default -> at.plusDays(count);
+      });
+   }
+
+   /*******************************************************************************
+    ** Keep DATE filters as dates and DATE_TIME filters as instants.
+    *******************************************************************************/
+   private static QQueryFilter range(String field, QFieldType type, ZonedDateTime start, ZonedDateTime end)
+   {
+      return (DrillFilters.range(field, type == QFieldType.DATE ? start.toLocalDate() : start.toInstant(),
+         type == QFieldType.DATE ? end.toLocalDate() : end.toInstant(), false));
+   }
+
+   /*******************************************************************************
+    ** Normalize core date-bucket keys independently of JDBC value representation.
+    *******************************************************************************/
+   private static String key(Serializable value, String bucket)
+   {
+      return ("HOUR".equals(bucket) ? ValueUtils.getValueAsInstant(value).toString() : ValueUtils.getValueAsLocalDate(value).toString());
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/watch/WatchVerdict.java

@@ -0,0 +1,38 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.watch;
+
+import com.kingsrook.qbits.dataanalysis.result.Drill;
+
+/*******************************************************************************
+ ** An unevaluated verdict must never resolve an existing alert.
+ *******************************************************************************/
+public record WatchVerdict(Boolean evaluated, Boolean firing, Double value, Double baseline,
+   Double baselineLow, Double baselineHigh, String message, Drill drill)
+{
+   /*******************************************************************************
+    ** Fail closed without retaining data or a drill.
+    *******************************************************************************/
+   public static WatchVerdict skipped(String message)
+   {
+      return (new WatchVerdict(false, false, null, null, null, null, message, null));
+   }
+}

src/main/resources/openapi/qqq-v1/data-analysis.yaml

@@ -118,6 +118,10 @@ components:
     DataAnalysisChartV1:
       nullable: true
       properties:
+        stacked:
+          description: "Stack category series to a total share of one when true."
+          nullable: true
+          type: "boolean"
         kind:
           description: "Semantic field kind: NUMERIC, DATE, DATE_TIME, TEXT, BOOLEAN\
             \ or CATEGORY."
@@ -273,6 +277,221 @@ components:
           description: "Chart."
           nullable: true
       type: "object"
+    DataAnalysisCompareRequestV1:
+      properties:
+        filterA:
+          $ref: "#/components/schemas/QueryFilter"
+          description: "Population A filter; null selects the whole permitted table."
+          nullable: true
+        filterB:
+          $ref: "#/components/schemas/QueryFilter"
+          description: "Population B filter; null selects the whole permitted table."
+          nullable: true
+        labelA:
+          description: "Display name of population A; default A."
+          type: "string"
+        labelB:
+          description: "Display name of population B; default B."
+          type: "string"
+        fields:
+          description: "Distinct FULL fields to analyze; correlation requires 2 to\
+            \ 12 numeric fields."
+          items:
+            type: "string"
+          type: "array"
+      required:
+      - "fields"
+      type: "object"
+    DataAnalysisCompareV1:
+      properties:
+        fields:
+          description: "Distinct FULL fields to analyze; correlation requires 2 to\
+            \ 12 numeric fields."
+          items:
+            $ref: "#/components/schemas/DataAnalysisFieldComparisonV1"
+          nullable: true
+          type: "array"
+      type: "object"
+    DataAnalysisComparisonSideV1:
+      properties:
+        label:
+          description: "Label."
+          nullable: true
+          type: "string"
+        metrics:
+          description: "Typed metrics with exact population drills unless privacy\
+            \ suppresses them."
+          items:
+            $ref: "#/components/schemas/DataAnalysisMetricV1"
+          nullable: true
+          type: "array"
+      type: "object"
+    DataAnalysisComparisonValueV1:
+      properties:
+        value:
+          description: "Value."
+          nullable: true
+        label:
+          description: "Label."
+          nullable: true
+          type: "string"
+        sideA:
+          $ref: "#/components/schemas/DataAnalysisComparisonSideV1"
+          description: "Side a."
+          nullable: true
+        sideB:
+          $ref: "#/components/schemas/DataAnalysisComparisonSideV1"
+          description: "Side b."
+          nullable: true
+        delta:
+          $ref: "#/components/schemas/DataAnalysisMetricV1"
+          description: "B minus A, in original units (share differences are fractions)."
+          nullable: true
+        percentDelta:
+          $ref: "#/components/schemas/DataAnalysisMetricV1"
+          description: "(B minus A) divided by absolute A, a fraction; null at a zero\
+            \ baseline."
+          nullable: true
+        significance:
+          $ref: "#/components/schemas/DataAnalysisSignificanceV1"
+          description: "Test assumptions, two-sided p-value, degrees of freedom and\
+            \ plain-language conclusion."
+          nullable: true
+      type: "object"
+    DataAnalysisCorrelationCellV1:
+      properties:
+        xField:
+          description: "FULL numeric field on the x axis."
+          nullable: true
+          type: "string"
+        yField:
+          description: "FULL numeric field on the y axis."
+          nullable: true
+          type: "string"
+        "n":
+          description: "Pairwise non-null population count; null when privacy suppresses\
+            \ it."
+          nullable: true
+          type: "integer"
+        r:
+          description: "Pearson correlation; null for insufficient data, zero variance\
+            \ or privacy suppression."
+          nullable: true
+          type: "number"
+        scatter:
+          $ref: "#/components/schemas/DataAnalysisScatterRequestV1"
+          description: "POST the included parameters to the table scatter endpoint."
+          nullable: true
+      type: "object"
+    DataAnalysisCorrelationRequestV1:
+      properties:
+        filter:
+          $ref: "#/components/schemas/QueryFilter"
+          description: "Current-user query filter; record locks and core field rules\
+            \ apply."
+          nullable: true
+        fields:
+          description: "Distinct FULL fields to analyze; correlation requires 2 to\
+            \ 12 numeric fields."
+          items:
+            type: "string"
+          type: "array"
+      required:
+      - "fields"
+      type: "object"
+    DataAnalysisCorrelationV1:
+      properties:
+        fields:
+          description: "Distinct FULL fields to analyze; correlation requires 2 to\
+            \ 12 numeric fields."
+          items:
+            type: "string"
+          nullable: true
+          type: "array"
+        cells:
+          description: "Cells."
+          items:
+            $ref: "#/components/schemas/DataAnalysisCorrelationCellV1"
+          nullable: true
+          type: "array"
+        chart:
+          $ref: "#/components/schemas/DataAnalysisChartV1"
+          description: "Semantic series; category comparisons are grouped and category\
+            \ time series are stacked."
+          nullable: true
+      type: "object"
+    DataAnalysisCrosstabCellV1:
+      properties:
+        rowIndex:
+          description: "Row index."
+          nullable: true
+          type: "integer"
+        columnIndex:
+          description: "Column index."
+          nullable: true
+          type: "integer"
+        count:
+          $ref: "#/components/schemas/DataAnalysisMetricV1"
+          description: "Cell count with its exact drill, or a suppressed metric."
+          nullable: true
+        rowShare:
+          $ref: "#/components/schemas/DataAnalysisMetricV1"
+          description: "Cell count divided by row total; suppressed if it could disclose\
+            \ a hidden cell."
+          nullable: true
+        columnShare:
+          $ref: "#/components/schemas/DataAnalysisMetricV1"
+          description: "Cell count divided by column total; suppressed if it could\
+            \ disclose a hidden cell."
+          nullable: true
+      type: "object"
+    DataAnalysisCrosstabRequestV1:
+      properties:
+        filter:
+          $ref: "#/components/schemas/QueryFilter"
+          description: "Current-user query filter; record locks and core field rules\
+            \ apply."
+          nullable: true
+        rowField:
+          description: "FULL field defining crosstab rows."
+          type: "string"
+        columnField:
+          description: "FULL field defining crosstab columns."
+          type: "string"
+        limit:
+          description: "Maximum sample points (1 to 2000, default 2000) or kept crosstab\
+            \ categories per axis (1 to 20, default 20)."
+          type: "integer"
+      required:
+      - "rowField"
+      - "columnField"
+      type: "object"
+    DataAnalysisCrosstabV1:
+      properties:
+        rows:
+          description: "Rows."
+          items:
+            $ref: "#/components/schemas/DataAnalysisPivotHeaderV1"
+          nullable: true
+          type: "array"
+        columns:
+          description: "Columns."
+          items:
+            $ref: "#/components/schemas/DataAnalysisPivotHeaderV1"
+          nullable: true
+          type: "array"
+        cells:
+          description: "Cells."
+          items:
+            $ref: "#/components/schemas/DataAnalysisCrosstabCellV1"
+          nullable: true
+          type: "array"
+        significance:
+          $ref: "#/components/schemas/DataAnalysisSignificanceV1"
+          description: "Test assumptions, two-sided p-value, degrees of freedom and\
+            \ plain-language conclusion."
+          nullable: true
+      type: "object"
     DataAnalysisDateProfileV1:
       nullable: true
       properties:
@@ -495,6 +714,29 @@ components:
           nullable: true
           type: "array"
       type: "object"
+    DataAnalysisFieldComparisonV1:
+      properties:
+        field:
+          description: "FULL field whose distribution is compared over time."
+          nullable: true
+          type: "string"
+        values:
+          description: "Values."
+          items:
+            $ref: "#/components/schemas/DataAnalysisComparisonValueV1"
+          nullable: true
+          type: "array"
+        significance:
+          $ref: "#/components/schemas/DataAnalysisSignificanceV1"
+          description: "Test assumptions, two-sided p-value, degrees of freedom and\
+            \ plain-language conclusion."
+          nullable: true
+        chart:
+          $ref: "#/components/schemas/DataAnalysisChartV1"
+          description: "Semantic series; category comparisons are grouped and category\
+            \ time series are stacked."
+          nullable: true
+      type: "object"
     DataAnalysisFieldSummaryV1:
       nullable: true
       properties:
@@ -638,6 +880,206 @@ components:
           nullable: true
           type: "array"
       type: "object"
+    DataAnalysisPivotCellV1:
+      properties:
+        rowIndex:
+          description: "Zero-based index in rowHeaders."
+          type: "integer"
+        columnIndex:
+          description: "Zero-based index in columnHeaders."
+          type: "integer"
+        values:
+          description: "Metrics in requested measure order; suppressed metrics have\
+            \ no value or drill."
+          items:
+            $ref: "#/components/schemas/DataAnalysisMetricV1"
+          type: "array"
+      type: "object"
+    DataAnalysisPivotDimensionV1:
+      properties:
+        field:
+          description: "FULL field name, optionally joinTable.field through an exposed\
+            \ join."
+          type: "string"
+        dateBucket:
+          description: "Optional calendar or cyclic bucket in the session timezone."
+          enum:
+          - "YEAR"
+          - "QUARTER"
+          - "MONTH"
+          - "WEEK"
+          - "DAY"
+          - "HOUR"
+          - "DAY_OF_WEEK"
+          - "HOUR_OF_DAY"
+          type: "string"
+        numericBins:
+          $ref: "#/components/schemas/DataAnalysisPivotNumericBinsV1"
+          description: "Optional equal-width numeric bins; mutually exclusive with\
+            \ dateBucket."
+      required:
+      - "field"
+      type: "object"
+    DataAnalysisPivotHeaderV1:
+      properties:
+        value:
+          description: "Typed group key; null for a blank group or Other."
+          nullable: true
+        label:
+          description: "Display label, including Other (k groups)."
+          type: "string"
+      type: "object"
+    DataAnalysisPivotMeasureInfoV1:
+      properties:
+        key:
+          description: "Stable measure key by request position."
+          type: "string"
+        label:
+          description: "Display label."
+          type: "string"
+        valueType:
+          description: "Semantic metric type."
+          enum:
+          - "COUNT"
+          - "DECIMAL"
+          - "PERCENT"
+          - "DATE"
+          - "DATE_TIME"
+          - "DURATION"
+          - "TEXT"
+          type: "string"
+      type: "object"
+    DataAnalysisPivotMeasureV1:
+      properties:
+        operator:
+          description: "Aggregate operator. COUNT counts records, including null values."
+          enum:
+          - "COUNT"
+          - "SUM"
+          - "AVG"
+          - "MIN"
+          - "MAX"
+          - "COUNT_DISTINCT"
+          - "PERCENTILE"
+          type: "string"
+        field:
+          description: "FULL field to aggregate; optional for COUNT."
+          type: "string"
+        percentile:
+          description: "PERCENTILE only: percentile_cont fraction from 0 to 1."
+          type: "number"
+      required:
+      - "operator"
+      type: "object"
+    DataAnalysisPivotNumericBinsV1:
+      properties:
+        count:
+          description: "Number of bins, 1–200; defaults to 20."
+          type: "integer"
+        min:
+          description: "Optional explicit lower bound; otherwise a nice enclosing\
+            \ edge."
+          type: "number"
+        max:
+          description: "Optional explicit upper bound; final interior bin includes\
+            \ this value."
+          type: "number"
+      type: "object"
+    DataAnalysisPivotRequestV1:
+      properties:
+        filter:
+          $ref: "#/components/schemas/QueryFilter"
+          description: "User query filter, passed through for core enforcement."
+        rows:
+          description: "One to three row dimensions."
+          items:
+            $ref: "#/components/schemas/DataAnalysisPivotDimensionV1"
+          type: "array"
+        columns:
+          description: "Zero to two column dimensions; defaults to empty."
+          items:
+            $ref: "#/components/schemas/DataAnalysisPivotDimensionV1"
+          type: "array"
+        values:
+          description: "One to six measures."
+          items:
+            $ref: "#/components/schemas/DataAnalysisPivotMeasureV1"
+          type: "array"
+        showTotals:
+          description: "Include row, column and grand totals; defaults to true."
+          type: "boolean"
+        limitGroups:
+          description: "Kept groups per dimension; default 50, maximum 200."
+          type: "integer"
+      required:
+      - "rows"
+      - "values"
+      type: "object"
+    DataAnalysisPivotV1:
+      properties:
+        rowHeaders:
+          description: "Row header tuples in cell-index order."
+          items:
+            items:
+              $ref: "#/components/schemas/DataAnalysisPivotHeaderV1"
+            type: "array"
+          type: "array"
+        columnHeaders:
+          description: "Column header tuples; an empty tuple represents no column\
+            \ dimensions."
+          items:
+            items:
+              $ref: "#/components/schemas/DataAnalysisPivotHeaderV1"
+            type: "array"
+          type: "array"
+        measures:
+          description: "Measure metadata in request order."
+          items:
+            $ref: "#/components/schemas/DataAnalysisPivotMeasureInfoV1"
+          type: "array"
+        cells:
+          description: "Sparse cells; absent combinations are not materialized."
+          items:
+            $ref: "#/components/schemas/DataAnalysisPivotCellV1"
+          type: "array"
+        rowTotals:
+          description: "Metric tuples aligned with rowHeaders; empty when totals disabled."
+          items:
+            items:
+              $ref: "#/components/schemas/DataAnalysisMetricV1"
+            type: "array"
+          type: "array"
+        columnTotals:
+          description: "Metric tuples aligned with columnHeaders; empty when totals\
+            \ disabled."
+          items:
+            items:
+              $ref: "#/components/schemas/DataAnalysisMetricV1"
+            type: "array"
+          type: "array"
+        grandTotals:
+          description: "Grand-total metrics; empty when totals disabled."
+          items:
+            $ref: "#/components/schemas/DataAnalysisMetricV1"
+          type: "array"
+        truncatedRows:
+          description: "Row groups were merged into Other."
+          type: "boolean"
+        truncatedColumns:
+          description: "Column groups were merged into Other."
+          type: "boolean"
+        estimate:
+          description: "True when bounded streamed fallback produced a partial result."
+          type: "boolean"
+        warnings:
+          description: "Privacy, partial-result and joined-drill limitations."
+          items:
+            type: "string"
+          type: "array"
+        asOf:
+          description: "UTC timestamp of computation."
+          type: "string"
+      type: "object"
     DataAnalysisPointV1:
       nullable: true
       properties:
@@ -712,6 +1154,68 @@ components:
           nullable: true
           type: "string"
       type: "object"
+    DataAnalysisScatterRequestV1:
+      properties:
+        tableName:
+          description: "Table for the scatter link; route parameter takes precedence."
+          nullable: true
+          type: "string"
+        exact:
+          description: "Compatibility flag; scatter always returns the bounded sample."
+          nullable: true
+          type: "boolean"
+        filter:
+          $ref: "#/components/schemas/QueryFilter"
+          description: "Current-user query filter; record locks and core field rules\
+            \ apply."
+          nullable: true
+        xField:
+          description: "FULL numeric field on the x axis."
+          type: "string"
+        yField:
+          description: "FULL numeric field on the y axis."
+          type: "string"
+        limit:
+          description: "Maximum sample points (1 to 2000, default 2000) or kept crosstab\
+            \ categories per axis (1 to 20, default 20)."
+          type: "integer"
+      required:
+      - "xField"
+      - "yField"
+      type: "object"
+    DataAnalysisScatterV1:
+      properties:
+        "n":
+          description: "Pairwise non-null population count; null when privacy suppresses\
+            \ it."
+          nullable: true
+          type: "integer"
+        sampleSize:
+          description: "Number of displayed paired records."
+          nullable: true
+          type: "integer"
+        sampling:
+          description: "Sampling method; core query currently uses a deterministic\
+            \ primary-key prefix."
+          nullable: true
+          type: "string"
+        points:
+          description: "Points."
+          items:
+            $ref: "#/components/schemas/DataAnalysisPointV1"
+          nullable: true
+          type: "array"
+        trend:
+          $ref: "#/components/schemas/DataAnalysisTrendLineV1"
+          description: "Least-squares slope, intercept and r fitted to the displayed\
+            \ sample."
+          nullable: true
+        chart:
+          $ref: "#/components/schemas/DataAnalysisChartV1"
+          description: "Semantic series; category comparisons are grouped and category\
+            \ time series are stacked."
+          nullable: true
+      type: "object"
     DataAnalysisSeriesV1:
       nullable: true
       properties:
@@ -726,6 +1230,105 @@ components:
           nullable: true
           type: "array"
       type: "object"
+    DataAnalysisShiftBucketV1:
+      properties:
+        value:
+          description: "Value."
+          nullable: true
+        label:
+          description: "Label."
+          nullable: true
+          type: "string"
+        complete:
+          description: "True when the calendar bucket end has passed in the session\
+            \ timezone."
+          nullable: true
+          type: "boolean"
+        metrics:
+          description: "Typed metrics with exact population drills unless privacy\
+            \ suppresses them."
+          items:
+            $ref: "#/components/schemas/DataAnalysisMetricV1"
+          nullable: true
+          type: "array"
+      type: "object"
+    DataAnalysisShiftRequestV1:
+      properties:
+        filter:
+          $ref: "#/components/schemas/QueryFilter"
+          description: "Current-user query filter; record locks and core field rules\
+            \ apply."
+          nullable: true
+        field:
+          description: "FULL field whose distribution is compared over time."
+          type: "string"
+        dateField:
+          description: "FULL DATE or DATE_TIME field for session-timezone calendar\
+            \ buckets."
+          type: "string"
+        bucket:
+          description: "Calendar unit: HOUR, DAY, WEEK, MONTH, QUARTER or YEAR; default\
+            \ MONTH."
+          type: "string"
+      required:
+      - "field"
+      - "dateField"
+      type: "object"
+    DataAnalysisShiftV1:
+      properties:
+        buckets:
+          description: "Buckets."
+          items:
+            $ref: "#/components/schemas/DataAnalysisShiftBucketV1"
+          nullable: true
+          type: "array"
+        psi:
+          $ref: "#/components/schemas/DataAnalysisMetricV1"
+          description: "Population stability index, null when inapplicable; zero shares\
+            \ are floored at 0.000001."
+          nullable: true
+        sentence:
+          description: "Plain-language result or reason the statistic is not applicable."
+          nullable: true
+          type: "string"
+        chart:
+          $ref: "#/components/schemas/DataAnalysisChartV1"
+          description: "Semantic series; category comparisons are grouped and category\
+            \ time series are stacked."
+          nullable: true
+      type: "object"
+    DataAnalysisSignificanceV1:
+      properties:
+        test:
+          description: "Test."
+          nullable: true
+          type: "string"
+        statistic:
+          description: "Statistic."
+          nullable: true
+          type: "number"
+        df:
+          description: "Degrees of freedom; null when undefined."
+          nullable: true
+          type: "number"
+        pValue:
+          description: "Two-sided p-value; p >= 0.05 is never significant."
+          nullable: true
+          type: "number"
+        applicable:
+          description: "Whether all test validity and privacy requirements hold."
+          nullable: true
+          type: "boolean"
+        sentence:
+          description: "Plain-language result or reason the statistic is not applicable."
+          nullable: true
+          type: "string"
+        cramersV:
+          description: "Cramer association strength computed on the pooled contingency\
+            \ table; null when invalid."
+          nullable: true
+          type: "number"
+      type: "object"
     DataAnalysisStartRunRequestV1:
       additionalProperties: false
       properties:
@@ -854,6 +1457,22 @@ components:
           nullable: true
           type: "integer"
       type: "object"
+    DataAnalysisTrendLineV1:
+      properties:
+        slope:
+          description: "Slope."
+          nullable: true
+          type: "number"
+        intercept:
+          description: "Intercept."
+          nullable: true
+          type: "number"
+        r:
+          description: "Pearson correlation; null for insufficient data, zero variance\
+            \ or privacy suppression."
+          nullable: true
+          type: "number"
+      type: "object"
     DataAnalysisValueCountV1:
       nullable: true
       properties:
@@ -884,6 +1503,60 @@ components:
             \ null when suppressed."
           nullable: true
       type: "object"
+    DataAnalysisWatchBucketV1:
+      properties:
+        start:
+          description: "Calendar date or hour-start instant in the user's time zone."
+          type: "string"
+        value:
+          nullable: true
+          type: "number"
+        categories:
+          items:
+            type: "string"
+          type: "array"
+        drill:
+          $ref: "#/components/schemas/DataAnalysisDrillV1"
+          nullable: true
+      type: "object"
+    DataAnalysisWatchPreviewV1:
+      properties:
+        series:
+          items:
+            $ref: "#/components/schemas/DataAnalysisWatchBucketV1"
+          type: "array"
+        chart:
+          $ref: "#/components/schemas/DataAnalysisChartV1"
+          description: "TIME_SERIES with baseline band annotations."
+        verdict:
+          $ref: "#/components/schemas/DataAnalysisWatchVerdictV1"
+      type: "object"
+    DataAnalysisWatchVerdictV1:
+      properties:
+        evaluated:
+          description: "False for insufficient history or privacy suppression; must\
+            \ not resolve an alert."
+          type: "boolean"
+        firing:
+          type: "boolean"
+        value:
+          nullable: true
+          type: "number"
+        baseline:
+          nullable: true
+          type: "number"
+        baselineLow:
+          nullable: true
+          type: "number"
+        baselineHigh:
+          nullable: true
+          type: "number"
+        message:
+          type: "string"
+        drill:
+          $ref: "#/components/schemas/DataAnalysisDrillV1"
+          nullable: true
+      type: "object"
     FilterCriteria:
       properties:
         fieldName:
@@ -966,10 +1639,10 @@ components:
 info:
   contact:
     email: "contact@kingsrook.com"
-  description: "Profiles, distinct values, duplicate groups and exact analysis runs\
-    \ as the signed-in user."
+  description: "Profiles, pivots, comparisons, distribution shifts, correlations,\
+    \ scatter samples, crosstabs and anomaly watch previews as the signed-in user."
   title: "QQQ Middleware API extension: data-analysis"
-  version: "1.0.0"
+  version: "1.3.0"
 openapi: "3.0.3"
 paths:
   /qqq/v1/qbit/data-analysis/tables/{table}/capabilities:
@@ -1051,6 +1724,206 @@ paths:
       - sessionUuidCookie:
         - "N/A"
       summary: "List distinct column values"
+  /qqq/v1/qbit/data-analysis/tables/{table}/compare:
+    post:
+      description: "Compare filtered A with filtered B (null means the whole permitted\
+        \ table). Return means, medians or category shares, B-minus-A deltas, valid\
+        \ significance tests and count-equivalent drills. Only FULL fields are accepted."
+      parameters:
+      - description: "QQQ table name to analyze."
+        in: "path"
+        name: "table"
+        required: true
+        schema:
+          type: "string"
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DataAnalysisCompareRequestV1"
+        required: true
+      responses:
+        200:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DataAnalysisCompareV1"
+          description: "Successful Response"
+      security:
+      - sessionUuidCookie:
+        - "N/A"
+      summary: "Compare two populations"
+  /qqq/v1/qbit/data-analysis/tables/{table}/shift:
+    post:
+      description: "Compare category shares or numeric quartiles across session-timezone\
+        \ calendar buckets. Compute descriptive PSI between the first and last complete\
+        \ nonempty buckets using fixed categories or baseline quartile bins."
+      parameters:
+      - description: "QQQ table name to analyze."
+        in: "path"
+        name: "table"
+        required: true
+        schema:
+          type: "string"
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DataAnalysisShiftRequestV1"
+        required: true
+      responses:
+        200:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DataAnalysisShiftV1"
+          description: "Successful Response"
+      security:
+      - sessionUuidCookie:
+        - "N/A"
+      summary: "Measure distribution shift over time"
+  /qqq/v1/qbit/data-analysis/tables/{table}/correlation:
+    post:
+      description: "Compute a Pearson correlation matrix for 2 to 12 distinct FULL\
+        \ numeric fields, using paired non-null records. Every cell includes n and\
+        \ parameters for the scatter endpoint; core pushes down CORR or uses bounded\
+        \ streaming."
+      parameters:
+      - description: "QQQ table name to analyze."
+        in: "path"
+        name: "table"
+        required: true
+        schema:
+          type: "string"
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DataAnalysisCorrelationRequestV1"
+        required: true
+      responses:
+        200:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DataAnalysisCorrelationV1"
+          description: "Successful Response"
+      security:
+      - sessionUuidCookie:
+        - "N/A"
+      summary: "Find numeric relationships"
+  /qqq/v1/qbit/data-analysis/tables/{table}/scatter:
+    post:
+      description: "Return at most 2000 paired numeric points as the user, ordered\
+        \ by primary key when core query sampling is unavailable, plus a least-squares\
+        \ line fitted to the sample. Privacy disables individual drills and suppresses\
+        \ small populations."
+      parameters:
+      - description: "QQQ table name to analyze."
+        in: "path"
+        name: "table"
+        required: true
+        schema:
+          type: "string"
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DataAnalysisScatterRequestV1"
+        required: true
+      responses:
+        200:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DataAnalysisScatterV1"
+          description: "Successful Response"
+      security:
+      - sessionUuidCookie:
+        - "N/A"
+      summary: "Inspect a numeric relationship"
+  /qqq/v1/qbit/data-analysis/tables/{table}/crosstab:
+    post:
+      description: "Count combinations of two FULL fields with row and column shares,\
+        \ up to 20 categories per axis plus Other. Test independence using chi-square\
+        \ and Cramer V after pooling low expected counts; privacy suppresses small\
+        \ cells and their drills."
+      parameters:
+      - description: "QQQ table name to analyze."
+        in: "path"
+        name: "table"
+        required: true
+        schema:
+          type: "string"
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DataAnalysisCrosstabRequestV1"
+        required: true
+      responses:
+        200:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DataAnalysisCrosstabV1"
+          description: "Successful Response"
+      security:
+      - sessionUuidCookie:
+        - "N/A"
+      summary: "Cross-tabulate two fields"
+  /qqq/v1/qbit/data-analysis/watches/{id}/preview:
+    post:
+      description: "Compute complete time buckets and a detector verdict under the\
+        \ signed-in user's READ, Analyze and FULL-field permissions. Includes a baseline\
+        \ band annotation. Does not update the watch or raise alerts."
+      parameters:
+      - description: "Owner-scoped analysis run or watch id."
+        in: "path"
+        name: "id"
+        required: true
+        schema:
+          type: "string"
+      responses:
+        200:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DataAnalysisWatchPreviewV1"
+          description: "Successful Response"
+      security:
+      - sessionUuidCookie:
+        - "N/A"
+      summary: "Preview an anomaly watch"
+  /qqq/v1/qbit/data-analysis/tables/{table}/pivot:
+    post:
+      description: "Group records by up to 3 row and 2 column fields (with date or\
+        \ numeric buckets) and compute counts, sums, averages, min/max, distinct counts\
+        \ or percentiles per cell; every cell has a drill-through filter."
+      parameters:
+      - description: "QQQ table name to analyze."
+        in: "path"
+        name: "table"
+        required: true
+        schema:
+          type: "string"
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DataAnalysisPivotRequestV1"
+        required: true
+      responses:
+        200:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DataAnalysisPivotV1"
+          description: "Successful Response"
+      security:
+      - sessionUuidCookie:
+        - "N/A"
+      summary: "Explore a pivot table"
   /qqq/v1/qbit/data-analysis/tables/{table}/table-profile:
     post:
       description: "Profile readable fields under a filter for completeness, uniqueness,\
@@ -1135,7 +2008,7 @@ paths:
         \ result of an owner-scoped run. Completed results are rechecked against current\
         \ permissions."
       parameters:
-      - description: "Owner-scoped analysis run id."
+      - description: "Owner-scoped analysis run or watch id."
         in: "path"
         name: "runId"
         required: true

src/test/java/com/kingsrook/qbits/dataanalysis/CoreAnalysisBackendTest.java

@@ -202,4 +202,28 @@ class CoreAnalysisBackendTest extends EngineFixture
          });
       }
    }
+
+   /*******************************************************************************
+    ** Core fallback limits never produce a falsely exact pivot drill.
+    *******************************************************************************/
+   @Test
+   void partialPivotDisablesDrills() throws Exception
+   {
+      capabilities(Set.of());
+      config.withDefaultMaxRows(3);
+      service.getConfigResolver().invalidate();
+      var request = new com.kingsrook.qbits.dataanalysis.result.PivotRequest().withTableName("orders")
+         .withRows(java.util.List.of(new com.kingsrook.qbits.dataanalysis.result.PivotDimension().withField("created")
+            .withDateBucket(com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.DateBucketUnit.DAY)))
+         .withValues(java.util.List.of(new com.kingsrook.qbits.dataanalysis.result.PivotMeasure().withField("amount")
+            .withOperator(com.kingsrook.qbits.dataanalysis.result.PivotMeasure.Operator.PERCENTILE).withPercentile(new java.math.BigDecimal("0.5"))));
+      var result = service.pivot(request);
+      assertThat(result.getEstimate()).isTrue();
+      assertThat(result.getWarnings()).anyMatch(w -> w.startsWith("Partial pivot"));
+      assertThat(result.getCells()).isNotEmpty().allSatisfy(c -> assertThat(c.getValues()).allSatisfy(m ->
+      {
+         assertThat(m.getDrill()).isNull();
+         assertThat(m.getEstimate()).isTrue();
+      }));
+   }
 }

src/test/java/com/kingsrook/qbits/dataanalysis/DataAnalysisApiTest.java

@@ -73,6 +73,10 @@ class DataAnalysisApiTest extends EngineFixture
             session.withPermission("orders.analyze");
          }
          session.withSecurityKeyValue("data_analysis_user", session.getUser().getIdReference());
+         if(session.getUuid().startsWith("watch-"))
+         {
+            session.getSecurityKeyValues().remove("data_analysis.admin");
+         }
       }
    }
 
@@ -169,7 +173,7 @@ class DataAnalysisApiTest extends EngineFixture
          assertThat(denied.getStatus()).isEqualTo(403);
          assertThat(run.path(operation.equals("COLUMN_PROFILE") ? "columnProfile" : "tableProfile").isObject()).isTrue();
       }
-      assertThat(invoker.listOperations().stream().filter(o -> o.pathTemplate().startsWith(DataAnalysisApi.PREFIX)).toList()).hasSize(7);
+      assertThat(invoker.listOperations().stream().filter(o -> o.pathTemplate().startsWith(DataAnalysisApi.PREFIX)).toList()).hasSize(14);
       var client = java.net.http.HttpClient.newHttpClient();
       var response = client.send(java.net.http.HttpRequest.newBuilder(java.net.URI.create("http://127.0.0.1:" + server.getBoundPort() + "/qqq/v1/openapi.json")).build(), java.net.http.HttpResponse.BodyHandlers.ofString());
       assertThat(response.statusCode()).isEqualTo(200);
@@ -255,7 +259,7 @@ class DataAnalysisApiTest extends EngineFixture
       call(HttpMethod.POST, "/runs", Map.of("operation", "PIVOT"), 400);
       call(HttpMethod.POST, "/runs", com.fasterxml.jackson.databind.node.NullNode.getInstance(), 400);
       call(HttpMethod.POST, "/tables/{table}/column-profile", Map.of("fieldName", "amount", "filter",
-         Map.of("criteria", List.of(Map.of("fieldName", "secret", "operator", "EQUALS", "values", List.of("hidden"))))), 400);
+         Map.of("criteria", List.of(Map.of("fieldName", "secret", "operator", "EQUALS", "values", List.of("hidden"))))), 403);
       var absent = invoker.invoke(new UiApiRequest().withMethod(HttpMethod.GET).withPath(DataAnalysisApi.PREFIX + "/tables/{table}/capabilities")
          .withPathParam("table", "missing").withSessionUUID(caller).withUserTimezone("America/Chicago"));
       assertThat(absent.getStatus()).isEqualTo(404);
@@ -269,7 +273,7 @@ class DataAnalysisApiTest extends EngineFixture
    }
 
    /*******************************************************************************
-    ** Generated fragment is committed verbatim and has only the seven operations.
+    ** Generated fragment is committed verbatim and has all fourteen operations.
     *******************************************************************************/
    @Test
    void contract() throws Exception
@@ -286,5 +290,166 @@ class DataAnalysisApiTest extends EngineFixture
       assertThat(Files.exists(path)).as("Regenerate with ./mvnw -o test -Dtest=DataAnalysisApiTest#contract -Dopenapi.write=true -Dqqq.snapshot.version=4.1.0-DATAANALYSIS-SNAPSHOT").isTrue();
       assertThat(Files.readString(path).replace("\r\n", "\n")).as("OpenAPI changed: regenerate with -Dopenapi.write=true").isEqualTo(yaml.replace("\r\n", "\n"));
    }
-}
+   @Test
+   void pivotHttp() throws Exception
+   {
+      start();
+      var body = Map.of("rows", List.of(Map.of("field", "status")), "columns", List.of(Map.of("field", "customer")),
+         "values", List.of(Map.of("operator", "COUNT")));
+      JsonNode result = call(HttpMethod.POST, "/tables/{table}/pivot", body, 200);
+      assertThat(result.path("cells").size()).isEqualTo(4);
+      checkDrills(result);
+      checkDrills(call(HttpMethod.POST, "/tables/{table}/pivot", Map.of("rows", List.of(Map.of("field", "paid")),
+         "values", List.of(Map.of("operator", "COUNT")), "limitGroups", 1), 200));
+      for(String field : List.of("note", "amount", "quantity"))
+      {
+         checkDrills(call(HttpMethod.POST, "/tables/{table}/pivot", Map.of("rows", List.of(Map.of("field", field)),
+            "values", List.of(Map.of("operator", "COUNT")), "limitGroups", 1), 200));
+      }
+      for(String unit : List.of("DAY", "HOUR", "DAY_OF_WEEK", "HOUR_OF_DAY"))
+      {
+         checkDrills(call(HttpMethod.POST, "/tables/{table}/pivot", Map.of("rows", List.of(Map.of("field", "created", "dateBucket", unit)),
+            "values", List.of(Map.of("operator", "COUNT"))), 200));
+      }
+      checkDrills(call(HttpMethod.POST, "/tables/{table}/pivot", Map.of("rows", List.of(Map.of("field", "amount", "numericBins", Map.of("count", 10))),
+         "values", List.of(Map.of("operator", "COUNT"))), 200));
+      for(String field : List.of("secret", "missing"))
+      {
+         call(HttpMethod.POST, "/tables/{table}/pivot", Map.of("rows", List.of(Map.of("field", field)), "values", List.of(Map.of("operator", "COUNT"))), 400);
+         call(HttpMethod.POST, "/tables/{table}/pivot", Map.of("rows", List.of(Map.of("field", "status")), "values", List.of(Map.of("operator", "MIN", "field", field))), 400);
+      }
+      call(HttpMethod.POST, "/tables/{table}/pivot", Map.of(), 400);
+      call(HttpMethod.POST, "/tables/{table}/pivot", Map.of("rows", "status", "values", List.of(Map.of("operator", "COUNT"))), 400);
+      call(HttpMethod.POST, "/tables/{table}/pivot", Map.of("rows", List.of(Map.of("field", "status")), "values", List.of(Map.of("operator", "COUNT")), "limitGroups", 1.5), 400);
+      caller = "denied";
+      call(HttpMethod.POST, "/tables/{table}/pivot", body, 403);
+   }
 
+   /*******************************************************************************
+    ** Exercise all five relationship endpoints and count drills.
+    *******************************************************************************/
+   @Test
+   void relationshipHttp() throws Exception
+   {
+      start();
+      JsonNode compare = call(HttpMethod.POST, "/tables/{table}/compare", Map.of("fields", List.of("amount", "status"), "labelA", "Selected", "labelB", "All"), 200);
+      assertThat(compare.path("fields").size()).isEqualTo(2);
+      assertThat(compare.path("fields").get(0).path("values").get(0).path("sideA").path("label").asText()).isEqualTo("Selected");
+      relationshipCountDrills(compare);
+      JsonNode shift = call(HttpMethod.POST, "/tables/{table}/shift", Map.of("field", "status", "dateField", "order_date", "bucket", "DAY"), 200);
+      assertThat(shift.path("psi").path("value").asDouble()).isZero();
+      relationshipCountDrills(shift);
+      JsonNode correlation = call(HttpMethod.POST, "/tables/{table}/correlation", Map.of("fields", List.of("amount", "quantity")), 200);
+      assertThat(correlation.path("cells").size()).isEqualTo(4);
+      assertThat(correlation.path("cells").get(1).path("n").asLong()).isEqualTo(11);
+      JsonNode scatter = call(HttpMethod.POST, "/tables/{table}/scatter", Map.of("xField", "id", "yField", "amount", "limit", 3), 200);
+      assertThat(scatter.path("sampleSize").asInt()).isEqualTo(3);
+      assertThat(scatter.path("trend").path("slope").asDouble()).isEqualTo(10);
+      for(JsonNode point : scatter.path("points"))
+      {
+         JsonNode drill = point.path("drill");
+         var response = invoker.invoke(new UiApiRequest().withMethod(HttpMethod.POST).withPath("/table/{tableName}/count")
+            .withPathParam("tableName", "orders").withJsonBody(Map.of("filter", drill.get("filter"))).withSessionUUID(caller));
+         assertThat(response.getStatus()).isEqualTo(200);
+         assertThat(response.getJson().path("count").asLong()).isEqualTo(1);
+      }
+      relationshipCountDrills(call(HttpMethod.POST, "/tables/{table}/crosstab", Map.of("rowField", "status", "columnField", "customer"), 200));
+      // All new schemas are discoverable from the same served OpenAPI catalog.
+      assertThat(com.kingsrook.qbits.dataanalysis.api.DataAnalysisApi.extension().getSemanticVersion()).isEqualTo("1.3.0");
+   }
+
+   /*******************************************************************************
+    ** Exercise all five relationship endpoints and count drills.
+    *******************************************************************************/
+   /*******************************************************************************
+    ** Verify strict request validation, privacy and authorization over HTTP.
+    *******************************************************************************/
+   @Test
+   void relationshipHttpErrorsAndPrivacy() throws Exception
+   {
+      config.withDefaultMinGroupSize(20);
+      instance.withSupplementalMetaData(new DataAnalysisRuntime(config));
+      start();
+      var requests = Map.of("compare", Map.of("fields", List.of("amount")), "shift", Map.of("field", "status", "dateField", "order_date"),
+         "correlation", Map.of("fields", List.of("amount", "quantity")), "scatter", Map.of("xField", "id", "yField", "amount"),
+         "crosstab", Map.of("rowField", "status", "columnField", "customer"));
+      assertThat(call(HttpMethod.POST, "/tables/{table}/scatter", requests.get("scatter"), 200).path("points").size()).isZero();
+      for(String field : List.of("secret", "missing"))
+      {
+         call(HttpMethod.POST, "/tables/{table}/compare", Map.of("fields", List.of(field)), 400);
+         call(HttpMethod.POST, "/tables/{table}/shift", Map.of("field", "status", "dateField", field), 400);
+         call(HttpMethod.POST, "/tables/{table}/correlation", Map.of("fields", List.of("id", field)), 400);
+         call(HttpMethod.POST, "/tables/{table}/scatter", Map.of("xField", "id", "yField", field), 400);
+         call(HttpMethod.POST, "/tables/{table}/crosstab", Map.of("rowField", "status", "columnField", field), 400);
+      }
+      call(HttpMethod.POST, "/tables/{table}/compare", Map.of("fields", "amount"), 400);
+      call(HttpMethod.POST, "/tables/{table}/compare", Map.of("fields", List.of("amount"), "filterA", "bad"), 400);
+      call(HttpMethod.POST, "/tables/{table}/compare", Map.of("fields", List.of("amount"), "labelA", 7), 400);
+      call(HttpMethod.POST, "/tables/{table}/scatter", Map.of("xField", "id", "yField", "amount", "limit", 2.5), 400);
+      call(HttpMethod.POST, "/tables/{table}/scatter", Map.of("xField", "id", "yField", "amount", "limit", 2001), 400);
+      call(HttpMethod.POST, "/tables/{table}/correlation", Map.of("fields", List.of("id")), 400);
+      call(HttpMethod.POST, "/tables/{table}/correlation", Map.of("fields", List.of("id", "id")), 400);
+      call(HttpMethod.POST, "/tables/{table}/shift", Map.of("field", "amount", "dateField", "order_date", "bucket", "BAD"), 400);
+      call(HttpMethod.POST, "/tables/{table}/crosstab", Map.of("rowField", "status", "columnField", "customer", "limit", 21), 400);
+      for(String operation : requests.keySet())
+      {
+         call(HttpMethod.POST, "/tables/{table}/" + operation, Map.of(), 400);
+      }
+      caller = "denied";
+      for(var request : requests.entrySet())
+      {
+         call(HttpMethod.POST, "/tables/{table}/" + request.getKey(), request.getValue(), 403);
+      }
+   }
+
+   /*******************************************************************************
+    ** Post each released count drill to the actual core count endpoint.
+    *******************************************************************************/
+   private void relationshipCountDrills(JsonNode node) throws Exception
+   {
+      if(node.path("valueType").asText().equals("COUNT"))
+      {
+         checkDrills(node);
+      }
+      else if(node.isContainerNode())
+      {
+         for(JsonNode child : node)
+         {
+            relationshipCountDrills(child);
+         }
+      }
+   }
+
+   @Test
+   void watchPreviewOverHttpIsReadOnlyAndOwnerLocked() throws Exception
+   {
+      caller = "watch-owner";
+      String owner = "User:" + Math.floorMod(caller.hashCode(), 10_000);
+      java.time.ZoneId zone = java.time.ZoneId.of("America/Chicago");
+      java.time.LocalDate today = java.time.LocalDate.now(zone);
+      for(int i = 0; i < 5; i++)
+      {
+         TestSupport.insert("orders", new com.kingsrook.qqq.backend.core.model.data.QRecord().withValue("id", 100 + i).withValue("customer", 1)
+            .withValue("created", today.minusDays(i < 2 ? 3 - i : 1).atTime(12, 0).atZone(zone).toInstant()));
+      }
+      var row = TestSupport.insert(com.kingsrook.qbits.dataanalysis.model.DataAnalysisTables.WATCH,
+         WatchDetectorsTest.definition("SPIKE", "COUNT", "{\"k\":2}").withValue("owner_user_id", owner));
+      start();
+      var request = new UiApiRequest().withMethod(HttpMethod.POST).withPath(DataAnalysisApi.PREFIX + "/watches/{id}/preview")
+         .withPathParam("id", row.getValueString("id")).withSessionUUID(caller).withUserTimezone("America/Chicago");
+      var response = invoker.invoke(request);
+      assertThat(response.getStatus()).as(response.getBody()).isEqualTo(200);
+      JsonNode json = response.getJson();
+      assertThat(json.path("series").size()).isEqualTo(3);
+      assertThat(json.path("verdict").path("firing").asBoolean()).isTrue();
+      assertThat(json.path("verdict").path("value").asDouble()).isEqualTo(3);
+      assertThat(json.path("chart").path("kind").asText()).isEqualTo("TIME_SERIES");
+      assertThat(json.path("chart").path("annotations").toString()).contains("Baseline band");
+      checkDrills(json);
+      assertThat(com.kingsrook.qbits.dataanalysis.watch.WatchRecords.get(com.kingsrook.qbits.dataanalysis.model.DataAnalysisTables.WATCH, row.getValue("id")).getValue("last_evaluated_at")).isNull();
+      assertThat(invoker.invoke(request.withSessionUUID("watch-outsider")).getStatus()).isEqualTo(404);
+      assertThat(invoker.invoke(request.withSessionUUID("denied")).getStatus()).isEqualTo(403);
+      assertThat(invoker.invoke(request.withSessionUUID(caller).withPathParam("id", "99999")).getStatus()).isEqualTo(404);
+      assertThat(invoker.invoke(request.withPathParam("id", "invalid")).getStatus()).isEqualTo(400);
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/DataAnalysisHomeTest.java

@@ -90,9 +90,9 @@ class DataAnalysisHomeTest
       TestSupport.insert(DataAnalysisTables.SAVED_STAR, new QRecord().withValue("saved_id", mine.getValue("id")).withValue("user_id", "alice"));
       TestSupport.insert(DataAnalysisTables.SAVED_STAR, new QRecord().withValue("saved_id", bob.getValue("id")).withValue("user_id", "alice"));
       TestSupport.insert(DataAnalysisTables.SAVED_STAR, new QRecord().withValue("saved_id", mine.getValue("id")).withValue("user_id", "bob"));
-      TestSupport.insert(DataAnalysisTables.WATCH, new QRecord().withValue("detector", "SPIKE").withValue("enabled", true).withValue("state", "FIRING"));
-      TestSupport.insert(DataAnalysisTables.WATCH, new QRecord().withValue("detector", "DROP").withValue("enabled", true));
-      TestSupport.insert(DataAnalysisTables.WATCH, new QRecord().withValue("detector", "DROP").withValue("enabled", false));
+      TestSupport.insert(DataAnalysisTables.WATCH, WatchDetectorsTest.definition("SPIKE", "COUNT", null).withValue("enabled", true).withValue("state", "FIRING"));
+      TestSupport.insert(DataAnalysisTables.WATCH, WatchDetectorsTest.definition("DROP", "COUNT", null).withValue("enabled", true));
+      TestSupport.insert(DataAnalysisTables.WATCH, WatchDetectorsTest.definition("DROP", "COUNT", null).withValue("enabled", false));
       run("alice", "COMPLETE", now);
       run("alice", "COMPLETE", now.minus(7, ChronoUnit.DAYS));
       run("alice", "FAILED", now.minus(1, ChronoUnit.DAYS));

src/test/java/com/kingsrook/qbits/dataanalysis/DataAnalysisMetadataTest.java

@@ -67,7 +67,7 @@ class DataAnalysisMetadataTest
       QInstance instance = TestSupport.instance();
       new QInstanceValidator().validate(instance);
       assertThat(instance.getTables()).containsOnlyKeys(DataAnalysisTables.ALL);
-      assertThat(instance.getPossibleValueSources().keySet().stream().filter(name -> name.startsWith("data_analysis_"))).hasSize(13);
+      assertThat(instance.getPossibleValueSources().keySet().stream().filter(name -> name.startsWith("data_analysis_"))).hasSize(16);
       assertThat(instance.getJoins()).hasSize(3);
       assertThat(instance.getWidgets()).hasSize(4).containsKey(DataAnalysisHome.HOME_WIDGET);
       assertThat(instance.getApp("dataAnalysis").getSections().getFirst().getProcesses()).isNullOrEmpty();
@@ -204,7 +204,7 @@ class DataAnalysisMetadataTest
       }
       assertThat(ddl).contains("id INTEGER GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY", "create_date TIMESTAMP WITHOUT TIME ZONE",
          "modify_date TIMESTAMP WITHOUT TIME ZONE", "rows_scanned BIGINT", "result_json TEXT", "shared BOOLEAN", "day INTEGER",
-         "owner_user_id VARCHAR(250) NOT NULL", "CREATE UNIQUE INDEX IF NOT EXISTS uq_data_analysis_table_config_1 ON data_analysis_table_config (table_name)",
+         "owner_user_id VARCHAR(250) NOT NULL", "date_field VARCHAR(250) NOT NULL", "last_value NUMERIC", "last_message TEXT", "CREATE UNIQUE INDEX IF NOT EXISTS uq_data_analysis_table_config_1 ON data_analysis_table_config (table_name)",
          "CREATE UNIQUE INDEX IF NOT EXISTS uq_data_analysis_saved_star_1 ON data_analysis_saved_star (saved_id, user_id)");
       assertThat(ddl).endsWith(";\n");
    }

src/test/java/com/kingsrook/qbits/dataanalysis/DataAnalysisPossibleValuesTest.java

@@ -0,0 +1,167 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.kingsrook.qbits.dataanalysis;
+
+
+import java.io.Serializable;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.dataanalysis.engine.EffectiveConfigResolver;
+import com.kingsrook.qbits.dataanalysis.model.DataAnalysisFieldPossibleValueProvider;
+import com.kingsrook.qbits.dataanalysis.model.DataAnalysisTables;
+import com.kingsrook.qqq.backend.core.actions.values.SearchPossibleValueSourceAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.model.actions.values.SearchPossibleValueSourceInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.PossibleValueSearchFilterUseCase;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValue;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValueSourceType;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+
+
+/*******************************************************************************
+ ** Dependent possible values through the same search inputs used by form requests.
+ *******************************************************************************/
+class DataAnalysisPossibleValuesTest
+{
+   /*******************************************************************************
+    ** Release the request context.
+    *******************************************************************************/
+   @AfterEach
+   void cleanup()
+   {
+      QContext.clear();
+   }
+
+
+
+   /*******************************************************************************
+    ** The watch table selection filters saved analyses without widening owner locks.
+    *******************************************************************************/
+   @Test
+   void watchSavedAnalysisDependsOnTable() throws Exception
+   {
+      QInstance instance = TestSupport.instance();
+      QRecord orders = TestSupport.insert(DataAnalysisTables.SAVED, TestSupport.saved("alice", false));
+      QRecord customers = TestSupport.insert(DataAnalysisTables.SAVED, TestSupport.saved("alice", false).withValue("table_name", "customers"));
+      TestSupport.insert(DataAnalysisTables.SAVED, TestSupport.saved("bob", true));
+      QContext.init(instance, TestSupport.user("alice").withPermissions("data_analysis.saved.read", "data_analysis.watch.edit"));
+      QFieldMetaData field = instance.getTable(DataAnalysisTables.WATCH).getField("saved_id");
+      assertThat(search(field, Map.of("table_name", "orders"))).extracting(value -> (Object) value.getId()).containsExactly(orders.getValueInteger("id"));
+      assertThat(search(field, Map.of("table_name", "customers"))).extracting(value -> (Object) value.getId()).containsExactly(customers.getValueInteger("id"));
+      assertThat(search(field, Map.of())).isEmpty();
+      assertThat(search(field, Map.of("table_name", "missing"))).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** All four table references use the core source, including host-owned sources.
+    *******************************************************************************/
+   @Test
+   void tableNamesUseCoreTablesSource() throws Exception
+   {
+      QInstance instance = TestSupport.instance();
+      instance.addTable(new QTableMetaData().withName("orders").withLabel("Orders"));
+      for(String tableName : List.of(DataAnalysisTables.TABLE_CONFIG, DataAnalysisTables.SAVED, DataAnalysisTables.WATCH, DataAnalysisTables.RUN))
+      {
+         QFieldMetaData field = instance.getTable(tableName).getField("table_name");
+         assertThat(field.getPossibleValueSourceName()).isEqualTo("tables");
+         assertThat(search(field, Map.of())).extracting(value -> value.getId().toString()).containsExactlyInAnyOrderElementsOf(instance.getTables().keySet());
+      }
+      var hostSource = instance.getPossibleValueSource("tables").withLabel("Host tables");
+      QInstance host = new QInstance();
+      host.addBackend(instance.getBackend("memory"));
+      host.addPossibleValueSource(hostSource);
+      new DataAnalysisQBitProducer().withQBitConfig(new DataAnalysisQBitConfig().withBackendName("memory")).produce(host);
+      assertThat(host.getPossibleValueSource("tables")).isSameAs(hostSource);
+      assertThat(host.getPossibleValueSource("tables").getLabel()).isEqualTo("Host tables");
+   }
+
+
+
+   /*******************************************************************************
+    ** Both CSV settings offer only selected-table fields and retain CSV parsing.
+    *******************************************************************************/
+   @Test
+   void fieldPickersDependOnTableAndKeepCsvStorage() throws Exception
+   {
+      QInstance instance = TestSupport.instance();
+      instance.addTable(new QTableMetaData().withName("orders").withLabel("Orders")
+         .withField(new QFieldMetaData("amount", QFieldType.DECIMAL).withLabel("Order total"))
+         .withField(new QFieldMetaData("status", QFieldType.STRING)));
+      instance.addTable(new QTableMetaData().withName("customers").withLabel("Customers")
+         .withField(new QFieldMetaData("email", QFieldType.STRING).withLabel("Email")));
+      for(String fieldName : List.of("analyzable_fields", "excluded_fields"))
+      {
+         QFieldMetaData field = instance.getTable(DataAnalysisTables.TABLE_CONFIG).getField(fieldName);
+         assertThat(field.getType()).isEqualTo(QFieldType.TEXT);
+         assertThat(instance.getPossibleValueSource(field.getPossibleValueSourceName()).getType()).isEqualTo(QPossibleValueSourceType.CUSTOM);
+         assertThat(search(field, Map.of("table_name", "orders"))).extracting(value -> (Object) value.getId()).containsExactly("amount", "status");
+         assertThat(search(field, Map.of("table_name", "orders"))).extracting(QPossibleValue::getLabel).containsExactly("Order total (amount)", "status (status)");
+         assertThat(search(field, Map.of("table_name", "customers"))).extracting(value -> (Object) value.getId()).containsExactly("email");
+         assertThat(search(field, Map.of())).isEmpty();
+         assertThat(search(field, Map.of("table_name", ""))).isEmpty();
+         assertThat(search(field, Map.of("table_name", "missing"))).isEmpty();
+         assertThat(search(field, null)).isEmpty();
+      }
+      SearchPossibleValueSourceInput input = new SearchPossibleValueSourceInput().withPossibleValueSourceName(DataAnalysisFieldPossibleValueProvider.NAME)
+         .withOtherValues(Map.of("table_name", "orders")).withSearchTerm("TOTAL");
+      assertThat(new SearchPossibleValueSourceAction().execute(input).getResults()).extracting(value -> (Object) value.getId()).containsExactly("amount");
+      input.withSearchTerm("AMOUNT");
+      assertThat(new SearchPossibleValueSourceAction().execute(input).getResults()).extracting(value -> (Object) value.getId()).containsExactly("amount");
+      input.withIdList(List.of("status", "email"));
+      assertThat(new SearchPossibleValueSourceAction().execute(input).getResults()).extracting(value -> (Object) value.getId()).containsExactly("status");
+      DataAnalysisFieldPossibleValueProvider provider = new DataAnalysisFieldPossibleValueProvider();
+      assertThat(provider.getPossibleValue(null)).isNull();
+      assertThat(provider.getPossibleValue("amount,status").getId()).isEqualTo("amount,status");
+      TestSupport.insert(DataAnalysisTables.TABLE_CONFIG, new QRecord().withValue("table_name", "orders")
+         .withValue("analyzable_fields", "amount, status").withValue("excluded_fields", "status, amount"));
+      var config = new EffectiveConfigResolver(new DataAnalysisQBitConfig().withBackendName("memory")).resolve("orders");
+      assertThat(config.getAnalyzableFields()).containsExactlyInAnyOrder("amount", "status");
+      assertThat(config.getExcludedFields()).containsExactlyInAnyOrder("amount", "status");
+   }
+
+
+
+   /*******************************************************************************
+    ** Mirror TablePossibleValuesSpecV1: clone and interpret the field filter as FORM.
+    *******************************************************************************/
+   private List<QPossibleValue<?>> search(QFieldMetaData field, Map<String, Serializable> otherValues) throws Exception
+   {
+      SearchPossibleValueSourceInput input = new SearchPossibleValueSourceInput()
+         .withPossibleValueSourceName(field.getPossibleValueSourceName()).withOtherValues(otherValues);
+      if(field.getPossibleValueSourceFilter() != null)
+      {
+         var filter = field.getPossibleValueSourceFilter().clone();
+         filter.interpretValues(Map.of("input", otherValues), PossibleValueSearchFilterUseCase.FORM);
+         input.withDefaultQueryFilter(filter);
+      }
+      return (new SearchPossibleValueSourceAction().execute(input).getResults());
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/EngineContractTest.java

@@ -61,7 +61,7 @@ import static org.assertj.core.api.Assertions.within;
 /*******************************************************************************
  ** Shared backend acceptance tests, including a generic drill equivalence walker.
  *******************************************************************************/
-abstract class EngineContractTest extends EngineFixture
+abstract class EngineContractTest extends RelationshipContractTest
 {
    /*******************************************************************************
     ** Every emitted key across all profile kinds has a label, on every backend.
@@ -249,7 +249,7 @@ abstract class EngineContractTest extends EngineFixture
    void permissionChecks() throws Exception
    {
       assertThat(service.capabilities("orders").getFields()).doesNotContain("secret");
-      assertThatThrownBy(() -> service.columnProfile(column("secret"))).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> service.columnProfile(column("secret"))).isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
       QContext.init(instance, TestSupport.user("alice").withPermission("orders.analyze"));
       assertThatThrownBy(() -> service.columnProfile(column("amount"))).isInstanceOf(QPermissionDeniedException.class);
       QContext.init(instance, TestSupport.user("alice").withPermission("orders.read"));
@@ -258,7 +258,7 @@ abstract class EngineContractTest extends EngineFixture
       config.withTableDefaults(Map.of("orders", new TableAnalysisDefaults().withExcludedFields(Set.of("amount"))));
       service.getConfigResolver().invalidate();
       assertThat(service.capabilities("orders").getFields()).doesNotContain("amount");
-      assertThatThrownBy(() -> service.columnProfile(column("amount"))).isInstanceOf(QPermissionDeniedException.class);
+      assertThatThrownBy(() -> service.columnProfile(column("amount"))).isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
       assertThatThrownBy(() -> service.capabilities("missing")).isInstanceOf(QPermissionDeniedException.class);
    }
 

src/test/java/com/kingsrook/qbits/dataanalysis/FieldAnalysisAccessTest.java

@@ -0,0 +1,244 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.util.List;
+import java.util.concurrent.atomic.AtomicReference;
+import com.kingsrook.qbits.dataanalysis.engine.CoreTierFieldAccessResolver;
+import com.kingsrook.qbits.dataanalysis.engine.DrillFilters;
+import com.kingsrook.qbits.dataanalysis.engine.FieldAnalysisAccess;
+import com.kingsrook.qbits.dataanalysis.engine.FieldAnalysisAccessResolver;
+import com.kingsrook.qbits.dataanalysis.engine.FieldSecurityLockFieldAccessResolver;
+import com.kingsrook.qbits.dataanalysis.result.DistinctValuesRequest;
+import com.kingsrook.qbits.dataanalysis.result.ValueCount;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfile;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfileRequest;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.PivotCell;
+import com.kingsrook.qbits.dataanalysis.result.PivotDimension;
+import com.kingsrook.qbits.dataanalysis.result.PivotMeasure;
+import com.kingsrook.qbits.dataanalysis.result.PivotRequest;
+import com.kingsrook.qbits.dataanalysis.result.PivotResult;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.assertj.core.api.Assertions.within;
+
+/*******************************************************************************
+ ** Exercise reflection without shadowing a future real core package on test classpaths.
+ *******************************************************************************/
+class FieldAnalysisAccessTest extends EngineFixture
+{
+   /*******************************************************************************
+    ** Test helper for field-access behavior.
+    *******************************************************************************/
+   public static class TierApi
+   {
+      static String tier = "FULL";
+      static boolean fail;
+      /*******************************************************************************
+       ** Verify or support the pivot and field-access contract.
+       *******************************************************************************/
+      public static String getTier(QTableMetaData table, String field)
+      {
+         if(fail)
+         {
+            throw new IllegalStateException("unavailable");
+         }
+         return (tier);
+      }
+      /*******************************************************************************
+       ** Verify or support the pivot and field-access contract.
+       *******************************************************************************/
+      public static String getAccessFingerprint()
+      {
+         if(fail)
+         {
+            throw new IllegalStateException("unavailable");
+         }
+         return ("policy-v1");
+      }
+   }
+
+   /*******************************************************************************
+    ** Test helper for field-access behavior.
+    *******************************************************************************/
+   public static class TierOnlyApi
+   {
+      /*******************************************************************************
+       ** Verify or support the pivot and field-access contract.
+       *******************************************************************************/
+      public static String getTier(QTableMetaData table, String field)
+      {
+         return ("FULL");
+      }
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void legacyFallbackAndReflectiveTierMapping() throws Exception
+   {
+      var table = instance.getTable("orders");
+      var fallback = new FieldSecurityLockFieldAccessResolver();
+      assertThat(fallback.resolve(table, table.getField("amount"))).isEqualTo(FieldAnalysisAccess.FULL);
+      assertThat(fallback.resolve(table, table.getField("secret"))).isEqualTo(FieldAnalysisAccess.NONE);
+      // The snapshot has no tier package. Test the actual default selection.
+      assertThat(CoreTierFieldAccessResolver.defaultResolver()).isInstanceOf(FieldSecurityLockFieldAccessResolver.class);
+      var resolver = new CoreTierFieldAccessResolver(TierApi.class);
+      try
+      {
+         for(String tier : List.of("FULL", "REVEALABLE", "MASKED", "HIDDEN", "UNKNOWN"))
+         {
+            TierApi.tier = tier;
+            assertThat(resolver.resolve(table, table.getField("amount"))).isEqualTo(tier.equals("FULL") ? FieldAnalysisAccess.FULL : tier.equals("REVEALABLE") ? FieldAnalysisAccess.EXACT_MATCH_ONLY : FieldAnalysisAccess.NONE);
+         }
+         assertThat(resolver.getAccessFingerprint()).isEqualTo("policy-v1");
+         TierApi.fail = true;
+         assertThat(resolver.resolve(table, table.getField("amount"))).isEqualTo(FieldAnalysisAccess.NONE);
+         assertThatThrownBy(resolver::getAccessFingerprint).isInstanceOf(IllegalStateException.class);
+         assertThat(new CoreTierFieldAccessResolver(TierOnlyApi.class).getAccessFingerprint()).isEmpty();
+      }
+      finally
+      {
+         TierApi.fail = false;
+         TierApi.tier = "FULL";
+      }
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void customPolicyAndUserFilterPassThrough() throws Exception
+   {
+      config.withFieldAnalysisAccessResolver(() -> (table, field) -> field.getName().equals("note") ? FieldAnalysisAccess.NONE
+         : field.getName().equals("paid") ? FieldAnalysisAccess.EXACT_MATCH_ONLY : new FieldSecurityLockFieldAccessResolver().resolve(table, field));
+      service = new DataAnalysisService(config, Runnable::run);
+      assertThat(service.capabilities("orders").getFields()).doesNotContain("note", "paid", "secret");
+      for(String field : List.of("note", "paid"))
+      {
+         assertThatThrownBy(() -> service.columnProfile(new ColumnProfileRequest().withTableName("orders").withFieldName(field)))
+            .isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
+         assertThatThrownBy(() -> service.pivot(new PivotRequest().withTableName("orders").withRows(List.of(new PivotDimension().withField(field)))
+            .withValues(List.of(new PivotMeasure().withOperator(PivotMeasure.Operator.COUNT)))))
+            .isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
+         assertThatThrownBy(() -> service.pivot(new PivotRequest().withTableName("orders").withRows(List.of(new PivotDimension().withField("status")))
+            .withValues(List.of(new PivotMeasure().withOperator(PivotMeasure.Operator.MIN).withField(field)))))
+            .isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
+      }
+      var request = new PivotRequest().withTableName("orders").withRows(List.of(new PivotDimension().withField("status")))
+         .withValues(List.of(new PivotMeasure().withOperator(PivotMeasure.Operator.COUNT)));
+      assertThat(JsonUtils.toJson(service.pivot(request))).doesNotContain("\"fieldName\":\"note\"", "\"fieldName\":\"paid\"");
+      var ownFilter = DrillFilters.condition("paid", QCriteriaOperator.EQUALS, true);
+      String before = JsonUtils.toJson(ownFilter);
+      PivotResult result = service.pivot(request.withFilter(ownFilter));
+      assertThat(JsonUtils.toJson(ownFilter)).isEqualTo(before);
+      assertThat(((Number)result.getGrandTotals().getFirst().getValue()).intValue()).isEqualTo(6);
+      for(PivotCell cell : result.getCells())
+      {
+         var drill = cell.getValues().getFirst().getDrill().getFilter();
+         assertThat(JsonUtils.toJson(drill.getSubFilters().getFirst())).isEqualTo(before);
+         assertThat(JsonUtils.toJson(drill.getSubFilters().get(1))).doesNotContain("paid", "note");
+      }
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void cacheMissesOnFieldTierAndCoreFingerprintChanges() throws Exception
+   {
+      AtomicReference<FieldAnalysisAccess> tier = new AtomicReference<>(FieldAnalysisAccess.FULL);
+      AtomicReference<String> fingerprint = new AtomicReference<>("first");
+      config.withFieldAnalysisAccessResolver(() -> new FieldAnalysisAccessResolver()
+      {
+         /*******************************************************************************
+          ** Verify or support the pivot and field-access contract.
+          *******************************************************************************/
+         @Override
+         public FieldAnalysisAccess resolve(QTableMetaData table, QFieldMetaData field)
+         {
+            return (field.getName().equals("quantity") ? tier.get() : new FieldSecurityLockFieldAccessResolver().resolve(table, field));
+         }
+         /*******************************************************************************
+          ** Verify or support the pivot and field-access contract.
+          *******************************************************************************/
+         @Override
+         public String getAccessFingerprint()
+         {
+            return (fingerprint.get());
+         }
+      });
+      service = new DataAnalysisService(config, Runnable::run);
+      ColumnProfileRequest request = new ColumnProfileRequest().withTableName("orders").withFieldName("amount").withExact(true);
+      String first = service.startExactRun(request);
+      assertThat(service.startExactRun(request)).isEqualTo(first);
+      tier.set(FieldAnalysisAccess.EXACT_MATCH_ONLY);
+      String second = service.startExactRun(request);
+      assertThat(second).isNotEqualTo(first);
+      assertThatThrownBy(() -> service.getRun(first)).isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException.class);
+      fingerprint.set("second");
+      assertThat(service.startExactRun(request)).isNotEqualTo(second);
+   }
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void generatedRepresentativeDrillsCannotUseRestrictedPrimaryKey() throws Exception
+   {
+      config.withFieldAnalysisAccessResolver(() -> (table, field) -> field.getName().equals("id") ? FieldAnalysisAccess.NONE
+         : new FieldSecurityLockFieldAccessResolver().resolve(table, field));
+      service = new DataAnalysisService(config, Runnable::run);
+      ColumnProfile profile = service.columnProfile(new ColumnProfileRequest().withTableName("orders").withFieldName("status").withExact(true));
+      Metric distinct = profile.getCounts().stream().filter(m -> m.getKey().equals("distinct")).findFirst().orElseThrow();
+      assertThat(distinct.getDrill()).isNull();
+      assertThat(profile.getCounts().getFirst().getDrill()).isNotNull();
+      var ownFilter = DrillFilters.condition("id", QCriteriaOperator.EQUALS, 1);
+      profile = service.columnProfile(new ColumnProfileRequest().withTableName("orders").withFieldName("status").withFilter(ownFilter).withExact(true));
+      assertThat(profile.getCounts().getFirst().getDrill()).isNotNull();
+      assertThat(JsonUtils.toJson(profile.getCounts().getFirst().getDrill())).contains("id");
+   }
+   /*******************************************************************************
+    ** Related label tiers must neither leak labels nor reuse a stale cache entry.
+    *******************************************************************************/
+   @Test
+   void relatedLabelTierChangesInvalidateCache() throws Exception
+   {
+      AtomicReference<FieldAnalysisAccess> tier = new AtomicReference<>(FieldAnalysisAccess.FULL);
+      config.withFieldAnalysisAccessResolver(() -> (table, field) -> table.getName().equals("customer") && field.getName().equals("name")
+         ? tier.get() : new FieldSecurityLockFieldAccessResolver().resolve(table, field));
+      service = new DataAnalysisService(config, Runnable::run);
+      ColumnProfileRequest request = new ColumnProfileRequest().withTableName("orders").withFieldName("customer").withExact(true);
+      String first = service.startExactRun(request);
+      assertThat(service.columnProfile(request).getTopValues()).extracting(ValueCount::getLabel).contains("Alice Co");
+      tier.set(FieldAnalysisAccess.NONE);
+      assertThat(service.startExactRun(request)).isNotEqualTo(first);
+      assertThat(service.columnProfile(request).getTopValues()).extracting(ValueCount::getLabel).containsExactly("1", "2");
+      assertThat(service.distinctValues(new DistinctValuesRequest().withTableName("orders").withFieldName("customer")).getValues()).extracting(ValueCount::getLabel).containsExactly("1", "2");
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/PivotContractTest.java

@@ -0,0 +1,368 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.math.BigDecimal;
+import java.util.List;
+import java.util.ArrayList;
+import com.kingsrook.qbits.dataanalysis.result.Drill;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.PivotCell;
+import com.kingsrook.qbits.dataanalysis.result.PivotDimension;
+import com.kingsrook.qbits.dataanalysis.result.PivotHeader;
+import com.kingsrook.qbits.dataanalysis.result.PivotMeasure;
+import com.kingsrook.qbits.dataanalysis.result.PivotNumericBins;
+import com.kingsrook.qbits.dataanalysis.result.PivotRequest;
+import com.kingsrook.qbits.dataanalysis.result.PivotResult;
+import com.kingsrook.qbits.dataanalysis.result.ValueType;
+import com.kingsrook.qbits.dataanalysis.engine.DrillFilters;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.CountAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.DateBucketUnit;
+import com.kingsrook.qqq.backend.core.model.metadata.joins.QJoinMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.joins.JoinOn;
+import com.kingsrook.qqq.backend.core.model.metadata.joins.JoinType;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.ExposedJoin;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.assertj.core.api.Assertions.within;
+
+/*******************************************************************************
+ ** Pivot contract inherited by every existing backend test configuration.
+ *******************************************************************************/
+abstract class PivotContractTest extends EngineFixture
+{
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   protected PivotDimension dimension(String field)
+   {
+      return (new PivotDimension().withField(field));
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   protected PivotMeasure measure(PivotMeasure.Operator operator, String field)
+   {
+      return (new PivotMeasure().withOperator(operator).withField(field));
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   protected PivotRequest pivot(List<String> rows, List<String> columns)
+   {
+      return (new PivotRequest().withTableName("orders").withRows(rows.stream().map(this::dimension).toList())
+         .withColumns(columns.stream().map(this::dimension).toList()).withValues(List.of(measure(PivotMeasure.Operator.COUNT, null))));
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   private void equalNumber(Metric metric, String value)
+   {
+      assertThat(new BigDecimal(metric.getValue().toString())).isEqualByComparingTo(value);
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   protected void countDrills(PivotResult result) throws Exception
+   {
+      List<List<Metric>> groups = new ArrayList<>(result.getRowTotals());
+      groups.addAll(result.getColumnTotals());
+      groups.add(result.getGrandTotals());
+      result.getCells().forEach(c -> groups.add(c.getValues()));
+      for(List<Metric> metrics : groups)
+      {
+         for(Metric metric : metrics)
+         {
+            if(metric.getKey().equals("value0") && !metric.getSuppressed())
+            {
+               assertThat(metric.getDrill()).isNotNull();
+               Drill drill = JsonUtils.toObject(JsonUtils.toJson(metric.getDrill()), Drill.class);
+               CountInput input = new CountInput(drill.getTableName()).withFilter(drill.getFilter());
+               input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+               assertThat(new CountAction().execute(input).getCount()).as(JsonUtils.toJson(drill)).isEqualTo(((Number) metric.getValue()).intValue());
+               QueryInput query = new QueryInput(drill.getTableName()).withFilter(drill.getFilter());
+               query.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+               assertThat(new QueryAction().execute(query).getRecords()).as(JsonUtils.toJson(drill)).hasSize(((Number) metric.getValue()).intValue());
+            }
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void pivotShapesAndTotals() throws Exception
+   {
+      for(PivotRequest request : List.of(pivot(List.of("status"), List.of("customer")), pivot(List.of("status", "paid"), List.of("customer")),
+         pivot(List.of("status"), List.of("customer", "paid"))))
+      {
+         PivotResult result = service.pivot(request);
+         equalNumber(result.getGrandTotals().getFirst(), "12");
+         assertThat(result.getCells().stream().mapToLong(c -> ((Number)c.getValues().getFirst().getValue()).longValue()).sum()).isEqualTo(12);
+         countDrills(result);
+      }
+      PivotResult result = service.pivot(pivot(List.of("status"), List.of("customer")));
+      assertThat(result.getCells()).hasSize(4);
+      assertThat(result.getCells()).allSatisfy(c -> assertThat(((Number)c.getValues().getFirst().getValue()).longValue()).isIn(2L, 4L));
+      assertThat(result.getRowTotals()).allSatisfy(m -> equalNumber(m.getFirst(), "6"));
+      result = service.pivot(pivot(List.of("status"), List.of()).withShowTotals(false));
+      assertThat(result.getGrandTotals()).isEmpty();
+      assertThat(result.getRowTotals()).isEmpty();
+      assertThat(result.getColumnHeaders()).containsExactly(List.of());
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void pivotOtherAndNonAdditiveMeasures() throws Exception
+   {
+      PivotRequest request = pivot(List.of("quantity"), List.of("status")).withLimitGroups(1).withValues(List.of(
+         measure(PivotMeasure.Operator.COUNT, null), measure(PivotMeasure.Operator.SUM, "amount"), measure(PivotMeasure.Operator.AVG, "amount"),
+         measure(PivotMeasure.Operator.COUNT_DISTINCT, "amount"), measure(PivotMeasure.Operator.PERCENTILE, "amount").withPercentile(new BigDecimal("0.5"))));
+      PivotResult result = service.pivot(request);
+      assertThat(result.getTruncatedRows()).isTrue();
+      assertThat(result.getTruncatedColumns()).isTrue();
+      assertThat(result.getRowHeaders().stream().flatMap(List::stream).map(PivotHeader::getLabel)).anyMatch(l -> l.equals("Other (5 groups)"));
+      equalNumber(result.getGrandTotals().get(1), "1170");
+      equalNumber(result.getGrandTotals().get(3), "8");
+      equalNumber(result.getGrandTotals().get(4), "20");
+      countDrills(result);
+      for(PivotCell cell : result.getCells())
+      {
+         var input = new com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput("orders").withFilter(cell.getValues().getFirst().getDrill().getFilter());
+         input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+         var numbers = new com.kingsrook.qqq.backend.core.actions.tables.QueryAction().execute(input).getRecords().stream().map(r -> r.getValueBigDecimal("amount"))
+            .filter(java.util.Objects::nonNull).sorted().toList();
+         BigDecimal sum = numbers.stream().reduce(BigDecimal.ZERO, BigDecimal::add);
+         equalNumber(cell.getValues().get(1), sum.toString());
+         assertThat(new BigDecimal(cell.getValues().get(2).getValue().toString()).doubleValue()).isCloseTo(sum.doubleValue() / numbers.size(), within(0.000000001));
+         equalNumber(cell.getValues().get(3), Long.toString(numbers.stream().map(BigDecimal::stripTrailingZeros).distinct().count()));
+         BigDecimal median = numbers.size() % 2 == 1 ? numbers.get(numbers.size() / 2) : numbers.get(numbers.size() / 2 - 1).add(numbers.get(numbers.size() / 2)).divide(BigDecimal.valueOf(2));
+         equalNumber(cell.getValues().get(4), median.toString());
+      }
+      for(String field : List.of("paid", "note", "amount"))
+      {
+         countDrills(service.pivot(pivot(List.of(field), List.of()).withLimitGroups(1)));
+      }
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void pivotBuckets() throws Exception
+   {
+      for(DateBucketUnit unit : DateBucketUnit.values())
+      {
+         PivotRequest request = pivot(List.of("created"), List.of("status")).withRows(List.of(dimension("created").withDateBucket(unit)));
+         PivotResult result = service.pivot(request);
+         equalNumber(result.getGrandTotals().getFirst(), "12");
+         countDrills(result);
+      }
+      PivotResult dates = service.pivot(pivot(List.of("order_date"), List.of("status")).withRows(List.of(dimension("order_date").withDateBucket(DateBucketUnit.DAY))));
+      assertThat(dates.getCells()).hasSize(4);
+      countDrills(dates);
+      for(PivotNumericBins bins : List.of(new PivotNumericBins().withCount(4).withMin(BigDecimal.ZERO).withMax(BigDecimal.valueOf(40)), new PivotNumericBins().withCount(10)))
+      {
+         countDrills(service.pivot(pivot(List.of("amount"), List.of("status")).withRows(List.of(dimension("amount").withNumericBins(bins)))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void pivotPrivacyAndUserFilter() throws Exception
+   {
+      config.withDefaultMinGroupSize(3);
+      service.getConfigResolver().invalidate();
+      PivotResult result = service.pivot(pivot(List.of("status"), List.of("customer")).withValues(List.of(measure(PivotMeasure.Operator.COUNT, null), measure(PivotMeasure.Operator.SUM, "amount"))));
+      assertThat(result.getCells().stream().filter(c -> c.getValues().getFirst().getSuppressed())).hasSize(2);
+      result.getCells().stream().filter(c -> c.getValues().getFirst().getSuppressed()).forEach(c -> assertThat(c.getValues()).allSatisfy(m ->
+      {
+         assertThat(m.getValue()).isNull();
+         assertThat(m.getDrill()).isNull();
+      }));
+      assertThat(service.pivot(pivot(List.of("quantity"), List.of())).getRowHeaders()).isEmpty();
+      config.withDefaultMinGroupSize(0);
+      service.getConfigResolver().invalidate();
+      var filter = DrillFilters.condition("customer", QCriteriaOperator.EQUALS, 1);
+      String before = JsonUtils.toJson(filter);
+      result = service.pivot(pivot(List.of("status"), List.of()).withFilter(filter));
+      equalNumber(result.getGrandTotals().getFirst(), "8");
+      assertThat(JsonUtils.toJson(filter)).isEqualTo(before);
+      countDrills(result);
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void pivotJoinedDimensionAndPermissions() throws Exception
+   {
+      instance.addJoin(new QJoinMetaData().withName("ordersCustomer").withLeftTable("orders").withRightTable("customer")
+         .withType(JoinType.MANY_TO_ONE).withJoinOn(new JoinOn("customer", "id")));
+      instance.getTable("orders").withExposedJoin(new ExposedJoin().withJoinTable("customer").withJoinPath(List.of("ordersCustomer")));
+      PivotResult result = service.pivot(pivot(List.of("customer.name"), List.of("status")));
+      assertThat(result.getRowHeaders().stream().flatMap(List::stream).map(PivotHeader::getValue)).containsExactlyInAnyOrder("Alice Co", "Bob Co");
+      equalNumber(result.getGrandTotals().getFirst(), "12");
+      assertThat(result.getWarnings()).isEmpty();
+      assertThat(result.getCells()).allSatisfy(c -> assertThat(JsonUtils.toJson(c.getValues().getFirst().getDrill())).contains("customer.name"));
+      countDrills(result);
+      countDrills(service.pivot(pivot(List.of("customer.name"), List.of("status")).withLimitGroups(1)
+         .withFilter(DrillFilters.condition("paid", QCriteriaOperator.EQUALS, true))));
+      instance.getJoins().put("ordersCustomer", instance.getJoin("ordersCustomer").flip());
+      countDrills(service.pivot(pivot(List.of("customer.name"), List.of("status"))));
+      QContext.getQSession().getPermissions().remove("customer.read");
+      assertThatThrownBy(() -> service.pivot(pivot(List.of("customer.name"), List.of()))).isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
+   }
+
+   /*******************************************************************************
+    ** Reversing a many-to-one join multiplies records and disables every drill.
+    *******************************************************************************/
+   @Test
+   void pivotToManyDimension() throws Exception
+   {
+      instance.addJoin(new QJoinMetaData().withName("ordersCustomer").withLeftTable("orders").withRightTable("customer")
+         .withType(JoinType.MANY_TO_ONE).withJoinOn(new JoinOn("customer", "id")));
+      instance.getTable("customer").withExposedJoin(new ExposedJoin().withJoinTable("orders").withJoinPath(List.of("ordersCustomer")));
+      QContext.getQSession().getPermissions().add("customer.analyze");
+      for(int direction = 0; direction < 2; direction++)
+      {
+         PivotResult result = service.pivot(pivot(List.of("orders.status"), List.of()).withTableName("customer"));
+         equalNumber(result.getGrandTotals().getFirst(), "12");
+         assertThat(result.getWarnings()).containsExactly("Counts include one row per related " + instance.getTable("orders").getLabel()
+            + "; drill-through is not available for this dimension.");
+         assertThat(result.getCells()).allSatisfy(c -> assertThat(c.getValues()).allSatisfy(m -> assertThat(m.getDrill()).isNull()));
+         assertThat(result.getRowTotals()).allSatisfy(metrics -> assertThat(metrics).allSatisfy(m -> assertThat(m.getDrill()).isNull()));
+         assertThat(result.getColumnTotals()).allSatisfy(metrics -> assertThat(metrics).allSatisfy(m -> assertThat(m.getDrill()).isNull()));
+         assertThat(result.getGrandTotals()).allSatisfy(m -> assertThat(m.getDrill()).isNull());
+         instance.getJoins().put("ordersCustomer", instance.getJoin("ordersCustomer").flip());
+      }
+   }
+
+   /*******************************************************************************
+    ** Every hop must be to-one, including hops preceding a one-to-one target.
+    *******************************************************************************/
+   @Test
+   void pivotMultiHopDimension() throws Exception
+   {
+      instance.addTable(new com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData().withName("region").withLabel("Region")
+         .withBackendName(instance.getTable("customer").getBackendName()).withPrimaryKeyField("id")
+         .withField(new com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData("id", com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType.INTEGER))
+         .withField(new com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData("name", com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType.STRING)));
+      if(connection != null)
+      {
+         try(var statement = connection.createStatement())
+         {
+            statement.execute("DROP TABLE IF EXISTS region");
+            statement.execute("CREATE TABLE region (id INTEGER PRIMARY KEY, name VARCHAR(100))");
+         }
+      }
+      new com.kingsrook.qqq.backend.core.instances.QInstanceEnricher(instance).enrich();
+      TestSupport.insert("region", new com.kingsrook.qqq.backend.core.model.data.QRecord().withValue("id", 1).withValue("name", "East"));
+      TestSupport.insert("region", new com.kingsrook.qqq.backend.core.model.data.QRecord().withValue("id", 2).withValue("name", "West"));
+      instance.addJoin(new QJoinMetaData().withName("ordersCustomer").withLeftTable("orders").withRightTable("customer")
+         .withType(JoinType.MANY_TO_ONE).withJoinOn(new JoinOn("customer", "id")));
+      instance.addJoin(new QJoinMetaData().withName("customerRegion").withLeftTable("region").withRightTable("customer")
+         .withType(JoinType.ONE_TO_ONE).withJoinOn(new JoinOn("id", "id")));
+      instance.getTable("orders").withExposedJoin(new ExposedJoin().withJoinTable("region").withJoinPath(List.of("ordersCustomer", "customerRegion")));
+      PivotResult result = service.pivot(pivot(List.of("region.name"), List.of("status")));
+      assertThat(result.getWarnings()).containsExactly("Drill-through is not available for fields reached through more than one join (Region).");
+      assertThat(result.getCells()).allSatisfy(c -> assertThat(c.getValues().getFirst().getDrill()).isNull());
+      instance.getJoin("ordersCustomer").withType(JoinType.MANY_TO_MANY);
+      result = service.pivot(pivot(List.of("region.name"), List.of("status")));
+      assertThat(result.getWarnings()).containsExactly("Counts include one row per related Region; drill-through is not available for this dimension.");
+      assertThat(result.getCells()).allSatisfy(c -> assertThat(c.getValues().getFirst().getDrill()).isNull());
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void pivotValidation() throws Exception
+   {
+      for(String field : List.of("secret", "missing", "missing.field"))
+      {
+         assertThatThrownBy(() -> service.pivot(pivot(List.of(field), List.of()))).isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
+         assertThatThrownBy(() -> service.pivot(pivot(List.of("status"), List.of()).withValues(List.of(measure(PivotMeasure.Operator.MIN, field)))))
+            .isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
+      }
+      for(PivotRequest bad : List.of(pivot(List.of(), List.of()), pivot(List.of("status"), List.of()).withLimitGroups(201),
+         pivot(List.of("status"), List.of("status")), pivot(List.of("status"), List.of()).withRows(List.of(dimension("status").withDateBucket(DateBucketUnit.YEAR))),
+         pivot(List.of("status"), List.of()).withValues(List.of(measure(PivotMeasure.Operator.PERCENTILE, "amount").withPercentile(BigDecimal.TEN)))))
+      {
+         assertThatThrownBy(() -> service.pivot(bad)).isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
+      }
+   }
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void pivotTypedExtremesAndEmptyScope() throws Exception
+   {
+      PivotResult result = service.pivot(pivot(List.of("status"), List.of()).withValues(List.of(measure(PivotMeasure.Operator.COUNT, "amount"),
+         measure(PivotMeasure.Operator.MIN, "order_date"), measure(PivotMeasure.Operator.MAX, "created"), measure(PivotMeasure.Operator.MIN, "amount"),
+         measure(PivotMeasure.Operator.MAX, "amount"))));
+      equalNumber(result.getGrandTotals().getFirst(), "12");
+      equalNumber(result.getGrandTotals().get(3), "-10");
+      equalNumber(result.getGrandTotals().get(4), "1000");
+      assertThat(result.getGrandTotals().get(1).getValueType()).isEqualTo(ValueType.DATE);
+      assertThat(result.getGrandTotals().get(2).getValueType()).isEqualTo(ValueType.DATE_TIME);
+      countDrills(result);
+      result = service.pivot(pivot(List.of("status"), List.of()).withFilter(DrillFilters.condition("id", QCriteriaOperator.EQUALS, -1)));
+      assertThat(result.getCells()).isEmpty();
+      equalNumber(result.getGrandTotals().getFirst(), "0");
+      countDrills(result);
+   }
+
+   @Test
+   void booleanHeadersAndHumanMeasureLabels() throws Exception
+   {
+      var booleans = service.pivot(pivot(List.of("paid"), List.of("status")));
+      assertThat(booleans.getRowHeaders().stream().flatMap(List::stream).map(PivotHeader::getLabel)).containsExactlyInAnyOrder("Yes", "No", "(Blank)");
+      assertThat(booleans.getMeasures().getFirst().getLabel()).isEqualTo("Count");
+      var operators = List.of(PivotMeasure.Operator.AVG, PivotMeasure.Operator.SUM, PivotMeasure.Operator.COUNT_DISTINCT,
+         PivotMeasure.Operator.MIN, PivotMeasure.Operator.MAX, PivotMeasure.Operator.PERCENTILE);
+      var measures = operators.stream().map(operator -> measure(operator, "amount")).toList();
+      measures.getLast().withPercentile(new BigDecimal("0.5"));
+      var result = service.pivot(pivot(List.of("paid"), List.of()).withValues(measures));
+      assertThat(result.getMeasures().stream().map(m -> m.getLabel())).containsExactly("Average Amount", "Sum of Amount", "Distinct Amount", "Minimum Amount", "Maximum Amount", "Median Amount");
+      measures.getLast().withPercentile(new BigDecimal("0.9"));
+      assertThat(service.pivot(pivot(List.of("paid"), List.of()).withValues(measures)).getMeasures().getLast().getLabel()).isEqualTo("90th percentile of Amount");
+      var cross = service.crosstab(new com.kingsrook.qbits.dataanalysis.result.CrosstabRequest().withTableName("orders").withRowField("paid").withColumnField("status"));
+      assertThat(cross.getRows().stream().map(PivotHeader::getLabel)).containsExactlyInAnyOrder("Yes", "No", "(Blank)");
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/RelationshipContractTest.java

@@ -0,0 +1,370 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.math.BigDecimal;
+import java.util.List;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.kingsrook.qbits.dataanalysis.engine.DrillFilters;
+import com.kingsrook.qbits.dataanalysis.engine.FieldAnalysisAccess;
+import com.kingsrook.qbits.dataanalysis.result.CompareRequest;
+import com.kingsrook.qbits.dataanalysis.result.CorrelationRequest;
+import com.kingsrook.qbits.dataanalysis.result.CrosstabRequest;
+import com.kingsrook.qbits.dataanalysis.result.Drill;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.ScatterRequest;
+import com.kingsrook.qbits.dataanalysis.result.ShiftRequest;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.CountAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.assertj.core.api.Assertions.within;
+
+/*******************************************************************************
+ ** Identical relationship contracts inherited by memory, H2 and PostgreSQL.
+ *******************************************************************************/
+abstract class RelationshipContractTest extends PivotContractTest
+{
+   /*******************************************************************************
+    ** Verify compare numeric and categorical.
+    *******************************************************************************/
+   @Test
+   void compareNumericAndCategorical() throws Exception
+   {
+      var request = new CompareRequest().withTableName("orders").withFields(List.of("amount"))
+         .withFilterA(DrillFilters.condition("id", QCriteriaOperator.LESS_THAN_OR_EQUALS, 6))
+         .withFilterB(DrillFilters.condition("id", QCriteriaOperator.GREATER_THAN, 6)).withLabelA("Early").withLabelB("Late");
+      var result = service.compare(request);
+      var field = result.getFields().getFirst();
+      var value = field.getValues().getFirst();
+      assertThat(value.getSideA().getLabel()).isEqualTo("Early");
+      assertNumber(value.getSideA().getMetrics(), "count", 6);
+      assertNumber(value.getSideA().getMetrics(), "mean", 50.0 / 6);
+      assertNumber(value.getSideA().getMetrics(), "median", 10);
+      assertNumber(value.getSideB().getMetrics(), "count", 5);
+      assertNumber(value.getSideB().getMetrics(), "mean", 224);
+      assertNumber(value.getSideB().getMetrics(), "median", 40);
+      assertThat(((Number) value.getDelta().getValue()).doubleValue()).isCloseTo(224 - 50.0 / 6, within(1e-9));
+      // scipy.stats.ttest_ind_from_stats(50/6, sqrt(136.66666666666666), 6, 224, sqrt(188530), 5, equal_var=False)
+      assertThat(field.getSignificance().getPValue()).isCloseTo(.3290396212758404, within(1e-10));
+      assertThat(field.getChart().getKind().name()).isEqualTo("BOX");
+      assertThat(field.getChart().getSeries()).hasSize(2).allSatisfy(s -> assertThat(s.getPoints()).hasSize(5));
+      relationshipDrills(result);
+      var categorical = service.compare(new CompareRequest().withTableName("orders").withFields(List.of("status")));
+      var category = categorical.getFields().getFirst();
+      assertThat(category.getValues()).hasSize(2);
+      assertThat(category.getSignificance().getPValue()).isEqualTo(1);
+      assertThat(category.getSignificance().getDf()).isEqualTo(1);
+      assertThat(category.getChart().getKind().name()).isEqualTo("BAR");
+      for(var v : category.getValues())
+      {
+         assertNumber(v.getSideA().getMetrics(), "count", 6);
+         assertNumber(v.getSideB().getMetrics(), "share", .5);
+         assertThat(v.getSignificance().getApplicable()).isTrue();
+      }
+      relationshipDrills(categorical);
+      var small = service.compare(request.withFields(List.of("status")));
+      assertThat(small.getFields().getFirst().getValues()).singleElement().satisfies(v -> assertThat(v.getLabel()).isEqualTo("Other"));
+      assertThat(small.getFields().getFirst().getSignificance().getApplicable()).isFalse();
+      relationshipDrills(small);
+   }
+
+   /*******************************************************************************
+    ** Verify correlation matches independent java pearson.
+    *******************************************************************************/
+   @Test
+   void correlationMatchesIndependentJavaPearson() throws Exception
+   {
+      var result = service.correlation(new CorrelationRequest().withTableName("orders").withFields(List.of("amount", "quantity", "id")));
+      assertThat(result.getCells()).hasSize(9);
+      double[] x = {-10, 0, 10, 10, 20, 20, 30, 40, 50, 1000, 0};
+      double[] y = {1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6};
+      double meanX = java.util.Arrays.stream(x).average().orElseThrow();
+      double meanY = java.util.Arrays.stream(y).average().orElseThrow();
+      double xx = 0, yy = 0, xy = 0;
+      for(int i = 0; i < x.length; i++)
+      {
+         xx += Math.pow(x[i] - meanX, 2);
+         yy += Math.pow(y[i] - meanY, 2);
+         xy += (x[i] - meanX) * (y[i] - meanY);
+      }
+      var cell = result.getCells().stream().filter(c -> c.getXField().equals("amount") && c.getYField().equals("quantity")).findFirst().orElseThrow();
+      assertThat(cell.getN()).isEqualTo(11);
+      assertThat(cell.getR()).isCloseTo(xy / Math.sqrt(xx * yy), within(1e-10));
+      assertThat(service.scatter(cell.getScatter()).getSampleSize()).isEqualTo(11);
+      assertThat(result.getChart().getKind().name()).isEqualTo("HEATMAP");
+      for(var c : result.getCells())
+      {
+         if(c.getXField().equals(c.getYField()))
+         {
+            assertThat(c.getR()).isCloseTo(1, within(1e-12));
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Verify scatter limits trend and record drills.
+    *******************************************************************************/
+   @Test
+   void scatterLimitsTrendAndRecordDrills() throws Exception
+   {
+      var result = service.scatter(new ScatterRequest().withTableName("orders").withXField("id").withYField("amount").withLimit(3));
+      assertThat(result.getN()).isEqualTo(11);
+      assertThat(result.getSampleSize()).isEqualTo(3);
+      assertThat(result.getPoints()).extracting(p -> p.getX().toString()).containsExactly("1", "2", "3");
+      assertThat(result.getTrend().getSlope()).isCloseTo(10, within(1e-12));
+      assertThat(result.getTrend().getIntercept()).isCloseTo(-20, within(1e-12));
+      assertThat(result.getTrend().getR()).isCloseTo(1, within(1e-12));
+      assertThat(result.getChart().getSeries()).hasSize(2);
+      for(var point : result.getPoints())
+      {
+         assertThat(drillCount(point.getDrill())).isEqualTo(1);
+         assertThat(point.getDrill().getFilter().getSubFilters().getLast().getCriteria()).singleElement().satisfies(c ->
+         {
+            assertThat(c.getFieldName()).isEqualTo("id");
+            assertThat(c.getOperator()).isEqualTo(QCriteriaOperator.EQUALS);
+         });
+      }
+      assertThatThrownBy(() -> service.scatter(new ScatterRequest().withTableName("orders").withXField("id").withYField("amount").withLimit(2001))).isInstanceOf(QBadRequestException.class);
+      assertThat(service.scatter(new ScatterRequest().withTableName("orders").withXField("id").withYField("amount").withLimit(1)).getTrend()).isNull();
+      var constant = service.scatter(new ScatterRequest().withTableName("orders").withXField("id").withYField("quantity").withLimit(2));
+      assertThat(constant.getTrend().getSlope()).isZero();
+      assertThat(constant.getTrend().getIntercept()).isEqualTo(1);
+      assertThat(constant.getTrend().getR()).isNull();
+      assertThat(service.scatter(new ScatterRequest().withTableName("orders").withXField("quantity").withYField("id").withLimit(2)).getTrend()).isNull();
+   }
+
+   /*******************************************************************************
+    ** Verify crosstab counts shares chi square and other.
+    *******************************************************************************/
+   @Test
+   void crosstabCountsSharesChiSquareAndOther() throws Exception
+   {
+      var request = new CrosstabRequest().withTableName("orders").withRowField("status").withColumnField("customer");
+      var result = service.crosstab(request);
+      assertThat(result.getCells()).hasSize(4);
+      assertThat(result.getCells()).extracting(c -> ((Number) c.getCount().getValue()).longValue()).containsExactlyInAnyOrder(4L, 4L, 2L, 2L);
+      assertThat(result.getCells()).allSatisfy(c -> assertThat(((Number) c.getColumnShare().getValue()).doubleValue()).isEqualTo(.5));
+      assertThat(result.getSignificance().getApplicable()).isFalse();
+      relationshipDrills(result);
+      relationshipDrills(service.crosstab(request.withLimit(1)));
+      for(int i = 13; i <= 132; i++)
+      {
+         TestSupport.insert("orders", new QRecord().withValue("id", i).withValue("customer", i < 73 ? 1 : 2).withValue("status", i % 3 == 0 ? "NEW" : "PAID"));
+      }
+      var larger = service.crosstab(request.withLimit(20));
+      assertThat(larger.getSignificance().getApplicable()).isTrue();
+      assertThat(larger.getSignificance().getCramersV()).isNotNull();
+      // scipy.stats.chi2_contingency([[24,22],[44,42]], correction=False)
+      assertThat(larger.getSignificance().getStatistic()).isCloseTo(.012267293166002618, within(1e-12));
+      assertThat(larger.getSignificance().getPValue()).isCloseTo(.9118083997104913, within(1e-12));
+      relationshipDrills(larger);
+   }
+
+   /*******************************************************************************
+    ** Verify shift psi and quartiles.
+    *******************************************************************************/
+   @Test
+   void shiftPsiAndQuartiles() throws Exception
+   {
+      var request = new ShiftRequest().withTableName("orders").withField("status").withDateField("order_date").withBucket("DAY");
+      var result = service.shift(request);
+      assertThat(result.getBuckets()).hasSize(2).allSatisfy(b -> assertThat(b.getComplete()).isTrue());
+      assertThat(((Number) result.getPsi().getValue()).doubleValue()).isZero();
+      assertThat(result.getChart().getSeries()).hasSize(2);
+      relationshipDrills(result);
+      var shifted = service.shift(request.withField("customer"));
+      // scipy.special.rel_entr([.5,.5], [1,1e-6]).sum() + scipy.special.rel_entr([1,1e-6], [.5,.5]).sum()
+      assertThat(((Number) shifted.getPsi().getValue()).doubleValue()).isCloseTo(6.907742156618759, within(1e-10));
+      var numeric = service.shift(request.withField("amount"));
+      assertThat(numeric.getPsi().getValue()).isNotNull();
+      assertNumber(numeric.getBuckets().getFirst().getMetrics(), "median", 5);
+      relationshipDrills(numeric);
+      for(String unit : List.of("WEEK", "MONTH", "QUARTER", "YEAR", "HOUR"))
+      {
+         var bucketed = service.shift(request.withDateField("created").withBucket(unit));
+         relationshipDrills(bucketed);
+      }
+   }
+
+   /*******************************************************************************
+    ** Verify relationship privacy and full field security.
+    *******************************************************************************/
+   @Test
+   void relationshipPrivacyAndFullFieldSecurity() throws Exception
+   {
+      config.withDefaultMinGroupSize(6);
+      service.getConfigResolver().invalidate();
+      var scatter = new ScatterRequest().withTableName("orders").withXField("id").withYField("amount");
+      assertThat(service.scatter(scatter).getPoints()).allSatisfy(p -> assertThat(p.getDrill()).isNull());
+      assertThat(service.scatter(scatter.withFilter(DrillFilters.condition("id", QCriteriaOperator.LESS_THAN, 4))).getPoints()).isEmpty();
+      var comparison = service.compare(new CompareRequest().withTableName("orders").withFields(List.of("amount", "customer"))
+         .withFilterA(DrillFilters.condition("id", QCriteriaOperator.LESS_THAN, 4)));
+      assertThat(comparison.getFields().getFirst().getValues().getFirst().getSideA().getMetrics()).allSatisfy(m ->
+      {
+         assertThat(m.getValue()).isNull();
+         assertThat(m.getDrill()).isNull();
+      });
+      assertThat(comparison.getFields().getFirst().getSignificance().getApplicable()).isFalse();
+      var cross = service.crosstab(new CrosstabRequest().withTableName("orders").withRowField("status").withColumnField("customer"));
+      assertThat(cross.getCells()).allSatisfy(c -> assertThat(c.getCount().getValue()).isNull());
+      assertThat(cross.getSignificance().getApplicable()).isFalse();
+      assertThat(service.shift(new ShiftRequest().withTableName("orders").withField("customer").withDateField("order_date").withBucket("DAY")).getPsi().getValue()).isNull();
+      assertThat(service.correlation(new CorrelationRequest().withTableName("orders").withFields(List.of("id", "amount")).withFilter(scatter.getFilter())).getCells())
+         .allSatisfy(c -> assertThat(c.getR()).isNull());
+      for(String field : List.of("secret", "missing"))
+      {
+         assertThatThrownBy(() -> service.compare(new CompareRequest().withTableName("orders").withFields(List.of(field)))).isInstanceOf(QBadRequestException.class);
+         assertThatThrownBy(() -> service.correlation(new CorrelationRequest().withTableName("orders").withFields(List.of("id", field)))).isInstanceOf(QBadRequestException.class);
+         assertThatThrownBy(() -> service.scatter(new ScatterRequest().withTableName("orders").withXField("id").withYField(field))).isInstanceOf(QBadRequestException.class);
+         assertThatThrownBy(() -> service.crosstab(new CrosstabRequest().withTableName("orders").withRowField("status").withColumnField(field))).isInstanceOf(QBadRequestException.class);
+         assertThatThrownBy(() -> service.shift(new ShiftRequest().withTableName("orders").withField(field).withDateField("order_date"))).isInstanceOf(QBadRequestException.class);
+      }
+      QContext.init(instance, TestSupport.user("denied").withPermissions("orders.read"));
+      assertThatThrownBy(() -> service.scatter(scatter)).isInstanceOf(QPermissionDeniedException.class);
+   }
+
+   /*******************************************************************************
+    ** Verify relationship locks and resolver.
+    *******************************************************************************/
+   @Test
+   void relationshipLocksAndResolver() throws Exception
+   {
+      QContext.getQSession().getSecurityKeyValues().remove("orders.all");
+      QContext.getQSession().withSecurityKeyValue("customer_scope", 1);
+      assertThat(service.scatter(new ScatterRequest().withTableName("orders").withXField("id").withYField("amount")).getN()).isEqualTo(8);
+      var restricted = new DataAnalysisQBitConfig().withBackendName("memory").withFieldAnalysisAccessResolver(() -> (t, f) -> f.getName().equals("amount") ? FieldAnalysisAccess.NONE : FieldAnalysisAccess.FULL);
+      service = newService(restricted, Runnable::run);
+      assertThatThrownBy(() -> service.compare(new CompareRequest().withTableName("orders").withFields(List.of("amount")))).isInstanceOf(QBadRequestException.class);
+   }
+
+   /*******************************************************************************
+    ** Verify top categories and empty populations.
+    *******************************************************************************/
+   @Test
+   void topCategoriesAndEmptyPopulations() throws Exception
+   {
+      for(int i = 0; i < 300; i++)
+      {
+         TestSupport.insert("orders", new QRecord().withValue("id", 1000 + i).withValue("customer", 1)
+            .withValue("note", "Category " + i % 15).withValue("paid", i % 2 == 0)
+            .withValue("order_date", java.time.LocalDate.of(2025, 1, i < 150 ? 1 : 2)));
+      }
+      var filter = DrillFilters.condition("id", QCriteriaOperator.GREATER_THAN_OR_EQUALS, 1000);
+      var compared = service.compare(new CompareRequest().withTableName("orders").withFields(List.of("note")).withFilterA(filter).withFilterB(filter));
+      assertThat(compared.getFields().getFirst().getValues()).hasSize(11);
+      assertThat(compared.getFields().getFirst().getValues().getLast().getLabel()).isEqualTo("Other");
+      assertNumber(compared.getFields().getFirst().getValues().getLast().getSideA().getMetrics(), "count", 100);
+      relationshipDrills(compared);
+      var shift = service.shift(new ShiftRequest().withTableName("orders").withField("note").withDateField("order_date").withBucket("DAY").withFilter(filter));
+      assertThat(shift.getChart().getSeries()).hasSize(9);
+      assertThat(shift.getChart().getStacked()).isTrue();
+      assertThat(((Number) shift.getPsi().getValue()).doubleValue()).isZero();
+      relationshipDrills(shift);
+      relationshipDrills(service.crosstab(new CrosstabRequest().withTableName("orders").withRowField("note").withColumnField("paid").withFilter(filter).withLimit(5)));
+      var empty = DrillFilters.condition("id", QCriteriaOperator.LESS_THAN, 0);
+      assertThat(service.compare(new CompareRequest().withTableName("orders").withFields(List.of("amount")).withFilterA(empty)).getFields().getFirst().getSignificance().getApplicable()).isFalse();
+      assertThat(service.correlation(new CorrelationRequest().withTableName("orders").withFields(List.of("id", "amount")).withFilter(empty)).getCells()).allSatisfy(c -> assertThat(c.getR()).isNull());
+      assertThat(service.crosstab(new CrosstabRequest().withTableName("orders").withRowField("note").withColumnField("paid").withFilter(empty)).getCells()).isEmpty();
+      assertThat(service.shift(new ShiftRequest().withTableName("orders").withField("note").withDateField("order_date").withFilter(empty)).getPsi().getValue()).isNull();
+   }
+
+   /*******************************************************************************
+    ** Verify future buckets do not enter psi and point drills respect resolver.
+    *******************************************************************************/
+   @Test
+   void futureBucketsDoNotEnterPsiAndPointDrillsRespectResolver() throws Exception
+   {
+      var future = java.time.LocalDate.now(java.time.ZoneId.of("America/Chicago")).plusYears(1);
+      TestSupport.insert("orders", new QRecord().withValue("id", 99).withValue("customer", 1).withValue("order_date", future).withValue("status", "NEW"));
+      var shift = service.shift(new ShiftRequest().withTableName("orders").withField("status").withDateField("order_date").withBucket("DAY"));
+      assertThat(shift.getBuckets().getLast().getComplete()).isFalse();
+      assertThat(((Number) shift.getPsi().getValue()).doubleValue()).isZero();
+      TestSupport.insert("orders", new QRecord().withValue("id", 98).withValue("customer", 1).withValue("amount", BigDecimal.ONE)
+         .withValue("order_date", java.time.LocalDate.of(2024, 1, 1)).withValue("status", "NEW"));
+      for(String field : List.of("amount", "status"))
+      {
+         var sparseFirst = service.shift(new ShiftRequest().withTableName("orders").withField(field).withDateField("order_date").withBucket("DAY"));
+         assertThat(sparseFirst.getPsi().getValue()).isNull();
+         assertThat(sparseFirst.getSentence()).contains("at least two values");
+      }
+      var restricted = new DataAnalysisQBitConfig().withBackendName("memory").withFieldAnalysisAccessResolver(() -> (t, f) -> f.getName().equals("id") ? FieldAnalysisAccess.NONE : FieldAnalysisAccess.FULL);
+      service = newService(restricted, Runnable::run);
+      assertThat(service.scatter(new ScatterRequest().withTableName("orders").withXField("amount").withYField("quantity")).getPoints()).hasSize(11).allSatisfy(p -> assertThat(p.getDrill()).isNull());
+      restricted.withFieldAnalysisAccessResolver(() -> (t, f) -> f.getName().equals("amount") ? FieldAnalysisAccess.EXACT_MATCH_ONLY : FieldAnalysisAccess.FULL);
+      service = newService(restricted, Runnable::run);
+      assertThatThrownBy(() -> service.correlation(new CorrelationRequest().withTableName("orders").withFields(List.of("amount", "quantity")))).isInstanceOf(QBadRequestException.class);
+   }
+
+   /*******************************************************************************
+    ** Verify assert number.
+    *******************************************************************************/
+   private static void assertNumber(List<Metric> metrics, String key, double expected)
+   {
+      assertThat(metrics.stream().filter(m -> m.getKey().equals(key)).findFirst().orElseThrow().getValue()).isNotNull();
+      assertThat(new BigDecimal(metrics.stream().filter(m -> m.getKey().equals(key)).findFirst().orElseThrow().getValue().toString()).doubleValue()).isCloseTo(expected, within(1e-9));
+   }
+
+   /*******************************************************************************
+    ** Verify drill count.
+    *******************************************************************************/
+   private static long drillCount(Drill drill) throws Exception
+   {
+      CountInput input = new CountInput(drill.getTableName()).withFilter(DrillFilters.restoreTypes(drill.getTableName(), drill.getFilter()));
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      return (new CountAction().execute(input).getCount());
+   }
+
+   /*******************************************************************************
+    ** Verify relationship drills.
+    *******************************************************************************/
+   private void relationshipDrills(Object result) throws Exception
+   {
+      walkRelationship(new ObjectMapper().readTree(JsonUtils.toJson(result)));
+   }
+
+   /*******************************************************************************
+    ** Verify walk relationship.
+    *******************************************************************************/
+   private void walkRelationship(JsonNode node) throws Exception
+   {
+      if(node.isObject() && node.path("valueType").asText().equals("COUNT") && node.hasNonNull("drill"))
+      {
+         assertThat(drillCount(JsonUtils.toObject(node.get("drill").toString(), Drill.class))).as(node.toString()).isEqualTo(node.path("value").asLong());
+      }
+      if(node.isContainerNode())
+      {
+         for(JsonNode child : node)
+         {
+            walkRelationship(child);
+         }
+      }
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/RelationshipFallbackTest.java

@@ -0,0 +1,133 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.util.List;
+import java.util.Set;
+import java.util.concurrent.atomic.AtomicInteger;
+import com.kingsrook.qbits.dataanalysis.result.CorrelationRequest;
+import com.kingsrook.qbits.dataanalysis.result.CompareRequest;
+import com.kingsrook.qqq.backend.core.actions.interfaces.AggregateInterface;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateCapability;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateOutput;
+import com.kingsrook.qqq.backend.core.modules.backend.QBackendModuleDispatcher;
+import com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryAggregateAction;
+import com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryBackendModule;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.assertj.core.api.Assertions.within;
+
+/*******************************************************************************
+ ** Force unavailable capabilities without replacing the actual core execution.
+ *******************************************************************************/
+class RelationshipFallbackTest extends EngineFixture
+{
+   /*******************************************************************************
+    ** Verify restore.
+    *******************************************************************************/
+   @AfterEach
+   void restore()
+   {
+      QBackendModuleDispatcher.registerBackendModule(new MemoryBackendModule());
+   }
+
+   /*******************************************************************************
+    ** Verify core streams unsupported correlation and rejects truncation.
+    *******************************************************************************/
+   @Test
+   void coreStreamsUnsupportedCorrelationAndRejectsTruncation() throws Exception
+   {
+      var request = new CorrelationRequest().withTableName("orders").withFields(List.of("id", "amount", "quantity"));
+      var nativeResult = service.correlation(request);
+      TrackingModule.fallback = true;
+      QBackendModuleDispatcher.registerBackendModule(new TrackingModule());
+      var streamed = service.correlation(request);
+      for(int i = 0; i < nativeResult.getCells().size(); i++)
+      {
+         assertThat(streamed.getCells().get(i).getR()).isCloseTo(nativeResult.getCells().get(i).getR(), within(1e-12));
+         assertThat(streamed.getCells().get(i).getN()).isEqualTo(nativeResult.getCells().get(i).getN());
+      }
+      assertThat(service.compare(new CompareRequest().withTableName("orders").withFields(List.of("amount"))).getFields().getFirst().getSignificance().getPValue()).isEqualTo(1);
+      config.withDefaultMaxRows(3);
+      service.getConfigResolver().invalidate();
+      assertThatThrownBy(() -> service.correlation(request)).isInstanceOf(QBadRequestException.class).hasMessageContaining("streamed row limit");
+   }
+
+   /*******************************************************************************
+    ** Verify all correlations use one aggregate call.
+    *******************************************************************************/
+   @Test
+   void allCorrelationsUseOneAggregateCall() throws Exception
+   {
+      TrackingModule.fallback = false;
+      TrackingModule.calls.set(0);
+      QBackendModuleDispatcher.registerBackendModule(new TrackingModule());
+      service.correlation(new CorrelationRequest().withTableName("orders").withFields(List.of("id", "amount", "quantity")));
+      assertThat(TrackingModule.calls.get()).isEqualTo(1);
+   }
+
+   /*******************************************************************************
+    ** Verify backend capability execution.
+    *******************************************************************************/
+   public static class TrackingModule extends MemoryBackendModule
+   {
+      static boolean fallback;
+      static final AtomicInteger calls = new AtomicInteger();
+
+      /*******************************************************************************
+       ** Verify get aggregate interface.
+       *******************************************************************************/
+      @Override
+      public AggregateInterface getAggregateInterface()
+      {
+         return (new MemoryAggregateAction()
+         {
+            /*******************************************************************************
+             ** Verify get supported capabilities.
+             *******************************************************************************/
+            @Override
+            public Set<AggregateCapability> getSupportedCapabilities(AggregateInput input)
+            {
+               return (fallback ? Set.of() : super.getSupportedCapabilities(input));
+            }
+
+            /*******************************************************************************
+             ** Verify execute.
+             *******************************************************************************/
+            @Override
+            public AggregateOutput execute(AggregateInput input) throws com.kingsrook.qqq.backend.core.exceptions.QException
+            {
+               if(!fallback && input.getTableName().equals("orders"))
+               {
+                  calls.incrementAndGet();
+                  assertThat(input.getAggregates()).hasSize(6).allSatisfy(a -> assertThat(a.getOperator()).isEqualTo(AggregateOperator.CORR));
+               }
+               return (super.execute(input));
+            }
+         });
+      }
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/StatisticsTest.java

@@ -0,0 +1,148 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import com.kingsrook.qbits.dataanalysis.stats.SpecialFunctions;
+import com.kingsrook.qbits.dataanalysis.stats.Statistics;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.within;
+
+/*******************************************************************************
+ ** Independent SciPy 1.18.1 references, never computed with production helpers.
+ *******************************************************************************/
+class StatisticsTest
+{
+   /*******************************************************************************
+    ** Verify welch references.
+    *******************************************************************************/
+   @Test
+   void welchReferences()
+   {
+      // scipy.stats.ttest_ind_from_stats(15, sqrt(87.5), 13, 12, sqrt(39), 11, equal_var=False)
+      var result = Statistics.welch(13, 15, 87.5, 11, 12, 39);
+      assertThat(result.statistic()).isCloseTo(0.9358461935556048, within(1e-12));
+      assertThat(result.pValue()).isCloseTo(0.35999818693244234, within(1e-12));
+      // scipy.stats.ttest_ind([1,3,4,6,11,13,15,19,22,24,25,26,26], [2,4,6,9,11,13,14,15,18,19,21], equal_var=False).df
+      assertThat(result.df()).isCloseTo(20.984611233429924, within(1e-12));
+      assertThat(result.sentence()).isEqualTo("No significant difference (p = 0.36)");
+      // scipy.stats.ttest_ind_from_stats(100, 2, 30, 104, 3, 25, equal_var=False)
+      assertThat(Statistics.welch(30, 100, 4, 25, 104, 9).pValue()).isCloseTo(1.2223199525471597e-6, within(1e-16));
+      assertThat(Statistics.welch(1, 0, 1, 2, 0, 1).sentence()).isEqualTo("Not applicable: too few records");
+      assertThat(Statistics.welch(2, 0, 0, 2, 1, 0).applicable()).isFalse();
+      assertThat(Statistics.welch(2, 0, -1, 2, 1, 1).applicable()).isFalse();
+      assertThat(Statistics.welch(2, Double.NaN, 1, 2, 1, 1).applicable()).isFalse();
+      assertThat(Statistics.welch(20, 1, 1, 20, 1, 1).pValue()).isEqualTo(1);
+   }
+
+   /*******************************************************************************
+    ** Verify proportion reference and significance boundary.
+    *******************************************************************************/
+   @Test
+   void proportionReferenceAndSignificanceBoundary()
+   {
+      // p=(30+45)/(150+200); z=(30/150-45/200)/sqrt(p*(1-p)*(1/150+1/200)); 2*scipy.stats.norm.sf(abs(z))
+      var result = Statistics.proportions(30, 150, 45, 200);
+      assertThat(result.statistic()).isCloseTo(-0.564076074817766, within(1e-12));
+      assertThat(result.pValue()).isCloseTo(0.5727023597783104, within(1e-12));
+      assertThat(Statistics.sentence(0.05)).isEqualTo("No significant difference (p = 0.05)");
+      assertThat(Statistics.sentence(0.003)).isEqualTo("A and B differ (p = 0.003)");
+      assertThat(Statistics.sentence(0.41)).isEqualTo("No significant difference (p = 0.41)");
+      assertThat(Statistics.proportions(1, 1, 1, 2).applicable()).isFalse();
+      assertThat(Statistics.proportions(0, 100, 0, 100).applicable()).isFalse();
+      assertThat(Statistics.proportions(-1, 20, 10, 20).applicable()).isFalse();
+      assertThat(Statistics.proportions(21, 20, 10, 20).applicable()).isFalse();
+   }
+
+   /*******************************************************************************
+    ** Verify chi square reference and pooling.
+    *******************************************************************************/
+   @Test
+   void chiSquareReferenceAndPooling()
+   {
+      // scipy.stats.chi2_contingency([[30,20],[10,40]], correction=False)
+      var result = Statistics.chiSquare(new double[][] {{30, 20}, {10, 40}}, false);
+      assertThat(result.statistic()).isCloseTo(16.666666666666668, within(1e-12));
+      assertThat(result.df()).isEqualTo(1);
+      assertThat(result.pValue()).isCloseTo(4.455709060405612e-5, within(1e-14));
+      // scipy.stats.contingency.association([[30,20],[10,40]], method='cramer', correction=False)
+      assertThat(result.cramersV()).isCloseTo(0.408248290463863, within(1e-12));
+      // scipy.stats.chi2_contingency([[20,30,50],[30,40,30]], correction=False)
+      assertThat(Statistics.chiSquare(new double[][] {{20, 30, 50}, {30, 40, 30}}, true).pValue()).isCloseTo(0.01478287719483942, within(1e-12));
+      // Ten rare columns pool into Other, yielding [[40,10],[20,30]]; scipy.stats.chi2_contingency(..., correction=False).
+      double[][] rare = {{40, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1}, {20, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3}};
+      assertThat(Statistics.chiSquare(rare, true).pValue()).isCloseTo(4.455709060405612e-5, within(1e-14));
+      // scipy.stats.chi2_contingency([[40,10],[20,30],[4,8]], correction=False); four rare rows merge into Other.
+      assertThat(Statistics.chiSquare(new double[][] {{40, 10}, {20, 30}, {1, 2}, {1, 2}, {1, 2}, {1, 2}}, false).pValue())
+         .isCloseTo(5.993665986784811e-5, within(1e-14));
+      assertThat(Statistics.chiSquare(new double[][] {{3, 3}, {3, 3}}, true).applicable()).isFalse();
+      assertThat(Statistics.chiSquare(new double[][] {{20, 1}, {20, 1}}, true).applicable()).isFalse();
+      assertThat(Statistics.chiSquare(new double[][] {{1, 0}, {10, 10}}, true).applicable()).isFalse();
+      assertThat(Statistics.chiSquare(new double[][] {{10}, {10}}, true).applicable()).isFalse();
+      assertThat(Statistics.chiSquare(new double[][] {{10, 10}, {10, -1}}, true).applicable()).isFalse();
+      assertThat(Statistics.chiSquare(new double[][] {{10, 10}, {10}}, true).applicable()).isFalse();
+   }
+
+   /*******************************************************************************
+    ** Verify descriptive references.
+    *******************************************************************************/
+   @Test
+   void descriptiveReferences()
+   {
+      // scipy.stats.pearsonr([1,2,3,4,5], [2,1,4,3,6]).statistic
+      assertThat(Statistics.pearson(new double[] {1, 2, 3, 4, 5}, new double[] {2, 1, 4, 3, 6})).isCloseTo(0.8219949365267865, within(1e-14));
+      // scipy.special.rel_entr(q,p).sum() + scipy.special.rel_entr(p,q).sum(), p=[.2,.3,.5], q=[.3,.3,.4]
+      assertThat(Statistics.psi(new double[] {20, 30, 50}, new double[] {30, 30, 40})).isCloseTo(0.06286086594223739, within(1e-14));
+      assertThat(Statistics.psi(new double[] {0, 1}, new double[] {1, 0})).isFinite();
+      assertThat(Statistics.psi(new double[] {0, 0}, new double[] {1, 1})).isNull();
+      assertThat(Statistics.psi(new double[] {-1, 1}, new double[] {1, 1})).isNull();
+      assertThat(Statistics.psi(new double[] {1}, new double[] {1, 1})).isNull();
+      assertThat(Statistics.pearson(new double[] {1, 1}, new double[] {2, 3})).isNull();
+      assertThat(Statistics.pearson(new double[] {1}, new double[] {2})).isNull();
+      assertThat(Statistics.pearson(new double[] {1, Double.NaN}, new double[] {2, 3})).isNull();
+   }
+
+   /*******************************************************************************
+    ** Verify distribution tails.
+    *******************************************************************************/
+   @Test
+   void distributionTails()
+   {
+      // scipy.stats.t.cdf(0, 10), t.cdf(1, 1), t.cdf(-1, 1); scipy.stats.chi2.cdf(2, 4)
+      assertThat(SpecialFunctions.studentTCdf(0, 10)).isEqualTo(.5);
+      assertThat(SpecialFunctions.studentTCdf(1, 1)).isCloseTo(.75, within(1e-13));
+      assertThat(SpecialFunctions.studentTCdf(-1, 1)).isCloseTo(.25, within(1e-13));
+      assertThat(SpecialFunctions.chiSquareCdf(2, 4)).isCloseTo(.2642411176571153, within(1e-13));
+      // scipy.special.betainc(2,5,.2), betainc(2,5,.8), betainc(.5,.5,.5), betainc(100,10,.02)
+      assertThat(SpecialFunctions.beta(.2, 2, 5)).isCloseTo(.3446400000000002, within(1e-13));
+      assertThat(SpecialFunctions.beta(.8, 2, 5)).isCloseTo(.9984, within(1e-13));
+      assertThat(SpecialFunctions.beta(.5, .5, .5)).isCloseTo(.5, within(1e-13));
+      assertThat(SpecialFunctions.beta(.02, 100, 10)).isCloseTo(4.514221366229434e-158, within(1e-169));
+      assertThat(SpecialFunctions.beta(0, 2, 5)).isZero();
+      assertThat(SpecialFunctions.beta(1, 2, 5)).isEqualTo(1);
+      // scipy.special.gammaincc(2,1), gammaincc(2,8), gammaincc(.5,2), gammaincc(20,18)
+      assertThat(SpecialFunctions.gammaQ(2, 1)).isCloseTo(.7357588823428847, within(1e-13));
+      assertThat(SpecialFunctions.gammaQ(2, 8)).isCloseTo(.003019163651122605, within(1e-13));
+      assertThat(SpecialFunctions.gammaQ(.5, 2)).isCloseTo(.04550026389635857, within(1e-13));
+      assertThat(SpecialFunctions.gammaQ(20, 18)).isCloseTo(.6509161279807018, within(1e-13));
+      assertThat(SpecialFunctions.gammaQ(2, 0)).isEqualTo(1);
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/WatchDetectorsTest.java

@@ -0,0 +1,174 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import com.kingsrook.qbits.dataanalysis.result.Drill;
+import com.kingsrook.qbits.dataanalysis.watch.WatchBucket;
+import com.kingsrook.qbits.dataanalysis.watch.WatchDefinition;
+import com.kingsrook.qbits.dataanalysis.watch.WatchDetectors;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/*******************************************************************************
+ ** Hand-computed detector cases isolate statistical behavior from the database.
+ *******************************************************************************/
+class WatchDetectorsTest
+{
+   static QRecord definition(String detector, String metric, String parameters)
+   {
+      return (new QRecord().withValue("table_name", "orders").withValue("owner_user_id", "alice").withValue("detector", detector)
+         .withValue("metric_json", "{\"operator\":\"" + metric + "\",\"field\":\"amount\"}").withValue("parameters_json", parameters)
+         .withValue("date_field", "created").withValue("bucket", "DAY").withValue("severity", "WARNING").withValue("enabled", true));
+   }
+
+   private WatchDefinition parsed(String detector, String metric, String parameters) throws Exception
+   {
+      return (WatchDefinition.parse(definition(detector, metric, parameters)));
+   }
+
+   private List<WatchBucket> series(Double... values)
+   {
+      List<WatchBucket> result = new ArrayList<>();
+      for(Double value : values)
+      {
+         result.add(new WatchBucket("day-" + result.size(), value, Set.of(), new Drill().withTableName("orders")));
+      }
+      return (result);
+   }
+
+   @Test
+   void robustZScoreHasDirectionAndStrictThreshold() throws Exception
+   {
+      var spike = parsed("SPIKE", "COUNT", "{\"k\":3}");
+      assertThat(WatchDetectors.evaluate(spike, series(9.0, 10.0, 11.0, 20.0), "Orders per day").firing()).isTrue();
+      assertThat(WatchDetectors.evaluate(spike, series(9.0, 10.0, 11.0, 1.0), "Orders").firing()).isFalse();
+      var drop = parsed("DROP", "COUNT", "{\"k\":3}");
+      var verdict = WatchDetectors.evaluate(drop, series(40.0, 45.0, 55.0, 12.0), "Orders per day");
+      assertThat(verdict.firing()).isTrue();
+      assertThat(verdict.baseline()).isEqualTo(45.0);
+      assertThat(verdict.message()).contains("Orders per day dropped to 12", "usual 40");
+      assertThat(verdict.drill().getTableName()).isEqualTo("orders");
+      assertThat(WatchDetectors.evaluate(drop, series(40.0, 45.0, 55.0, 100.0), "Orders").firing()).isFalse();
+      var exact = parsed("SPIKE", "COUNT", "{\"k\":3,\"threshold\":0.6745}");
+      assertThat(WatchDetectors.evaluate(exact, series(9.0, 10.0, 11.0, 11.0), "Orders").firing()).isFalse();
+   }
+
+   @Test
+   void zeroMadUsesRelativeChangeAndHandlesZeroAndNegativeBaselines() throws Exception
+   {
+      var spike = parsed("SPIKE", "COUNT", "{\"k\":2}");
+      for(double x : new double[] {10, 15})
+      {
+         assertThat(WatchDetectors.evaluate(spike, series(10.0, 10.0, x), "Orders").firing()).isFalse();
+      }
+      assertThat(WatchDetectors.evaluate(spike, series(10.0, 10.0, 16.0), "Orders").firing()).isTrue();
+      assertThat(WatchDetectors.evaluate(spike, series(0.0, 0.0, 0.0), "Orders").firing()).isFalse();
+      assertThat(WatchDetectors.evaluate(spike, series(0.0, 0.0, 1.0), "Orders").firing()).isTrue();
+      assertThat(WatchDetectors.evaluate(spike, series(-10.0, -10.0, -4.0), "Balance").firing()).isTrue();
+      var drop = parsed("DROP", "COUNT", "{\"k\":2}");
+      assertThat(WatchDetectors.evaluate(drop, series(10.0, 10.0, 4.0), "Orders").firing()).isTrue();
+      assertThat(WatchDetectors.evaluate(drop, series(0.0, 0.0, -1.0), "Balance").firing()).isTrue();
+   }
+
+   @Test
+   void rangeIncludesBothBoundsAndNeedsOnlyLatestValue() throws Exception
+   {
+      var range = parsed("OUT_OF_RANGE", "SUM", "{\"min\":10,\"max\":20}");
+      assertThat(WatchDetectors.evaluate(range, series(10.0), "Amount").firing()).isFalse();
+      assertThat(WatchDetectors.evaluate(range, series(20.0), "Amount").firing()).isFalse();
+      assertThat(WatchDetectors.evaluate(range, series(9.0), "Amount").firing()).isTrue();
+      assertThat(WatchDetectors.evaluate(range, series(21.0), "Amount").firing()).isTrue();
+   }
+
+   @Test
+   void categoriesCompareWithEntireTrailingWindow() throws Exception
+   {
+      var definition = parsed("NEW_CATEGORY", "CATEGORY_SET", "{\"k\":2}");
+      var baseline = List.of(new WatchBucket("1", 1.0, Set.of("a"), null), new WatchBucket("2", 1.0, Set.of("b"), null));
+      List<WatchBucket> values = new ArrayList<>(baseline);
+      values.add(new WatchBucket("3", 2.0, Set.of("a", "b"), null));
+      assertThat(WatchDetectors.evaluate(definition, values, "Status").firing()).isFalse();
+      values.set(2, new WatchBucket("3", 2.0, Set.of("a", "new"), null));
+      assertThat(WatchDetectors.evaluate(definition, values, "Status").message()).contains("1 new category");
+      values.set(2, new WatchBucket("3", 0.0, Set.of(), null));
+      assertThat(WatchDetectors.evaluate(definition, values, "Status").firing()).isFalse();
+   }
+
+   @Test
+   void nullRateDetectsDeltaOrConsecutiveRises() throws Exception
+   {
+      var definition = parsed("NULL_RATE_CREEP", "NULL_SHARE", "{\"k\":3}");
+      assertThat(WatchDetectors.evaluate(definition, series(0.1, 0.1, 0.1, 0.16), "Null share").firing()).isTrue();
+      assertThat(WatchDetectors.evaluate(definition, series(0.1, 0.11, 0.12, 0.13), "Null share").firing()).isTrue();
+      assertThat(WatchDetectors.evaluate(definition, series(0.1, 0.12, 0.11, 0.13), "Null share").firing()).isFalse();
+      assertThat(WatchDetectors.evaluate(definition, series(0.1, 0.11, 0.11, 0.12), "Null share").firing()).isFalse();
+   }
+
+   @ParameterizedTest
+   @ValueSource(strings = {"SPIKE", "DROP", "NEW_CATEGORY", "NULL_RATE_CREEP"})
+   void insufficientHistoryNeverBecomesRecovery(String detector) throws Exception
+   {
+      String metric = detector.equals("NEW_CATEGORY") ? "CATEGORY_SET" : detector.equals("NULL_RATE_CREEP") ? "NULL_SHARE" : "COUNT";
+      var result = WatchDetectors.evaluate(parsed(detector, metric, null), series(1.0), "Orders");
+      assertThat(result.evaluated()).isFalse();
+      assertThat(result.message()).contains("Not enough history");
+      assertThat(result.value()).isNull();
+      assertThat(result.drill()).isNull();
+   }
+
+   @Test
+   void emptyAndMissingNumericBucketsAreNotZero() throws Exception
+   {
+      var range = parsed("OUT_OF_RANGE", "AVG", "{\"min\":0,\"max\":1}");
+      assertThat(WatchDetectors.evaluate(range, List.of(), "Orders").evaluated()).isFalse();
+      assertThat(WatchDetectors.evaluate(range, series((Double) null), "Orders").evaluated()).isFalse();
+      assertThat(WatchDetectors.evaluate(range, series(Double.NaN), "Orders").evaluated()).isFalse();
+   }
+
+   @ParameterizedTest
+   @ValueSource(strings = {"[]", "{", "null", "{\"k\":0}", "{\"k\":1001}", "{\"k\":1.5}", "{\"k\":\"14\"}", "{\"threshold\":0}", "{\"threshold\":null}", "{\"relativeChange\":-1}", "{\"delta\":0.1}"})
+   void rejectsInvalidSpikeParameters(String json)
+   {
+      assertThatThrownBy(() -> parsed("SPIKE", "COUNT", json)).isInstanceOf(QBadRequestException.class);
+   }
+
+   @Test
+   void validatesMetricDetectorAndRangeCompatibility() throws Exception
+   {
+      assertThatThrownBy(() -> parsed("SPIKE", "CATEGORY_SET", null)).hasMessageContaining("NEW_CATEGORY");
+      assertThatThrownBy(() -> parsed("NEW_CATEGORY", "COUNT", null)).hasMessageContaining("CATEGORY_SET");
+      assertThatThrownBy(() -> parsed("NULL_RATE_CREEP", "SUM", null)).hasMessageContaining("NULL_SHARE");
+      assertThatThrownBy(() -> parsed("OUT_OF_RANGE", "COUNT", "{\"min\":2,\"max\":1}")).hasMessageContaining("min <= max");
+      assertThatThrownBy(() -> parsed("OUT_OF_RANGE", "COUNT", null)).hasMessageContaining("requires min and max");
+      assertThatThrownBy(() -> parsed("NULL_RATE_CREEP", "NULL_SHARE", "{\"delta\":2}")).hasMessageContaining("delta");
+      assertThatThrownBy(() -> parsed("NULL_RATE_CREEP", "NULL_SHARE", "{\"n\":0}")).hasMessageContaining("n must");
+      assertThat(parsed("SPIKE", "COUNT", null).k()).isEqualTo(14);
+      assertThat(parsed("SPIKE", "COUNT", null).threshold()).isEqualTo(3.5);
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/WatchesTest.java

@@ -0,0 +1,460 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.math.BigDecimal;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.ZoneOffset;
+import java.util.ArrayList;
+import java.util.List;
+import com.kingsrook.qbits.dataanalysis.app.DataAnalysisHome;
+import com.kingsrook.qbits.dataanalysis.engine.DrillFilters;
+import com.kingsrook.qbits.dataanalysis.model.DataAnalysisTables;
+import com.kingsrook.qbits.dataanalysis.processes.WatchActions;
+import com.kingsrook.qbits.dataanalysis.watch.WatchEvaluator;
+import com.kingsrook.qbits.dataanalysis.watch.WatchRecords;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.alerts.AlertResolution;
+import com.kingsrook.qqq.backend.core.alerts.AlertSignal;
+import com.kingsrook.qqq.backend.core.alerts.AlertSinkInterface;
+import com.kingsrook.qqq.backend.core.alerts.AlertsInstanceMetaData;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.instances.QInstanceEnricher;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepInput;
+import com.kingsrook.qqq.backend.core.model.actions.processes.RunBackendStepOutput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.security.RecordSecurityLock;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/*******************************************************************************
+ ** Real core memory rows, owner sessions, alerts SPI and record-action summaries.
+ *******************************************************************************/
+class WatchesTest
+{
+   static final LocalDate TODAY = LocalDate.now(ZoneOffset.UTC);
+   static final Instant NOW = TODAY.atTime(12, 0).toInstant(ZoneOffset.UTC);
+   private QInstance instance;
+   private DataAnalysisQBitConfig config;
+   private WatchEvaluator evaluator;
+   private final List<Integer> latestIds = new ArrayList<>();
+
+   public static class Sink implements AlertSinkInterface
+   {
+      static final List<AlertSignal> raised = new ArrayList<>();
+      static final List<AlertResolution> resolved = new ArrayList<>();
+
+      @Override
+      public void raise(AlertSignal signal)
+      {
+         raised.add(signal);
+      }
+
+      @Override
+      public void resolve(AlertResolution resolution)
+      {
+         resolved.add(resolution);
+      }
+
+      @Override
+      public void heartbeat(String key, Instant at)
+      {
+      }
+   }
+
+   static QSession owner(String user)
+   {
+      return (TestSupport.user(user).withPermissions("orders.read", "orders.analyze", "data_analysis.watch.read", "data_analysis.watch.edit", "data_analysis.saved.read")
+         .withValue(QSession.VALUE_KEY_USER_TIMEZONE, "UTC"));
+   }
+
+   @BeforeEach
+   void setup() throws Exception
+   {
+      instance = TestSupport.instance();
+      instance.addTable(new QTableMetaData().withName("orders").withLabel("Orders").withBackendName("memory").withPrimaryKeyField("id")
+         .withPermissionRules(DataAnalysisTables.permissionRules("orders"))
+         .withField(new QFieldMetaData("id", QFieldType.INTEGER)).withField(new QFieldMetaData("amount", QFieldType.DECIMAL))
+         .withField(new QFieldMetaData("created", QFieldType.DATE_TIME)).withField(new QFieldMetaData("day", QFieldType.DATE))
+         .withField(new QFieldMetaData("category", QFieldType.STRING)).withField(new QFieldMetaData("owner", QFieldType.STRING))
+         .withRecordSecurityLock(new RecordSecurityLock().withFieldName("owner").withSecurityKeyType(DataAnalysisTables.USER_KEY)));
+      new QInstanceEnricher(instance).enrich();
+      QContext.init(instance, TestSupport.admin().withPermissions("orders.read", "orders.insert", "orders.edit", "orders.analyze")
+         .withValue(QSession.VALUE_KEY_USER_TIMEZONE, "UTC"));
+      int[] counts = {10, 11, 9, 60};
+      for(int day = 0; day < 4; day++)
+      {
+         for(int i = 0; i < counts[day]; i++)
+         {
+            QRecord row = order(TODAY.minusDays(4 - day), "alice", i % 2 == 0 ? null : BigDecimal.TEN, day == 3 ? "new" : "old");
+            if(day == 3)
+            {
+               latestIds.add(row.getValueInteger("id"));
+            }
+         }
+      }
+      // Another owner and the incomplete current bucket must never affect Alice.
+      order(TODAY.minusDays(1), "bob", new BigDecimal("1000000"), "private");
+      order(TODAY, "alice", new BigDecimal("1000000"), "incomplete");
+      config = new DataAnalysisQBitConfig().withBackendName("memory").withOwnerSessionSupplier(WatchesTest::owner);
+      new DataAnalysisRuntime(config).addSelfToInstance(instance);
+      evaluator = DataAnalysisRuntime.watches();
+      Sink.raised.clear();
+      Sink.resolved.clear();
+      AlertsInstanceMetaData.ofOrWithNew(instance).withSink(new QCodeReference(Sink.class));
+   }
+
+   private QRecord order(LocalDate day, String owner, BigDecimal amount, String category) throws Exception
+   {
+      return (TestSupport.insert("orders", new QRecord().withValue("created", day.atTime(12, 0).toInstant(ZoneOffset.UTC))
+         .withValue("day", day).withValue("owner", owner).withValue("amount", amount).withValue("category", category)));
+   }
+
+   private QRecord watch(String detector, String metric, String parameters) throws Exception
+   {
+      return (TestSupport.insert(DataAnalysisTables.WATCH, WatchDetectorsTest.definition(detector, metric, parameters)));
+   }
+
+   private QRecord stored(QRecord watch) throws Exception
+   {
+      return (WatchRecords.get(DataAnalysisTables.WATCH, watch.getValue("id")));
+   }
+
+   @AfterEach
+   void cleanup()
+   {
+      QContext.clear();
+   }
+
+   @Test
+   void raisesAndResolvesOnceUsingOwnerRows() throws Exception
+   {
+      QRecord watch = watch("SPIKE", "COUNT", "{\"k\":3}");
+      QSession caller = QContext.getQSession();
+      var verdict = evaluator.evaluate(watch.getValue("id"), NOW);
+      assertThat(verdict.firing()).isTrue();
+      assertThat(verdict.value()).isEqualTo(60.0);
+      assertThat(QContext.getQSession()).isSameAs(caller);
+      assertThat(stored(watch).getValueString("state")).isEqualTo("FIRING");
+      assertThat(stored(watch).getValueInstant("last_evaluated_at")).isEqualTo(NOW);
+      assertThat(Sink.raised).hasSize(1);
+      AlertSignal signal = Sink.raised.getFirst();
+      assertThat(signal.getAlertTypeName()).isEqualTo(WatchEvaluator.ALERT_TYPE);
+      assertThat(signal.getDedupKey()).isEqualTo("data_analysis_watch:" + watch.getValue("id"));
+      assertThat(signal.getRecordRefs().getFirst().getTableName()).isEqualTo(DataAnalysisTables.WATCH);
+      assertThat(signal.getLinks().getFirst().getTableName()).isEqualTo("orders");
+      assertThat(signal.getLinks().getFirst().getUrl()).isNull();
+      assertThat(signal.getLinks().getFirst().getFilter()).isNotNull();
+      evaluator.evaluate(watch.getValue("id"), NOW);
+      assertThat(Sink.raised).hasSize(1);
+      for(int id : latestIds.subList(10, latestIds.size()))
+      {
+         UpdateInput update = new UpdateInput("orders").withRecords(List.of(new QRecord().withValue("id", id)
+            .withValue("created", TODAY.plusDays(1).atTime(12, 0).toInstant(ZoneOffset.UTC))));
+         update.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+         assertThat(new UpdateAction().execute(update).getRecords().getFirst().getErrors()).isNullOrEmpty();
+      }
+      assertThat(evaluator.evaluate(watch.getValue("id"), NOW).firing()).isFalse();
+      assertThat(stored(watch).getValueString("state")).isEqualTo("OK");
+      assertThat(Sink.resolved).hasSize(1);
+      assertThat(Sink.resolved.getFirst().getDedupKey()).isEqualTo(signal.getDedupKey());
+      evaluator.evaluate(watch.getValue("id"), NOW);
+      assertThat(Sink.resolved).hasSize(1);
+   }
+
+   @Test
+   void missingOrMismatchedOwnerSessionsNeverReadAsCaller() throws Exception
+   {
+      QRecord watch = watch("SPIKE", "COUNT", "{\"k\":3}");
+      config.withOwnerSessionSupplier(id -> null);
+      assertThat(evaluator.evaluate(watch.getValue("id"), NOW).message()).isEqualTo("Owner session unavailable");
+      assertThat(stored(watch).getValue("last_value")).isNull();
+      config.withOwnerSessionSupplier(id -> owner("bob"));
+      assertThat(evaluator.evaluate(watch.getValue("id"), NOW).message()).isEqualTo("Owner session unavailable");
+      config.withOwnerSessionSupplier(null);
+      assertThat(evaluator.evaluate(watch.getValue("id"), NOW).message()).isEqualTo("Owner session unavailable");
+      assertThat(Sink.raised).isEmpty();
+   }
+
+   @Test
+   void revokedReadOrAnalyzeSkipsWithoutResolving() throws Exception
+   {
+      QRecord watch = watch("SPIKE", "COUNT", "{\"k\":3}");
+      evaluator.evaluate(watch.getValue("id"), NOW);
+      for(String revoked : List.of("orders.read", "orders.analyze"))
+      {
+         config.withOwnerSessionSupplier(id ->
+         {
+            QSession session = owner(id);
+            session.getPermissions().remove(revoked);
+            return (session);
+         });
+         var verdict = evaluator.evaluate(watch.getValue("id"), NOW);
+         assertThat(verdict.evaluated()).isFalse();
+         assertThat(verdict.message()).contains("Owner lacks READ or Analyze");
+         assertThat(verdict.value()).isNull();
+         assertThat(verdict.drill()).isNull();
+         assertThat(stored(watch).getValueString("state")).isEqualTo("FIRING");
+         assertThat(stored(watch).getValue("last_value")).isNull();
+      }
+      assertThat(Sink.resolved).isEmpty();
+      assertThat(Sink.raised).hasSize(1);
+   }
+
+   @Test
+   void previewCoversAllMetricsAndPrivacy() throws Exception
+   {
+      QContext.setQSession(owner("alice"));
+      for(String metric : List.of("COUNT", "SUM", "AVG", "NULL_SHARE", "CATEGORY_SET"))
+      {
+         String detector = metric.equals("CATEGORY_SET") ? "NEW_CATEGORY" : metric.equals("NULL_SHARE") ? "NULL_RATE_CREEP" : "SPIKE";
+         QRecord definition = WatchDetectorsTest.definition(detector, metric, "{\"k\":3}");
+         if(metric.equals("CATEGORY_SET"))
+         {
+            definition.withValue("metric_json", "{\"operator\":\"CATEGORY_SET\",\"field\":\"category\"}");
+         }
+         var preview = new DataAnalysisService(config).watchPreview(definition, NOW);
+         assertThat(preview.series()).hasSize(4);
+         assertThat(preview.chart().getKind().name()).isEqualTo("TIME_SERIES");
+         assertThat(preview.chart().getAnnotations()).isNotEmpty();
+         assertThat(preview.verdict().evaluated()).isTrue();
+         if(metric.equals("CATEGORY_SET"))
+         {
+            assertThat(preview.verdict().firing()).isTrue();
+            assertThat(preview.series().getLast().categories()).containsExactly("new");
+         }
+         if(metric.equals("AVG"))
+         {
+            assertThat(preview.verdict().value()).isEqualTo(10.0);
+         }
+         if(metric.equals("NULL_SHARE"))
+         {
+            assertThat(preview.verdict().value()).isEqualTo(0.5);
+         }
+      }
+      var guarded = new DataAnalysisService(new DataAnalysisQBitConfig().withBackendName("memory").withDefaultMinGroupSize(12))
+         .watchPreview(WatchDetectorsTest.definition("SPIKE", "COUNT", "{\"k\":3}"), NOW);
+      assertThat(guarded.series()).isEmpty();
+      assertThat(guarded.verdict().message()).contains("Privacy guard");
+      assertThat(guarded.verdict().drill()).isNull();
+   }
+
+   @Test
+   void fullFieldPolicyAndRowLimitAreEnforced() throws Exception
+   {
+      QContext.setQSession(owner("alice"));
+      var restricted = new DataAnalysisQBitConfig().withBackendName("memory").withExcludeTables(java.util.Set.of("orders"));
+      assertThatThrownBy(() -> new DataAnalysisService(restricted).watchPreview(WatchDetectorsTest.definition("SPIKE", "COUNT", "{\"k\":3}"), NOW))
+         .hasMessageContaining("unavailable");
+      config.withFieldAnalysisAccessResolver(() -> (table, field) -> field.getName().equals("amount")
+         ? com.kingsrook.qbits.dataanalysis.engine.FieldAnalysisAccess.NONE : com.kingsrook.qbits.dataanalysis.engine.FieldAnalysisAccess.FULL);
+      QRecord definition = WatchDetectorsTest.definition("SPIKE", "SUM", "{\"k\":3}");
+      assertThatThrownBy(() -> new DataAnalysisService(config).watchPreview(definition, NOW)).hasMessageContaining("Unknown analysis field");
+      definition.withValue("metric_json", "{\"operator\":\"COUNT\"}").withValue("filter_json", "{\"criteria\":[{\"fieldName\":\"amount\",\"operator\":\"IS_BLANK\"}]}");
+      assertThatThrownBy(() -> new DataAnalysisService(config).watchPreview(definition, NOW)).hasMessageContaining("Unknown analysis field");
+   }
+
+   @Test
+   void actionsHaveReviewAndResultLinesAndEnableDisable() throws Exception
+   {
+      QRecord spike = watch("SPIKE", "COUNT", "{\"k\":3}");
+      QRecord ok = watch("OUT_OF_RANGE", "COUNT", "{\"min\":0,\"max\":100}");
+      QRecord secondOk = watch("DROP", "COUNT", "{\"k\":3}");
+      RunBackendStepInput input = new RunBackendStepInput().withProcessName(WatchActions.EVALUATE).withRecords(List.of(spike, ok, secondOk));
+      RunBackendStepOutput output = new RunBackendStepOutput();
+      WatchActions.Review review = new WatchActions.Review();
+      review.runOnePage(input, output);
+      assertThat(review.getProcessSummary(output, false)).hasSize(3).allSatisfy(line -> assertThat(line.toString()).contains("will be evaluated"));
+      assertThat(Sink.raised).isEmpty();
+      WatchActions.Result result = new WatchActions.Result();
+      result.runOnePage(input, new RunBackendStepOutput());
+      assertThat(result.getProcessSummary(output, true).getFirst().toString()).contains("3 watches evaluated: 1 firing, 2 OK");
+      for(String action : List.of(WatchActions.DISABLE, WatchActions.ENABLE))
+      {
+         WatchActions.Result load = new WatchActions.Result();
+         load.runOnePage(new RunBackendStepInput().withProcessName(action).withRecords(List.of(spike)), new RunBackendStepOutput());
+         assertThat(stored(spike).getValueBoolean("enabled")).isEqualTo(action.equals(WatchActions.ENABLE));
+         assertThat(load.getProcessSummary(output, true).getFirst().toString()).contains(action.equals(WatchActions.ENABLE) ? "1 watch enabled" : "1 watch disabled");
+      }
+   }
+
+   @Test
+   void scheduleEvaluatesEnabledAndHomeLinksFiringFirst() throws Exception
+   {
+      QRecord spike = watch("SPIKE", "COUNT", "{\"k\":3}");
+      QRecord disabled = watch("DROP", "COUNT", "{\"k\":3}");
+      evaluator.setEnabled(disabled.getValue("id"), false);
+      assertThat(evaluator.evaluateEnabled(NOW)).isEqualTo(1);
+      assertThat(stored(disabled).getValue("last_evaluated_at")).isNull();
+      String html = DataAnalysisHome.render(NOW);
+      assertThat(html.indexOf("Firing &middot; Spike")).isLessThan(html.indexOf("Ok &middot; Drop"));
+      assertThat(html).contains("/" + spike.getValue("id") + "\"");
+      assertThat(instance.getProcess(WatchActions.SCHEDULED).getIsHidden()).isTrue();
+      assertThat(instance.getProcess(WatchActions.EVALUATE).getTableName()).isEqualTo(DataAnalysisTables.WATCH);
+   }
+
+   @Test
+   void standardCrudValidatesPartialUpdatesAndOwnerLocks() throws Exception
+   {
+      QRecord watch = watch("SPIKE", "COUNT", "{\"k\":3}");
+      UpdateInput input = new UpdateInput(DataAnalysisTables.WATCH).withRecords(List.of(new QRecord().withValue("id", watch.getValue("id")).withValue("parameters_json", "{\"k\":0}")));
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      assertThat(new UpdateAction().execute(input).getRecords().getFirst().getErrors()).isNotEmpty();
+      assertThat(stored(watch).getValueString("parameters_json")).contains("3");
+      InsertInput invalid = new InsertInput(DataAnalysisTables.WATCH).withRecord(WatchDetectorsTest.definition("OUT_OF_RANGE", "COUNT", "{}"));
+      invalid.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      assertThat(new InsertAction().execute(invalid).getRecords().getFirst().getErrors()).isNotEmpty();
+      QContext.setQSession(owner("bob"));
+      assertThatThrownBy(() -> evaluator.preview(watch.getValue("id"), NOW)).hasMessageContaining("unavailable");
+      assertThatThrownBy(() -> evaluator.evaluate(watch.getValue("id"), NOW)).hasMessageContaining("unavailable");
+      QContext.setQSession(owner("alice"));
+      QContext.getQSession().getPermissions().remove("data_analysis.watch.edit");
+      assertThatThrownBy(() -> evaluator.evaluate(watch.getValue("id"), NOW)).hasMessageContaining("editing is unavailable");
+      assertThat(Sink.raised).isEmpty();
+   }
+
+   @Test
+   void savedAnalysisResolvesAsOwnerAndNoAlertsInstallationStillStoresState() throws Exception
+   {
+      QRecord saved = TestSupport.insert(DataAnalysisTables.SAVED, TestSupport.saved("alice", false)
+         .withValue("definition_json", "{\"values\":[{\"operator\":\"COUNT\"}]}"));
+      QRecord definition = WatchDetectorsTest.definition("SPIKE", "COUNT", "{\"k\":3}")
+         .withValue("saved_id", saved.getValue("id")).withValue("table_name", null).withValue("metric_json", null);
+      QRecord watch = TestSupport.insert(DataAnalysisTables.WATCH, definition);
+      AlertsInstanceMetaData.of(instance).withSink(null);
+      assertThat(evaluator.evaluate(watch.getValue("id"), NOW).firing()).isTrue();
+      assertThat(stored(watch).getValueString("state")).isEqualTo("FIRING");
+      assertThat(Sink.raised).isEmpty();
+   }
+
+   public static class AutomatedSessions implements com.kingsrook.qqq.backend.core.modules.authentication.QAuthenticationModuleCustomizerInterface
+   {
+      @Override
+      public void customizeAutomatedSessionForUser(QInstance instance, QSession session, java.io.Serializable userId)
+      {
+         QSession grants = owner(userId.toString());
+         session.setPermissions(grants.getPermissions());
+         session.setSecurityKeyValues(grants.getSecurityKeyValues());
+         session.withValue(QSession.VALUE_KEY_USER_TIMEZONE, "UTC");
+      }
+   }
+
+   @Test
+   void hostAuthenticationModuleSuppliesTheOwnerSession() throws Exception
+   {
+      config.withOwnerSessionSupplier(null);
+      instance.withInstanceDefaultAuthentication(new com.kingsrook.qqq.backend.core.model.metadata.authentication.QAuthenticationMetaData()
+         .withName("owner-auth").withType(com.kingsrook.qqq.backend.core.model.metadata.QAuthenticationType.MOCK).withCustomizer(new QCodeReference(AutomatedSessions.class)));
+      QRecord watch = watch("SPIKE", "COUNT", "{\"k\":3}");
+      assertThat(evaluator.evaluate(watch.getValue("id"), NOW).value()).isEqualTo(60.0);
+      assertThat(Sink.raised).hasSize(1);
+   }
+
+   @Test
+   void allCalendarUnitsExcludeCurrentBucketAndHaveExactDrills() throws Exception
+   {
+      for(String unit : List.of("HOUR", "DAY", "WEEK", "MONTH"))
+      {
+         java.time.ZonedDateTime end = NOW.atZone(ZoneOffset.UTC);
+         end = switch(unit)
+         {
+            case "HOUR" -> end.truncatedTo(java.time.temporal.ChronoUnit.HOURS);
+            case "WEEK" -> end.toLocalDate().with(java.time.temporal.TemporalAdjusters.previousOrSame(java.time.DayOfWeek.MONDAY)).atStartOfDay(ZoneOffset.UTC);
+            case "MONTH" -> end.toLocalDate().withDayOfMonth(1).atStartOfDay(ZoneOffset.UTC);
+            default -> end.toLocalDate().atStartOfDay(ZoneOffset.UTC);
+         };
+         java.time.temporal.ChronoUnit duration = switch(unit)
+         {
+            case "HOUR" -> java.time.temporal.ChronoUnit.HOURS;
+            case "WEEK" -> java.time.temporal.ChronoUnit.WEEKS;
+            case "MONTH" -> java.time.temporal.ChronoUnit.MONTHS;
+            default -> java.time.temporal.ChronoUnit.DAYS;
+         };
+         for(int ago : new int[] {2, 1, 1, 0})
+         {
+            TestSupport.insert("orders", new QRecord().withValue("owner", "alice").withValue("category", unit)
+               .withValue("created", end.minus(ago, duration).toInstant()).withValue("day", end.minus(ago, duration).toLocalDate()));
+         }
+         QRecord definition = WatchDetectorsTest.definition("SPIKE", "COUNT", "{\"k\":1}").withValue("bucket", unit)
+            .withValue("date_field", unit.equals("HOUR") ? "created" : "day")
+            .withValue("filter_json", com.kingsrook.qqq.backend.core.utils.JsonUtils.toJson(DrillFilters.condition("category", QCriteriaOperator.EQUALS, unit)));
+         QContext.setQSession(owner("alice"));
+         var preview = new DataAnalysisService(config).watchPreview(definition, NOW);
+         assertThat(preview.series()).as(unit).hasSize(2);
+         assertThat(preview.verdict().value()).as(unit).isEqualTo(2.0);
+         assertThat(preview.verdict().firing()).as(unit).isTrue();
+         var count = new com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput("orders").withFilter(preview.verdict().drill().getFilter());
+         count.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+         assertThat(new com.kingsrook.qqq.backend.core.actions.tables.CountAction().execute(count).getCount()).as(unit).isEqualTo(2);
+         QContext.setQSession(TestSupport.admin().withPermissions("orders.insert"));
+      }
+   }
+
+   @Test
+   void streamedProcessRunsSelectedRecordsThroughCore() throws Exception
+   {
+      QRecord watch = watch("SPIKE", "COUNT", "{\"k\":3}");
+      var input = new com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessInput().withProcessName(WatchActions.EVALUATE)
+         .withFrontendStepBehavior(com.kingsrook.qqq.backend.core.model.actions.processes.RunProcessInput.FrontendStepBehavior.SKIP)
+         .withCallback(new com.kingsrook.qqq.backend.core.actions.processes.QProcessCallback()
+         {
+            @Override
+            public com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter getQueryFilter()
+            {
+               return (DrillFilters.condition("id", QCriteriaOperator.EQUALS, watch.getValue("id")));
+            }
+         });
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      var output = new com.kingsrook.qqq.backend.core.actions.processes.RunProcessAction().execute(input);
+      assertThat(output.getException()).isEmpty();
+      assertThat(output.getValue(com.kingsrook.qqq.backend.core.processes.implementations.etl.streamedwithfrontend.StreamedETLWithFrontendProcess.FIELD_PROCESS_SUMMARY).toString())
+         .contains("1 watch evaluated: 1 firing, 0 OK");
+      assertThat(stored(watch).getValueString("state")).isEqualTo("FIRING");
+   }
+
+   @Test
+   void configuredSchedulerUsesFifteenMinuteInterval() throws Exception
+   {
+      var configured = new QInstance();
+      configured.addBackend(new com.kingsrook.qqq.backend.core.model.metadata.QBackendMetaData().withName("memory")
+         .withBackendType(com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryBackendModule.class));
+      new DataAnalysisQBitProducer().withQBitConfig(new DataAnalysisQBitConfig().withBackendName("memory").withSchedulerName("hostScheduler")).produce(configured);
+      var schedule = configured.getProcess(WatchActions.SCHEDULED).getSchedule();
+      assertThat(schedule.getSchedulerName()).isEqualTo("hostScheduler");
+      assertThat(schedule.getRepeatSeconds()).isEqualTo(900);
+      new WatchActions.Scheduled().run(new RunBackendStepInput(), new RunBackendStepOutput());
+   }
+}