Merge remote-tracking branch 'origin/feature/profile-endpoints' into feature/pivot

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,4 +6,29 @@ Following [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [Semantic
 
 ### Added
 
+- Phase c pivot backend and `POST /qbit/data-analysis/tables/{table}/pivot`, extension version 1.1.0, typed schemas and regenerated OpenAPI fragment.
+- Row/column dimensions, calendar/numeric buckets, seven measure operators, sparse cells, exact Other recomputation, totals, privacy suppression and count-equivalent drills.
+- Exposed-join dimensions and measures with READ/FULL checks; filter-only drills for to-one paths and explicit null-drill warnings for to-many paths whose joined-row counts can exceed record counts.
+- Configurable field-access resolver, cached reflective core tier bridge with legacy fallback, FULL-only capabilities/selections/labels, generated-drill protection and field-access cache fingerprints.
+- Shared memory/H2/PostgreSQL pivot contracts, HTTP drills and errors, reflective resolver/fallback and tier-change cache tests.
+
+- Session-bound profile, capability, distinct-value, duplicate and run endpoints, typed schemas and a checked OpenAPI fragment (introduced in extension 1.0.0).
+- Core table-feature permission registration and capability-directed aggregate pushdown, with native sampling and portable streamed fallbacks.
+- HTTP authorization, drill-to-core-count round trips, async polling, served OpenAPI and assistant discovery tests; H2 streamed and native-compatibility contract variants.
+
+### Changed
+
+- Scalable estimates sample each native aggregate without primary-key IN lists, scale counts using observed sample sizes, retain exact population totals and unscaled ratios, and drill over the full population. Portable estimates use one primary-key boundary and report unscaled prefix counts.
+
+- Target QQQ 4.1.0-RC.6; local verification uses `-Dqqq.snapshot.version=4.1.0-DATAANALYSIS-SNAPSHOT`.
+- Empty-string and temporal drills round-trip through core HTTP filter interpretation.
+
+### Previously added
+
+- Phase b host engine: typed column/table profiles, distinct pages, duplicates, count-equivalent drills, chart data, candidate keys and completeness heatmaps.
+- Internal `AnalysisBackend` port and RC.5 stand-in with aggregate pushdown, bounded query pages, deterministic prefix estimates and honest truncation metadata.
+- Personalized field/table authorization, enforced FK label lookup, runtime configuration overrides and minimum-group-size privacy before caching.
+- Owner-scoped exact runs, asynchronous session propagation, normalized SHA-256 request identities and data-version/TTL cache reuse.
+- Shared memory/H2/PostgreSQL contract tests for metric references, drill equivalence, permissions, locks, privacy, estimates, jobs and cache behavior. PostgreSQL tests skip when Docker is unavailable.
+
 - Repository scaffold; analysis settings, saved analyses, schedules, stars, watches and runs tables; permissions; Analyses app home.

README.md

@@ -2,13 +2,17 @@
 
 Statistical analysis and data dives on any QQQ table, filter or saved view: profiles, pivots, comparisons, anomalies, and saved and scheduled analyses. The approved [design is QRun-IO/qqq#1137](https://github.com/QRun-IO/qqq/pull/1137), `docs/DATA-ANALYSIS.md` in QQQ; [DESIGN.md](docs/DESIGN.md) includes its phase table.
 
-Implemented now: repository scaffold, producer and configuration, six visible tables, enum sources, joins and child lists, permissions and owner locks, PostgreSQL DDL generation, and the Analyses home with real counts. No analysis engine, Analyze action, processes, scheduling, alert evaluation, exports or UI API endpoints ship yet.
+## What works now
+
+The host API provides column and table profiles, distinct-value pages, duplicate groups, drill-through filters, effective per-table configuration, privacy suppression, and asynchronous exact runs with a persistent per-user cache. Metadata, six visible tables, owner locks, PostgreSQL DDL generation and the Analyses home are also available.
+
+Seven HTTP operations are available under `/qqq/v1/qbit/data-analysis`; the Analyze UI is a later phase. Pivots, comparisons, anomalies, saved-analysis execution, scheduling and exports remain later phases.
 
 ## Requirements
 
-- Java 21; QQQ **4.1.0-RC.5+**.
+- Java 21; QQQ **4.1.0-RC.6+**.
 - A configured QQQ backend for the qbit tables and authenticated sessions with permissions and security keys.
-- Later phases require the core aggregate extensions in DATA-ANALYSIS.md §3 and the UI API extension point ([qqq#1128](https://github.com/QRun-IO/qqq/pull/1128), RC.6).
+- Core aggregate and table-feature permission APIs ([qqq#1139](https://github.com/QRun-IO/qqq/pull/1139)) and the UI API extension point ([qqq#1128](https://github.com/QRun-IO/qqq/pull/1128)). Middleware Javalin remains optional; the producer registers endpoints only when it is present.
 
 ## Install
 
@@ -41,7 +45,7 @@ QQQ names and physical SQL table names are identical. `backendName` in configura
 | `data_analysis_watch` | Watches: metric, detector, parameters and observed state; links to saved analysis |
 | `data_analysis_run` | Analysis Runs: exact-run/cache result and history, scoped by user |
 
-Only Saved Analyses, Watches, Analysis Settings and Analysis Runs appear in navigation. Schedules, stars and linked watches appear on saved records. Enum PVS cover analysis kind, chart kind, detector, watch state, run status, schedule frequency and format. JSON definitions, requests and results are stored as text; typed request validation arrives with the relevant execution phase.
+Only Saved Analyses, Watches, Analysis Settings and Analysis Runs appear in navigation. Schedules, stars and linked watches appear on saved records. Enum PVS cover analysis kind, chart kind, detector, watch state, run status, schedule frequency and format. JSON definitions and results are stored as text. Profile, distinct-value and duplicate requests have typed Java contracts and are validated by the facade.
 
 ## Permissions
 
@@ -54,11 +58,11 @@ Only Saved Analyses, Watches, Analysis Settings and Analysis Runs appear in navi
 | `data_analysis.admin` | The all-access key of the `data_analysis_user` record locks (see Security) |
 | `<effective table permission base>.analyze` | Analyze a source table, also requiring its READ permission |
 
-`DataAnalysisPermissions.analyzePermissionName(table)` honors a custom permission base name and instance defaults. `canAnalyze(table)` requires both READ and the analyze permission; if instance core permission enforcement is off, only the READ check is waived. The feature check is a stand-in for core `TableFeaturePermissionsMetaData` (§3.6); hosts must grant these analyze names explicitly until that hook registers them in the catalog. All qbit tables use standard permission rules (no custom checker), so every name above appears in the core permission catalog and the qbit-authentik policy editor.
+`DataAnalysisPermissions.analyzePermissionName(table)` honors the effective table permission base. `canAnalyze(table)` delegates to core's table-feature permission check. The producer registers `analyze`, labelled **Analyze**, on configured source tables, excluding this qbit's own tables. No CRUD permission implies analyze. Core checks READ as well as the feature grant on protected tables. All analysis queries enforce permissions even when the instance default is off. Qbit CRUD permissions also appear in the core catalog.
 
 ## Security
 
-Every home count runs under the current `QContext` session with `PermissionEnforcement.ENFORCE`. A denied section explains the missing permission instead of showing zero. Mine and starred counts explicitly filter the current user even for administrators. Shared counts include only readable shared rows. Stars pointing at unreadable or deleted saved analyses do not count. Run counts cover starts within the last seven days, excluding future rows.
+Every engine operation and home count runs under the current `QContext` session with `PermissionEnforcement.ENFORCE`. A denied section explains the missing permission instead of showing zero. Mine and starred counts explicitly filter the current user even for administrators. Shared counts include only readable shared rows. Stars pointing at unreadable or deleted saved analyses do not count. Run counts cover starts within the last seven days, excluding future rows.
 
 Saved analyses have a READ_AND_WRITE lock on `owner_user_id`; stars and runs have locks on `user_id`. Schedules inherit the saved analysis owner's lock through their join. Null owners are denied. The host's authentication/session adapter must supply:
 
@@ -73,7 +77,11 @@ QQQ permissions and security-key values are separate. An admin permission alone
 
 **Shared READ is deliberately restricted in this scaffold.** The ordinary owner lock does not express owner OR shared while keeping writes owner-only, so setting `shared=true` currently does not expose a saved analysis to other users. Phase f will introduce separate read and write policies: reads permit owner OR shared only after checking `data_analysis.saved.read`; writes retain owner/admin checks. Query, get, count, joins, child lists and exports will receive cross-user regression tests before enabling shared READ. Collaboration sharing and favorites (§7.3, qqq#1136) will then replace the local sharing/star contracts. Shared analyses must always execute as their viewer.
 
-Minimum group size defaults to 0 (off). Hosts should configure it for personal-data tables. Privacy suppression and outlier restrictions are planned with the analysis engine; the scaffold does not compute or cache analysis results.
+Minimum group size defaults to 0 (off). Hosts should set it for personal-data tables. Groups, bins and distinct listings below N are merged into an Other row with no value or drill. Min/max, percentiles, mean and standard deviation are suppressed when the assessed population is below N. Outlier listings and their count's drill are removed whenever the guard is enabled. The guard runs before chart construction and before `result_json` is stored.
+
+Source fields must be present in personalized metadata, pass `FieldSecurityLockHelper`, and pass the configured allow/exclude lists. FK labels are queried with enforcement before core PVS formatting; unreadable related records or label fields fall back to the source id. This avoids RC.5's ordinary table-PVS translator's trusted permission bypass.
+
+Cached results are scoped to the authenticated user, normalized request, effective policy, session permissions/security keys/backend variants/time zone, and data version. Access and policy are checked again when retrieving runs. Hosts must grant `data_analysis.run.read`, `.insert` and `.edit` to analysis users for persisted profiles and exact jobs. Run errors contain safe text rather than backend data or query details.
 
 ## Configuration
 
@@ -92,25 +100,110 @@ Minimum group size defaults to 0 (off). Hosts should configure it for personal-d
 | `excludeTables` | Empty set |
 | `tableDefaults` | Empty map of table names to `TableAnalysisDefaults` |
 
-All properties have fluent `withX` setters. Global numeric defaults must be non-null and non-negative. Nullable per-table numeric overrides inherit global defaults; configured values must be non-negative. `TableAnalysisDefaults` also supports enabled, analyzable fields and excluded fields. Runtime table-config rows will take precedence over code defaults through the specified 60-second lookup in a later phase; the repository phase defines the configuration contract only.
+All properties have fluent `withX` setters. Global numeric defaults must be non-null and non-negative. Nullable per-table numeric overrides inherit global defaults; configured values must be non-negative. `TableAnalysisDefaults` also supports enabled, analyzable fields and excluded fields. Runtime `data_analysis_table_config` values override per-table code defaults, which override global defaults. Null row values inherit; blank field lists mean all readable fields or no exclusions. Include/exclude table lists remain an outer restriction, even if a runtime row enables the table. Only the config-row lookup uses a temporary system session, restored in `finally`. It selects configuration fields only and is memoized for 60 seconds. Settings editors can call `service.getConfigResolver().invalidate()` for immediate refresh.
+
+`max_rows` bounds the stand-in's selected population and retained records. An exact request disables sampling but still respects this bound and reports `truncated: true` when necessary; increase the limit to obtain a complete larger profile. Zero selects no rows in the stand-in. Above `sample_threshold_rows`, capable backends run each aggregate with `samplePercent = min(100, sample_rows * 100 / total)` on the user's filter. Counts, top values and histograms are scaled by the full population divided by the observed sample count for that call; ratios and descriptive statistics remain in sample units. The `rows` metric always reports the unsampled total for estimates. Other metrics carry `estimate: true` and an `≈ ` formatted prefix. Sampling never materializes a primary-key IN filter. Backends without sampling use one `pk <= boundary` criterion to compute an unscaled first-N prefix estimate. Estimate drills combine the original filter with the metric condition over the full population, so count/drill equivalence applies only to exact results. Warnings distinguish random samples from prefixes; `sampleRows`, `rowsScanned` and `asOf` describe coverage. `cache_ttl_minutes: 0` disables cache reuse.
+
+## Host API
+
+Call the facade with the authenticated user's `QContext` installed. The producer registers an instance-scoped runtime:
+
+```java
+import com.kingsrook.qbits.dataanalysis.DataAnalysisRuntime;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfileRequest;
+import com.kingsrook.qbits.dataanalysis.result.TableProfileRequest;
+import com.kingsrook.qbits.dataanalysis.result.DistinctValuesRequest;
+import com.kingsrook.qbits.dataanalysis.result.DuplicatesRequest;
+
+var service = DataAnalysisRuntime.service();
+var capabilities = service.capabilities("orders");
+var column = service.columnProfile(new ColumnProfileRequest()
+   .withTableName("orders").withFieldName("amount").withFilter(filter));
+var table = service.tableProfile(new TableProfileRequest()
+   .withTableName("orders").withFilter(filter));
+var values = service.distinctValues(new DistinctValuesRequest()
+   .withTableName("orders").withFieldName("status").withPage(0).withPageSize(100));
+var duplicates = service.duplicates(new DuplicatesRequest()
+   .withTableName("orders").withFields(java.util.List.of("customer", "status")));
+String runId = service.startExactRun(new ColumnProfileRequest()
+   .withTableName("orders").withFieldName("amount").withFilter(filter));
+var status = service.getRun(runId); // RUNNING, COMPLETE or FAILED; typed result on COMPLETE
+```
+
+`startExactRun` also accepts `TableProfileRequest`. Identical fresh exact requests reuse the existing COMPLETE row and id. A host may construct `DataAnalysisService(config, executor)` to use its managed executor; the default is the common pool. Workers receive a cloned session and instance context, with no inherited transaction or privileged action scope.
+
+The `result` package contains Serializable, Jackson-friendly request/result POJOs, semantic metrics, charts and drills. There are no frontend-specific fields. Distinct pages are zero-based with a maximum size of 500; search matches stored values. Guarded distinct groups are merged before pagination. Shares are fractions from 0 to 1. Numeric standard deviation is the sample statistic; percentiles match `percentile_cont` interpolation at `p * (n - 1)`. Date buckets use the session time zone (including DST), ISO Monday weeks and the specified 92-day/two-year/ten-year thresholds. Date range metrics are in days. Text shapes use at most the first 10,000 rows and state that sample size.
+
+Count drills combine an untouched copy of the request filter with their producing condition. Cardinality drills select one representative record per distinct non-null value; the privacy guard removes those representative drills. Truncated profiles retain their primary-key boundary in drills, so their counts remain reproducible. Serialized drill getters restore temporal operand types from the current instance metadata before core evaluates them.
+
+## HTTP endpoints
+
+Extension `data-analysis` version **1.1.0**, prefix `/qbit/data-analysis` inside `/qqq/v1`:
+
+| Method | Path after `/qqq/v1` | Body or purpose |
+| --- | --- | --- |
+| GET | `/qbit/data-analysis/tables/{table}/capabilities` | Availability, fields and charts, limits, backend capabilities, SQL Workbench presence |
+| POST | `/qbit/data-analysis/tables/{table}/column-profile` | `{fieldName, filter, exact}` |
+| POST | `/qbit/data-analysis/tables/{table}/distinct-values` | `{fieldName, filter, page, pageSize, search}` |
+| POST | `/qbit/data-analysis/tables/{table}/table-profile` | `{filter, fields}` |
+| POST | `/qbit/data-analysis/tables/{table}/duplicates` | `{fields, filter, limit}`; default limit 50, maximum 500 |
+| POST | `/qbit/data-analysis/tables/{table}/pivot` | `{rows, columns, values, filter, showTotals, limitGroups}`; 1–3 row dimensions, 0–2 column dimensions, 1–6 measures |
+| POST | `/qbit/data-analysis/runs` | `{operation: COLUMN_PROFILE or TABLE_PROFILE, tableName, request}` returns `{runId, status}` |
+| GET | `/qbit/data-analysis/runs/{runId}` | Status, timestamps, error, typed `columnProfile` or `tableProfile` |
+
+Every operation uses the request session through `DataAnalysisService`. Capabilities returns 200 with `canAnalyze: false` and no fields when denied. Other permission denials return 403, bad bodies or unavailable fields return 400, and unknown tables return 404. Core middleware supplies plain messages in its standard `{error: message}` JSON envelope. Run rows remain owner-locked.
+
+Requests and drills reuse core's `QueryFilter` JSON shape and schema reference. Versioned `DataAnalysis...V1` schemas cover profiles, metrics, drills, charts, series, points, field summaries, distinct and duplicate results, capabilities and runs. The [OpenAPI fragment](src/main/resources/openapi/qqq-v1/data-analysis.yaml) is checked against regeneration. The deployed `/qqq/v1/openapi.json` and `UiApiInvoker.listOperations()` include all eight operations.
+
+Regenerate deliberately after an API change:
+
+```bash
+./mvnw -o -q test -Dtest=DataAnalysisApiTest#contract -Dopenapi.write=true -Dqqq.snapshot.version=4.1.0-DATAANALYSIS-SNAPSHOT
+```
+
+## Pivot backend and field access
+
+`DataAnalysisService.pivot(PivotRequest)` returns sparse cells indexed into row/column header tuples, aligned totals, typed/formatted metrics, warnings and `asOf`. `COUNT` counts records (including null measure values); other operators require a field. `PERCENTILE` uses continuous interpolation with a fraction from 0 to 1. Calendar buckets use the session timezone. Numeric bins reuse profile nice-edge selection when explicit bounds are omitted; the last interior bin includes its maximum.
+
+The planner first requests count-ordered top-N groups for every dimension (default 50, maximum 200), then dimension counts for privacy/cardinality, one grouped matrix and one aggregate per totals level. Additional aggregates recompute merged Other cells/totals: averages, distinct counts and percentiles cannot safely be combined from displayed cells. Ordinary Other predicates exclude kept values and handle null/empty strings separately. Boolean, temporal and bucketed Other groups use equivalent membership/range predicates for core HTTP compatibility. Cyclic date predicates enumerate observed values through core grouping; memory numeric boundaries reuse the profiles' decimal-scale compatibility helper. Native pivots are exact; bounded core streamed fallback marks partial results as estimates and disables their drills.
+
+`joinTable.field` resolves only through an unambiguous exposed join path. Every table in that path requires READ and the selected field must be FULL; core enforces joins and record locks. The installed data-analysis snapshot does not contain the related-record picker path API, so this implementation uses `getExposedJoins()` and `QueryJoin`. Paths whose every hop is MANY_TO_ONE or ONE_TO_ONE in the analyzed direction support ordinary filter-only drills: core infers the joins from qualified criteria. To-many paths can multiply a base record, so their pivots retain null drills and warn that counts include one row per related table record.
+
+`min_group_size` suppresses rare dimension groups and rare row/column tuples; every measure of a small cell or total is suppressed, including COUNT, with no drill. Totals include the full authorized population. As with existing profiles, separate aggregate calls are not a transactional snapshot.
+
+Hosts can supply `withFieldAnalysisAccessResolver(() -> resolver)`. FULL fields alone appear in capabilities and may be selected. EXACT_MATCH_ONLY and NONE get the same 400 as an unknown field; user-authored filters are passed through for core enforcement. Generated drills using a restricted field (including representative primary keys) are disabled. Related PVS display labels also require FULL access. Exact-run cache identities hash the sorted FULL-field list, the optional core access fingerprint, and related label access.
+
+The default resolver discovers the optional core `fieldaccess.FieldAccessHelper` class and its static methods once. FULL maps to FULL, REVEALABLE to EXACT_MATCH_ONLY, MASKED/HIDDEN to NONE. Without that class, legacy field locks supply FULL/NONE. Replace the reflective calls when the core package ships. Reflection tests use a local stand-in helper rather than shadowing a future real core class at its FQN; the installed snapshot exercises the actual fallback selection. Exact-run persistence continues to support profiles only; pivot results are synchronous.
+
+## Backend selection
+
+`DataAnalysisService` selects `CoreAnalysisBackend` when the source backend advertises aggregate capabilities, including memory. Supported standard deviation, percentiles, null/blank counts, numeric/date buckets and length statistics execute through core aggregates as the current session. Unsupported primitives delegate to `StandInAnalysisBackend`. Patterns and derived length histograms remain streamed; representative distinct drills and cyclic-date membership use bounded scans.
+
+The installed snapshot requires H2 PostgreSQL compatibility mode for native bucket SQL (`GROUP BY` positions).
+
+`engine.AnalysisBackend` isolates profilers from backend-specific operators. `StandInAnalysisBackend` pushes down COUNT, COUNT_DISTINCT, MIN, MAX, AVG, SUM, grouped counts, aggregate ordering and limits through core actions. RC.5 has no aggregate OFFSET, so pages over-fetch through the requested end and slice locally. Memory grouping pagination and scale-sensitive decimal equality have isolated compatibility handling.
+
+Variance, interpolated percentiles, string lengths/shapes, date classification, whitespace detection and representative-row drills use bounded primary-key query pages. Histogram/date membership counts use enforced range/count queries after their boundaries have been calculated. Numeric histograms have 20 interior bins between p1 and p99 plus below/above bins, and the last interior bin is closed. Profiles include Tukey outliers, date gaps, date-time weekday/hour patterns, chart alternatives, a seven-bucket moving average, table completeness and candidate keys (single fields and pairs among the eight most unique).
+
+Data versions use filtered COUNT plus MAX of a readable modification-date-like field, otherwise MAX(primary key). This is the specified inexpensive invalidation heuristic, not snapshot isolation; updates on a table without a modification timestamp can remain cached until TTL expiry. Concurrent writes can also change drill counts after a profile is produced. Results always retain `asOf`.
 
 ## Adopting in another app
 
 1. Add a backend, install the producer and run the usual `QInstanceValidator`.
 2. For PostgreSQL, obtain `DataAnalysisSchema.postgresScript(config)` and apply it through your application's migration system. It derives fields and unique indexes from table metadata. It does not execute DDL or upgrade existing schemas.
 3. Map user-id security keys and permissions in the authentication adapter. Configure core audit persistence if field audit history is needed.
-4. Review per-table include/exclude sets, limits and minimum group sizes before enabling future computation. Integrate Saved Analyses and Watches with host ESB/Quick Search when those optional host features are installed; this scaffold does not add those dependencies.
+4. Review per-table include/exclude sets, limits and minimum group sizes before enabling analysis. Integrate Saved Analyses and Watches with host ESB/Quick Search when those optional host features are installed; this scaffold does not add those dependencies.
 5. Use the Analyses home as the owner of analysis data. Other dashboards should link there until saved-analysis widgets are implemented.
 
-Planned phases: **a** core aggregate extensions; **b** profiles, drill-through, runs/cache and endpoints; **c** pivots; **d** comparisons and relationships; **e** watch evaluation and alerts; **f** saved-analysis execution, sharing, stars integration, schedules, chart widgets, full home and exports. The current home summarizes stored rows; it does not run analyses or send deliveries.
+Phase **b** profiles, drill-through, runs/cache and HTTP endpoints, and phase **c** pivot backend are implemented. Remaining work: **b** analysis UI; **c** pivot UI; **d** comparisons and relationships; **e** watch evaluation and alerts; **f** saved-analysis execution, sharing, stars integration, schedules, chart widgets, full home and exports. The current home summarizes stored rows; the host facade executes profiles. The home does not send deliveries.
 
 ## Build
 
 ```bash
-./mvnw verify
+./mvnw -o -q verify -Dqqq.snapshot.version=4.1.0-DATAANALYSIS-SNAPSHOT
 ```
 
-The wrapper pins Maven 3.9.11. On Windows use `mvnw.cmd`. Verification runs Checkstyle, JUnit 5/AssertJ tests against the memory backend and JaCoCo gates of 70% instructions and 90% classes. For a populated local dependency cache use `./mvnw -o -q verify`. RDBMS, H2, Testcontainers PostgreSQL and the PostgreSQL driver remain test-scoped for later pushdown tests; middleware Javalin is optional.
+The wrapper pins Maven 3.9.11. On Windows use `mvnw.cmd`. Verification runs Checkstyle, a shared JUnit 5/AssertJ contract suite on memory and H2, PostgreSQL via Testcontainers when Docker is available, and JaCoCo gates of 70% instructions and 90% classes. The suite checks numerical references, every exact count/drill pair, full-population estimate drills, security, guarded cache JSON, native sampling, asynchronous jobs and cache invalidation. The POM targets RC.6; until its release, always supply the locally installed snapshot override shown above. RDBMS, H2, Testcontainers PostgreSQL and the PostgreSQL driver are test-scoped; middleware Javalin is optional.
 
 ## License
 

pom.xml

@@ -85,6 +85,11 @@
          <artifactId>qqq-backend-module-rdbms</artifactId>
          <scope>test</scope>
       </dependency>
+      <dependency>
+         <groupId>com.kingsrook.qqq</groupId>
+         <artifactId>qqq-backend-module-postgres</artifactId>
+         <scope>test</scope>
+      </dependency>
       <dependency>
          <groupId>org.postgresql</groupId>
          <artifactId>postgresql</artifactId>
@@ -210,7 +215,7 @@
             <activeByDefault>true</activeByDefault>
          </activation>
          <properties>
-            <qqq.snapshot.version>4.1.0-RC.5</qqq.snapshot.version>
+            <qqq.snapshot.version>4.1.0-RC.6</qqq.snapshot.version>
          </properties>
          <dependencyManagement>
             <dependencies>

src/main/java/com/kingsrook/qbits/dataanalysis/DataAnalysisQBitConfig.java

@@ -26,6 +26,9 @@ import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.function.Supplier;
+import com.kingsrook.qbits.dataanalysis.engine.CoreTierFieldAccessResolver;
+import com.kingsrook.qbits.dataanalysis.engine.FieldAnalysisAccessResolver;
 import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
 import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitConfig;
 
@@ -35,6 +38,7 @@ import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitConfig;
  *******************************************************************************/
 public class DataAnalysisQBitConfig implements QBitConfig
 {
+   private Supplier<FieldAnalysisAccessResolver> fieldAnalysisAccessResolver = CoreTierFieldAccessResolver::defaultResolver;
    private String backendName;
    private String schedulerName;
    private String appName = "dataAnalysis";
@@ -387,4 +391,21 @@ public class DataAnalysisQBitConfig implements QBitConfig
       this.tableDefaults = tableDefaults;
       return (this);
    }
+
+   /*******************************************************************************
+    ** Host override for session-aware field analysis access.
+    *******************************************************************************/
+   public Supplier<FieldAnalysisAccessResolver> getFieldAnalysisAccessResolver()
+   {
+      return (fieldAnalysisAccessResolver);
+   }
+
+   /*******************************************************************************
+    ** Configure an instance supplier; each service resolves one policy instance.
+    *******************************************************************************/
+   public DataAnalysisQBitConfig withFieldAnalysisAccessResolver(Supplier<FieldAnalysisAccessResolver> resolver)
+   {
+      this.fieldAnalysisAccessResolver = java.util.Objects.requireNonNull(resolver);
+      return (this);
+   }
 }

src/main/java/com/kingsrook/qbits/dataanalysis/DataAnalysisQBitProducer.java

@@ -21,9 +21,12 @@
 package com.kingsrook.qbits.dataanalysis;
 
 
+import com.kingsrook.qbits.dataanalysis.api.DataAnalysisApi;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.model.metadata.MetaDataProducerMultiOutput;
 import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.TableFeaturePermission;
+import com.kingsrook.qqq.backend.core.model.metadata.permissions.TableFeaturePermissionsMetaData;
 import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitMetaData;
 import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitMetaDataProducer;
 
@@ -128,6 +131,23 @@ public class DataAnalysisQBitProducer implements QBitMetaDataProducer<DataAnalys
       qBitConfig.validate(instance);
       MetaDataProducerMultiOutput output = QBitMetaDataProducer.super.produce(instance);
       output.addSelfToInstance(instance);
+      new DataAnalysisRuntime(qBitConfig).addSelfToInstance(instance);
+      var included = java.util.Set.copyOf(qBitConfig.getIncludeTables());
+      var excluded = java.util.Set.copyOf(qBitConfig.getExcludeTables());
+      TableFeaturePermissionsMetaData.ofOrWithNew(instance).withPermission(new TableFeaturePermission()
+         .withSuffix("analyze").withLabel("Analyze").withImpliedBy(null)
+         .withAppliesTo((qInstance, table) -> !table.getName().startsWith(DataAnalysisQBitConfig.TABLE_NAME_PREFIX)
+            && (included.isEmpty() || included.contains(table.getName())) && !excluded.contains(table.getName())));
+      try
+      {
+         Class.forName("io.javalin.Javalin");
+         Class.forName("com.kingsrook.qqq.middleware.javalin.QJavalinImplementation");
+         DataAnalysisApi.register(instance);
+      }
+      catch(ClassNotFoundException expected)
+      {
+         // The engine and metadata also work without the optional middleware.
+      }
       if(qBitConfig.getParentAppName() != null && instance.getApp(qBitConfig.getParentAppName()) != null)
       {
          instance.getApp(qBitConfig.getParentAppName()).withChild(instance.getApp(qBitConfig.getAppName()));

src/main/java/com/kingsrook/qbits/dataanalysis/DataAnalysisRuntime.java

@@ -0,0 +1,73 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.model.metadata.QSupplementalInstanceMetaData;
+
+/*******************************************************************************
+ ** Instance-scoped service holder for UI API endpoints and host integrations.
+ *******************************************************************************/
+public class DataAnalysisRuntime implements QSupplementalInstanceMetaData
+{
+   private final transient DataAnalysisService service;
+
+   /*******************************************************************************
+    ** Create a runtime for one configured instance.
+    *******************************************************************************/
+   public DataAnalysisRuntime(DataAnalysisQBitConfig config)
+   {
+      service = new DataAnalysisService(config);
+   }
+
+
+
+   /*******************************************************************************
+    ** Stable supplemental metadata name.
+    *******************************************************************************/
+   @Override
+   public String getName()
+   {
+      return ("dataAnalysisRuntime");
+   }
+
+
+
+   /*******************************************************************************
+    ** Runtime objects never appear in metadata JSON.
+    *******************************************************************************/
+   @JsonIgnore
+   public DataAnalysisService getService()
+   {
+      return (service);
+   }
+
+
+
+   /*******************************************************************************
+    ** Locate the service belonging to the current QInstance.
+    *******************************************************************************/
+   public static DataAnalysisService service()
+   {
+      return (((DataAnalysisRuntime) QContext.getQInstance().getSupplementalMetaData("dataAnalysisRuntime")).getService());
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/DataAnalysisService.java

@@ -0,0 +1,283 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.Executor;
+import com.kingsrook.qbits.dataanalysis.engine.AnalysisBackend;
+import com.kingsrook.qbits.dataanalysis.engine.AnalysisDrillGuard;
+import com.kingsrook.qbits.dataanalysis.engine.AnalysisLabels;
+import com.kingsrook.qbits.dataanalysis.engine.AnalysisSecurity;
+import com.kingsrook.qbits.dataanalysis.engine.ColumnProfiler;
+import com.kingsrook.qbits.dataanalysis.engine.CoreAnalysisBackend;
+import com.kingsrook.qbits.dataanalysis.engine.DistinctValues;
+import com.kingsrook.qbits.dataanalysis.engine.DrillFilters;
+import com.kingsrook.qbits.dataanalysis.engine.DuplicateFinder;
+import com.kingsrook.qbits.dataanalysis.engine.EffectiveConfigResolver;
+import com.kingsrook.qbits.dataanalysis.engine.FieldAnalysisAccessResolver;
+import com.kingsrook.qbits.dataanalysis.engine.PivotExplorer;
+import com.kingsrook.qbits.dataanalysis.engine.StandInAnalysisBackend;
+import com.kingsrook.qbits.dataanalysis.engine.TableProfiler;
+import com.kingsrook.qbits.dataanalysis.result.AnalysisRequest;
+import com.kingsrook.qbits.dataanalysis.result.Capabilities;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfile;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfileRequest;
+import com.kingsrook.qbits.dataanalysis.result.DistinctValuesPage;
+import com.kingsrook.qbits.dataanalysis.result.DistinctValuesRequest;
+import com.kingsrook.qbits.dataanalysis.result.DuplicatesRequest;
+import com.kingsrook.qbits.dataanalysis.result.DuplicatesResult;
+import com.kingsrook.qbits.dataanalysis.result.PivotRequest;
+import com.kingsrook.qbits.dataanalysis.result.PivotResult;
+import com.kingsrook.qbits.dataanalysis.result.RunStatus;
+import com.kingsrook.qbits.dataanalysis.result.TableProfile;
+import com.kingsrook.qbits.dataanalysis.result.TableProfileRequest;
+import com.kingsrook.qbits.dataanalysis.run.AnalysisRunService;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+
+/*******************************************************************************
+ ** Single host facade for analysis; all entry points use the calling QContext.
+ *******************************************************************************/
+public class DataAnalysisService
+{
+   private final EffectiveConfigResolver configs;
+   private final AnalysisSecurity security;
+   private final FieldAnalysisAccessResolver fieldAccess;
+   private final AnalysisRunService runs;
+
+   /*******************************************************************************
+    ** Default asynchronous jobs use the common executor with captured context.
+    *******************************************************************************/
+   public DataAnalysisService(DataAnalysisQBitConfig config)
+   {
+      this(config, java.util.concurrent.ForkJoinPool.commonPool());
+   }
+
+
+
+   /*******************************************************************************
+    ** Hosts may supply their managed executor.
+    *******************************************************************************/
+   public DataAnalysisService(DataAnalysisQBitConfig config, Executor executor)
+   {
+      configs = new EffectiveConfigResolver(config);
+      fieldAccess = config.getFieldAnalysisAccessResolver().get();
+      security = new AnalysisSecurity(configs, fieldAccess);
+      runs = new AnalysisRunService(this, executor);
+   }
+
+
+
+   /*******************************************************************************
+    ** Expose only readable, configured fields and detached effective settings.
+    *******************************************************************************/
+   public Capabilities capabilities(String table) throws QException
+   {
+      return (new Capabilities().withTableName(table).withFields(security.analyzableFields(table).stream().map(QFieldMetaData::getName).toList())
+         .withConfig(configs.resolve(table)).withBackend(CoreAnalysisBackend.capabilities(table).isEmpty() ? "Streamed analysis" : "Core aggregate pushdown"));
+   }
+
+
+
+   /*******************************************************************************
+    ** Estimate above the threshold; otherwise reuse or persist an exact run.
+    *******************************************************************************/
+   public ColumnProfile columnProfile(ColumnProfileRequest request) throws QException
+   {
+      validate(request);
+      return (runs.columnProfile(request));
+   }
+
+
+
+   /*******************************************************************************
+    ** Table profiles share the exact-run cache lifecycle.
+    *******************************************************************************/
+   public TableProfile tableProfile(TableProfileRequest request) throws QException
+   {
+      validate(request);
+      return (runs.tableProfile(request));
+   }
+
+
+
+   /*******************************************************************************
+    ** Page guarded distinct values as the current user.
+    *******************************************************************************/
+   public DistinctValuesPage distinctValues(DistinctValuesRequest request) throws QException
+   {
+      validate(request);
+      return (protect(new DistinctValues(backend(request.getTableName()), fieldAccess).page(request, security.field(request.getTableName(), request.getFieldName()), configs.resolve(request.getTableName())), request));
+   }
+
+
+
+   /*******************************************************************************
+    ** Find guarded duplicate groups using only authorized fields.
+    *******************************************************************************/
+   public DuplicatesResult duplicates(DuplicatesRequest request) throws QException
+   {
+      validate(request);
+      return (protect(new DuplicateFinder(backend(request.getTableName())).find(request, configs.resolve(request.getTableName())), request));
+   }
+
+
+
+   /*******************************************************************************
+    ** Start either supported exact profile kind and return the persistent run id.
+    *******************************************************************************/
+   public String startExactRun(AnalysisRequest request) throws QException
+   {
+      validate(request);
+      return (runs.startExactRun(request));
+   }
+
+
+
+   /*******************************************************************************
+    ** Owner-locked status plus a typed completed result.
+    *******************************************************************************/
+   public RunStatus getRun(String id) throws QException
+   {
+      return (runs.getRun(id));
+   }
+
+
+
+   /*******************************************************************************
+    ** Settings editors can force an immediate runtime-policy refresh.
+    *******************************************************************************/
+   public EffectiveConfigResolver getConfigResolver()
+   {
+      return (configs);
+   }
+
+
+
+   /*******************************************************************************
+    ** Select core pushdown when the backend advertises analysis capabilities.
+    *******************************************************************************/
+   public AnalysisBackend backend(String table) throws QException
+   {
+      return (CoreAnalysisBackend.capabilities(table).isEmpty() ? new StandInAnalysisBackend(configs.resolve(table)) : new CoreAnalysisBackend(configs.resolve(table)));
+   }
+
+
+
+   /*******************************************************************************
+    ** Validate every entry point before counting source data or consulting cache.
+    *******************************************************************************/
+   public void validate(AnalysisRequest request) throws QException
+   {
+      if(request == null || request.getTableName() == null)
+      {
+         throw new QException("An analysis table is required.");
+      }
+      security.table(request.getTableName());
+      if(request instanceof ColumnProfileRequest column)
+      {
+         security.field(request.getTableName(), column.getFieldName());
+      }
+      else if(request instanceof DistinctValuesRequest distinct)
+      {
+         security.field(request.getTableName(), distinct.getFieldName());
+      }
+      else if(request instanceof DuplicatesRequest duplicates)
+      {
+         if(duplicates.getFields() == null || duplicates.getFields().isEmpty())
+         {
+            throw new QException("Choose at least one duplicate field.");
+         }
+         for(String field : duplicates.getFields())
+         {
+            security.field(request.getTableName(), field);
+         }
+      }
+      else if(request instanceof TableProfileRequest table && table.getFields() != null)
+      {
+         for(String field : table.getFields())
+         {
+            security.field(request.getTableName(), field);
+         }
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** The run layer supplies the scope; privacy is applied by the profiler.
+    *******************************************************************************/
+   public ColumnProfile compute(ColumnProfileRequest request, AnalysisBackend backend, AnalysisBackend.Scope scope) throws QException
+   {
+      validate(request);
+      return (protect(new ColumnProfiler(backend, fieldAccess).profile(request, security.field(request.getTableName(), request.getFieldName()), scope, configs.resolve(request.getTableName())), request));
+   }
+
+
+
+   /*******************************************************************************
+    ** Resolve requested fields against personalized metadata on every execution.
+    *******************************************************************************/
+   public TableProfile compute(TableProfileRequest request, AnalysisBackend backend, AnalysisBackend.Scope scope) throws QException
+   {
+      validate(request);
+      List<QFieldMetaData> fields = security.analyzableFields(request.getTableName()).stream()
+         .filter(f -> request.getFields() == null || request.getFields().contains(f.getName())).toList();
+      return (protect(new TableProfiler(backend).profile(request, fields, scope), request));
+   }
+
+   /*******************************************************************************
+    ** Field policy identity is re-evaluated before cache reads and writes.
+    *******************************************************************************/
+   public String fieldAccessFingerprint(String table) throws QException
+   {
+      return (security.accessFingerprint(table));
+   }
+
+   /*******************************************************************************
+    ** Execute a pivot as the current user through core aggregates.
+    *******************************************************************************/
+   public PivotResult pivot(PivotRequest request) throws QException
+   {
+      validate(request);
+      return (new PivotExplorer(security, configs.resolve(request.getTableName())).execute(request));
+   }
+
+   /*******************************************************************************
+    ** Generated primary-key drills also obey the configured field-access seam.
+    *******************************************************************************/
+   private <T> T protect(T result, AnalysisRequest request) throws QException
+   {
+      new AnalysisDrillGuard(Set.copyOf(capabilities(request.getTableName()).getFields()),
+         DrillFilters.restoreTypes(request.getTableName(), request.getFilter())).apply(result);
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Include resolved tiers of related label fields in cache identity.
+    *******************************************************************************/
+   public Map<String, Object> fieldAccessPolicy(String table) throws QException
+   {
+      return (AnalysisLabels.policy(table, fieldAccess));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/api/DataAnalysisApi.java

@@ -0,0 +1,580 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.api;
+
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.dataanalysis.DataAnalysisRuntime;
+import com.kingsrook.qbits.dataanalysis.DataAnalysisService;
+import com.kingsrook.qbits.dataanalysis.engine.CoreAnalysisBackend;
+import com.kingsrook.qbits.dataanalysis.result.AnalysisRequest;
+import com.kingsrook.qbits.dataanalysis.result.ChartKind;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfileRequest;
+import com.kingsrook.qbits.dataanalysis.result.DistinctValuesRequest;
+import com.kingsrook.qbits.dataanalysis.result.DuplicatesRequest;
+import com.kingsrook.qbits.dataanalysis.result.PivotRequest;
+import com.kingsrook.qbits.dataanalysis.result.TableProfileRequest;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+import com.kingsrook.qqq.middleware.javalin.specs.BasicOperation;
+import com.kingsrook.qqq.middleware.javalin.specs.extensions.AbstractJsonEndpointSpec;
+import com.kingsrook.qqq.middleware.javalin.specs.extensions.MiddlewareSpecExtension;
+import com.kingsrook.qqq.middleware.javalin.specs.extensions.MiddlewareSpecExtensionsMetaData;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import com.kingsrook.qqq.openapi.model.In;
+import com.kingsrook.qqq.openapi.model.Parameter;
+import com.kingsrook.qqq.openapi.model.Schema;
+import com.kingsrook.qqq.openapi.model.Type;
+
+/*******************************************************************************
+ ** Session-bound profile operations registered only with optional Javalin present.
+ *******************************************************************************/
+public class DataAnalysisApi
+{
+   public static final String PREFIX = "/qbit/data-analysis";
+
+   /*******************************************************************************
+    ** Publish the extension through the core spec registry.
+    *******************************************************************************/
+   public static void register(QInstance instance)
+   {
+      MiddlewareSpecExtensionsMetaData.ofOrWithNew(instance).withExtension(extension());
+   }
+
+   /*******************************************************************************
+    ** The same descriptor drives routes, OpenAPI and assistant tool discovery.
+    *******************************************************************************/
+   public static MiddlewareSpecExtension extension()
+   {
+      return (new MiddlewareSpecExtension().withName("data-analysis").withSemanticVersion("1.1.0")
+         .withDescription("Profiles, pivots, distinct values, duplicate groups and exact analysis runs as the signed-in user.")
+         .withSpec(CapabilitiesSpec.class).withSpec(ColumnProfileSpec.class).withSpec(DistinctValuesSpec.class)
+         .withSpec(PivotSpec.class).withSpec(TableProfileSpec.class).withSpec(DuplicatesSpec.class).withSpec(StartRunSpec.class).withSpec(GetRunSpec.class));
+   }
+
+   /*******************************************************************************
+    ** Common schema catalog and path parameters for the seven JSON specs.
+    *******************************************************************************/
+   public abstract static class ProfileSpec extends AbstractJsonEndpointSpec
+   {
+      private final String path;
+      private final HttpMethod method;
+      private final String summary;
+      private final String description;
+      private final String request;
+      private final String response;
+
+      /*******************************************************************************
+       ** Bind immutable operation metadata.
+       *******************************************************************************/
+      protected ProfileSpec(String path, HttpMethod method, String summary, String description, String request, String response)
+      {
+         this.path = path;
+         this.method = method;
+         this.summary = summary;
+         this.description = description;
+         this.request = request;
+         this.response = response;
+      }
+
+      /*******************************************************************************
+       ** Assistant-facing operation purpose.
+       *******************************************************************************/
+      @Override
+      public BasicOperation defineBasicOperation()
+      {
+         return (new BasicOperation().withPath(PREFIX + path).withHttpMethod(method).withShortSummary(summary).withLongDescription(description));
+      }
+
+      /*******************************************************************************
+       ** Required path parameter, when present.
+       *******************************************************************************/
+      @Override
+      public List<Parameter> defineRequestParameters()
+      {
+         String name = path.contains("{table}") ? "table" : path.contains("{runId}") ? "runId" : null;
+         return (name == null ? List.of() : List.of(new Parameter().withName(name).withIn(In.PATH).withRequired(true)
+            .withDescription(name.equals("table") ? "QQQ table name to analyze." : "Owner-scoped analysis run id.").withSchema(new Schema().withType(Type.STRING))));
+      }
+
+      /*******************************************************************************
+       ** Versioned request schema.
+       *******************************************************************************/
+      @Override
+      protected Schema defineRequestBodySchema()
+      {
+         return (request == null ? null : new Schema().withRef("#/components/schemas/DataAnalysis" + request + "V1"));
+      }
+
+      /*******************************************************************************
+       ** Versioned response schema.
+       *******************************************************************************/
+      @Override
+      protected String getResponseSchemaName()
+      {
+         return ("DataAnalysis" + response + "V1");
+      }
+
+      /*******************************************************************************
+       ** Include all referenced transport models and the shared core filter.
+       *******************************************************************************/
+      @Override
+      public Map<String, Schema> defineComponentSchemas()
+      {
+         return (this instanceof CapabilitiesSpec ? DataAnalysisSchemas.components() : Map.of());
+      }
+   }
+
+   /*******************************************************************************
+    ** Existing table lookup before invoking permission-sensitive operations.
+    *******************************************************************************/
+   private static QTableMetaData table(String name) throws QNotFoundException
+   {
+      QTableMetaData table = QContext.getQInstance().getTable(name);
+      if(table == null)
+      {
+         throw new QNotFoundException("Unknown analysis table.");
+      }
+      return (table);
+   }
+
+   /*******************************************************************************
+    ** Parse one JSON object with strict scalar/list types and core filter JSON.
+    *******************************************************************************/
+   private static AnalysisRequest request(String operation, String table, Map<String, Object> body) throws Exception
+   {
+      table(table);
+      DataAnalysisService service = DataAnalysisRuntime.service();
+      List<String> readable = service.capabilities(table).getFields();
+      try
+      {
+         for(String name : List.of("fieldName", "search"))
+         {
+            if(body.get(name) != null && !(body.get(name) instanceof String))
+            {
+               throw new IllegalArgumentException(name + " must be a string.");
+            }
+         }
+         if(body.get("exact") != null && !(body.get("exact") instanceof Boolean))
+         {
+            throw new IllegalArgumentException("exact must be a boolean.");
+         }
+         QQueryFilter filter = body.get("filter") == null ? null : JsonUtils.toObject(JsonUtils.toJson(body.get("filter")), QQueryFilter.class);
+         validateFilter(filter);
+         List<String> fields = null;
+         if(body.get("fields") != null)
+         {
+            if(!(body.get("fields") instanceof List<?> values) || values.stream().anyMatch(v -> !(v instanceof String)))
+            {
+               throw new IllegalArgumentException("fields must be an array of field names.");
+            }
+            fields = ((List<?>) body.get("fields")).stream().map(String.class::cast).toList();
+            if(fields.isEmpty() || !readable.containsAll(fields))
+            {
+               throw new IllegalArgumentException("Choose readable analysis fields.");
+            }
+         }
+         String field = (String) body.get("fieldName");
+         if((operation.equals("COLUMN_PROFILE") || operation.equals("DISTINCT_VALUES")) && !readable.contains(field))
+         {
+            throw new IllegalArgumentException("Choose a readable analysis field.");
+         }
+         boolean exact = Boolean.TRUE.equals(body.get("exact"));
+         return (switch(operation)
+         {
+            case "COLUMN_PROFILE" -> new ColumnProfileRequest().withTableName(table).withFilter(filter).withFieldName(field).withExact(exact);
+            case "TABLE_PROFILE" -> new TableProfileRequest().withTableName(table).withFilter(filter).withFields(fields);
+            case "DISTINCT_VALUES" -> new DistinctValuesRequest().withTableName(table).withFilter(filter).withFieldName(field)
+               .withPage(integer(body, "page", 0, 0, 1_000_000)).withPageSize(integer(body, "pageSize", 100, 1, 500)).withSearch((String) body.get("search"));
+            case "DUPLICATES" -> new DuplicatesRequest().withTableName(table).withFilter(filter)
+               .withFields(java.util.Objects.requireNonNull(fields, "Choose duplicate fields.")).withLimit(integer(body, "limit", 50, 1, 500));
+            default -> throw new IllegalArgumentException("operation must be COLUMN_PROFILE or TABLE_PROFILE.");
+         });
+      }
+      catch(Exception e)
+      {
+         throw new QBadRequestException("Invalid analysis request: " + e.getMessage());
+      }
+   }
+
+   /*******************************************************************************
+    ** Bad filter fields fail before any aggregate or cached result is consulted.
+    *******************************************************************************/
+   private static void validateFilter(QQueryFilter filter)
+   {
+      if(filter == null)
+      {
+         return;
+      }
+      for(var criterion : filter.getCriteria())
+      {
+         if(criterion.getOperator() == null || criterion.getFieldName() == null)
+         {
+            throw new IllegalArgumentException("Choose readable filter fields and a valid operator.");
+         }
+      }
+      filter.getSubFilters().forEach(sub -> validateFilter(sub));
+   }
+
+   /*******************************************************************************
+    ** Reject fractional, null, overflowing and out-of-range numeric parameters.
+    *******************************************************************************/
+   private static int integer(Map<String, Object> body, String name, int fallback, int min, int max)
+   {
+      if(!body.containsKey(name))
+      {
+         return (fallback);
+      }
+      Object value = body.get(name);
+      if(!(value instanceof Number number) || number.doubleValue() != number.intValue() || number.intValue() < min || number.intValue() > max)
+      {
+         throw new IllegalArgumentException(name + " must be an integer from " + min + " to " + max + ".");
+      }
+      return (number.intValue());
+   }
+
+   /*******************************************************************************
+    ** Transport conversion avoids middleware dependencies in engine results.
+    *******************************************************************************/
+   private static <T> T transport(Object value, Class<T> type) throws Exception
+   {
+      return (JsonUtils.toObject(JsonUtils.toJson(value), type));
+   }
+
+   /*******************************************************************************
+    ** Check analysis availability.
+    *******************************************************************************/
+   public static class CapabilitiesSpec extends ProfileSpec
+   {
+      /*******************************************************************************
+       ** Public constructor used by the core extension registry.
+       *******************************************************************************/
+      public CapabilitiesSpec()
+      {
+         super("/tables/{table}/capabilities", HttpMethod.GET, "Check analysis availability",
+            "Discover whether the current user can analyze this table, readable fields, chart defaults, limits and backend capabilities.", null, "Capabilities");
+      }
+
+      /*******************************************************************************
+       ** Execute in the request session established by core middleware.
+       *******************************************************************************/
+      @Override
+      protected Object handle(JsonInput input) throws Exception
+      {
+         return (capabilities(input.getPathParam("table")));
+      }
+   }
+
+   /*******************************************************************************
+    ** Profile one column.
+    *******************************************************************************/
+   public static class ColumnProfileSpec extends ProfileSpec
+   {
+      /*******************************************************************************
+       ** Public constructor used by the core extension registry.
+       *******************************************************************************/
+      public ColumnProfileSpec()
+      {
+         super("/tables/{table}/column-profile", HttpMethod.POST, "Profile one column",
+            "Profile one column of a table under a filter: counts, nulls, distinct values, top values, numeric statistics and histogram, date patterns; every number has a drill-through filter unless privacy suppresses it.", "ColumnProfileRequest", "ColumnProfile");
+      }
+
+      /*******************************************************************************
+       ** Execute in the request session established by core middleware.
+       *******************************************************************************/
+      @Override
+      protected Object handle(JsonInput input) throws Exception
+      {
+         return (transport(DataAnalysisRuntime.service().columnProfile((ColumnProfileRequest) request("COLUMN_PROFILE", input.getPathParam("table"), input.getBody())), DataAnalysisSchemas.DataAnalysisColumnProfileV1.class));
+      }
+   }
+
+   /*******************************************************************************
+    ** List distinct column values.
+    *******************************************************************************/
+   public static class DistinctValuesSpec extends ProfileSpec
+   {
+      /*******************************************************************************
+       ** Public constructor used by the core extension registry.
+       *******************************************************************************/
+      public DistinctValuesSpec()
+      {
+         super("/tables/{table}/distinct-values", HttpMethod.POST, "List distinct column values",
+            "Page through distinct stored values with display labels, counts and drill-through filters; search narrows stored values.", "DistinctValuesRequest", "DistinctValuesPage");
+      }
+
+      /*******************************************************************************
+       ** Execute in the request session established by core middleware.
+       *******************************************************************************/
+      @Override
+      protected Object handle(JsonInput input) throws Exception
+      {
+         return (transport(DataAnalysisRuntime.service().distinctValues((DistinctValuesRequest) request("DISTINCT_VALUES", input.getPathParam("table"), input.getBody())), DataAnalysisSchemas.DataAnalysisDistinctValuesPageV1.class));
+      }
+   }
+
+   /*******************************************************************************
+    ** Profile table completeness and keys.
+    *******************************************************************************/
+   public static class TableProfileSpec extends ProfileSpec
+   {
+      /*******************************************************************************
+       ** Public constructor used by the core extension registry.
+       *******************************************************************************/
+      public TableProfileSpec()
+      {
+         super("/tables/{table}/table-profile", HttpMethod.POST, "Profile table completeness and keys",
+            "Profile readable fields under a filter for completeness, uniqueness, constant or empty columns and candidate keys.", "TableProfileRequest", "TableProfile");
+      }
+
+      /*******************************************************************************
+       ** Execute in the request session established by core middleware.
+       *******************************************************************************/
+      @Override
+      protected Object handle(JsonInput input) throws Exception
+      {
+         return (transport(DataAnalysisRuntime.service().tableProfile((TableProfileRequest) request("TABLE_PROFILE", input.getPathParam("table"), input.getBody())), DataAnalysisSchemas.DataAnalysisTableProfileV1.class));
+      }
+   }
+
+   /*******************************************************************************
+    ** Find duplicate groups.
+    *******************************************************************************/
+   public static class DuplicatesSpec extends ProfileSpec
+   {
+      /*******************************************************************************
+       ** Public constructor used by the core extension registry.
+       *******************************************************************************/
+      public DuplicatesSpec()
+      {
+         super("/tables/{table}/duplicates", HttpMethod.POST, "Find duplicate groups",
+            "Group matching records by the selected readable fields and return repeated tuples with counts and drill-through filters.", "DuplicatesRequest", "DuplicatesResult");
+      }
+
+      /*******************************************************************************
+       ** Execute in the request session established by core middleware.
+       *******************************************************************************/
+      @Override
+      protected Object handle(JsonInput input) throws Exception
+      {
+         return (transport(DataAnalysisRuntime.service().duplicates((DuplicatesRequest) request("DUPLICATES", input.getPathParam("table"), input.getBody())), DataAnalysisSchemas.DataAnalysisDuplicatesResultV1.class));
+      }
+   }
+
+   /*******************************************************************************
+    ** Start an exact profile run.
+    *******************************************************************************/
+   public static class StartRunSpec extends ProfileSpec
+   {
+      /*******************************************************************************
+       ** Public constructor used by the core extension registry.
+       *******************************************************************************/
+      public StartRunSpec()
+      {
+         super("/runs", HttpMethod.POST, "Start an exact profile run",
+            "Start an owner-scoped exact column or table profile. Poll the returned runId until COMPLETE or FAILED; results honor the current session permissions.", "StartRunRequest", "RunStarted");
+      }
+
+      /*******************************************************************************
+       ** Execute in the request session established by core middleware.
+       *******************************************************************************/
+      @Override
+      protected Object handle(JsonInput input) throws Exception
+      {
+         Map<String, Object> body = input.getBody();
+         if(body == null || !(body.get("tableName") instanceof String name) || !(body.get("operation") instanceof String operation)
+            || !List.of("COLUMN_PROFILE", "TABLE_PROFILE").contains(operation) || !(body.get("request") instanceof Map<?, ?>))
+         {
+            throw new QBadRequestException("Supply operation, tableName and a profile request object.");
+         }
+         Map<String, Object> parameters = JsonUtils.toObject(JsonUtils.toJson(body.get("request")), java.util.LinkedHashMap.class);
+         String id = DataAnalysisRuntime.service().startExactRun(request(operation, name, parameters));
+         DataAnalysisSchemas.DataAnalysisRunStartedV1 result = new DataAnalysisSchemas.DataAnalysisRunStartedV1();
+         result.runId = id;
+         result.status = DataAnalysisRuntime.service().getRun(id).getStatus();
+         return (result);
+      }
+   }
+
+   /*******************************************************************************
+    ** Get an exact profile run.
+    *******************************************************************************/
+   public static class GetRunSpec extends ProfileSpec
+   {
+      /*******************************************************************************
+       ** Public constructor used by the core extension registry.
+       *******************************************************************************/
+      public GetRunSpec()
+      {
+         super("/runs/{runId}", HttpMethod.GET, "Get an exact profile run",
+            "Read status, timestamps and the typed columnProfile or tableProfile result of an owner-scoped run. Completed results are rechecked against current permissions.", null, "RunStatus");
+      }
+
+      /*******************************************************************************
+       ** Execute in the request session established by core middleware.
+       *******************************************************************************/
+      @Override
+      protected Object handle(JsonInput input) throws Exception
+      {
+         return (transport(DataAnalysisRuntime.service().getRun(input.getPathParam("runId")), DataAnalysisSchemas.DataAnalysisRunStatusV1.class));
+      }
+   }
+
+   /*******************************************************************************
+    ** Permission probing is a successful response with no disclosed field list.
+    *******************************************************************************/
+   private static DataAnalysisSchemas.DataAnalysisCapabilitiesV1 capabilities(String name) throws Exception
+   {
+      QTableMetaData table = table(name);
+      DataAnalysisSchemas.DataAnalysisCapabilitiesV1 result = new DataAnalysisSchemas.DataAnalysisCapabilitiesV1();
+      result.tableName = name;
+      result.tableLabel = table.getLabel();
+      result.canAnalyze = false;
+      result.fields = List.of();
+      result.backendCapabilities = List.of();
+      result.sqlWorkbenchAvailable = QContext.getQInstance().getApp("sqlWorkbench") != null
+         || QContext.getQInstance().getTables().keySet().stream().anyMatch(t -> t.startsWith("sql_workbench_"));
+      try
+      {
+         var capabilities = DataAnalysisRuntime.service().capabilities(name);
+         result.canAnalyze = true;
+         result.backendCapabilities = CoreAnalysisBackend.capabilities(name).stream().map(Enum::name).sorted().toList();
+         result.fields = capabilities.getFields().stream().map(f -> capabilityField(table.getField(f))).toList();
+         var config = capabilities.getConfig();
+         result.limits = new DataAnalysisSchemas.DataAnalysisLimitsV1();
+         result.limits.maxRows = config.getMaxRows();
+         result.limits.sampleThresholdRows = config.getSampleThresholdRows();
+         result.limits.sampleRows = config.getSampleRows();
+         result.limits.minGroupSize = config.getMinGroupSize();
+      }
+      catch(QPermissionDeniedException expected)
+      {
+         // A UI capability probe deliberately reports denial without an error.
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Semantic type and the default visualization, with PVS/FK taking priority.
+    *******************************************************************************/
+   private static DataAnalysisSchemas.DataAnalysisCapabilityFieldV1 capabilityField(QFieldMetaData field)
+   {
+      DataAnalysisSchemas.DataAnalysisCapabilityFieldV1 result = new DataAnalysisSchemas.DataAnalysisCapabilityFieldV1();
+      result.name = field.getName();
+      result.label = field.getLabel();
+      result.type = field.getType().name();
+      result.kind = field.getPossibleValueSourceName() != null ? "CATEGORY" : switch(field.getType())
+      {
+         case INTEGER, LONG, DECIMAL -> "NUMERIC";
+         case DATE -> "DATE";
+         case DATE_TIME -> "DATE_TIME";
+         case BOOLEAN -> "BOOLEAN";
+         default -> "TEXT";
+      };
+      result.defaultChartKind = switch(result.kind)
+      {
+         case "NUMERIC" -> ChartKind.HISTOGRAM;
+         case "DATE", "DATE_TIME" -> ChartKind.TIME_SERIES;
+         default -> ChartKind.BAR;
+      };
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Group records by row and column dimensions.
+    *******************************************************************************/
+   public static class PivotSpec extends ProfileSpec
+   {
+      /*******************************************************************************
+       ** Publish assistant-friendly grouping and measure capabilities.
+       *******************************************************************************/
+      public PivotSpec()
+      {
+         super("/tables/{table}/pivot", HttpMethod.POST, "Explore a pivot table",
+            "Group records by up to 3 row and 2 column fields (with date or numeric buckets) and compute counts, sums, averages, min/max, distinct counts or percentiles per cell; every cell has a drill-through filter.", "PivotRequest", "Pivot");
+      }
+
+      /*******************************************************************************
+       ** Strict body validation precedes the session-bound engine.
+       *******************************************************************************/
+      @Override
+      protected Object handle(JsonInput input) throws Exception
+      {
+         String tableName = input.getPathParam("table");
+         table(tableName);
+         DataAnalysisRuntime.service().capabilities(tableName);
+         PivotRequest pivot;
+         try
+         {
+            Map<String, Object> body = input.getBody();
+            integer(body, "limitGroups", 50, 1, 200);
+            if(body.containsKey("showTotals") && !(body.get("showTotals") instanceof Boolean))
+            {
+               throw new IllegalArgumentException("showTotals must be a boolean.");
+            }
+            for(String axis : List.of("rows", "columns"))
+            {
+               if(body.containsKey(axis))
+               {
+                  if(!(body.get(axis) instanceof List<?> dimensions))
+                  {
+                     throw new IllegalArgumentException("Dimensions must be arrays.");
+                  }
+                  for(Object dimension : dimensions)
+                  {
+                     if(!(dimension instanceof Map<?, ?> map) || !(map.get("field") instanceof String))
+                     {
+                        throw new IllegalArgumentException("Each dimension requires a field name.");
+                     }
+                     if(map.get("numericBins") instanceof Map<?, ?> bins)
+                     {
+                        Object count = bins.get("count");
+                        if(count != null && (!(count instanceof Number number) || number.doubleValue() != number.intValue()))
+                        {
+                           throw new IllegalArgumentException("Bin count must be an integer.");
+                        }
+                     }
+                  }
+               }
+            }
+            if(!(body.get("values") instanceof List<?> values) || values.stream().anyMatch(v -> !(v instanceof Map<?, ?> m)
+               || !(m.get("operator") instanceof String) || m.get("field") != null && !(m.get("field") instanceof String)))
+            {
+               throw new IllegalArgumentException("Measures require an operator and optional field name.");
+            }
+            pivot = JsonUtils.toObject(JsonUtils.toJson(body), PivotRequest.class).withTableName(tableName);
+            validateFilter(pivot.getFilter());
+         }
+         catch(Exception e)
+         {
+            throw new QBadRequestException("Invalid pivot request.");
+         }
+         return (transport(DataAnalysisRuntime.service().pivot(pivot), DataAnalysisSchemas.DataAnalysisPivotV1.class));
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/app/DataAnalysisHome.java

@@ -22,26 +22,33 @@ package com.kingsrook.qbits.dataanalysis.app;
 
 
 import java.time.Instant;
-import java.time.temporal.ChronoUnit;
+import java.util.Arrays;
 import java.util.List;
+import java.util.Locale;
+import java.util.stream.Collectors;
 import com.kingsrook.qbits.dataanalysis.DataAnalysisQBitConfig;
+import com.kingsrook.qbits.dataanalysis.engine.AnalysisFormatting;
 import com.kingsrook.qbits.dataanalysis.model.DataAnalysisTables;
 import com.kingsrook.qqq.backend.core.actions.dashboard.widgets.AbstractWidgetRenderer;
 import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
 import com.kingsrook.qqq.backend.core.actions.permissions.PermissionsHelper;
 import com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType;
 import com.kingsrook.qqq.backend.core.actions.tables.CountAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
 import com.kingsrook.qqq.backend.core.context.QContext;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterCriteria;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryJoin;
 import com.kingsrook.qqq.backend.core.model.actions.widgets.RenderWidgetInput;
 import com.kingsrook.qqq.backend.core.model.actions.widgets.RenderWidgetOutput;
 import com.kingsrook.qqq.backend.core.model.dashboard.widgets.RawHTML;
 import com.kingsrook.qqq.backend.core.model.dashboard.widgets.WidgetType;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
 import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
 import com.kingsrook.qqq.backend.core.model.metadata.dashboard.QWidgetMetaData;
 import com.kingsrook.qqq.backend.core.model.metadata.layout.QAppMetaData;
@@ -93,7 +100,8 @@ public class DataAnalysisHome extends AbstractWidgetRenderer
 
 
    /*******************************************************************************
-    ** Standard QQQ widget renderer entry point.
+    ** RawHTML is carried as a JSON string by the HTML widget, not a text/html response.
+    ** Entities keep static separators independent of any host charset handling.
     *******************************************************************************/
    @Override
    public RenderWidgetOutput render(RenderWidgetInput input) throws QException
@@ -110,7 +118,7 @@ public class DataAnalysisHome extends AbstractWidgetRenderer
    {
       StringBuilder html = new StringBuilder("<div class=\"data-analysis-home\" style=\"display:grid;gap:1rem;min-width:0;overflow-wrap:anywhere\">");
       String userId = QContext.getQSession() == null || QContext.getQSession().getUser() == null ? null : QContext.getQSession().getUser().getIdReference();
-      html.append("<section><h2>Saved analyses</h2>");
+      html.append("<section><h3>Saved analyses</h3>");
       if(userId == null)
       {
          html.append("<p>Sign in to see your saved analyses and stars.</p>");
@@ -119,7 +127,7 @@ public class DataAnalysisHome extends AbstractWidgetRenderer
       {
          int mine = count(DataAnalysisTables.SAVED, equal("owner_user_id", userId));
          int shared = count(DataAnalysisTables.SAVED, equal("shared", true));
-         html.append("<p>Mine: ").append(mine).append(" · Shared (visible to you): ").append(shared).append("</p>");
+         html.append("<p>Mine: ").append(AnalysisFormatting.number(mine, 0)).append(" &middot; Shared (visible to you): ").append(AnalysisFormatting.number(shared, 0)).append("</p>");
          if(canRead(DataAnalysisTables.SAVED_STAR))
          {
             CountInput stars = new CountInput(DataAnalysisTables.SAVED).withIncludeDistinctCount(true)
@@ -127,28 +135,28 @@ public class DataAnalysisHome extends AbstractWidgetRenderer
                .withFilter(equal(DataAnalysisTables.SAVED_STAR + ".user_id", userId));
             stars.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
             int starred = new CountAction().execute(stars).getDistinctCount();
-            html.append("<p>Starred by me: ").append(starred).append("</p>");
+            html.append("<p>Starred by me: ").append(AnalysisFormatting.number(starred, 0)).append("</p>");
          }
          if(mine == 0 && shared == 0)
          {
-            html.append("<p>No saved analyses yet: open any table and choose Analyze on a column header.</p>");
+            html.append("<p>No saved analyses yet. Open any table and choose Analyze on a column header to explore its data.</p>");
          }
-         html.append("<p>The Analyze action is planned for phase b; this scaffold currently stores definitions.</p>");
          link(html, DataAnalysisTables.SAVED);
       }
       else
       {
          html.append("<p>Saved analyses are unavailable: you need data_analysis.saved.read.</p>");
       }
-      html.append("</section><section><h2>Watches</h2>");
+      html.append("</section><section><h3>Watches</h3>");
       if(canRead(DataAnalysisTables.WATCH))
       {
+         int total = count(DataAnalysisTables.WATCH, new QQueryFilter());
          int enabled = count(DataAnalysisTables.WATCH, equal("enabled", true));
          int firing = count(DataAnalysisTables.WATCH, equal("state", "FIRING"));
-         html.append("<p>Enabled: ").append(enabled).append(" · Firing: ").append(firing).append("</p>");
-         if(enabled == 0 && firing == 0)
+         html.append("<p>Total: ").append(AnalysisFormatting.number(total, 0)).append(" &middot; Enabled: ").append(AnalysisFormatting.number(enabled, 0)).append(" &middot; Firing: ").append(AnalysisFormatting.number(firing, 0)).append("</p>");
+         if(total == 0)
          {
-            html.append("<p>No active watches: watch evaluation is planned for phase e.</p>");
+            html.append("<p>No watches yet.</p>");
          }
          link(html, DataAnalysisTables.WATCH);
       }
@@ -156,15 +164,37 @@ public class DataAnalysisHome extends AbstractWidgetRenderer
       {
          html.append("<p>Watches are unavailable: you need data_analysis.watch.read.</p>");
       }
-      html.append("</section><section><h2>Runs in the last 7 days</h2>");
-      if(canRead(DataAnalysisTables.RUN))
+      html.append("</section><section><h3>Recent analysis runs</h3>");
+      if(userId == null)
       {
-         int complete = count(DataAnalysisTables.RUN, recentRuns("COMPLETE", now));
-         int failed = count(DataAnalysisTables.RUN, recentRuns("FAILED", now));
-         html.append("<p>Complete: ").append(complete).append(" · Failed: ").append(failed).append("</p>");
-         if(complete == 0 && failed == 0)
+         html.append("<p>Sign in to see your recent analysis runs.</p>");
+      }
+      else if(canRead(DataAnalysisTables.RUN))
+      {
+         QueryInput query = new QueryInput(DataAnalysisTables.RUN).withFilter(equal("user_id", userId)
+            .withCriteria(new QFilterCriteria("started_at", QCriteriaOperator.LESS_THAN_OR_EQUALS, now))
+            .withOrderBy(new QFilterOrderBy("started_at", false)).withOrderBy(new QFilterOrderBy("id", false)).withLimit(5));
+         query.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+         List<QRecord> runs = new QueryAction().execute(query).getRecords();
+         if(runs.isEmpty())
          {
-            html.append("<p>No completed or failed runs in this period: exact analysis execution is planned for phase b.</p>");
+            html.append("<p>No analysis runs yet.</p>");
+         }
+         else
+         {
+            html.append("<ul class=\"data-analysis-runs\">");
+            for(QRecord run : runs)
+            {
+               QTableMetaData table = QContext.getQInstance().getTable(run.getValueString("table_name"));
+               String tableLabel = table == null ? run.getValueString("table_name") : table.getLabel();
+               String path = QContext.getQInstance().getTablePath(DataAnalysisTables.RUN) + "/" + run.getValueInteger("id");
+               html.append("<li><a href=\"").append(escape(path)).append("\">").append(escape(tableLabel)).append(" &middot; ")
+                  .append(escape(words(run.getValueString("operation")))).append("</a><dl class=\"data-analysis-run-details\"><dt>Status</dt><dd>")
+                  .append(escape(words(run.getValueString("status")))).append("</dd><dt>Finished</dt><dd>")
+                  .append(run.getValue("finished_at") == null ? "Not finished" : escape(AnalysisFormatting.instant(run.getValueInstant("finished_at"))))
+                  .append("</dd></dl></li>");
+            }
+            html.append("</ul>");
          }
          link(html, DataAnalysisTables.RUN);
       }
@@ -198,13 +228,22 @@ public class DataAnalysisHome extends AbstractWidgetRenderer
 
 
    /*******************************************************************************
-    ** Runs started within the inclusive seven-day interval, excluding future rows.
+    ** Stored operation and status keys are displayed as ordinary words.
     *******************************************************************************/
-   private static QQueryFilter recentRuns(String status, Instant now)
+   private static String words(String value)
    {
-      return (equal("status", status)
-         .withCriteria(new QFilterCriteria("started_at", QCriteriaOperator.GREATER_THAN_OR_EQUALS, now.minus(7, ChronoUnit.DAYS)))
-         .withCriteria(new QFilterCriteria("started_at", QCriteriaOperator.LESS_THAN_OR_EQUALS, now)));
+      return (value == null ? "Unknown" : Arrays.stream(value.toLowerCase(Locale.ROOT).split("_"))
+         .filter(part -> !part.isEmpty()).map(part -> Character.toUpperCase(part.charAt(0)) + part.substring(1)).collect(Collectors.joining(" ")));
+   }
+
+
+
+   /*******************************************************************************
+    ** Metadata and persisted values must never become executable widget markup.
+    *******************************************************************************/
+   private static String escape(String value)
+   {
+      return (value == null ? "Unknown" : value.replace("&", "&amp;").replace("\"", "&quot;").replace("<", "&lt;").replace(">", "&gt;").replace("'", "&#39;"));
    }
 
 
@@ -227,7 +266,7 @@ public class DataAnalysisHome extends AbstractWidgetRenderer
    private static void link(StringBuilder html, String table) throws QException
    {
       String path = QContext.getQInstance().getTablePath(table);
-      html.append("<a href=\"").append(path.replace("&", "&amp;").replace("\"", "&quot;").replace("<", "&lt;").replace(">", "&gt;"))
+      html.append("<a href=\"").append(escape(path))
          .append("\">View all</a>");
    }
 }

src/main/java/com/kingsrook/qbits/dataanalysis/engine/AnalysisBackend.java

@@ -0,0 +1,186 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import java.time.ZoneId;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+/*******************************************************************************
+ ** Primitive port. All operations use the current session with ENFORCE.
+ *******************************************************************************/
+public interface AnalysisBackend
+{
+   /*******************************************************************************
+    ** Date units use the session zone and ISO Monday weeks.
+    *******************************************************************************/
+   enum DateUnit
+   {
+      DAY, WEEK, MONTH, QUARTER, YEAR, HOUR, DAY_OF_WEEK, HOUR_OF_DAY
+   }
+
+
+
+   /*******************************************************************************
+    ** Computation scope, observed coverage and optional native sampling percentage.
+    *******************************************************************************/
+   record Scope(QQueryFilter filter, long total, long rowsScanned, boolean truncated, boolean estimate, BigDecimal samplePercent)
+   {
+      /*******************************************************************************
+       ** Exact and prefix scopes have no random sampling percentage.
+       *******************************************************************************/
+      public Scope(QQueryFilter filter, long total, long rowsScanned, boolean truncated, boolean estimate)
+      {
+         this(filter, total, rowsScanned, truncated, estimate, null);
+      }
+
+      /*******************************************************************************
+       ** Explain whether counts extrapolate a random sample or describe a prefix.
+       *******************************************************************************/
+      public String warning()
+      {
+         return (samplePercent == null ? "Estimate from the first " + rowsScanned + " rows by id"
+            : "Estimate from a random sample of about " + rowsScanned + " rows (" + samplePercent.stripTrailingZeros().toPlainString()
+               + "%). Counts are scaled to the full " + total + " rows; run exact for exact numbers.");
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Blank includes null and whitespace; distinct excludes null.
+    *******************************************************************************/
+   record FieldCounts(long nonNull, long nulls, long blanks, long distinct, QQueryFilter blankFilter, QQueryFilter distinctFilter, BigDecimal uniqueness, BigDecimal completeness, boolean constant)
+   {
+      /*******************************************************************************
+       ** Exact and prefix counters use their own population for ratios.
+       *******************************************************************************/
+      public FieldCounts(long nonNull, long nulls, long blanks, long distinct, QQueryFilter blankFilter, QQueryFilter distinctFilter)
+      {
+         this(nonNull, nulls, blanks, distinct, blankFilter, distinctFilter, ProfileSupport.share(distinct, nonNull),
+            ProfileSupport.share(nonNull + nulls - blanks, nonNull + nulls), distinct == 1);
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Group and exact predicate producing its members.
+    *******************************************************************************/
+   record GroupCount(Serializable value, String label, long count, QQueryFilter condition, BigDecimal share)
+   {
+      /*******************************************************************************
+       ** Ordinary groups derive their share from the profiler population.
+       *******************************************************************************/
+      public GroupCount(Serializable value, String label, long count, QQueryFilter condition)
+      {
+         this(value, label, count, condition, null);
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Numeric moments, percentile_cont and sample standard deviation.
+    *******************************************************************************/
+   record NumericSummary(Map<String, BigDecimal> metrics, List<GroupCount> outliers, long outlierCount, QQueryFilter outlierFilter, List<GroupCount> counts)
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Text lengths exclude null but include empty strings.
+    *******************************************************************************/
+   record LengthSummary(Map<String, BigDecimal> metrics, List<GroupCount> histogram)
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Actual inspected non-null values, independent of estimated population counts.
+    *******************************************************************************/
+   record PatternSummary(List<GroupCount> groups, long values, boolean truncated)
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Filtered count; a native estimate scales conditional counts to its population.
+    *******************************************************************************/
+   long count(String table, QQueryFilter filter) throws QException;
+
+   /*******************************************************************************
+    ** Configure a request-local exact, prefix or native sampling scope.
+    *******************************************************************************/
+   Scope scope(String table, QQueryFilter filter, boolean exact) throws QException;
+
+   /*******************************************************************************
+    ** Batch field counts in groups of twenty.
+    *******************************************************************************/
+   Map<String, FieldCounts> fieldCounts(String table, QQueryFilter filter, List<String> fields) throws QException;
+
+   /*******************************************************************************
+    ** Ordered groups with search on the stored value.
+    *******************************************************************************/
+   List<GroupCount> topValues(String table, QQueryFilter filter, String field, int limit, int offset, String search) throws QException;
+
+   /*******************************************************************************
+    ** Numeric summary and ten extreme-value groups.
+    *******************************************************************************/
+   NumericSummary numericSummary(String table, QQueryFilter filter, String field, List<BigDecimal> percentiles) throws QException;
+
+   /*******************************************************************************
+    ** Half-open interior bins, closed final bin, and exterior bins.
+    *******************************************************************************/
+   List<GroupCount> numericHistogram(String table, QQueryFilter filter, String field, BigDecimal low, BigDecimal high, int bins) throws QException;
+
+   /*******************************************************************************
+    ** Date buckets include interior zero intervals.
+    *******************************************************************************/
+   List<GroupCount> dateBuckets(String table, QQueryFilter filter, String field, DateUnit unit, ZoneId zone) throws QException;
+
+   /*******************************************************************************
+    ** Typed minimum and maximum.
+    *******************************************************************************/
+   Map<String, Serializable> extrema(String table, QQueryFilter filter, String field) throws QException;
+
+   /*******************************************************************************
+    ** Length moments and histogram.
+    *******************************************************************************/
+   LengthSummary lengthSummary(String table, QQueryFilter filter, String field) throws QException;
+
+   /*******************************************************************************
+    ** Top shapes over a bounded primary-key prefix.
+    *******************************************************************************/
+   PatternSummary patterns(String table, QQueryFilter filter, String field, int sampleRows) throws QException;
+
+   /*******************************************************************************
+    ** Top groups with count greater than one.
+    *******************************************************************************/
+   List<GroupCount> duplicates(String table, QQueryFilter filter, List<String> fields, int limit) throws QException;
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/AnalysisDrillGuard.java

@@ -0,0 +1,168 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.util.Set;
+import com.kingsrook.qbits.dataanalysis.result.CandidateKey;
+import com.kingsrook.qbits.dataanalysis.result.Chart;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfile;
+import com.kingsrook.qbits.dataanalysis.result.DateProfile;
+import com.kingsrook.qbits.dataanalysis.result.DistinctValuesPage;
+import com.kingsrook.qbits.dataanalysis.result.Drill;
+import com.kingsrook.qbits.dataanalysis.result.DuplicatesResult;
+import com.kingsrook.qbits.dataanalysis.result.FieldSummary;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.NumericProfile;
+import com.kingsrook.qbits.dataanalysis.result.Point;
+import com.kingsrook.qbits.dataanalysis.result.Series;
+import com.kingsrook.qbits.dataanalysis.result.TableProfile;
+import com.kingsrook.qbits.dataanalysis.result.TextProfile;
+import com.kingsrook.qbits.dataanalysis.result.ValueCount;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+
+/*******************************************************************************
+ ** Final defense for profile-generated drills, including representative primary
+ ** keys and prefix bounds. User-authored predicates remain intact; unsafe generated
+ ** drills are disabled rather than broadened by removing their conditions.
+ *******************************************************************************/
+public class AnalysisDrillGuard
+{
+   private final Set<String> fields;
+   private final String original;
+
+   /*******************************************************************************
+    ** Resolve FULL fields once per completed result.
+    *******************************************************************************/
+   public AnalysisDrillGuard(Set<String> fields, QQueryFilter original)
+   {
+      this.fields = fields;
+      this.original = JsonUtils.toJson(DrillFilters.copy(original));
+   }
+
+   /*******************************************************************************
+    ** Visit only typed result containers, never the caller's query.
+    *******************************************************************************/
+   public void apply(Object value)
+   {
+      if(value instanceof Iterable<?> list)
+      {
+         list.forEach(this::apply);
+      }
+      else if(value instanceof Metric metric)
+      {
+         metric.withDrill(permitted(metric.getDrill()));
+      }
+      else if(value instanceof ValueCount count)
+      {
+         count.withDrill(permitted(count.getDrill()));
+      }
+      else if(value instanceof Point point)
+      {
+         point.withDrill(permitted(point.getDrill()));
+      }
+      else if(value instanceof CandidateKey key)
+      {
+         key.withDrill(permitted(key.getDrill()));
+      }
+      else if(value instanceof ColumnProfile profile)
+      {
+         apply(profile.getCounts());
+         apply(profile.getTopValues());
+         apply(profile.getBooleans());
+         apply(profile.getNumeric());
+         apply(profile.getDates());
+         apply(profile.getText());
+         apply(profile.getChart());
+      }
+      else if(value instanceof NumericProfile profile)
+      {
+         apply(profile.getMetrics());
+         apply(profile.getHistogram());
+         apply(profile.getOutliers());
+      }
+      else if(value instanceof DateProfile profile)
+      {
+         apply(profile.getMetrics());
+         apply(profile.getBuckets());
+         apply(profile.getGaps());
+         apply(profile.getDayOfWeek());
+         apply(profile.getHourOfDay());
+      }
+      else if(value instanceof TextProfile profile)
+      {
+         apply(profile.getMetrics());
+         apply(profile.getHistogram());
+         apply(profile.getPatterns());
+      }
+      else if(value instanceof TableProfile profile)
+      {
+         apply(profile.getRowCount());
+         apply(profile.getFields());
+         apply(profile.getCandidateKeys());
+         apply(profile.getHeatmap());
+      }
+      else if(value instanceof FieldSummary field)
+      {
+         apply(field.getNulls());
+         apply(field.getBlanks());
+      }
+      else if(value instanceof Chart chart)
+      {
+         apply(chart.getSeries());
+      }
+      else if(value instanceof Series series)
+      {
+         apply(series.getPoints());
+      }
+      else if(value instanceof DistinctValuesPage page)
+      {
+         apply(page.getValues());
+      }
+      else if(value instanceof DuplicatesResult result)
+      {
+         apply(result.getGroups());
+      }
+   }
+
+   /*******************************************************************************
+    ** Preserve count equivalence by removing the entire unsafe drill.
+    *******************************************************************************/
+   private Drill permitted(Drill drill)
+   {
+      return (drill == null || safe(drill.getFilter()) ? drill : null);
+   }
+
+   /*******************************************************************************
+    ** An exact copy of a user subtree is exempt from analysis field restrictions.
+    *******************************************************************************/
+   private boolean safe(QQueryFilter filter)
+   {
+      if(original.equals(JsonUtils.toJson(DrillFilters.copy(filter))))
+      {
+         return (true);
+      }
+      return (filter.getCriteria().stream().allMatch(c -> fields.contains(c.getFieldName())
+         && (c.getOtherFieldName() == null || fields.contains(c.getOtherFieldName()))
+         && (c.getFieldFunction() == null || fields.contains(c.getFieldFunction().getFieldName())))
+         && filter.getSubFilters().stream().allMatch(this::safe));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/AnalysisFormatting.java

@@ -0,0 +1,225 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import java.math.MathContext;
+import java.math.RoundingMode;
+import java.time.DayOfWeek;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.Period;
+import java.time.ZoneId;
+import java.time.format.DateTimeFormatter;
+import java.time.format.TextStyle;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.ValueType;
+import com.kingsrook.qqq.backend.core.actions.values.QValueFormatter;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.DisplayFormat;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.utils.ValueUtils;
+
+/*******************************************************************************
+ ** Display-ready values shared by metrics, chart labels and the home widget.
+ *******************************************************************************/
+public final class AnalysisFormatting
+{
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private AnalysisFormatting()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Ratios remain numeric and bounded, with stable JSON precision.
+    *******************************************************************************/
+   public static BigDecimal ratio(BigDecimal value)
+   {
+      return (value.max(BigDecimal.ZERO).min(BigDecimal.ONE).setScale(6, RoundingMode.HALF_UP).stripTrailingZeros());
+   }
+
+
+
+   /*******************************************************************************
+    ** Plain numeric defaults are independent of the server locale.
+    *******************************************************************************/
+   public static String number(Number value, int decimals)
+   {
+      return (String.format(Locale.US, "%,." + decimals + "f", new BigDecimal(value.toString())));
+   }
+
+
+
+   /*******************************************************************************
+    ** Types and length keys determine display without changing numeric raw values.
+    *******************************************************************************/
+   public static String scalar(String key, Serializable value, ValueType type)
+   {
+      if(value == null)
+      {
+         return (null);
+      }
+      if(type == ValueType.PERCENT)
+      {
+         BigDecimal percent = new BigDecimal(value.toString()).multiply(BigDecimal.valueOf(100)).setScale(1, RoundingMode.HALF_UP);
+         return (percent.signum() == 0 || percent.compareTo(BigDecimal.valueOf(100)) == 0 ? percent.toBigInteger() + "%" : percent.toPlainString() + "%");
+      }
+      if(type == ValueType.DATE_TIME)
+      {
+         return (instant((Instant) value));
+      }
+      if(value instanceof Number n)
+      {
+         return (number(n, "meanLength".equals(key) ? 1 : type == ValueType.COUNT || key.endsWith("Length") ? 0 : 2));
+      }
+      return (value.toString());
+   }
+
+
+
+   /*******************************************************************************
+    ** Display formats belong to the host field; fallback defaults preserve fractions.
+    *******************************************************************************/
+   public static String numeric(QFieldMetaData field, String key, BigDecimal value)
+   {
+      if(value == null)
+      {
+         return (null);
+      }
+      String format = field.getDisplayFormat();
+      if(format != null && !format.isBlank() && !DisplayFormat.DEFAULT.equals(format))
+      {
+         Serializable displayValue = format.endsWith("d") ? value.toBigInteger() : value;
+         return (QValueFormatter.formatValue(format, displayValue));
+      }
+      return (number(value, field.getType() == QFieldType.DECIMAL || "mean".equals(key) || "stddev".equals(key) ? 2 : 0));
+   }
+
+
+
+   /*******************************************************************************
+    ** Decimal statistics retain ten significant digits; formatting uses the original.
+    *******************************************************************************/
+   public static Metric numericMetric(QFieldMetaData field, String key, BigDecimal value)
+   {
+      BigDecimal raw = value == null || field.getType() != QFieldType.DECIMAL ? value : value.round(new MathContext(10));
+      return (ProfileSupport.metric(key, raw, ValueType.DECIMAL).withFormatted(numeric(field, key, value)));
+   }
+
+
+
+   /*******************************************************************************
+    ** Use the same field formatter on both ends of every histogram interval.
+    *******************************************************************************/
+   public static String interval(QFieldMetaData field, BigDecimal low, BigDecimal high)
+   {
+      return (low == null ? "Below " + edge(field, high)
+         : high == null ? edge(field, low) + " and above"
+         : edge(field, low) + " – " + edge(field, high));
+   }
+
+
+
+   /*******************************************************************************
+    ** Whole edges omit redundant cents; unformatted fractional edges stay distinct.
+    *******************************************************************************/
+   private static String edge(QFieldMetaData field, BigDecimal value)
+   {
+      String format = field.getDisplayFormat();
+      int scale = Math.max(0, value.stripTrailingZeros().scale());
+      if(format == null || format.isBlank() || DisplayFormat.DEFAULT.equals(format))
+      {
+         return (number(value, scale));
+      }
+      String formatted = numeric(field, "min", value);
+      return (scale == 0 && DisplayFormat.CURRENCY.equals(format) && formatted.endsWith(".00")
+         ? formatted.substring(0, formatted.length() - 3) : formatted);
+   }
+
+
+
+   /*******************************************************************************
+    ** Instants remain UTC in raw values and display in the current session zone.
+    *******************************************************************************/
+   public static String instant(Instant value)
+   {
+      return (DateTimeFormatter.ofPattern("uuuu-MM-dd HH:mm", Locale.US).format(value.atZone(ValueUtils.getSessionOrInstanceZoneId())));
+   }
+
+
+
+   /*******************************************************************************
+    ** Calendar duration avoids misleading fixed-length month and year arithmetic.
+    *******************************************************************************/
+   public static String duration(LocalDate first, LocalDate last)
+   {
+      Period period = Period.between(first, last);
+      List<String> parts = new ArrayList<>();
+      if(period.getYears() != 0)
+      {
+         parts.add(period.getYears() + (period.getYears() == 1 ? " year" : " years"));
+      }
+      if(period.getMonths() != 0)
+      {
+         parts.add(period.getMonths() + (period.getMonths() == 1 ? " month" : " months"));
+      }
+      if(period.getDays() != 0 || parts.isEmpty())
+      {
+         parts.add(period.getDays() + (period.getDays() == 1 ? " day" : " days"));
+      }
+      return (String.join(" ", parts));
+   }
+
+
+
+   /*******************************************************************************
+    ** Calendar labels describe one bucket; the raw value remains its ISO start.
+    *******************************************************************************/
+   public static String dateBucket(Serializable start, AnalysisBackend.DateUnit unit, ZoneId zone)
+   {
+      if(unit == AnalysisBackend.DateUnit.DAY_OF_WEEK)
+      {
+         return (DayOfWeek.of(((Number) start).intValue()).getDisplayName(TextStyle.FULL, Locale.US));
+      }
+      if(unit == AnalysisBackend.DateUnit.HOUR_OF_DAY)
+      {
+         return (String.format(Locale.US, "%02d:00", ((Number) start).intValue()));
+      }
+      LocalDate date = ProfileSupport.day(start, zone);
+      return (switch(unit)
+      {
+         case YEAR -> Integer.toString(date.getYear());
+         case QUARTER -> date.getYear() + " Q" + ((date.getMonthValue() - 1) / 3 + 1);
+         case MONTH -> DateTimeFormatter.ofPattern("MMM uuuu", Locale.US).format(date);
+         case WEEK -> "Week of " + date;
+         case HOUR -> DateTimeFormatter.ofPattern("uuuu-MM-dd HH:00", Locale.US).format(((Instant) start).atZone(zone));
+         default -> date.toString();
+      });
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/AnalysisLabels.java

@@ -0,0 +1,195 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.io.Serializable;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Set;
+import com.kingsrook.qqq.backend.core.actions.metadata.personalization.TableMetaDataPersonalizerAction;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.values.QPossibleValueTranslator;
+import com.kingsrook.qqq.backend.core.actions.values.QValueFormatter;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValue;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValueSource;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValueSourceType;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Translate through core while enforcing access to every referenced label.
+ ** RC.5's direct table-PVS translation bypasses permissions, so table values are
+ ** read with ENFORCE and handed to the translator as an ephemeral enum source.
+ ** No shared metadata or session is mutated.
+ *******************************************************************************/
+public final class AnalysisLabels
+{
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private AnalysisLabels()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Missing or denied labels fall back to the already-readable source id.
+    *******************************************************************************/
+   public static String translate(QFieldMetaData field, Serializable value) throws QException
+   {
+      return (translate(field, value, CoreTierFieldAccessResolver.defaultResolver()));
+   }
+
+
+
+   /*******************************************************************************
+    ** Resolve nested PVS label fields without invoking core's trusted lookup path.
+    *******************************************************************************/
+   public static String translate(QFieldMetaData field, Serializable value, FieldAnalysisAccessResolver access) throws QException
+   {
+      return (translate(field, value, new LinkedHashSet<>(), access));
+   }
+
+   /*******************************************************************************
+    ** Resolve nested labels only through FULL fields under the host policy.
+    *******************************************************************************/
+   private static String translate(QFieldMetaData field, Serializable value, Set<String> visited, FieldAnalysisAccessResolver access) throws QException
+   {
+      if(value == null)
+      {
+         return (null);
+      }
+      String fallback = value.toString();
+      QPossibleValueSource source = QContext.getQInstance().getPossibleValueSource(field.getPossibleValueSourceName());
+      if(source == null || visited.size() >= 8 || !visited.add(source.getName()))
+      {
+         return (fallback);
+      }
+      try
+      {
+         QPossibleValueTranslator translator = new QPossibleValueTranslator();
+         if(source.getType() != QPossibleValueSourceType.TABLE)
+         {
+            return (translator.translatePossibleValue(field, value));
+         }
+         QueryInput input = new QueryInput(source.getTableName());
+         input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+         QTableMetaData table = TableMetaDataPersonalizerAction.execute(input, true);
+         QTableMetaData original = QContext.getQInstance().getTable(source.getTableName());
+         List<String> labelFields = original.getRecordLabelFields() == null ? List.of() : original.getRecordLabelFields();
+         for(String labelField : labelFields)
+         {
+            if(!table.getFields().containsKey(labelField) || access.resolve(table, table.getField(labelField)) != FieldAnalysisAccess.FULL)
+            {
+               return (fallback);
+            }
+         }
+         String id = source.getOverrideIdField() == null ? table.getPrimaryKeyField() : source.getOverrideIdField();
+         Set<String> selection = new LinkedHashSet<>(labelFields);
+         selection.add(id);
+         input.withFilter(DrillFilters.condition(id, QCriteriaOperator.EQUALS, value).withLimit(1)).withFieldNamesToInclude(selection)
+            .withShouldFetchHeavyFields(true).withShouldGenerateDisplayValues(true);
+         List<QRecord> records = new QueryAction().execute(input).getRecords();
+         if(records.isEmpty())
+         {
+            return (fallback);
+         }
+         QRecord record = records.getFirst();
+         for(String labelField : labelFields)
+         {
+            QFieldMetaData labelMetadata = table.getField(labelField);
+            if(labelMetadata.getPossibleValueSourceName() != null)
+            {
+               record.withDisplayValue(labelField, translate(labelMetadata, record.getValue(labelField), visited, access));
+            }
+         }
+         String label = QValueFormatter.formatRecordLabel(table, record);
+         QPossibleValueSource permitted = new QPossibleValueSource().withName(source.getName()).withType(QPossibleValueSourceType.ENUM)
+            .withValueFormat(source.getValueFormat()).withValueFields(source.getValueFields()).withEnumValues(List.of(new QPossibleValue<>(value, label)));
+         return (translator.buildTranslatedPossibleValueList(permitted, List.of(value)).getFirst().getLabel());
+      }
+      catch(QPermissionDeniedException e)
+      {
+         return (fallback);
+      }
+      finally
+      {
+         visited.remove(source.getName());
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Cache identity includes personalized field and related-label policies, so a
+    ** host changing field/record locks cannot release older translated labels.
+    *******************************************************************************/
+   public static java.util.Map<String, Object> policy(String tableName) throws QException
+   {
+      return (policy(tableName, CoreTierFieldAccessResolver.defaultResolver()));
+   }
+
+   /*******************************************************************************
+    ** Include host-resolved tiers of related labels in the exact-run identity.
+    *******************************************************************************/
+   public static java.util.Map<String, Object> policy(String tableName, FieldAnalysisAccessResolver access) throws QException
+   {
+      java.util.Map<String, Object> result = new java.util.TreeMap<>();
+      java.util.ArrayDeque<String> pending = new java.util.ArrayDeque<>();
+      pending.add(tableName);
+      while(!pending.isEmpty())
+      {
+         String name = pending.removeFirst();
+         if(result.containsKey(name))
+         {
+            continue;
+         }
+         QueryInput input = new QueryInput(name);
+         input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+         QTableMetaData table = TableMetaDataPersonalizerAction.execute(input, true);
+         java.util.Map<String, Object> entry = new java.util.TreeMap<>();
+         entry.put("fields", table.getFields());
+         entry.put("fullFields", table.getFields().values().stream().filter(f -> access.resolve(table, f) == FieldAnalysisAccess.FULL).map(QFieldMetaData::getName).sorted().toList());
+         entry.put("locks", table.getRecordSecurityLocks());
+         entry.put("labelFields", table.getRecordLabelFields());
+         entry.put("labelFormat", table.getRecordLabelFormat());
+         entry.put("permissions", table.getPermissionRules());
+         result.put(name, entry);
+         for(QFieldMetaData field : table.getFields().values())
+         {
+            QPossibleValueSource source = QContext.getQInstance().getPossibleValueSource(field.getPossibleValueSourceName());
+            if(source != null && source.getType() == QPossibleValueSourceType.TABLE)
+            {
+               pending.add(source.getTableName());
+            }
+         }
+      }
+      return (result);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/AnalysisSecurity.java

@@ -0,0 +1,150 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.io.Serializable;
+import java.util.List;
+import com.kingsrook.qbits.dataanalysis.permissions.DataAnalysisPermissions;
+import com.kingsrook.qqq.backend.core.actions.metadata.personalization.TableMetaDataPersonalizerAction;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionsHelper;
+import com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+
+/*******************************************************************************
+ ** Fail closed before any source-table computation, including cache retrieval.
+ *******************************************************************************/
+public class AnalysisSecurity
+{
+   private final EffectiveConfigResolver configs;
+   private final FieldAnalysisAccessResolver fieldAccess;
+
+   /*******************************************************************************
+    ** Use the runtime's configuration policy.
+    *******************************************************************************/
+   public AnalysisSecurity(EffectiveConfigResolver configs)
+   {
+      this(configs, CoreTierFieldAccessResolver.defaultResolver());
+   }
+
+
+
+   /*******************************************************************************
+    ** Bind the host field policy.
+    *******************************************************************************/
+   public AnalysisSecurity(EffectiveConfigResolver configs, FieldAnalysisAccessResolver fieldAccess)
+   {
+      this.configs = configs;
+      this.fieldAccess = fieldAccess;
+   }
+
+   /*******************************************************************************
+    ** Explicit enforcement is independent of the instance's default switch.
+    *******************************************************************************/
+   public QTableMetaData table(String name) throws QException
+   {
+      QTableMetaData table = QContext.getQInstance().getTable(name);
+      QueryInput input = new QueryInput(name);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      if(table == null || !configs.resolve(name).getEnabled() || !DataAnalysisPermissions.canAnalyze(table)
+         || !PermissionsHelper.hasTablePermission(input, name, TablePermissionSubType.READ))
+      {
+         throw new QPermissionDeniedException("Analysis is unavailable for this table.");
+      }
+      return (TableMetaDataPersonalizerAction.execute(input, true));
+   }
+
+
+
+   /*******************************************************************************
+    ** Use personalized fields and locks; excluded fields never appear in capabilities.
+    *******************************************************************************/
+   public List<QFieldMetaData> analyzableFields(String name) throws QException
+   {
+      QTableMetaData table = table(name);
+      EffectiveConfig c = configs.resolve(name);
+      return (table.getFields().values().stream().filter(f -> fieldAccess.resolve(table, f) == FieldAnalysisAccess.FULL)
+         .filter(f -> c.getAnalyzableFields().isEmpty() || c.getAnalyzableFields().contains(f.getName()))
+         .filter(f -> !c.getExcludedFields().contains(f.getName())).toList());
+   }
+
+
+
+   /*******************************************************************************
+    ** A common denial does not disclose a hidden field's existence or values.
+    *******************************************************************************/
+   public QFieldMetaData field(String table, String field) throws QException
+   {
+      return (analyzableFields(table).stream().filter(f -> f.getName().equals(field)).findFirst()
+         .orElseThrow(() -> new QBadRequestException("Unknown analysis field.")));
+   }
+
+   /*******************************************************************************
+    ** Core fingerprint plus the sorted FULL-field list, hashed by the run identity.
+    *******************************************************************************/
+   public String accessFingerprint(String table) throws QException
+   {
+      return (fieldAccess.getAccessFingerprint() + ":" + JsonUtils.toJson(analyzableFields(table).stream().map(QFieldMetaData::getName).sorted().toList()));
+   }
+
+   /*******************************************************************************
+    ** Check a joined field without requiring the related table analyze permission.
+    *******************************************************************************/
+   public QFieldMetaData joinedField(String tableName, String fieldName) throws QException
+   {
+      QTableMetaData table = joinedTable(tableName);
+      QFieldMetaData field = table.getFields().get(fieldName);
+      if(field == null || fieldAccess.resolve(table, field) != FieldAnalysisAccess.FULL)
+      {
+         throw new QBadRequestException("Unknown analysis field.");
+      }
+      return (field);
+   }
+
+   /*******************************************************************************
+    ** Display labels use the same policy as the selected pivot field.
+    *******************************************************************************/
+   public String label(QFieldMetaData field, Serializable value) throws QException
+   {
+      return (AnalysisLabels.translate(field, value, fieldAccess));
+   }
+
+   /*******************************************************************************
+    ** Each intermediate exposed-join table requires READ, without analyze rights.
+    *******************************************************************************/
+   public QTableMetaData joinedTable(String tableName) throws QException
+   {
+      QueryInput input = new QueryInput(tableName);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      if(QContext.getQInstance().getTable(tableName) == null || !PermissionsHelper.hasTablePermission(input, tableName, TablePermissionSubType.READ))
+      {
+         throw new QBadRequestException("Unknown analysis field.");
+      }
+      return (TableMetaDataPersonalizerAction.execute(input, true));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/ColumnProfiler.java

@@ -0,0 +1,259 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.ZoneId;
+import java.time.temporal.ChronoUnit;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.dataanalysis.result.ChartKind;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfile;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfileRequest;
+import com.kingsrook.qbits.dataanalysis.result.DateProfile;
+import com.kingsrook.qbits.dataanalysis.result.NumericProfile;
+import com.kingsrook.qbits.dataanalysis.result.TextProfile;
+import com.kingsrook.qbits.dataanalysis.result.ValueCount;
+import com.kingsrook.qbits.dataanalysis.result.ValueType;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.utils.ValueUtils;
+
+/*******************************************************************************
+ ** Column profiles depend only on primitive backend operations and typed results.
+ *******************************************************************************/
+public class ColumnProfiler
+{
+   private final AnalysisBackend backend;
+   private final FieldAnalysisAccessResolver fieldAccess;
+
+   /*******************************************************************************
+    ** The backend can be replaced when core's new operators ship.
+    *******************************************************************************/
+   public ColumnProfiler(AnalysisBackend backend)
+   {
+      this(backend, CoreTierFieldAccessResolver.defaultResolver());
+   }
+
+   /*******************************************************************************
+    ** Bind the host field policy for possible-value labels.
+    *******************************************************************************/
+   public ColumnProfiler(AnalysisBackend backend, FieldAnalysisAccessResolver fieldAccess)
+   {
+      this.backend = backend;
+      this.fieldAccess = fieldAccess;
+   }
+
+
+
+   /*******************************************************************************
+    ** Produce a guarded profile for a validated field and selected population.
+    *******************************************************************************/
+   public ColumnProfile profile(ColumnProfileRequest request, QFieldMetaData field, AnalysisBackend.Scope scope, EffectiveConfig config) throws QException
+   {
+      String table = request.getTableName();
+      String name = field.getName();
+      QQueryFilter filter = scope.filter();
+      long rows = backend.count(table, filter);
+      QQueryFilter drillFilter = scope.estimate() ? request.getFilter() : filter;
+      AnalysisBackend.FieldCounts counts = backend.fieldCounts(table, filter, List.of(name)).get(name);
+      ColumnProfile result = new ColumnProfile().withTableName(table).withFieldName(name).withFieldLabel(field.getLabel()).withFieldType(field.getType().name())
+         .withFilter(DrillFilters.restoreTypes(request.getTableName(), request.getFilter())).withEstimate(scope.estimate()).withSampleRows(scope.estimate() ? scope.rowsScanned() : 0L)
+         .withRowsScanned(scope.rowsScanned()).withTruncated(scope.truncated()).withAsOf(Instant.now());
+      result.getCounts().add(ProfileSupport.count("rows", scope.estimate() ? scope.total() : rows, table, drillFilter, null));
+      result.getCounts().add(ProfileSupport.count("nonNull", counts.nonNull(), table, drillFilter, DrillFilters.nonNull(name, field.getType().isStringLike())));
+      result.getCounts().add(ProfileSupport.count("nulls", counts.nulls(), table, drillFilter, DrillFilters.nulls(name, field.getType().isStringLike())));
+      if(field.getType().isStringLike())
+      {
+         result.getCounts().add(ProfileSupport.count("blanks", counts.blanks(), table, drillFilter, counts.blankFilter()));
+      }
+      result.getCounts().add(ProfileSupport.count("distinct", counts.distinct(), table, drillFilter, counts.distinctFilter()));
+      result.getCounts().add(ProfileSupport.metric("uniqueness", counts.uniqueness(), ValueType.PERCENT));
+      result.withTopValues(ProfileSupport.values(table, drillFilter, field, backend.topValues(table, filter, name, 20, 0, null), rows, fieldAccess));
+      QFieldType type = field.getType();
+      if(type == QFieldType.INTEGER || type == QFieldType.LONG || type == QFieldType.DECIMAL)
+      {
+         numeric(result, filter, drillFilter, rows, field);
+      }
+      else if(type == QFieldType.DATE || type == QFieldType.DATE_TIME)
+      {
+         dates(result, filter, drillFilter, rows, type);
+      }
+      else if(type.isStringLike())
+      {
+         AnalysisBackend.LengthSummary summary = backend.lengthSummary(table, filter, name);
+         AnalysisBackend.PatternSummary patterns = backend.patterns(table, filter, name, 10_000);
+         long patternValues = patterns.values();
+         TextProfile text = new TextProfile().withHistogram(ProfileSupport.values(table, drillFilter, null, summary.histogram(), rows))
+            .withPatterns(ProfileSupport.values(table, drillFilter, null, patterns.groups(), patternValues))
+            .withSampleRows(patternValues);
+         summary.metrics().forEach((key, value) -> text.getMetrics().add(ProfileSupport.metric(key, value, ValueType.DECIMAL)));
+         result.withText(text);
+         if(patterns.truncated())
+         {
+            result.getWarnings().add(scope.samplePercent() == null ? "Patterns are based on the first " + AnalysisFormatting.number(patternValues, 0) + " values."
+               : "Patterns are based on " + AnalysisFormatting.number(patternValues, 0) + " sampled values.");
+         }
+      }
+      else if(type == QFieldType.BOOLEAN)
+      {
+         result.withBooleans(new java.util.ArrayList<>());
+         for(boolean value : List.of(true, false))
+         {
+            QQueryFilter condition = DrillFilters.value(name, value, false);
+            result.getBooleans().add(ProfileSupport.count(Boolean.toString(value), backend.count(table, DrillFilters.and(filter, condition)), table, drillFilter, condition));
+         }
+         result.getBooleans().add(ProfileSupport.count("nulls", counts.nulls(), table, drillFilter, DrillFilters.nulls(name, false)));
+      }
+      new MinGroupSizeGuard(config.getMinGroupSize()).column(result, rows);
+      if(scope.estimate())
+      {
+         ProfileSupport.markEstimates(result.getCounts());
+         ProfileSupport.markEstimates(result.getBooleans());
+         if(result.getNumeric() != null)
+         {
+            ProfileSupport.markEstimates(result.getNumeric().getMetrics());
+         }
+         if(result.getDates() != null)
+         {
+            ProfileSupport.markEstimates(result.getDates().getMetrics());
+         }
+         if(result.getText() != null)
+         {
+            ProfileSupport.markEstimates(result.getText().getMetrics());
+         }
+      }
+      if(field.getPossibleValueSourceName() != null || result.getNumeric() == null && result.getDates() == null)
+      {
+         result.withChart(ProfileSupport.chart(ChartKind.BAR, ChartKind.PARETO, name, result.getTopValues()));
+      }
+      else if(result.getNumeric() != null)
+      {
+         result.withChart(ProfileSupport.chart(ChartKind.HISTOGRAM, ChartKind.BOX, name, result.getNumeric().getHistogram()));
+      }
+      else
+      {
+         result.withChart(ProfileSupport.chart(ChartKind.TIME_SERIES, ChartKind.BAR, name, result.getDates().getBuckets()));
+         result.getChart().getX().withLabel(field.getLabel() + (result.getDates().getUnit() == null ? "" : " (" + result.getDates().getUnit().toLowerCase(java.util.Locale.ROOT) + ")"));
+      }
+      if(scope.total() == 0)
+      {
+         result.getWarnings().add("No readable records match this analysis scope.");
+      }
+      else if(counts.nonNull() == 0 && rows > 0 && (!scope.estimate() || scope.rowsScanned() > 0))
+      {
+         result.getWarnings().add(scope.estimate() ? "All observed values are null." : "All values in this analysis scope are null.");
+      }
+      if(scope.estimate())
+      {
+         result.getWarnings().add(scope.warning());
+         if(scope.rowsScanned() == 0)
+         {
+            result.getWarnings().add("No sample rows were observed; run exact for exact numbers.");
+         }
+      }
+      if(scope.truncated())
+      {
+         result.getWarnings().add(scope.estimate() ? "Partial result: max_rows reached; counts cover the selected prefix and drills cover the full population."
+            : "Partial result: max_rows reached; counts and drills cover only the selected prefix.");
+      }
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** Numeric moments, nice interior bins, exterior bins and Tukey outliers.
+    *******************************************************************************/
+   private void numeric(ColumnProfile result, QQueryFilter filter, QQueryFilter drillFilter, long rows, QFieldMetaData metadata) throws QException
+   {
+      String table = result.getTableName();
+      String field = result.getFieldName();
+      AnalysisBackend.NumericSummary summary = backend.numericSummary(table, filter, field,
+         List.of("0.01", "0.05", "0.25", "0.50", "0.75", "0.95", "0.99").stream().map(BigDecimal::new).toList());
+      NumericProfile numeric = new NumericProfile();
+      summary.metrics().forEach((key, value) -> numeric.getMetrics().add(AnalysisFormatting.numericMetric(metadata, key, value)));
+      for(AnalysisBackend.GroupCount count : summary.counts())
+      {
+         numeric.getMetrics().add(ProfileSupport.count(count.label(), count.count(), table, drillFilter, count.condition()));
+      }
+      numeric.getMetrics().add(ProfileSupport.count("outliers", summary.outlierCount(), table, drillFilter, summary.outlierFilter()));
+      numeric.withHistogram(ProfileSupport.values(table, drillFilter, null,
+         backend.numericHistogram(table, filter, field, summary.metrics().get("p1"), summary.metrics().get("p99"), 20), rows));
+      numeric.withOutliers(ProfileSupport.values(table, drillFilter, null, summary.outliers(), rows));
+      result.withNumeric(numeric);
+   }
+
+
+
+   /*******************************************************************************
+    ** Date extrema, range, calendar volume, gaps and cyclic time patterns.
+    *******************************************************************************/
+   private void dates(ColumnProfile result, QQueryFilter filter, QQueryFilter drillFilter, long rows, QFieldType type) throws QException
+   {
+      String table = result.getTableName();
+      String field = result.getFieldName();
+      ZoneId zone = ValueUtils.getSessionOrInstanceZoneId();
+      Map<String, Serializable> extrema = backend.extrema(table, filter, field);
+      DateProfile dates = new DateProfile();
+      ValueType valueType = type == QFieldType.DATE ? ValueType.DATE : ValueType.DATE_TIME;
+      extrema.forEach((key, value) -> dates.getMetrics().add(ProfileSupport.metric(key, value, valueType)));
+      if(extrema.get("min") != null && extrema.get("max") != null)
+      {
+         LocalDate first = ProfileSupport.day(extrema.get("min"), zone);
+         LocalDate last = ProfileSupport.day(extrema.get("max"), zone);
+         AnalysisBackend.DateUnit unit = autoBucket(first, last);
+         dates.withUnit(unit.name());
+         dates.getMetrics().add(ProfileSupport.metric("range", ChronoUnit.DAYS.between(first, last), ValueType.DURATION).withFormatted(AnalysisFormatting.duration(first, last)));
+         List<ValueCount> buckets = ProfileSupport.values(table, drillFilter, null, backend.dateBuckets(table, filter, field, unit, zone), rows);
+         dates.withBuckets(buckets).withGaps(buckets.stream().filter(b -> b.getCount() == 0).toList());
+         if(type == QFieldType.DATE_TIME)
+         {
+            dates.withDayOfWeek(ProfileSupport.values(table, drillFilter, null, backend.dateBuckets(table, filter, field, AnalysisBackend.DateUnit.DAY_OF_WEEK, zone), rows))
+               .withHourOfDay(ProfileSupport.values(table, drillFilter, null, backend.dateBuckets(table, filter, field, AnalysisBackend.DateUnit.HOUR_OF_DAY, zone), rows));
+         }
+      }
+      result.withDates(dates);
+   }
+
+
+
+   /*******************************************************************************
+    ** Inclusive calendar boundaries: 92 days, two years and ten years.
+    *******************************************************************************/
+   public static AnalysisBackend.DateUnit autoBucket(LocalDate first, LocalDate last)
+   {
+      if(ChronoUnit.DAYS.between(first, last) <= 92)
+      {
+         return (AnalysisBackend.DateUnit.DAY);
+      }
+      if(!last.isAfter(first.plusYears(2)))
+      {
+         return (AnalysisBackend.DateUnit.WEEK);
+      }
+      return (!last.isAfter(first.plusYears(10)) ? AnalysisBackend.DateUnit.MONTH : AnalysisBackend.DateUnit.YEAR);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/CoreAnalysisBackend.java

@@ -0,0 +1,483 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import java.math.MathContext;
+import java.math.RoundingMode;
+import java.time.LocalDate;
+import java.time.ZoneId;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.Aggregate;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateCapability;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateResult;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.DateBucket;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.DateBucketUnit;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.GroupBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.NumericBucket;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.modules.backend.QBackendModuleDispatcher;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+
+/*******************************************************************************
+ ** Capability-directed aggregates; streamed primitives retain portable drills.
+ *******************************************************************************/
+public class CoreAnalysisBackend extends StandInAnalysisBackend
+{
+   private BigDecimal samplePercent;
+   private QQueryFilter populationFilter;
+   private long populationRows;
+   private long aggregateRows;
+   private BigDecimal lastCountShare;
+
+   /*******************************************************************************
+    ** Bind the same bounded configuration as the streamed implementation.
+    *******************************************************************************/
+   public CoreAnalysisBackend(EffectiveConfig config)
+   {
+      super(config);
+   }
+
+   /*******************************************************************************
+    ** Ask the actual backend implementation, including dialect-specific support.
+    *******************************************************************************/
+   public static Set<AggregateCapability> capabilities(String table) throws QException
+   {
+      AggregateInput input = new AggregateInput(table);
+      return (new QBackendModuleDispatcher().getQBackendModule(input.getBackend()).getAggregateInterface().getSupportedCapabilities(input));
+   }
+
+   /*******************************************************************************
+    ** Sampling belongs to each aggregate, never to a materialized key filter.
+    *******************************************************************************/
+   @Override
+   public Scope scope(String table, QQueryFilter filter, boolean exact) throws QException
+   {
+      samplePercent = null;
+      long total = super.count(table, filter);
+      if(exact || total <= config.getSampleThresholdRows() || total <= config.getSampleRows() || !capabilities(table).contains(AggregateCapability.SAMPLING))
+      {
+         return (super.scope(table, filter, exact));
+      }
+      estimating = true;
+      populationRows = total;
+      populationFilter = DrillFilters.copy(filter);
+      samplePercent = BigDecimal.valueOf(config.getSampleRows()).multiply(BigDecimal.valueOf(100))
+         .divide(BigDecimal.valueOf(total), MathContext.DECIMAL128).min(BigDecimal.valueOf(100));
+      long seen = sampledCount(table, populationFilter);
+      return (new Scope(DrillFilters.copy(filter), total, seen, false, true, samplePercent));
+   }
+
+   /*******************************************************************************
+    ** Count the sampled call's actual rows rather than assuming the requested size.
+    *******************************************************************************/
+   private long sampledCount(String table, QQueryFilter filter) throws QException
+   {
+      if(samplePercent.signum() == 0)
+      {
+         return (0);
+      }
+      List<AggregateResult> result = super.aggregate(new AggregateInput(table).withFilter(DrillFilters.copy(filter))
+         .withAggregate(countOf(primaryKey(table), AggregateOperator.COUNT)).withSamplePercent(samplePercent));
+      return (result.isEmpty() ? 0 : number(result.getFirst(), primaryKey(table), AggregateOperator.COUNT).longValue());
+   }
+
+   /*******************************************************************************
+    ** Unpaginated groups supply their own denominator, including null groups.
+    ** Limited groups use a separate sampled population count for this call.
+    *******************************************************************************/
+   @Override
+   protected List<AggregateResult> aggregate(AggregateInput input) throws QException
+   {
+      if(samplePercent == null)
+      {
+         return (super.aggregate(input));
+      }
+      if(samplePercent.signum() == 0)
+      {
+         aggregateRows = 0;
+         return (List.of());
+      }
+      Aggregate count = countOf(primaryKey(input.getTableName()), AggregateOperator.COUNT);
+      if(input.getAggregates() == null || !input.getAggregates().contains(count))
+      {
+         input.withAggregate(count);
+      }
+      input.withSamplePercent(samplePercent);
+      boolean fullPopulation = JsonUtils.toJson(DrillFilters.copy(input.getFilter())).equals(JsonUtils.toJson(populationFilter));
+      List<AggregateResult> result = super.aggregate(input);
+      aggregateRows = fullPopulation && input.getLimit() == null
+         ? result.stream().mapToLong(r -> number(r, primaryKey(input.getTableName()), AggregateOperator.COUNT).longValue()).sum()
+         : sampledCount(input.getTableName(), populationFilter);
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Population rows remain exact; conditional counters estimate their membership.
+    *******************************************************************************/
+   @Override
+   public long count(String table, QQueryFilter filter) throws QException
+   {
+      if(samplePercent == null)
+      {
+         return (super.count(table, filter));
+      }
+      if(JsonUtils.toJson(DrillFilters.copy(filter)).equals(JsonUtils.toJson(populationFilter)))
+      {
+         lastCountShare = ProfileSupport.share(populationRows, populationRows);
+         return (populationRows);
+      }
+      long value = sampledCount(table, filter);
+      aggregateRows = sampledCount(table, populationFilter);
+      lastCountShare = ProfileSupport.share(value, aggregateRows);
+      return (aggregateCount(value));
+   }
+
+   /*******************************************************************************
+    ** Round count estimates only after normalizing by observed sample rows.
+    *******************************************************************************/
+   @Override
+   protected long aggregateCount(long value)
+   {
+      return (samplePercent == null ? value : aggregateRows == 0 ? 0 : BigDecimal.valueOf(value).multiply(BigDecimal.valueOf(populationRows))
+         .divide(BigDecimal.valueOf(aggregateRows), 0, RoundingMode.HALF_UP).longValueExact());
+   }
+
+   /*******************************************************************************
+    ** Keep ratios in sample units, independent of count rounding.
+    *******************************************************************************/
+   @Override
+   protected BigDecimal aggregateShare(long value)
+   {
+      return (samplePercent == null ? null : ProfileSupport.share(value, aggregateRows));
+   }
+
+   /*******************************************************************************
+    ** Conditional groups retain the ratio from their sampled count call.
+    *******************************************************************************/
+   @Override
+   protected BigDecimal countShare()
+   {
+      return (samplePercent == null ? null : lastCountShare);
+   }
+
+   /*******************************************************************************
+    ** Streamed fallbacks also observe native sampling, without binding sampled ids.
+    *******************************************************************************/
+   @Override
+   protected List<QRecord> rows(String table, QQueryFilter filter, Set<String> fields, int limit) throws QException
+   {
+      if(samplePercent == null)
+      {
+         return (super.rows(table, filter, fields, limit));
+      }
+      if(limit == 0 || config.getMaxRows() == 0)
+      {
+         return (List.of());
+      }
+      AggregateInput input = new AggregateInput(table).withFilter(DrillFilters.copy(filter)).withGroupBy(new GroupBy(field(table, primaryKey(table))))
+         .withLimit(Math.min(limit, config.getMaxRows()));
+      fields.stream().filter(f -> !f.equals(primaryKey(table))).forEach(f -> input.withGroupBy(new GroupBy(field(table, f))));
+      List<QRecord> result = new ArrayList<>();
+      for(AggregateResult row : aggregate(input))
+      {
+         QRecord record = new QRecord();
+         row.getGroupByValues().forEach((key, value) -> record.setValue(key.getFieldName(), value));
+         result.add(record);
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Every field batch shares a COUNT denominator from the same sampled call.
+    *******************************************************************************/
+   @Override
+   public Map<String, FieldCounts> fieldCounts(String table, QQueryFilter filter, List<String> fields) throws QException
+   {
+      if(samplePercent == null)
+      {
+         return (super.fieldCounts(table, filter, fields));
+      }
+      Map<String, FieldCounts> result = new LinkedHashMap<>();
+      for(int start = 0; start < fields.size(); start += 20)
+      {
+         List<String> batch = fields.subList(start, Math.min(start + 20, fields.size()));
+         AggregateInput input = new AggregateInput(table).withFilter(DrillFilters.copy(filter));
+         for(String field : batch)
+         {
+            input.withAggregate(countOf(field, AggregateOperator.COUNT)).withAggregate(countOf(field, AggregateOperator.COUNT_DISTINCT));
+         }
+         fieldCountAggregates(input, batch);
+         List<String> stringFields = batch.stream().filter(f -> field(table, f).getType().isStringLike()).toList();
+         List<QRecord> records = stringFields.isEmpty() ? List.of() : rows(table, filter, Set.copyOf(stringFields), config.getMaxRows());
+         List<AggregateResult> results = aggregate(input);
+         long seen = aggregateRows;
+         for(String field : batch)
+         {
+            boolean string = field(table, field).getType().isStringLike();
+            long nonNull = results.isEmpty() ? 0 : number(results.getFirst(), field, AggregateOperator.COUNT).longValue();
+            long distinct = results.isEmpty() ? 0 : number(results.getFirst(), field, AggregateOperator.COUNT_DISTINCT).longValue();
+            long blanks = string && capabilities(table).contains(AggregateCapability.NULL_BLANK_COUNTS) && !results.isEmpty()
+               ? number(results.getFirst(), field, AggregateOperator.COUNT_BLANK).longValue() : seen - nonNull;
+            QQueryFilter blankFilter = DrillFilters.nulls(field, string);
+            if(string)
+            {
+               blankFilter = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR).withSubFilter(blankFilter);
+               for(String blank : records.stream().map(r -> r.getValueString(field)).filter(Objects::nonNull).filter(String::isBlank).distinct().toList())
+               {
+                  blankFilter.withSubFilter(DrillFilters.condition(field, QCriteriaOperator.EQUALS, blank));
+               }
+            }
+            long blankCount = aggregateCount(blanks);
+            BigDecimal completeness = ProfileSupport.share(seen - blanks, seen);
+            if(string && !capabilities(table).contains(AggregateCapability.NULL_BLANK_COUNTS))
+            {
+               blankCount = count(table, DrillFilters.and(filter, blankFilter));
+               completeness = BigDecimal.ONE.subtract(countShare());
+               aggregateRows = seen;
+            }
+            result.put(field, new FieldCounts(aggregateCount(nonNull), aggregateCount(seen - nonNull), blankCount, aggregateCount(distinct),
+               blankFilter, DrillFilters.nonNull(field, string), ProfileSupport.share(distinct, nonNull), completeness, distinct == 1));
+         }
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Add supported counters to the existing twenty-field aggregate batch.
+    *******************************************************************************/
+   @Override
+   protected void fieldCountAggregates(AggregateInput input, List<String> fields) throws QException
+   {
+      if(capabilities(input.getTableName()).contains(AggregateCapability.NULL_BLANK_COUNTS))
+      {
+         for(String name : fields)
+         {
+            input.withAggregate(new Aggregate(name, AggregateOperator.COUNT_NULL));
+            if(field(input.getTableName(), name).getType().isStringLike())
+            {
+               input.withAggregate(new Aggregate(name, AggregateOperator.COUNT_BLANK));
+            }
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Read native counters, falling back to the portable predicate counter.
+    *******************************************************************************/
+   @Override
+   protected long fieldCount(String table, QQueryFilter filter, String field, AggregateOperator operator,
+      List<AggregateResult> results, QQueryFilter condition) throws QException
+   {
+      if(capabilities(table).contains(AggregateCapability.NULL_BLANK_COUNTS))
+      {
+         return (results.isEmpty() ? 0 : number(results.getFirst(), field, operator).longValue());
+      }
+      return (super.fieldCount(table, filter, field, operator, results, condition));
+   }
+
+   /*******************************************************************************
+    ** Push each supported statistic, streaming only unavailable operators.
+    *******************************************************************************/
+   @Override
+   protected Map<String, BigDecimal> numericMetrics(String table, QQueryFilter filter, String field, List<BigDecimal> percentiles, List<BigDecimal> values) throws QException
+   {
+      Set<AggregateCapability> supported = capabilities(table);
+      if(!supported.containsAll(Set.of(AggregateCapability.STDDEV, AggregateCapability.PERCENTILE)))
+      {
+         return (partialNumericMetrics(table, filter, field, percentiles, values, supported));
+      }
+      return (nativeNumericMetrics(table, filter, field, percentiles, supported));
+   }
+
+   /*******************************************************************************
+    ** Existing streamed arithmetic supplies only unavailable metrics.
+    *******************************************************************************/
+   private Map<String, BigDecimal> partialNumericMetrics(String table, QQueryFilter filter, String field, List<BigDecimal> percentiles,
+      List<BigDecimal> values, Set<AggregateCapability> supported) throws QException
+   {
+      Map<String, BigDecimal> metrics = super.numericMetrics(table, filter, field, percentiles, values);
+      metrics.putAll(nativeNumericMetrics(table, filter, field, percentiles, supported));
+      return (metrics);
+   }
+
+   /*******************************************************************************
+    ** One aggregate call computes basic moments and all supported extensions.
+    *******************************************************************************/
+   private Map<String, BigDecimal> nativeNumericMetrics(String table, QQueryFilter filter, String field, List<BigDecimal> percentiles,
+      Set<AggregateCapability> supported) throws QException
+   {
+      Map<String, BigDecimal> metrics = new LinkedHashMap<>();
+      AggregateInput input = new AggregateInput(table).withFilter(DrillFilters.copy(filter));
+      Map<AggregateOperator, String> names = Map.of(AggregateOperator.MIN, "min", AggregateOperator.MAX, "max", AggregateOperator.AVG, "mean", AggregateOperator.SUM, "sum", AggregateOperator.STDDEV_SAMP, "stddev");
+      for(AggregateOperator op : names.keySet())
+      {
+         if(op != AggregateOperator.STDDEV_SAMP || supported.contains(AggregateCapability.STDDEV))
+         {
+            input.withAggregate(new Aggregate(field, op));
+         }
+      }
+      if(supported.contains(AggregateCapability.PERCENTILE))
+      {
+         percentiles.forEach(p -> input.withAggregate(new Aggregate(field, AggregateOperator.PERCENTILE_CONT).withPercentile(p)));
+      }
+      for(AggregateResult row : aggregate(input))
+      {
+         row.getAggregateValues().entrySet().stream().filter(e -> e.getKey().getOperator() != AggregateOperator.COUNT).forEach(entry ->
+         {
+            Aggregate key = entry.getKey();
+            Serializable value = entry.getValue();
+            metrics.put(key.getOperator() == AggregateOperator.PERCENTILE_CONT
+               ? "p" + key.getPercentile().multiply(BigDecimal.valueOf(100)).stripTrailingZeros().toPlainString() : names.get(key.getOperator()),
+               value == null ? null : new BigDecimal(value.toString()));
+         });
+      }
+      return (metrics);
+   }
+
+   /*******************************************************************************
+    ** Convert native bin numbers into identical half-open drill predicates.
+    *******************************************************************************/
+   @Override
+   public List<GroupCount> numericHistogram(String table, QQueryFilter filter, String field, BigDecimal low, BigDecimal high, int bins) throws QException
+   {
+      if(low == null || high == null || low.compareTo(high) >= 0 || !capabilities(table).contains(AggregateCapability.NUMERIC_BUCKET))
+      {
+         return (super.numericHistogram(table, filter, field, low, high, bins));
+      }
+      NiceBins nice = NiceBins.covering(low, high);
+      low = nice.low();
+      high = nice.high();
+      bins = nice.count();
+      GroupBy group = new GroupBy(field(table, field)).withBucket(new NumericBucket(low, high, bins));
+      Map<Serializable, Long> counts = bucketCounts(table, filter, group);
+      List<BigDecimal> values = !estimating && isMemory(table) ? rows(table, filter, Set.of(field), config.getMaxRows()).stream().map(r -> r.getValue(field))
+         .filter(Objects::nonNull).map(v -> new BigDecimal(v.toString())).toList() : List.of();
+      List<GroupCount> result = new ArrayList<>();
+      result.add(new GroupCount(AnalysisFormatting.interval(field(table, field), null, low), AnalysisFormatting.interval(field(table, field), null, low), aggregateCount(counts.getOrDefault(0, 0L)), numericRange(table, field, values, null, low, false), aggregateShare(counts.getOrDefault(0, 0L))));
+      BigDecimal width = high.subtract(low).divide(BigDecimal.valueOf(bins), MathContext.DECIMAL128);
+      for(int i = 0; i < bins; i++)
+      {
+         BigDecimal start = low.add(width.multiply(BigDecimal.valueOf(i)));
+         BigDecimal end = i == bins - 1 ? high : low.add(width.multiply(BigDecimal.valueOf(i + 1)));
+         String label = AnalysisFormatting.interval(field(table, field), start, end);
+         result.add(new GroupCount(label, label, aggregateCount(counts.getOrDefault(i + 1, 0L)), numericRange(table, field, values, start, end, i == bins - 1), aggregateShare(counts.getOrDefault(i + 1, 0L))));
+      }
+      result.add(new GroupCount(AnalysisFormatting.interval(field(table, field), high, null), AnalysisFormatting.interval(field(table, field), high, null), aggregateCount(counts.getOrDefault(bins + 1, 0L)),
+         DrillFilters.and(DrillFilters.condition(field, QCriteriaOperator.IS_NOT_BLANK), DrillFilters.condition(field, QCriteriaOperator.GREATER_THAN, high)), aggregateShare(counts.getOrDefault(bins + 1, 0L))));
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Native dates use the session zone; fill calendar gaps with zero counts.
+    *******************************************************************************/
+   @Override
+   public List<GroupCount> dateBuckets(String table, QQueryFilter filter, String field, DateUnit unit, ZoneId zone) throws QException
+   {
+      if(unit == DateUnit.HOUR || unit == DateUnit.QUARTER)
+      {
+         return (super.dateBuckets(table, filter, field, unit, zone));
+      }
+      GroupBy group = new GroupBy(field(table, field)).withBucket(new DateBucket(DateBucketUnit.valueOf(unit.name())));
+      AggregateInput probe = new AggregateInput(table).withGroupBy(group);
+      if(!new QBackendModuleDispatcher().getQBackendModule(probe.getBackend()).getAggregateInterface().getSupportedCapabilities(probe).contains(AggregateCapability.DATE_BUCKET))
+      {
+         return (super.dateBuckets(table, filter, field, unit, zone));
+      }
+      Map<Serializable, Long> counts = bucketCounts(table, filter, group);
+      if(unit == DateUnit.DAY_OF_WEEK || unit == DateUnit.HOUR_OF_DAY)
+      {
+         long seen = aggregateRows;
+         List<GroupCount> conditions = super.dateBuckets(table, filter, field, unit, zone);
+         aggregateRows = seen;
+         return (conditions.stream()
+            .map(g -> new GroupCount(g.value(), g.label(), aggregateCount(counts.getOrDefault(g.value(), 0L)), g.condition(), aggregateShare(counts.getOrDefault(g.value(), 0L)))).toList());
+      }
+      List<LocalDate> dates = counts.keySet().stream().filter(Objects::nonNull).map(v -> (LocalDate) v).sorted().toList();
+      List<GroupCount> result = new ArrayList<>();
+      if(!dates.isEmpty())
+      {
+         LocalDate start = dates.getFirst();
+         while(!start.isAfter(dates.getLast()))
+         {
+            LocalDate end = next(start, unit);
+            String label = AnalysisFormatting.dateBucket(start, unit, zone);
+            result.add(new GroupCount(start, label, aggregateCount(counts.getOrDefault(start, 0L)),
+               DrillFilters.dateRange(field, start, end, field(table, field).getType() == QFieldType.DATE_TIME, zone), aggregateShare(counts.getOrDefault(start, 0L))));
+            start = end;
+         }
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Length moments are native; the derived length histogram remains streamed.
+    *******************************************************************************/
+   @Override
+   public LengthSummary lengthSummary(String table, QQueryFilter filter, String field) throws QException
+   {
+      LengthSummary streamed = super.lengthSummary(table, filter, field);
+      if(capabilities(table).contains(AggregateCapability.STRING_LENGTH))
+      {
+         AggregateInput input = new AggregateInput(table).withFilter(DrillFilters.copy(filter));
+         Map<AggregateOperator, String> names = Map.of(AggregateOperator.MIN_LENGTH, "minLength", AggregateOperator.MAX_LENGTH, "maxLength", AggregateOperator.AVG_LENGTH, "meanLength");
+         names.keySet().forEach(op -> input.withAggregate(new Aggregate(field, op)));
+         for(AggregateResult row : aggregate(input))
+         {
+            row.getAggregateValues().forEach((key, value) ->
+            {
+               if(value != null && names.containsKey(key.getOperator()))
+               {
+                  streamed.metrics().put(names.get(key.getOperator()), new BigDecimal(value.toString()));
+               }
+            });
+         }
+      }
+      return (streamed);
+   }
+
+   /*******************************************************************************
+    ** Bucket result keys retain core's typed date or integer values.
+    *******************************************************************************/
+   private Map<Serializable, Long> bucketCounts(String table, QQueryFilter filter, GroupBy group) throws QException
+   {
+      Map<Serializable, Long> result = new LinkedHashMap<>();
+      AggregateInput input = new AggregateInput(table).withFilter(DrillFilters.copy(filter)).withGroupBy(group)
+         .withAggregate(countOf(primaryKey(table), AggregateOperator.COUNT));
+      for(AggregateResult row : aggregate(input))
+      {
+         result.put(row.getGroupByValues().get(group), number(row, primaryKey(table), AggregateOperator.COUNT).longValue());
+      }
+      return (result);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/CoreTierFieldAccessResolver.java

@@ -0,0 +1,118 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.lang.reflect.Method;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Optional core bridge: replace with direct calls once QQQ ships the fieldaccess package.
+ ** Class and method discovery happen once; invocation failures fail closed.
+ *******************************************************************************/
+public class CoreTierFieldAccessResolver implements FieldAnalysisAccessResolver
+{
+   private static final CoreTierFieldAccessResolver DEFAULT = discover();
+   private final Method tier;
+   private final Method fingerprint;
+
+   /*******************************************************************************
+    ** Bind discovered static methods once.
+    *******************************************************************************/
+   public CoreTierFieldAccessResolver(Class<?> helper) throws ReflectiveOperationException
+   {
+      tier = helper.getMethod("getTier", QTableMetaData.class, String.class);
+      Method optional;
+      try
+      {
+         optional = helper.getMethod("getAccessFingerprint");
+      }
+      catch(NoSuchMethodException e)
+      {
+         optional = null;
+      }
+      fingerprint = optional;
+   }
+
+   /*******************************************************************************
+    ** Resolve the optional class once per class loader.
+    *******************************************************************************/
+   private static CoreTierFieldAccessResolver discover()
+   {
+      try
+      {
+         return (new CoreTierFieldAccessResolver(Class.forName("com.kingsrook.qqq.backend.core.actions.permissions.fieldaccess.FieldAccessHelper")));
+      }
+      catch(ClassNotFoundException e)
+      {
+         return (null);
+      }
+      catch(ReflectiveOperationException e)
+      {
+         throw new ExceptionInInitializerError(e);
+      }
+   }
+
+   /*******************************************************************************
+    ** Use legacy locks only when the core helper class is absent.
+    *******************************************************************************/
+   public static FieldAnalysisAccessResolver defaultResolver()
+   {
+      return (DEFAULT == null ? new FieldSecurityLockFieldAccessResolver() : DEFAULT);
+   }
+
+   /*******************************************************************************
+    ** Unknown tiers and invocation failures never grant analysis rights.
+    *******************************************************************************/
+   @Override
+   public FieldAnalysisAccess resolve(QTableMetaData table, QFieldMetaData field)
+   {
+      try
+      {
+         return (switch(String.valueOf(tier.invoke(null, table, field.getName())))
+         {
+            case "FULL" -> FieldAnalysisAccess.FULL;
+            case "REVEALABLE" -> FieldAnalysisAccess.EXACT_MATCH_ONLY;
+            default -> FieldAnalysisAccess.NONE;
+         });
+      }
+      catch(ReflectiveOperationException e)
+      {
+         return (FieldAnalysisAccess.NONE);
+      }
+   }
+
+   /*******************************************************************************
+    ** A broken fingerprint prevents cache reuse rather than returning stale data.
+    *******************************************************************************/
+   @Override
+   public String getAccessFingerprint()
+   {
+      try
+      {
+         return (fingerprint == null ? "" : (String) fingerprint.invoke(null));
+      }
+      catch(ReflectiveOperationException e)
+      {
+         throw new IllegalStateException("Could not resolve field access fingerprint.", e);
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/DistinctValues.java

@@ -0,0 +1,84 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.time.Instant;
+import java.util.List;
+import com.kingsrook.qbits.dataanalysis.result.DistinctValuesPage;
+import com.kingsrook.qbits.dataanalysis.result.DistinctValuesRequest;
+import com.kingsrook.qbits.dataanalysis.result.ValueCount;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+
+/*******************************************************************************
+ ** Distinct-value pages apply privacy before pagination, never page rare groups.
+ *******************************************************************************/
+public class DistinctValues
+{
+   private final AnalysisBackend backend;
+   private final FieldAnalysisAccessResolver fieldAccess;
+
+   /*******************************************************************************
+    ** Bind primitive operations.
+    *******************************************************************************/
+   public DistinctValues(AnalysisBackend backend)
+   {
+      this(backend, CoreTierFieldAccessResolver.defaultResolver());
+   }
+
+   /*******************************************************************************
+    ** Bind the host field policy for possible-value labels.
+    *******************************************************************************/
+   public DistinctValues(AnalysisBackend backend, FieldAnalysisAccessResolver fieldAccess)
+   {
+      this.backend = backend;
+      this.fieldAccess = fieldAccess;
+   }
+
+
+
+   /*******************************************************************************
+    ** Request validation caps the page size at 500 and rejects overflow.
+    *******************************************************************************/
+   public DistinctValuesPage page(DistinctValuesRequest request, QFieldMetaData field, EffectiveConfig config) throws QException
+   {
+      if(request.getPage() == null || request.getPage() < 0 || request.getPageSize() == null || request.getPageSize() < 1 || request.getPageSize() > 500
+         || (long) request.getPage() * request.getPageSize() > Integer.MAX_VALUE - 501)
+      {
+         throw new QException("Invalid distinct-values page; pageSize must be between 1 and 500.");
+      }
+      AnalysisBackend.Scope scope = backend.scope(request.getTableName(), request.getFilter(), true);
+      int offset = request.getPage() * request.getPageSize();
+      boolean wholeListing = config.getMinGroupSize() > 0 || request.getSearch() != null && !request.getSearch().isBlank();
+      int fetch = wholeListing ? Math.max(1, config.getMaxRows()) : request.getPageSize() + 1;
+      List<ValueCount> values = ProfileSupport.values(request.getTableName(), scope.filter(), field,
+         backend.topValues(request.getTableName(), scope.filter(), field.getName(), fetch, wholeListing ? 0 : offset, request.getSearch()), scope.rowsScanned(), fieldAccess);
+      long totalDistinct = wholeListing ? values.stream().filter(v -> v.getValue() != null).count()
+         : backend.fieldCounts(request.getTableName(), scope.filter(), List.of(field.getName())).get(field.getName()).distinct();
+      values = new MinGroupSizeGuard(config.getMinGroupSize()).groups(values);
+      int start = wholeListing ? Math.min(offset, values.size()) : 0;
+      boolean more = values.size() > start + request.getPageSize();
+      return (new DistinctValuesPage().withTableName(request.getTableName()).withFieldName(field.getName()).withFilter(DrillFilters.copy(request.getFilter()))
+         .withPage(request.getPage()).withPageSize(request.getPageSize()).withHasMore(more).withValues(values.subList(start, Math.min(values.size(), start + request.getPageSize())))
+         .withTotalDistinct(totalDistinct)
+         .withRowsScanned(scope.rowsScanned()).withTruncated(scope.truncated()).withAsOf(Instant.now()));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/DrillFilters.java

@@ -0,0 +1,314 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.io.Serializable;
+import java.time.LocalDate;
+import java.time.ZoneId;
+import java.util.List;
+import com.kingsrook.qbits.dataanalysis.result.Drill;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+/*******************************************************************************
+ ** Immutable composition of the request filter and the producing condition.
+ *******************************************************************************/
+public final class DrillFilters
+{
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private DrillFilters()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Copy criteria only; pagination and ordering are not analysis predicates.
+    *******************************************************************************/
+   public static QQueryFilter copy(QQueryFilter filter)
+   {
+      QQueryFilter result = filter == null ? new QQueryFilter() : filter.clone();
+      result.setLimit(null);
+      result.setSkip(null);
+      result.setOrderBys(null);
+      if(result.getSubFilters() != null)
+      {
+         result.setSubFilters(result.getSubFilters().stream().map(DrillFilters::copy).toList());
+      }
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** Preserve OR semantics of both operands by nesting them under AND.
+    *******************************************************************************/
+   public static QQueryFilter and(QQueryFilter original, QQueryFilter condition)
+   {
+      return (new QQueryFilter().withSubFilter(copy(original)).withSubFilter(copy(condition)));
+   }
+
+
+
+   /*******************************************************************************
+    ** A drill always owns its filters.
+    *******************************************************************************/
+   public static Drill drill(String table, QQueryFilter original, QQueryFilter condition)
+   {
+      QQueryFilter filter = and(original, condition);
+      var instance = com.kingsrook.qqq.backend.core.context.QContext.getQInstance();
+      if(instance != null && "memory".equals(instance.getBackend(instance.getTable(table).getBackendName()).getBackendType()))
+      {
+         filter = memoryTemporalBounds(restoreTypes(table, filter));
+      }
+      return (new Drill().withTableName(table).withFilter(filter));
+   }
+
+
+
+   /*******************************************************************************
+    ** Memory's inclusive lower bound uses Java equality, which differs after
+    ** HTTP turns dates into strings. Strict lower bounds avoid that equality.
+    ** Only memory uses this adjustment: SQL timestamp precision may be coarser.
+    *******************************************************************************/
+   private static QQueryFilter memoryTemporalBounds(QQueryFilter filter)
+   {
+      filter.setSubFilters(new java.util.ArrayList<>(filter.getSubFilters()));
+      for(var criterion : new java.util.ArrayList<>(filter.getCriteria()))
+      {
+         if(criterion.getValues() != null && !criterion.getValues().isEmpty()
+            && criterion.getValues().stream().allMatch(v -> v instanceof java.time.Instant || v instanceof LocalDate)
+            && (criterion.getOperator() == QCriteriaOperator.EQUALS || criterion.getOperator() == QCriteriaOperator.IN))
+         {
+            QQueryFilter members = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR);
+            for(Serializable value : criterion.getValues())
+            {
+               members.withSubFilter(range(criterion.getFieldName(), value, value, true));
+            }
+            filter.getCriteria().remove(criterion);
+            filter.withSubFilter(members);
+            continue;
+         }
+         if(criterion.getValues() != null && criterion.getValues().size() == 1)
+         {
+            Serializable value = criterion.getValues().getFirst();
+            if(value instanceof java.time.Instant || value instanceof LocalDate)
+            {
+               Serializable previous = value instanceof java.time.Instant instant ? instant.minusNanos(1) : ((LocalDate) value).minusDays(1);
+               if(criterion.getOperator() == QCriteriaOperator.GREATER_THAN_OR_EQUALS)
+               {
+                  criterion.setOperator(QCriteriaOperator.GREATER_THAN);
+                  criterion.setValues(List.of(previous));
+               }
+               else if(criterion.getOperator() == QCriteriaOperator.LESS_THAN)
+               {
+                  criterion.setOperator(QCriteriaOperator.LESS_THAN_OR_EQUALS);
+                  criterion.setValues(List.of(previous));
+               }
+            }
+         }
+      }
+      filter.getSubFilters().forEach(DrillFilters::memoryTemporalBounds);
+      return (filter);
+   }
+
+   /*******************************************************************************
+    ** One criterion, including predicates without operands.
+    *******************************************************************************/
+   public static QQueryFilter condition(String field, QCriteriaOperator operator, Serializable... values)
+   {
+      return (new QQueryFilter().withCriteria(field, operator, values));
+   }
+
+
+
+   /*******************************************************************************
+    ** RC.5 IS_BLANK includes empty strings. Applying it to StringLength
+    ** distinguishes null from length zero on both SQL and memory backends.
+    *******************************************************************************/
+   public static QQueryFilter nulls(String field, boolean string)
+   {
+      QQueryFilter result = condition(field, QCriteriaOperator.IS_BLANK);
+      if(string)
+      {
+         result.withCriteria(new com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterCriteria(field, QCriteriaOperator.NOT_EQUALS_OR_IS_NULL, 0)
+            .withFieldFunction(new com.kingsrook.qqq.backend.core.model.metadata.fields.functions.FieldFunction().withFieldName(field)
+               .withFunctionTypeIdentifier(com.kingsrook.qqq.backend.core.model.metadata.fields.functions.implementations.StringLengthFunction.IDENTIFIER)));
+      }
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** Non-null includes an empty string, unlike core IS_NOT_BLANK.
+    *******************************************************************************/
+   public static QQueryFilter nonNull(String field, boolean string)
+   {
+      QQueryFilter result = condition(field, QCriteriaOperator.IS_NOT_BLANK);
+      if(string)
+      {
+         result.withBooleanOperator(QQueryFilter.BooleanOperator.OR).withSubFilter(emptyString(field));
+      }
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** A group equality uses a null-only filter for a null group.
+    *******************************************************************************/
+   public static QQueryFilter value(String field, Serializable value, boolean string)
+   {
+      return (value == null ? nulls(field, string) : "".equals(value) ? emptyString(field)
+         : value instanceof java.time.Instant || value instanceof LocalDate ? range(field, value, value, true) : condition(field, QCriteriaOperator.EQUALS, value));
+   }
+
+
+
+   /*******************************************************************************
+    ** Half-open bounds, except that the final interior histogram bin is closed.
+    ** Explicit non-null avoids RC.5 memory treating null as less than a value.
+    *******************************************************************************/
+   public static QQueryFilter range(String field, Serializable low, Serializable high, boolean closed)
+   {
+      QQueryFilter result = condition(field, QCriteriaOperator.IS_NOT_BLANK);
+      if(low != null)
+      {
+         result.withCriteria(field, QCriteriaOperator.GREATER_THAN_OR_EQUALS, low);
+      }
+      if(high != null)
+      {
+         result.withCriteria(field, closed ? QCriteriaOperator.LESS_THAN_OR_EQUALS : QCriteriaOperator.LESS_THAN, high);
+      }
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** Local midnight boundaries preserve DST and the user's time zone.
+    *******************************************************************************/
+   public static QQueryFilter dateRange(String field, LocalDate low, LocalDate high, boolean dateTime, ZoneId zone)
+   {
+      return (range(field, dateTime ? low.atStartOfDay(zone).toInstant() : low,
+         dateTime ? high.atStartOfDay(zone).toInstant() : high, false));
+   }
+
+
+
+   /*******************************************************************************
+    ** Strict Tukey fences, excluding nulls on every backend.
+    *******************************************************************************/
+   public static QQueryFilter outliers(String field, Serializable low, Serializable high)
+   {
+      QQueryFilter outside = condition(field, QCriteriaOperator.LESS_THAN, low)
+         .withBooleanOperator(QQueryFilter.BooleanOperator.OR).withCriteria(field, QCriteriaOperator.GREATER_THAN, high);
+      return (and(condition(field, QCriteriaOperator.IS_NOT_BLANK), outside));
+   }
+
+
+
+   /*******************************************************************************
+    ** Exact membership for streamed shapes, lengths and duplicate tuples.
+    *******************************************************************************/
+   public static QQueryFilter in(String field, List<? extends Serializable> values)
+   {
+      if(values.stream().anyMatch(v -> v instanceof java.time.Instant || v instanceof LocalDate))
+      {
+         QQueryFilter result = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR);
+         values.forEach(value -> result.withSubFilter(range(field, value, value, true)));
+         return (result);
+      }
+      if(values.contains(""))
+      {
+         List<? extends Serializable> nonEmpty = values.stream().filter(v -> !"".equals(v)).toList();
+         return (new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR).withSubFilter(emptyString(field)).withSubFilter(in(field, nonEmpty)));
+      }
+      return (values.isEmpty() ? condition(field, QCriteriaOperator.FALSE) : new QQueryFilter().withCriteria(field, QCriteriaOperator.IN, values));
+   }
+
+
+
+   /*******************************************************************************
+    ** Core HTTP interpretation treats empty string operands as missing inputs.
+    ** A zero-length predicate expresses the same set without an empty operand.
+    *******************************************************************************/
+   private static QQueryFilter emptyString(String field)
+   {
+      return (new QQueryFilter().withCriteria(new com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterCriteria(field, QCriteriaOperator.EQUALS, 0)
+         .withFieldFunction(new com.kingsrook.qqq.backend.core.model.metadata.fields.functions.FieldFunction().withFieldName(field)
+            .withFunctionTypeIdentifier(com.kingsrook.qqq.backend.core.model.metadata.fields.functions.implementations.StringLengthFunction.IDENTIFIER))));
+   }
+
+   /*******************************************************************************
+    ** JSON has no temporal scalar types. Restore them from current metadata before
+    ** a cached drill is handed back to core, without mutating the stored filter.
+    *******************************************************************************/
+   public static QQueryFilter restoreTypes(String table, QQueryFilter filter)
+   {
+      QQueryFilter result = copy(filter);
+      var instance = com.kingsrook.qqq.backend.core.context.QContext.getQInstance();
+      if(instance == null || instance.getTable(table) == null)
+      {
+         return (result);
+      }
+      if(result.getCriteria() != null)
+      {
+         for(var criterion : result.getCriteria())
+         {
+            var field = instance.getTable(table).getFields().get(criterion.getFieldName());
+            if(field != null && criterion.getValues() != null)
+            {
+               var type = field.getType();
+               if(type == com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType.DATE
+                  || type == com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType.DATE_TIME
+                  || type == com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType.DECIMAL
+                  || criterion.getOperator() == QCriteriaOperator.EQUALS || criterion.getOperator() == QCriteriaOperator.IN)
+               {
+                  criterion.setValues(criterion.getValues().stream().map(v -> restoreValue(type, v)).toList());
+               }
+            }
+         }
+      }
+      if(result.getSubFilters() != null)
+      {
+         result.setSubFilters(result.getSubFilters().stream().map(f -> restoreTypes(table, f)).toList());
+      }
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** String decimal operands preserve exact scale and precision across JSON round trips.
+    *******************************************************************************/
+   private static Serializable restoreValue(com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType type, Serializable value)
+   {
+      if(type == com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType.DECIMAL)
+      {
+         return (value == null ? null : value.toString());
+      }
+      return (com.kingsrook.qqq.backend.core.utils.ValueUtils.getValueAsFieldType(type, value));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/DuplicateFinder.java

@@ -0,0 +1,56 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.time.Instant;
+import com.kingsrook.qbits.dataanalysis.result.DuplicatesRequest;
+import com.kingsrook.qbits.dataanalysis.result.DuplicatesResult;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+
+/*******************************************************************************
+ ** Top fifty duplicate tuples with permission-filtered membership drills.
+ *******************************************************************************/
+public class DuplicateFinder
+{
+   private final AnalysisBackend backend;
+
+   /*******************************************************************************
+    ** Bind primitive operations.
+    *******************************************************************************/
+   public DuplicateFinder(AnalysisBackend backend)
+   {
+      this.backend = backend;
+   }
+
+
+
+   /*******************************************************************************
+    ** Guard tuples before exposing or serializing them.
+    *******************************************************************************/
+   public DuplicatesResult find(DuplicatesRequest request, EffectiveConfig config) throws QException
+   {
+      AnalysisBackend.Scope scope = backend.scope(request.getTableName(), request.getFilter(), true);
+      return (new DuplicatesResult().withTableName(request.getTableName()).withFields(request.getFields()).withFilter(DrillFilters.copy(request.getFilter()))
+         .withRowsScanned(scope.rowsScanned()).withTruncated(scope.truncated()).withAsOf(Instant.now())
+         .withGroups(new MinGroupSizeGuard(config.getMinGroupSize()).groups(ProfileSupport.values(request.getTableName(), scope.filter(), null,
+            backend.duplicates(request.getTableName(), scope.filter(), request.getFields(), request.getLimit()), scope.rowsScanned()))));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/EffectiveConfig.java

@@ -0,0 +1,211 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+
+import java.io.Serializable;
+import java.util.Set;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+
+/*******************************************************************************
+ ** Typed EffectiveConfig contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class EffectiveConfig implements Serializable
+{
+   private Boolean enabled = true;
+   private Integer maxRows;
+   private Integer sampleThresholdRows;
+   private Integer sampleRows;
+   private Integer minGroupSize;
+   private Integer cacheTtlMinutes;
+   private Set<String> analyzableFields = Set.of();
+   private Set<String> excludedFields = Set.of();
+
+
+
+   /*******************************************************************************
+    ** Getter for enabled.
+    *******************************************************************************/
+   public Boolean getEnabled()
+   {
+      return (enabled);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for enabled.
+    *******************************************************************************/
+   public EffectiveConfig withEnabled(Boolean enabled)
+   {
+      this.enabled = enabled;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for maxRows.
+    *******************************************************************************/
+   public Integer getMaxRows()
+   {
+      return (maxRows);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for maxRows.
+    *******************************************************************************/
+   public EffectiveConfig withMaxRows(Integer maxRows)
+   {
+      this.maxRows = maxRows;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for sampleThresholdRows.
+    *******************************************************************************/
+   public Integer getSampleThresholdRows()
+   {
+      return (sampleThresholdRows);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for sampleThresholdRows.
+    *******************************************************************************/
+   public EffectiveConfig withSampleThresholdRows(Integer sampleThresholdRows)
+   {
+      this.sampleThresholdRows = sampleThresholdRows;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for sampleRows.
+    *******************************************************************************/
+   public Integer getSampleRows()
+   {
+      return (sampleRows);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for sampleRows.
+    *******************************************************************************/
+   public EffectiveConfig withSampleRows(Integer sampleRows)
+   {
+      this.sampleRows = sampleRows;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for minGroupSize.
+    *******************************************************************************/
+   public Integer getMinGroupSize()
+   {
+      return (minGroupSize);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for minGroupSize.
+    *******************************************************************************/
+   public EffectiveConfig withMinGroupSize(Integer minGroupSize)
+   {
+      this.minGroupSize = minGroupSize;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for cacheTtlMinutes.
+    *******************************************************************************/
+   public Integer getCacheTtlMinutes()
+   {
+      return (cacheTtlMinutes);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for cacheTtlMinutes.
+    *******************************************************************************/
+   public EffectiveConfig withCacheTtlMinutes(Integer cacheTtlMinutes)
+   {
+      this.cacheTtlMinutes = cacheTtlMinutes;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for analyzableFields.
+    *******************************************************************************/
+   public Set<String> getAnalyzableFields()
+   {
+      return (analyzableFields);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for analyzableFields.
+    *******************************************************************************/
+   public EffectiveConfig withAnalyzableFields(Set<String> analyzableFields)
+   {
+      this.analyzableFields = analyzableFields;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for excludedFields.
+    *******************************************************************************/
+   public Set<String> getExcludedFields()
+   {
+      return (excludedFields);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for excludedFields.
+    *******************************************************************************/
+   public EffectiveConfig withExcludedFields(Set<String> excludedFields)
+   {
+      this.excludedFields = excludedFields;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/EffectiveConfigResolver.java

@@ -0,0 +1,171 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.stream.Collectors;
+import com.kingsrook.qbits.dataanalysis.DataAnalysisQBitConfig;
+import com.kingsrook.qbits.dataanalysis.TableAnalysisDefaults;
+import com.kingsrook.qbits.dataanalysis.model.DataAnalysisTables;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
+
+/*******************************************************************************
+ ** Instance-owned configuration resolver; only the settings lookup is privileged.
+ *******************************************************************************/
+public class EffectiveConfigResolver
+{
+   private final DataAnalysisQBitConfig defaults;
+   private final ConcurrentHashMap<String, CachedConfig> cache = new ConcurrentHashMap<>();
+
+   /*******************************************************************************
+    ** A 60-second configuration snapshot, never a user-data cache.
+    *******************************************************************************/
+   private record CachedConfig(long expires, EffectiveConfig config)
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Bind code defaults to one host runtime.
+    *******************************************************************************/
+   public EffectiveConfigResolver(DataAnalysisQBitConfig defaults)
+   {
+      this.defaults = defaults;
+   }
+
+
+
+   /*******************************************************************************
+    ** Return a detached snapshot so callers cannot change memoized policy.
+    *******************************************************************************/
+   public EffectiveConfig resolve(String table) throws QException
+   {
+      CachedConfig cached = cache.get(table);
+      if(cached == null || cached.expires() <= System.currentTimeMillis())
+      {
+         cached = new CachedConfig(System.currentTimeMillis() + 60_000, load(table));
+         cache.put(table, cached);
+      }
+      EffectiveConfig c = cached.config();
+      return (new EffectiveConfig().withEnabled(c.getEnabled()).withMaxRows(c.getMaxRows()).withSampleRows(c.getSampleRows())
+         .withSampleThresholdRows(c.getSampleThresholdRows()).withMinGroupSize(c.getMinGroupSize()).withCacheTtlMinutes(c.getCacheTtlMinutes())
+         .withAnalyzableFields(Set.copyOf(c.getAnalyzableFields())).withExcludedFields(Set.copyOf(c.getExcludedFields())));
+   }
+
+
+
+   /*******************************************************************************
+    ** Settings editors may invalidate immediately instead of waiting for expiry.
+    *******************************************************************************/
+   public void invalidate()
+   {
+      cache.clear();
+   }
+
+
+
+   /*******************************************************************************
+    ** Runtime row overrides per-table code defaults, then global defaults.
+    *******************************************************************************/
+   private EffectiveConfig load(String table) throws QException
+   {
+      TableAnalysisDefaults d = defaults.getTableDefaults().getOrDefault(table, new TableAnalysisDefaults());
+      EffectiveConfig c = new EffectiveConfig().withEnabled(!Boolean.FALSE.equals(d.getEnabled()))
+         .withMaxRows(or(d.getMaxRows(), defaults.getDefaultMaxRows())).withSampleRows(or(d.getSampleRows(), defaults.getDefaultSampleRows()))
+         .withSampleThresholdRows(or(d.getSampleThresholdRows(), defaults.getDefaultSampleThresholdRows()))
+         .withMinGroupSize(or(d.getMinGroupSize(), defaults.getDefaultMinGroupSize())).withCacheTtlMinutes(or(d.getCacheTtlMinutes(), defaults.getDefaultCacheTtlMinutes()))
+         .withAnalyzableFields(d.getAnalyzableFields() == null ? Set.of() : Set.copyOf(d.getAnalyzableFields()))
+         .withExcludedFields(d.getExcludedFields() == null ? Set.of() : Set.copyOf(d.getExcludedFields()));
+      QSession original = QContext.getQSession();
+      List<QRecord> rows;
+      try
+      {
+         QContext.setQSession(new QSystemUserSession());
+         QueryInput input = new QueryInput(DataAnalysisTables.TABLE_CONFIG)
+            .withFilter(DrillFilters.condition("table_name", QCriteriaOperator.EQUALS, table).withLimit(1))
+            .withFieldNamesToInclude(Set.of("enabled", "max_rows", "sample_rows", "sample_threshold_rows", "min_group_size", "cache_ttl_minutes", "analyzable_fields", "excluded_fields"))
+            .withShouldFetchHeavyFields(true);
+         input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+         rows = new QueryAction().execute(input).getRecords();
+      }
+      finally
+      {
+         QContext.setQSession(original);
+      }
+      if(!rows.isEmpty())
+      {
+         QRecord r = rows.getFirst();
+         if(r.getValue("enabled") != null)
+         {
+            c.withEnabled(r.getValueBoolean("enabled"));
+         }
+         c.withMaxRows(or(r.getValueInteger("max_rows"), c.getMaxRows())).withSampleRows(or(r.getValueInteger("sample_rows"), c.getSampleRows()))
+            .withSampleThresholdRows(or(r.getValueInteger("sample_threshold_rows"), c.getSampleThresholdRows()))
+            .withMinGroupSize(or(r.getValueInteger("min_group_size"), c.getMinGroupSize())).withCacheTtlMinutes(or(r.getValueInteger("cache_ttl_minutes"), c.getCacheTtlMinutes()));
+         if(r.getValue("analyzable_fields") != null)
+         {
+            c.withAnalyzableFields(csv(r.getValueString("analyzable_fields")));
+         }
+         if(r.getValue("excluded_fields") != null)
+         {
+            c.withExcludedFields(csv(r.getValueString("excluded_fields")));
+         }
+      }
+      c.withEnabled(c.getEnabled() && (defaults.getIncludeTables().isEmpty() || defaults.getIncludeTables().contains(table)) && !defaults.getExcludeTables().contains(table));
+      if(List.of(c.getMaxRows(), c.getSampleRows(), c.getSampleThresholdRows(), c.getMinGroupSize(), c.getCacheTtlMinutes()).stream().anyMatch(n -> n < 0))
+      {
+         throw new QException("Analysis settings contain an invalid limit.");
+      }
+      return (c);
+   }
+
+
+
+   /*******************************************************************************
+    ** Null inherits, zero is a real configured limit.
+    *******************************************************************************/
+   private static Integer or(Integer value, Integer fallback)
+   {
+      return (value == null ? fallback : value);
+   }
+
+
+
+   /*******************************************************************************
+    ** Blank lists mean all readable fields or no exclusions.
+    *******************************************************************************/
+   private static Set<String> csv(String text)
+   {
+      return (Arrays.stream(text.split(",")).map(String::trim).filter(s -> !s.isEmpty()).collect(Collectors.toSet()));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/FieldAnalysisAccess.java

@@ -0,0 +1,29 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+/*******************************************************************************
+ ** Analysis access is stricter than the ability to submit an exact query.
+ *******************************************************************************/
+public enum FieldAnalysisAccess
+{
+   FULL, EXACT_MATCH_ONLY, NONE
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/FieldAnalysisAccessResolver.java

@@ -0,0 +1,43 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Resolve the current user's analysis rights without exposing protected values.
+ *******************************************************************************/
+public interface FieldAnalysisAccessResolver
+{
+   /*******************************************************************************
+    ** Only FULL fields may contribute generated analysis predicates.
+    *******************************************************************************/
+   FieldAnalysisAccess resolve(QTableMetaData table, QFieldMetaData field);
+
+   /*******************************************************************************
+    ** Optional core policy fingerprint supplements the FULL-field list hash.
+    *******************************************************************************/
+   default String getAccessFingerprint()
+   {
+      return ("");
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/FieldSecurityLockFieldAccessResolver.java

@@ -0,0 +1,42 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import com.kingsrook.qqq.backend.core.actions.permissions.FieldSecurityLockHelper;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Legacy lock adapter. The core tier API (qbit-secured-data) will map REVEALABLE
+ ** to EXACT_MATCH_ONLY, MASKED/HIDDEN without filter rights to NONE, and
+ ** MASKED/HIDDEN with filter rights to FULL.
+ *******************************************************************************/
+public class FieldSecurityLockFieldAccessResolver implements FieldAnalysisAccessResolver
+{
+   /*******************************************************************************
+    ** Keep the legacy lock enforcement when core tiers are not installed.
+    *******************************************************************************/
+   @Override
+   public FieldAnalysisAccess resolve(QTableMetaData table, QFieldMetaData field)
+   {
+      return (FieldSecurityLockHelper.isFieldAccessible(field) ? FieldAnalysisAccess.FULL : FieldAnalysisAccess.NONE);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/MetricLabels.java

@@ -0,0 +1,65 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.util.Map;
+import java.util.Objects;
+import com.kingsrook.qbits.dataanalysis.result.ValueType;
+
+/*******************************************************************************
+ ** One vocabulary for every emitted metric, including date-specific extrema.
+ *******************************************************************************/
+public final class MetricLabels
+{
+   private static final Map<String, String> LABELS = Map.ofEntries(
+      Map.entry("rows", "Rows"), Map.entry("nonNull", "Non-empty"), Map.entry("nulls", "Nulls"),
+      Map.entry("blanks", "Blanks"), Map.entry("distinct", "Distinct values"), Map.entry("uniqueness", "Uniqueness"),
+      Map.entry("completeness", "Completeness"), Map.entry("share", "Share"),
+      Map.entry("min", "Minimum"), Map.entry("max", "Maximum"), Map.entry("mean", "Mean"),
+      Map.entry("median", "Median"), Map.entry("stddev", "Standard deviation"), Map.entry("sum", "Sum"),
+      Map.entry("zeros", "Zeros"), Map.entry("negatives", "Negatives"), Map.entry("outliers", "Outliers"),
+      Map.entry("p1", "1st percentile"), Map.entry("p5", "5th percentile"), Map.entry("p25", "25th percentile (Q1)"),
+      Map.entry("p50", "Median"), Map.entry("p75", "75th percentile (Q3)"), Map.entry("p95", "95th percentile"), Map.entry("p99", "99th percentile"),
+      Map.entry("minLength", "Shortest"), Map.entry("maxLength", "Longest"), Map.entry("meanLength", "Average length"),
+      Map.entry("earliest", "Earliest"), Map.entry("latest", "Latest"), Map.entry("range", "Range"),
+      Map.entry("true", "True"), Map.entry("false", "False"), Map.entry("other", "Other"));
+
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private MetricLabels()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Fail at construction when a new metric lacks a human label.
+    *******************************************************************************/
+   public static String label(String key, ValueType type)
+   {
+      if(type == ValueType.DATE || type == ValueType.DATE_TIME)
+      {
+         key = "min".equals(key) ? "earliest" : "max".equals(key) ? "latest" : key;
+      }
+      return (Objects.requireNonNull(LABELS.get(key), "Missing metric label: " + key));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/MinGroupSizeGuard.java

@@ -0,0 +1,158 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.util.ArrayList;
+import java.util.List;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfile;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.ValueCount;
+
+/*******************************************************************************
+ ** Privacy transformation before chart construction, serialization and caching.
+ *******************************************************************************/
+public class MinGroupSizeGuard
+{
+   private final int minimum;
+
+   /*******************************************************************************
+    ** Zero disables suppression.
+    *******************************************************************************/
+   public MinGroupSizeGuard(int minimum)
+   {
+      this.minimum = minimum;
+   }
+
+
+
+   /*******************************************************************************
+    ** Never carry original values or drills into a merged group.
+    *******************************************************************************/
+   public List<ValueCount> groups(List<ValueCount> groups)
+   {
+      if(minimum == 0)
+      {
+         return (groups);
+      }
+      List<ValueCount> result = new ArrayList<>();
+      long count = 0;
+      int hidden = 0;
+      java.math.BigDecimal share = java.math.BigDecimal.ZERO;
+      for(ValueCount group : groups)
+      {
+         if(group.getCount() < minimum)
+         {
+            hidden++;
+            count += group.getCount();
+            share = share.add(group.getShare());
+         }
+         else
+         {
+            result.add(group);
+         }
+      }
+      if(hidden > 0)
+      {
+         result.add(new ValueCount().withLabel("Other (" + hidden + " groups below " + minimum + ")").withCount(count).withShare(AnalysisFormatting.ratio(share)));
+      }
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** Suppressed scalar values are removed, not just tagged as hidden.
+    *******************************************************************************/
+   public void metrics(List<Metric> metrics, long rows)
+   {
+      if(rows >= minimum)
+      {
+         return;
+      }
+      for(Metric metric : metrics)
+      {
+         String key = metric.getKey();
+         if(key.startsWith("p") || key.startsWith("min") || key.startsWith("max") || key.startsWith("mean") || key.equals("stddev") || key.equals("range"))
+         {
+            metric.withValue(null).withFormatted(null).withDrill(null).withSuppressed(true)
+               .withSuppressedReason("Hidden: fewer than " + minimum + " records");
+         }
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Remove extreme values and their drills whenever privacy is enabled.
+    *******************************************************************************/
+   public void column(ColumnProfile profile, long rows)
+   {
+      profile.withTopValues(groups(profile.getTopValues()));
+      if(minimum > 0)
+      {
+         profile.getCounts().stream().filter(m -> m.getKey().equals("distinct")).forEach(m -> m.withDrill(null));
+         if(profile.getBooleans() != null)
+         {
+            List<ValueCount> booleanGroups = profile.getBooleans().stream().map(m -> new ValueCount().withValue(m.getKey()).withLabel(m.getLabel())
+               .withCount(((Number) m.getValue()).longValue()).withShare(ProfileSupport.share(((Number) m.getValue()).longValue(), rows)).withDrill(m.getDrill())).toList();
+            profile.withBooleans(groups(booleanGroups).stream().map(v -> ProfileSupport.metric(v.getValue() == null ? "other" : v.getValue().toString(), v.getCount(),
+               com.kingsrook.qbits.dataanalysis.result.ValueType.COUNT).withDrill(v.getDrill())).toList());
+         }
+      }
+      if(profile.getNumeric() != null)
+      {
+         metrics(profile.getNumeric().getMetrics(), rows);
+         profile.getNumeric().withHistogram(groups(profile.getNumeric().getHistogram()));
+         if(minimum > 0)
+         {
+            profile.getNumeric().withOutliers(List.of());
+            profile.getNumeric().getMetrics().stream().filter(m -> m.getKey().equals("outliers")).forEach(m -> m.withDrill(null));
+         }
+      }
+      if(profile.getDates() != null)
+      {
+         metrics(profile.getDates().getMetrics(), rows);
+         profile.getDates().withBuckets(groups(profile.getDates().getBuckets())).withDayOfWeek(groups(profile.getDates().getDayOfWeek()))
+            .withHourOfDay(groups(profile.getDates().getHourOfDay()));
+         if(minimum > 0)
+         {
+            profile.getDates().withGaps(List.of());
+         }
+      }
+      if(profile.getText() != null)
+      {
+         metrics(profile.getText().getMetrics(), rows);
+         profile.getText().withHistogram(groups(profile.getText().getHistogram())).withPatterns(groups(profile.getText().getPatterns()));
+      }
+   }
+
+   /*******************************************************************************
+    ** Small pivot cells suppress every measure, including count, with no drill.
+    *******************************************************************************/
+   public void pivotMetrics(List<Metric> metrics, long rows)
+   {
+      if(rows < minimum)
+      {
+         metrics.forEach(m -> m.withValue(null).withFormatted(null).withDrill(null).withSuppressed(true)
+            .withSuppressedReason("Hidden: fewer than " + minimum + " records"));
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/NiceBins.java

@@ -0,0 +1,70 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.math.BigDecimal;
+import java.math.RoundingMode;
+import java.util.List;
+
+/*******************************************************************************
+ ** Exact decimal boundaries with a readable step and approximately twenty bins.
+ *******************************************************************************/
+public record NiceBins(BigDecimal low, BigDecimal high, int count)
+{
+   /*******************************************************************************
+    ** Select the closest 10..25-bin enclosure from 1, 2, 2.5 and 5 times powers of ten.
+    *******************************************************************************/
+   public static NiceBins covering(BigDecimal low, BigDecimal high)
+   {
+      return (covering(low, high, 20));
+   }
+
+   /*******************************************************************************
+    ** Choose readable enclosing edges for a requested pivot bin count.
+    *******************************************************************************/
+   public static NiceBins covering(BigDecimal low, BigDecimal high, int target)
+   {
+      BigDecimal span = high.subtract(low);
+      if(span.signum() == 0)
+      {
+         span = low.abs().max(BigDecimal.ONE);
+         low = low.subtract(span.divide(BigDecimal.valueOf(2)));
+         high = high.add(span.divide(BigDecimal.valueOf(2)));
+      }
+      int exponent = span.precision() - span.scale() - Integer.toString(target).length();
+      NiceBins best = null;
+      for(int power = exponent - 2; power <= exponent + 2; power++)
+      {
+         for(String factor : List.of("1", "2", "2.5", "5"))
+         {
+            BigDecimal step = new BigDecimal(factor).scaleByPowerOfTen(power);
+            BigDecimal first = low.divide(step, 0, RoundingMode.FLOOR).multiply(step);
+            BigDecimal last = high.divide(step, 0, RoundingMode.CEILING).multiply(step);
+            int count = last.subtract(first).divide(step).intValueExact();
+            if(count >= Math.max(1, target / 2) && count <= Math.max(2, target * 5 / 4) && (best == null || Math.abs(count - target) < Math.abs(best.count() - target)))
+            {
+               best = new NiceBins(first, last, count);
+            }
+         }
+      }
+      return (java.util.Objects.requireNonNull(best));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/PivotExplorer.java

@@ -0,0 +1,607 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import java.math.MathContext;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.PivotCell;
+import com.kingsrook.qbits.dataanalysis.result.PivotDimension;
+import com.kingsrook.qbits.dataanalysis.result.PivotHeader;
+import com.kingsrook.qbits.dataanalysis.result.PivotMeasure;
+import com.kingsrook.qbits.dataanalysis.result.PivotMeasureInfo;
+import com.kingsrook.qbits.dataanalysis.result.PivotRequest;
+import com.kingsrook.qbits.dataanalysis.result.PivotResult;
+import com.kingsrook.qbits.dataanalysis.result.ValueType;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.AggregateAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.Aggregate;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateResult;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.DateBucket;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.DateBucketUnit;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.GroupBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.NumericBucket;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.QFilterOrderByAggregate;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryJoin;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.joins.JoinType;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.ExposedJoin;
+import com.kingsrook.qqq.backend.core.utils.ValueUtils;
+import com.kingsrook.qqq.backend.core.utils.aggregates.AggregateAnalysis;
+
+/*******************************************************************************
+ ** Request-local pivot planner. Core executes every aggregate with ENFORCE.
+ ** Merged cells are re-aggregated so non-additive measures remain exact.
+ *******************************************************************************/
+public class PivotExplorer
+{
+   private final AnalysisSecurity security;
+   private final EffectiveConfig config;
+   private final List<QueryJoin> joins = new ArrayList<>();
+   private final LinkedHashSet<String> toManyTables = new LinkedHashSet<>();
+   private final LinkedHashSet<String> multiHopTables = new LinkedHashSet<>();
+   private PivotRequest request;
+   private Aggregate count;
+   private final List<Aggregate> measures = new ArrayList<>();
+   private final List<PivotMeasureInfo> measureInfo = new ArrayList<>();
+   private boolean partial;
+
+   /*******************************************************************************
+    ** Bind the current user's policy and bounded streamed fallback.
+    *******************************************************************************/
+   public PivotExplorer(AnalysisSecurity security, EffectiveConfig config)
+   {
+      this.security = security;
+      this.config = config;
+   }
+
+   /*******************************************************************************
+    ** One slot is a visible group or the exact complement of the kept groups.
+    *******************************************************************************/
+   private record Slot(Serializable value, String label, QQueryFilter condition, boolean other)
+   {
+   }
+
+   /*******************************************************************************
+    ** Dimension state owns predicates, so no generated filter names hidden fields.
+    *******************************************************************************/
+   private record Dimension(GroupBy group, QFieldMetaData field, Map<Serializable, Slot> kept, Map<Serializable, Long> counts, Slot other)
+   {
+      /*******************************************************************************
+       ** Return the kept group, Other, or null for a privacy-suppressed group.
+       *******************************************************************************/
+      Slot slot(Serializable value, int minimum)
+      {
+         return (counts.getOrDefault(value, 0L) < minimum ? null : kept.getOrDefault(value, other));
+      }
+   }
+
+   /*******************************************************************************
+    ** Validate the complete plan before any source computation.
+    *******************************************************************************/
+   public PivotResult execute(PivotRequest request) throws QException
+   {
+      this.request = request;
+      validate();
+      String primaryKey = QContext.getQInstance().getTable(request.getTableName()).getPrimaryKeyField();
+      count = new Aggregate(primaryKey, AggregateOperator.COUNT).withFieldType(QFieldType.INTEGER);
+      List<PivotDimension> requested = new ArrayList<>(request.getRows());
+      requested.addAll(request.getColumns());
+      List<QFieldMetaData> fields = new ArrayList<>();
+      for(PivotDimension dimension : requested)
+      {
+         fields.add(resolve(dimension.getField()));
+      }
+      for(int i = 0; i < request.getValues().size(); i++)
+      {
+         prepareMeasure(request.getValues().get(i), i);
+      }
+      List<Dimension> dimensions = new ArrayList<>();
+      for(int i = 0; i < requested.size(); i++)
+      {
+         dimensions.add(dimension(requested.get(i), fields.get(i)));
+      }
+      int rowCount = request.getRows().size();
+      List<Dimension> rows = dimensions.subList(0, rowCount);
+      List<Dimension> columns = dimensions.subList(rowCount, dimensions.size());
+      PivotResult result = new PivotResult().withAsOf(Instant.now()).withMeasures(measureInfo)
+         .withTruncatedRows(rows.stream().anyMatch(d -> d.other() != null))
+         .withTruncatedColumns(columns.stream().anyMatch(d -> d.other() != null));
+      Map<List<Slot>, List<Metric>> matrix = level(dimensions);
+      Map<List<Slot>, List<Metric>> rowTotals = request.getShowTotals() || config.getMinGroupSize() > 0 ? level(rows) : Map.of();
+      Map<List<Slot>, List<Metric>> columnTotals = request.getShowTotals() || config.getMinGroupSize() > 0 ? level(columns) : Map.of();
+      List<List<Slot>> rowKeys = new ArrayList<>();
+      List<List<Slot>> columnKeys = new ArrayList<>();
+      for(var entry : matrix.entrySet())
+      {
+         List<Slot> row = List.copyOf(entry.getKey().subList(0, rowCount));
+         List<Slot> column = List.copyOf(entry.getKey().subList(rowCount, dimensions.size()));
+         if(config.getMinGroupSize() > 0 && (rowTotals.getOrDefault(row, List.of()).stream().allMatch(m -> m.getSuppressed())
+            || columnTotals.getOrDefault(column, List.of()).stream().allMatch(m -> m.getSuppressed())))
+         {
+            continue;
+         }
+         if(!rowKeys.contains(row))
+         {
+            rowKeys.add(row);
+         }
+         if(!columnKeys.contains(column))
+         {
+            columnKeys.add(column);
+         }
+         result.getCells().add(new PivotCell().withRowIndex(rowKeys.indexOf(row)).withColumnIndex(columnKeys.indexOf(column)).withValues(entry.getValue()));
+      }
+      result.withRowHeaders(headers(rowKeys)).withColumnHeaders(headers(columnKeys));
+      if(request.getShowTotals())
+      {
+         rowKeys.forEach(key -> result.getRowTotals().add(rowTotals.getOrDefault(key, List.of())));
+         columnKeys.forEach(key -> result.getColumnTotals().add(columnTotals.getOrDefault(key, List.of())));
+         result.withGrandTotals(level(List.of()).getOrDefault(List.of(), List.of()));
+      }
+      for(String tableName : toManyTables)
+      {
+         result.getWarnings().add("Counts include one row per related " + QContext.getQInstance().getTable(tableName).getLabel()
+            + "; drill-through is not available for this dimension.");
+      }
+      for(String tableName : multiHopTables)
+      {
+         result.getWarnings().add("Drill-through is not available for fields reached through more than one join (" + QContext.getQInstance().getTable(tableName).getLabel() + ").");
+      }
+      if(config.getMinGroupSize() > 0)
+      {
+         result.getWarnings().add("Groups below " + config.getMinGroupSize() + " records are omitted; small cells and totals are suppressed.");
+      }
+      if(partial)
+      {
+         result.withEstimate(true);
+         result.getWarnings().add("Partial pivot: the streamed row limit was reached. Drills are disabled because aggregates may cover different prefixes.");
+         result.getCells().forEach(c -> disableDrills(c.getValues()));
+         result.getRowTotals().forEach(this::disableDrills);
+         result.getColumnTotals().forEach(this::disableDrills);
+         disableDrills(result.getGrandTotals());
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Reject invalid shapes and types before aggregate execution.
+    *******************************************************************************/
+   private void validate() throws QException
+   {
+      if(request.getRows() == null || request.getRows().isEmpty() || request.getRows().size() > 3
+         || request.getColumns() == null || request.getColumns().size() > 2 || request.getValues() == null
+         || request.getValues().isEmpty() || request.getValues().size() > 6 || request.getShowTotals() == null
+         || request.getLimitGroups() == null || request.getLimitGroups() < 1 || request.getLimitGroups() > 200)
+      {
+         throw new QBadRequestException("Choose 1�3 row dimensions, 0�2 column dimensions, 1�6 measures and a group limit from 1 to 200.");
+      }
+      List<PivotDimension> dimensions = new ArrayList<>(request.getRows());
+      dimensions.addAll(request.getColumns());
+      LinkedHashSet<String> names = new LinkedHashSet<>();
+      for(PivotDimension dimension : dimensions)
+      {
+         if(dimension == null || dimension.getField() == null || !names.add(dimension.getField()))
+         {
+            throw new QBadRequestException("Choose distinct dimension fields.");
+         }
+         QFieldMetaData field = resolve(dimension.getField());
+         var bins = dimension.getNumericBins();
+         if(dimension.getDateBucket() != null && (bins != null || field.getType() != QFieldType.DATE && field.getType() != QFieldType.DATE_TIME)
+            || bins != null && (!numeric(field) || bins.getCount() == null || bins.getCount() < 1 || bins.getCount() > 200
+               || bins.getMin() != null && bins.getMax() != null && bins.getMin().compareTo(bins.getMax()) >= 0))
+         {
+            throw new QBadRequestException("Buckets must match the field type; numeric bins require 1�200 bins and min < max.");
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Only exposed, unambiguous paths may introduce a joined field.
+    ** The installed snapshot has no related-record picker join-path helper.
+    *******************************************************************************/
+   private QFieldMetaData resolve(String name) throws QException
+   {
+      if(name == null || !name.contains("."))
+      {
+         return (security.field(request.getTableName(), name));
+      }
+      String[] parts = name.split("\\.", -1);
+      var table = QContext.getQInstance().getTable(request.getTableName());
+      List<ExposedJoin> exposed = table.getExposedJoins() == null ? List.of() : table.getExposedJoins();
+      List<ExposedJoin> paths = exposed.stream().filter(j -> j.getJoinTable().equals(parts[0])).toList();
+      if(parts.length != 2 || paths.size() != 1 || paths.getFirst().getJoinPath() == null || paths.getFirst().getJoinPath().isEmpty())
+      {
+         throw new QBadRequestException("Unknown analysis field.");
+      }
+      String current = table.getName();
+      boolean toOne = true;
+      for(String joinName : paths.getFirst().getJoinPath())
+      {
+         var metadata = QContext.getQInstance().getJoin(joinName);
+         if(metadata == null || !current.equals(metadata.getLeftTable()) && !current.equals(metadata.getRightTable()))
+         {
+            throw new QBadRequestException("Unknown analysis field.");
+         }
+         String next = current.equals(metadata.getLeftTable()) ? metadata.getRightTable() : metadata.getLeftTable();
+         JoinType type = metadata.getType();
+         if(type != null && current.equals(metadata.getRightTable()))
+         {
+            type = type.flip();
+         }
+         toOne &= type == JoinType.MANY_TO_ONE || type == JoinType.ONE_TO_ONE;
+         security.joinedTable(next);
+         QueryJoin existing = joins.stream().filter(j -> next.equals(j.getJoinTable())).findFirst().orElse(null);
+         if(existing == null)
+         {
+            joins.add(new QueryJoin(current, next).withJoinMetaData(metadata));
+         }
+         else if(!existing.getJoinMetaData().getName().equals(joinName))
+         {
+            throw new QBadRequestException("Ambiguous analysis join path.");
+         }
+         current = next;
+      }
+      if(!current.equals(parts[0]))
+      {
+         throw new QBadRequestException("Unknown analysis field.");
+      }
+      if(!toOne)
+      {
+         toManyTables.add(current);
+      }
+      else if(paths.getFirst().getJoinPath().size() > 1)
+      {
+         ///////////////////////////////////////////////////////////////////////////////
+         // counts are per record, but core's implicit joins for a multi-hop filter     //
+         // do not reproduce them on every backend yet (memory counts differ), so no   //
+         // drill until that is fixed in core                                          //
+         ///////////////////////////////////////////////////////////////////////////////
+         multiHopTables.add(current);
+      }
+      return (security.joinedField(parts[0], parts[1]));
+   }
+
+   /*******************************************************************************
+    ** Count records even when a supplied COUNT field is nullable.
+    *******************************************************************************/
+   private void prepareMeasure(PivotMeasure measure, int index) throws QException
+   {
+      if(measure == null || measure.getOperator() == null)
+      {
+         throw new QBadRequestException("Choose a measure operator.");
+      }
+      QFieldMetaData field = measure.getField() == null && measure.getOperator() == PivotMeasure.Operator.COUNT ? null : resolve(measure.getField());
+      PivotMeasure.Operator operator = measure.getOperator();
+      if((operator == PivotMeasure.Operator.SUM || operator == PivotMeasure.Operator.AVG || operator == PivotMeasure.Operator.PERCENTILE) && !numeric(field)
+         || operator == PivotMeasure.Operator.PERCENTILE && (measure.getPercentile() == null || measure.getPercentile().signum() < 0 || measure.getPercentile().compareTo(BigDecimal.ONE) > 0)
+         || operator != PivotMeasure.Operator.PERCENTILE && measure.getPercentile() != null)
+      {
+         throw new QBadRequestException("Numeric measures require a numeric field; percentile must be between 0 and 1.");
+      }
+      Aggregate aggregate = operator == PivotMeasure.Operator.COUNT ? count : new Aggregate(measure.getField(),
+         operator == PivotMeasure.Operator.PERCENTILE ? AggregateOperator.PERCENTILE_CONT : AggregateOperator.valueOf(operator.name()));
+      if(operator == PivotMeasure.Operator.PERCENTILE)
+      {
+         aggregate.withPercentile(measure.getPercentile());
+      }
+      if(operator == PivotMeasure.Operator.COUNT_DISTINCT)
+      {
+         aggregate.withFieldType(QFieldType.INTEGER);
+      }
+      measures.add(aggregate);
+      ValueType type = operator == PivotMeasure.Operator.COUNT || operator == PivotMeasure.Operator.COUNT_DISTINCT ? ValueType.COUNT
+         : numeric(field) ? ValueType.DECIMAL : field.getType() == QFieldType.DATE ? ValueType.DATE : field.getType() == QFieldType.DATE_TIME ? ValueType.DATE_TIME : ValueType.TEXT;
+      measureInfo.add(new PivotMeasureInfo().withKey("value" + index).withLabel(operator.name() + (field == null ? " records" : " " + field.getLabel())).withValueType(type));
+   }
+
+   /*******************************************************************************
+    ** Numeric buckets and moments accept the same numeric QQQ field types.
+    *******************************************************************************/
+   private static boolean numeric(QFieldMetaData field)
+   {
+      return (field != null && (field.getType() == QFieldType.INTEGER || field.getType() == QFieldType.LONG || field.getType() == QFieldType.DECIMAL));
+   }
+
+   /*******************************************************************************
+    ** Select top groups first, then collect cardinality and privacy counts.
+    *******************************************************************************/
+   private Dimension dimension(PivotDimension requested, QFieldMetaData field) throws QException
+   {
+      GroupBy group = new GroupBy(field.getType(), requested.getField());
+      if(requested.getDateBucket() != null)
+      {
+         group.withBucket(new DateBucket(requested.getDateBucket()));
+      }
+      if(requested.getNumericBins() != null)
+      {
+         var bins = requested.getNumericBins();
+         BigDecimal low = bins.getMin();
+         BigDecimal high = bins.getMax();
+         if(low == null || high == null)
+         {
+            Aggregate min = new Aggregate(requested.getField(), AggregateOperator.MIN);
+            Aggregate max = new Aggregate(requested.getField(), AggregateOperator.MAX);
+            var extrema = aggregate(List.of(), request.getFilter(), List.of(min, max), null);
+            Serializable first = extrema.isEmpty() ? null : extrema.getFirst().getAggregateValues().get(min);
+            Serializable last = extrema.isEmpty() ? null : extrema.getFirst().getAggregateValues().get(max);
+            NiceBins nice = NiceBins.covering(first == null ? BigDecimal.ZERO : new BigDecimal(first.toString()), last == null ? BigDecimal.ONE : new BigDecimal(last.toString()), bins.getCount());
+            low = low == null ? nice.low() : low;
+            high = high == null ? nice.high() : high;
+         }
+         if(low.compareTo(high) >= 0)
+         {
+            throw new QBadRequestException("Numeric bin min must be below max.");
+         }
+         group.withBucket(new NumericBucket(low, high, bins.getCount()));
+      }
+      List<AggregateResult> top = aggregate(List.of(group), request.getFilter(), List.of(count), request.getLimitGroups());
+      List<AggregateResult> all = aggregate(List.of(group), request.getFilter(), List.of(count), null);
+      Map<Serializable, Long> counts = new LinkedHashMap<>();
+      all.forEach(r -> counts.put(r.getGroupByValues().get(group), count(r)));
+      Map<Serializable, Slot> kept = new LinkedHashMap<>();
+      for(AggregateResult row : top)
+      {
+         Serializable value = row.getGroupByValues().get(group);
+         if(count(row) >= config.getMinGroupSize())
+         {
+            kept.put(value, new Slot(value, label(group, field, value), condition(group, field, value), false));
+         }
+      }
+      List<Serializable> remaining = counts.keySet().stream().filter(v -> !kept.containsKey(v) && counts.get(v) >= config.getMinGroupSize()).toList();
+      Slot other = null;
+      if(!remaining.isEmpty())
+      {
+         QQueryFilter predicate;
+         if(group.getBucket() == null && field.getType() != QFieldType.BOOLEAN && config.getMinGroupSize() == 0 && !kept.containsKey("") && kept.keySet().stream().noneMatch(v -> v instanceof Instant || v instanceof LocalDate))
+         {
+            List<Serializable> values = kept.keySet().stream().filter(Objects::nonNull).toList();
+            predicate = values.isEmpty() ? new QQueryFilter() : new QQueryFilter().withCriteria(group.getFieldName(), QCriteriaOperator.NOT_IN, values);
+            predicate = DrillFilters.and(predicate, DrillFilters.nonNull(group.getFieldName(), field.getType().isStringLike()));
+            if(!kept.containsKey(null))
+            {
+               predicate = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR).withSubFilter(predicate).withSubFilter(DrillFilters.nulls(group.getFieldName(), field.getType().isStringLike()));
+            }
+            if(field.getType().isStringLike())
+            {
+               predicate = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR).withSubFilter(predicate).withSubFilter(DrillFilters.value(group.getFieldName(), "", true));
+            }
+         }
+         else
+         {
+            predicate = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR);
+            for(Serializable value : remaining)
+            {
+               predicate.withSubFilter(condition(group, field, value));
+            }
+         }
+         other = new Slot(null, "Other (" + remaining.size() + " groups)", predicate, true);
+      }
+      return (new Dimension(group, field, kept, counts, other));
+   }
+
+   /*******************************************************************************
+    ** Native group keys are displayed as labels without changing filter operands.
+    *******************************************************************************/
+   private String label(GroupBy group, QFieldMetaData field, Serializable value) throws QException
+   {
+      if(value == null)
+      {
+         return ("(Blank)");
+      }
+      if(group.getBucket() instanceof DateBucket date)
+      {
+         return (AnalysisFormatting.dateBucket(value, AnalysisBackend.DateUnit.valueOf(date.getUnit().name()), ValueUtils.getSessionOrInstanceZoneId()));
+      }
+      if(group.getBucket() instanceof NumericBucket bins)
+      {
+         BigDecimal[] edges = edges(bins, ((Number) value).intValue());
+         return (AnalysisFormatting.interval(field, edges[0], edges[1]));
+      }
+      return (security.label(field, value));
+   }
+
+   /*******************************************************************************
+    ** Match core's final closed numeric bin and exterior bins.
+    *******************************************************************************/
+   private static BigDecimal[] edges(NumericBucket bins, int index)
+   {
+      BigDecimal width = bins.getMax().subtract(bins.getMin()).divide(BigDecimal.valueOf(bins.getCount()), MathContext.DECIMAL128);
+      return (new BigDecimal[] { index == 0 ? null : index > bins.getCount() ? bins.getMax() : bins.getMin().add(width.multiply(BigDecimal.valueOf(index - 1))),
+         index == 0 ? bins.getMin() : index > bins.getCount() ? null : index == bins.getCount() ? bins.getMax() : bins.getMin().add(width.multiply(BigDecimal.valueOf(index))) });
+   }
+
+   /*******************************************************************************
+    ** Calendar and numeric predicates use core bucket boundaries in the session zone.
+    *******************************************************************************/
+   private QQueryFilter condition(GroupBy group, QFieldMetaData field, Serializable value) throws QException
+   {
+      String name = group.getFieldName();
+      if(value == null || group.getBucket() == null)
+      {
+         return (DrillFilters.value(name, value, field.getType().isStringLike()));
+      }
+      if(group.getBucket() instanceof NumericBucket bins)
+      {
+         int index = ((Number) value).intValue();
+         BigDecimal[] edges = edges(bins, index);
+         if(StandInAnalysisBackend.isMemory(request.getTableName()) && index <= bins.getCount())
+         {
+            GroupBy raw = new GroupBy(field.getType(), name);
+            List<BigDecimal> members = aggregate(List.of(raw), request.getFilter(), List.of(count), null).stream()
+               .map(r -> r.getGroupByValues().get(raw)).filter(Objects::nonNull).map(v -> new BigDecimal(v.toString())).toList();
+            return (new StandInAnalysisBackend(config).numericRange(request.getTableName(), name, members, edges[0], edges[1], index == bins.getCount()));
+         }
+         return (index > bins.getCount() ? DrillFilters.condition(name, QCriteriaOperator.GREATER_THAN, bins.getMax())
+            : DrillFilters.range(name, edges[0], edges[1], index == bins.getCount()));
+      }
+      DateBucketUnit unit = ((DateBucket) group.getBucket()).getUnit();
+      if(unit == DateBucketUnit.HOUR)
+      {
+         Instant start = ValueUtils.getValueAsInstant(value);
+         return (DrillFilters.range(name, start, start.plusSeconds(3600), false));
+      }
+      if(unit == DateBucketUnit.DAY_OF_WEEK || unit == DateBucketUnit.HOUR_OF_DAY)
+      {
+         GroupBy raw = new GroupBy(field.getType(), name);
+         List<Serializable> members = aggregate(List.of(raw), request.getFilter(), List.of(count), null).stream().map(r -> r.getGroupByValues().get(raw))
+            .filter(v -> Objects.equals(AggregateAnalysis.bucket(v, group.getBucket(), ValueUtils.getSessionOrInstanceZoneId()), value)).toList();
+         return (DrillFilters.in(name, members));
+      }
+      LocalDate start = ValueUtils.getValueAsLocalDate(value);
+      LocalDate end = switch(unit)
+      {
+         case YEAR -> start.plusYears(1);
+         case QUARTER -> start.plusMonths(3);
+         case MONTH -> start.plusMonths(1);
+         case WEEK -> start.plusWeeks(1);
+         default -> start.plusDays(1);
+      };
+      return (DrillFilters.dateRange(name, start, end, field.getType() == QFieldType.DATE_TIME, ValueUtils.getSessionOrInstanceZoneId()));
+   }
+
+   /*******************************************************************************
+    ** A level is the full matrix, row totals, column totals or grand totals.
+    *******************************************************************************/
+   private Map<List<Slot>, List<Metric>> level(List<Dimension> dimensions) throws QException
+   {
+      List<Aggregate> requested = new ArrayList<>(measures);
+      if(!requested.contains(count))
+      {
+         requested.add(count);
+      }
+      Map<List<Slot>, List<AggregateResult>> grouped = new LinkedHashMap<>();
+      List<AggregateResult> aggregates = aggregate(dimensions.stream().map(Dimension::group).toList(), request.getFilter(), requested, null);
+      if(dimensions.isEmpty() && aggregates.isEmpty())
+      {
+         AggregateResult empty = new AggregateResult();
+         requested.forEach(a -> empty.withAggregateValue(a, a.getOperator() == AggregateOperator.COUNT || a.getOperator() == AggregateOperator.COUNT_DISTINCT ? 0L : null));
+         aggregates = List.of(empty);
+      }
+      for(AggregateResult row : aggregates)
+      {
+         List<Slot> key = new ArrayList<>();
+         for(Dimension dimension : dimensions)
+         {
+            key.add(dimension.slot(row.getGroupByValues().get(dimension.group()), config.getMinGroupSize()));
+         }
+         if(!key.contains(null))
+         {
+            grouped.computeIfAbsent(key, ignored -> new ArrayList<>()).add(row);
+         }
+      }
+      Map<List<Slot>, List<Metric>> result = new LinkedHashMap<>();
+      for(var entry : grouped.entrySet())
+      {
+         QQueryFilter predicate = new QQueryFilter();
+         entry.getKey().forEach(slot -> predicate.withSubFilter(slot.condition()));
+         AggregateResult row = entry.getValue().getFirst();
+         if(entry.getKey().stream().anyMatch(Slot::other))
+         {
+            var merged = aggregate(List.of(), DrillFilters.and(request.getFilter(), predicate), requested, null);
+            if(merged.isEmpty())
+            {
+               continue;
+            }
+            row = merged.getFirst();
+         }
+         List<Metric> values = new ArrayList<>();
+         for(int i = 0; i < measures.size(); i++)
+         {
+            PivotMeasureInfo info = measureInfo.get(i);
+            Serializable value = row.getAggregateValues().get(measures.get(i));
+            Metric metric = new Metric().withKey(info.getKey()).withLabel(info.getLabel()).withValueType(info.getValueType()).withValue(value)
+               .withFormatted(AnalysisFormatting.scalar(info.getKey(), value, info.getValueType()));
+            if(toManyTables.isEmpty() && multiHopTables.isEmpty())
+            {
+               metric.withDrill(DrillFilters.drill(request.getTableName(), request.getFilter(), predicate));
+            }
+            values.add(metric);
+         }
+         new MinGroupSizeGuard(config.getMinGroupSize()).pivotMetrics(values, count(row));
+         result.put(entry.getKey(), values);
+      }
+      return (result);
+   }
+
+   /*******************************************************************************
+    ** Count is always present, even when the user selects only non-count measures.
+    *******************************************************************************/
+   private long count(AggregateResult row)
+   {
+      Object value = row.getAggregateValues().get(count);
+      return (value == null ? 0 : ((Number) value).longValue());
+   }
+
+   /*******************************************************************************
+    ** Core owns SQL pushdown, joins, record locks, field locks and bounded fallback.
+    *******************************************************************************/
+   private List<AggregateResult> aggregate(List<GroupBy> groups, QQueryFilter filter, List<Aggregate> aggregates, Integer limit) throws QException
+   {
+      QQueryFilter query = DrillFilters.restoreTypes(request.getTableName(), filter);
+      if(limit != null)
+      {
+         query.withOrderBy(new QFilterOrderByAggregate(count, false));
+      }
+      AggregateInput input = new AggregateInput(request.getTableName()).withFilter(query).withQueryJoins(joins.stream().map(QueryJoin::clone).toList())
+         .withAllowStreamedFallback(true).withStreamedRowLimit(config.getMaxRows()).withLimit(limit);
+      groups.forEach(input::withGroupBy);
+      new LinkedHashSet<>(aggregates).forEach(input::withAggregate);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      var output = new AggregateAction().execute(input);
+      partial |= output.getTruncated();
+      return (limit == null ? output.getResults() : output.getResults().stream().sorted(java.util.Comparator.comparingLong(this::count).reversed()
+         .thenComparing(r -> String.valueOf(r.getGroupByValues().values()))).limit(limit).toList());
+   }
+
+   /*******************************************************************************
+    ** Header tuples retain typed values; Other is distinguished by its label.
+    *******************************************************************************/
+   private static List<List<PivotHeader>> headers(List<List<Slot>> keys)
+   {
+      return (keys.stream().map(key -> key.stream().map(slot -> new PivotHeader().withValue(slot.value()).withLabel(slot.label())).toList()).toList());
+   }
+
+   /*******************************************************************************
+    ** Partial numbers must never claim an exact drill equivalence.
+    *******************************************************************************/
+   private void disableDrills(List<Metric> metrics)
+   {
+      metrics.forEach(m -> m.withDrill(null).withEstimate(true));
+   }
+}
+

src/main/java/com/kingsrook/qbits/dataanalysis/engine/ProfileSupport.java

@@ -0,0 +1,182 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import java.math.MathContext;
+import java.util.ArrayList;
+import java.util.List;
+import com.kingsrook.qbits.dataanalysis.result.Axis;
+import com.kingsrook.qbits.dataanalysis.result.Chart;
+import com.kingsrook.qbits.dataanalysis.result.ChartKind;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.Point;
+import com.kingsrook.qbits.dataanalysis.result.Series;
+import com.kingsrook.qbits.dataanalysis.result.ValueCount;
+import com.kingsrook.qbits.dataanalysis.result.ValueType;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+
+/*******************************************************************************
+ ** Shared semantic result construction; profilers contain no rendering concerns.
+ *******************************************************************************/
+public final class ProfileSupport
+{
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private ProfileSupport()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Empty populations have zero share, never NaN.
+    *******************************************************************************/
+   public static BigDecimal share(long count, long rows)
+   {
+      return (rows == 0 ? BigDecimal.ZERO : BigDecimal.valueOf(count).divide(BigDecimal.valueOf(rows), 6, java.math.RoundingMode.HALF_UP).stripTrailingZeros());
+   }
+
+
+
+   /*******************************************************************************
+    ** Every ordinary count carries its exact membership predicate.
+    *******************************************************************************/
+   public static Metric count(String key, long count, String table, QQueryFilter filter, QQueryFilter condition)
+   {
+      return (metric(key, count, ValueType.COUNT).withDrill(DrillFilters.drill(table, filter, condition)));
+   }
+
+
+
+   /*******************************************************************************
+    ** Scalars have semantic types and locale-neutral formatted values.
+    *******************************************************************************/
+   public static Metric metric(String key, Serializable value, ValueType type)
+   {
+      if(type == ValueType.PERCENT && value != null)
+      {
+         value = AnalysisFormatting.ratio(new BigDecimal(value.toString()));
+      }
+      return (new Metric().withKey(key).withLabel(MetricLabels.label(key, type)).withValue(value).withValueType(type)
+         .withFormatted(AnalysisFormatting.scalar(key, value, type)));
+   }
+
+
+
+   /*******************************************************************************
+    ** The population row total is exact even when other metrics are estimates.
+    *******************************************************************************/
+   public static void markEstimates(List<Metric> metrics)
+   {
+      if(metrics != null)
+      {
+         metrics.stream().filter(m -> !"rows".equals(m.getKey())).forEach(m ->
+         {
+            m.withEstimate(true);
+            if(m.getFormatted() != null)
+            {
+               m.withFormatted("≈ " + m.getFormatted());
+            }
+         });
+      }
+   }
+
+   /*******************************************************************************
+    ** PVS translations run as the current user; drill values always remain ids.
+    *******************************************************************************/
+   public static List<ValueCount> values(String table, QQueryFilter filter, QFieldMetaData field, List<AnalysisBackend.GroupCount> groups, long total) throws QException
+   {
+      return (values(table, filter, field, groups, total, CoreTierFieldAccessResolver.defaultResolver()));
+   }
+
+   /*******************************************************************************
+    ** Host field policy applies to related display labels as well as source values.
+    *******************************************************************************/
+   public static List<ValueCount> values(String table, QQueryFilter filter, QFieldMetaData field, List<AnalysisBackend.GroupCount> groups, long total,
+      FieldAnalysisAccessResolver access) throws QException
+   {
+      List<ValueCount> result = new ArrayList<>();
+      for(AnalysisBackend.GroupCount group : groups)
+      {
+         String label = group.label();
+         if(field != null && field.getPossibleValueSourceName() != null && group.value() != null)
+         {
+            String translated = AnalysisLabels.translate(field, group.value(), access);
+            if(translated != null)
+            {
+               label = translated;
+            }
+         }
+         result.add(new ValueCount().withValue(group.value()).withLabel(label).withCount(group.count()).withShare(group.share() == null ? share(group.count(), total) : AnalysisFormatting.ratio(group.share()))
+            .withDrill(DrillFilters.drill(table, filter, group.condition())));
+      }
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** Charts are built only from privacy-guarded groups.
+    *******************************************************************************/
+   public static Chart chart(ChartKind kind, ChartKind alternative, String field, List<ValueCount> values)
+   {
+      Series series = new Series().withName("Count");
+      for(ValueCount value : values)
+      {
+         series.getPoints().add(new Point().withX(value.getValue()).withY(BigDecimal.valueOf(value.getCount()))
+            .withLabel(value.getLabel()).withDrill(value.getDrill()));
+      }
+      Chart chart = new Chart().withKind(kind).withAlternatives(List.of(alternative))
+         .withX(new Axis().withField(field).withLabel(field).withValueType(ValueType.TEXT))
+         .withY(new Axis().withLabel("Count").withValueType(ValueType.COUNT)).withSeries(new ArrayList<>(List.of(series)));
+      if(kind == ChartKind.TIME_SERIES)
+      {
+         Series average = new Series().withName("7-bucket moving average");
+         for(int i = 0; i < values.size(); i++)
+         {
+            long sum = 0;
+            for(int j = Math.max(0, i - 6); j <= i; j++)
+            {
+               sum += values.get(j).getCount();
+            }
+            average.getPoints().add(new Point().withX(values.get(i).getValue()).withLabel(values.get(i).getLabel())
+               .withY(BigDecimal.valueOf(sum).divide(BigDecimal.valueOf(Math.min(7, i + 1)), MathContext.DECIMAL128)));
+         }
+         chart.getSeries().add(average);
+      }
+      return (chart);
+   }
+
+
+
+   /*******************************************************************************
+    ** Convert instants in the session zone; DATE values are already local dates.
+    *******************************************************************************/
+   public static java.time.LocalDate day(Serializable value, java.time.ZoneId zone)
+   {
+      return (value instanceof java.time.LocalDate date ? date : ((java.time.Instant) value).atZone(zone).toLocalDate());
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/StandInAnalysisBackend.java

@@ -0,0 +1,784 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import java.math.MathContext;
+import java.time.DayOfWeek;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.ZoneId;
+import java.time.temporal.TemporalAdjusters;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.function.Function;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.AggregateAction;
+import com.kingsrook.qqq.backend.core.actions.tables.CountAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.Aggregate;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateResult;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.GroupBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.QFilterOrderByAggregate;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.QFilterOrderByGroupBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+
+/*******************************************************************************
+ ** Stand-in until QQQ core DATA-ANALYSIS.md §3 operators ship in an RC; then add
+ ** CoreAnalysisBackend that pushes these down. RC.5 estimates use the first
+ ** sample_rows rows by primary key, not random sampling. Streamed operations
+ ** page by primary key and retain at most max_rows records.
+ *******************************************************************************/
+public class StandInAnalysisBackend implements AnalysisBackend
+{
+   private static final MathContext MATH = MathContext.DECIMAL128;
+   protected final EffectiveConfig config;
+   protected boolean estimating;
+
+   /*******************************************************************************
+    ** Bind one request's detached configuration.
+    *******************************************************************************/
+   public StandInAnalysisBackend(EffectiveConfig config)
+   {
+      this.config = config;
+   }
+
+
+
+   /*******************************************************************************
+    ** CountAction is core's dedicated query-count operation.
+    *******************************************************************************/
+   @Override
+   public long count(String table, QQueryFilter filter) throws QException
+   {
+      CountInput input = new CountInput(table).withFilter(DrillFilters.restoreTypes(table, filter));
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      return (new CountAction().execute(input).getCount().longValue());
+   }
+
+
+
+   /*******************************************************************************
+    ** A single boundary parameter bounds the prefix used for computation.
+    *******************************************************************************/
+   @Override
+   public Scope scope(String table, QQueryFilter filter, boolean exact) throws QException
+   {
+      long total = count(table, filter);
+      boolean estimate = !exact && total > config.getSampleThresholdRows() && total > Math.min(config.getSampleRows(), config.getMaxRows());
+      estimating = estimate;
+      int limit = estimate ? Math.min(config.getSampleRows(), config.getMaxRows()) : config.getMaxRows();
+      QQueryFilter scoped = DrillFilters.copy(filter);
+      if(total > limit)
+      {
+         String pk = primaryKey(table);
+         if(limit == 0)
+         {
+            scoped = DrillFilters.and(scoped, DrillFilters.condition(pk, QCriteriaOperator.IS_BLANK));
+         }
+         else
+         {
+            List<QRecord> boundary = query(table, scoped, Set.of(pk), limit - 1, 1);
+            if(boundary.isEmpty())
+            {
+               throw new QException("Data changed while selecting analysis rows; retry.");
+            }
+            scoped = DrillFilters.and(scoped, DrillFilters.condition(pk, QCriteriaOperator.LESS_THAN_OR_EQUALS, boundary.getFirst().getValue(pk)));
+         }
+      }
+      return (new Scope(scoped, total, Math.min(total, limit), total > limit && (!estimate || limit < config.getSampleRows()), estimate));
+   }
+
+
+
+   /*******************************************************************************
+    ** Fetch only fields used by the operation, including requested heavy text.
+    *******************************************************************************/
+   private List<QRecord> query(String table, QQueryFilter filter, Set<String> fields, int offset, int limit) throws QException
+   {
+      QueryInput input = new QueryInput(table).withFilter(DrillFilters.restoreTypes(table, filter).withOrderBy(new QFilterOrderBy(primaryKey(table))).withSkip(offset).withLimit(limit))
+         .withFieldNamesToInclude(fields).withShouldFetchHeavyFields(true);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      return (new QueryAction().execute(input).getRecords());
+   }
+
+
+
+   /*******************************************************************************
+    ** Bound both page size and retained records.
+    *******************************************************************************/
+   protected List<QRecord> rows(String table, QQueryFilter filter, Set<String> fields, int limit) throws QException
+   {
+      List<QRecord> records = new ArrayList<>();
+      int bound = Math.min(limit, config.getMaxRows());
+      while(records.size() < bound)
+      {
+         int size = Math.min(1000, bound - records.size());
+         List<QRecord> page = query(table, filter, fields, records.size(), size);
+         records.addAll(page);
+         if(page.size() < size)
+         {
+            break;
+         }
+      }
+      return (records);
+   }
+
+
+
+   /*******************************************************************************
+    ** Core applies table permissions, field locks and record locks.
+    *******************************************************************************/
+   protected List<AggregateResult> aggregate(AggregateInput input) throws QException
+   {
+      QQueryFilter restored = DrillFilters.restoreTypes(input.getTableName(), input.getFilter());
+      restored.setOrderBys(input.getFilter().getOrderBys());
+      input.setFilter(restored);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      return (new AggregateAction().execute(input).getResults());
+   }
+
+
+
+   /*******************************************************************************
+    ** Batch supported aggregates; nulls use core criteria. The bounded scan adds
+    ** whitespace blanks and representative records for cardinality drills.
+    *******************************************************************************/
+   @Override
+   public Map<String, FieldCounts> fieldCounts(String table, QQueryFilter filter, List<String> fields) throws QException
+   {
+      Map<String, FieldCounts> result = new LinkedHashMap<>();
+      long total = count(table, filter);
+      for(int start = 0; start < fields.size(); start += 20)
+      {
+         List<String> batch = fields.subList(start, Math.min(start + 20, fields.size()));
+         AggregateInput input = new AggregateInput(table).withFilter(DrillFilters.copy(filter));
+         for(String field : batch)
+         {
+            input.withAggregate(countOf(field, AggregateOperator.COUNT)).withAggregate(countOf(field, AggregateOperator.COUNT_DISTINCT));
+         }
+         fieldCountAggregates(input, batch);
+         List<AggregateResult> aggregates = aggregate(input);
+         Set<String> selection = new LinkedHashSet<>(batch);
+         selection.add(primaryKey(table));
+         List<QRecord> records = rows(table, filter, selection, config.getMaxRows());
+         for(String field : batch)
+         {
+            boolean string = field(table, field).getType().isStringLike();
+            long nulls = fieldCount(table, filter, field, AggregateOperator.COUNT_NULL, aggregates, DrillFilters.nulls(field, string));
+            Map<Serializable, Serializable> representatives = new LinkedHashMap<>();
+            Set<Serializable> blanks = new LinkedHashSet<>();
+            for(QRecord record : records)
+            {
+               Serializable value = record.getValue(field);
+               if(value != null)
+               {
+                  representatives.putIfAbsent(value instanceof BigDecimal d ? d.stripTrailingZeros() : value, record.getValue(primaryKey(table)));
+                  if(string && value.toString().isBlank())
+                  {
+                     blanks.add(value);
+                  }
+               }
+            }
+            QQueryFilter blankFilter = DrillFilters.nulls(field, string);
+            if(!blanks.isEmpty())
+            {
+               blankFilter = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR).withSubFilter(blankFilter)
+                  .withSubFilter(DrillFilters.in(field, new ArrayList<>(blanks)));
+            }
+            long distinct = aggregates.isEmpty() ? 0 : number(aggregates.getFirst(), field, AggregateOperator.COUNT_DISTINCT).longValue();
+            if(!estimating && isMemory(table) && field(table, field).getType() == QFieldType.DECIMAL)
+            {
+               distinct = representatives.size();
+            }
+            result.put(field, new FieldCounts(total - nulls, nulls, string ? fieldCount(table, filter, field, AggregateOperator.COUNT_BLANK, aggregates, blankFilter) : nulls,
+               distinct, blankFilter, estimating ? DrillFilters.nonNull(field, string) : DrillFilters.in(primaryKey(table), new ArrayList<>(representatives.values()))));
+         }
+      }
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** Subclasses may extend the existing batch with native null/blank counts.
+    *******************************************************************************/
+   protected void fieldCountAggregates(AggregateInput input, List<String> fields) throws QException
+   {
+      // The portable backend counts null and blank predicates separately.
+   }
+
+   /*******************************************************************************
+    ** Count the exact drill predicate when native counters are unavailable.
+    *******************************************************************************/
+   protected long fieldCount(String table, QQueryFilter filter, String field, AggregateOperator operator,
+      List<AggregateResult> results, QQueryFilter condition) throws QException
+   {
+      return (count(table, DrillFilters.and(filter, condition)));
+   }
+
+   /*******************************************************************************
+    ** Push down group, count, ordering and pagination.
+    *******************************************************************************/
+   @Override
+   public List<GroupCount> topValues(String table, QQueryFilter filter, String field, int limit, int offset, String search) throws QException
+   {
+      QQueryFilter selected = DrillFilters.copy(filter);
+      if(search != null && !search.isBlank())
+      {
+         if(!field(table, field).getType().isStringLike())
+         {
+            return (groups(table, selected, List.of(field), Math.max(1, config.getMaxRows()), 0, false).stream()
+               .filter(g -> g.value() != null && g.value().toString().contains(search)).skip(offset).limit(limit).toList());
+         }
+         selected = DrillFilters.and(selected, DrillFilters.condition(field, QCriteriaOperator.CONTAINS, search));
+      }
+      return (groups(table, selected, List.of(field), limit, offset, false));
+   }
+
+
+
+   /*******************************************************************************
+    ** Random backends scale a count using the current aggregate's sample size.
+    *******************************************************************************/
+   protected long aggregateCount(long value)
+   {
+      return (value);
+   }
+
+   /*******************************************************************************
+    ** Random backends retain the raw sample ratio before rounding counts.
+    *******************************************************************************/
+   protected BigDecimal aggregateShare(long value)
+   {
+      return (null);
+   }
+
+   /*******************************************************************************
+    ** Exact and prefix groups derive shares from the profiler's row count.
+    *******************************************************************************/
+   protected BigDecimal countShare()
+   {
+      return (null);
+   }
+
+   /*******************************************************************************
+    ** Tuple drills use IN for non-null values and null-only predicates otherwise.
+    *******************************************************************************/
+   private List<GroupCount> groups(String table, QQueryFilter filter, List<String> fields, int limit, int offset, boolean duplicates) throws QException
+   {
+      Aggregate count = countOf(primaryKey(table), AggregateOperator.COUNT);
+      QQueryFilter ordered = DrillFilters.copy(filter).withOrderBy(new QFilterOrderByAggregate(count, false));
+      AggregateInput input = new AggregateInput(table).withFilter(ordered).withAggregate(count).withLimit(Math.addExact(limit, offset));
+      for(String field : fields)
+      {
+         input.withGroupBy(new GroupBy(field(table, field)));
+         ordered.withOrderBy(new QFilterOrderByGroupBy(new GroupBy(field(table, field))));
+      }
+      Map<Serializable, GroupCount> merged = new LinkedHashMap<>();
+      for(AggregateResult row : aggregate(input))
+      {
+         long rawSize = number(row, primaryKey(table), AggregateOperator.COUNT).longValue();
+         long size = aggregateCount(rawSize);
+         LinkedHashMap<String, Serializable> tuple = new LinkedHashMap<>();
+         QQueryFilter condition = new QQueryFilter();
+         for(String field : fields)
+         {
+            Serializable value = row.getGroupByValues().entrySet().stream().filter(e -> field.equals(e.getKey().getFieldName())).findFirst().orElseThrow().getValue();
+            tuple.put(field, value instanceof BigDecimal d ? new BigDecimal(d.stripTrailingZeros().toPlainString()) : value);
+            condition.withSubFilter(value == null ? DrillFilters.nulls(field, field(table, field).getType().isStringLike())
+               : value instanceof BigDecimal && !estimating ? DrillFilters.in(field, List.of(value.toString()))
+               : duplicates ? DrillFilters.in(field, List.of(value)) : DrillFilters.value(field, value, field(table, field).getType().isStringLike()));
+         }
+         Serializable value = duplicates ? tuple : tuple.get(fields.getFirst());
+         GroupCount previous = merged.get(value);
+         if(previous != null)
+         {
+            size += previous.count();
+            condition = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR).withSubFilter(previous.condition()).withSubFilter(condition);
+         }
+         merged.put(value, new GroupCount(value, value == null ? "(null)" : value.toString(), size, condition, aggregateShare(rawSize)));
+      }
+      List<GroupCount> groups = new ArrayList<>(merged.values());
+      if(isMemory(table))
+      {
+         groups.sort(Comparator.comparingLong(GroupCount::count).reversed().thenComparing(GroupCount::label));
+      }
+      return (groups.stream().filter(g -> !duplicates || g.count() > 1).skip(offset).limit(limit).toList());
+   }
+
+
+
+   /*******************************************************************************
+    ** Push down basic moments; stream ordered values for variance and percentiles.
+    *******************************************************************************/
+   @Override
+   public NumericSummary numericSummary(String table, QQueryFilter filter, String field, List<BigDecimal> percentiles) throws QException
+   {
+      List<BigDecimal> values = rows(table, filter, Set.of(field), config.getMaxRows()).stream().map(r -> r.getValue(field))
+         .filter(Objects::nonNull).map(v -> new BigDecimal(v.toString())).sorted().toList();
+      Map<String, BigDecimal> metrics = numericMetrics(table, filter, field, percentiles, values);
+      if(metrics.isEmpty() || metrics.get("min") == null)
+      {
+         for(String key : List.of("min", "max", "mean", "stddev", "sum"))
+         {
+            metrics.put(key, null);
+         }
+         for(BigDecimal p : percentiles)
+         {
+            metrics.put("p" + p.multiply(BigDecimal.valueOf(100)).stripTrailingZeros().toPlainString(), null);
+         }
+         QQueryFilter empty = DrillFilters.condition(primaryKey(table), QCriteriaOperator.IS_BLANK);
+         return (new NumericSummary(metrics, List.of(), 0, empty, List.of(new GroupCount("zeros", "zeros", 0, estimating ? DrillFilters.condition(field, QCriteriaOperator.EQUALS, BigDecimal.ZERO) : empty),
+            new GroupCount("negatives", "negatives", 0, estimating ? DrillFilters.range(field, null, BigDecimal.ZERO, false) : empty))));
+      }
+      BigDecimal q1 = metrics.containsKey("p25") ? metrics.get("p25") : percentile(values, new BigDecimal("0.25"));
+      BigDecimal q3 = metrics.containsKey("p75") ? metrics.get("p75") : percentile(values, new BigDecimal("0.75"));
+      BigDecimal span = q3.subtract(q1).multiply(new BigDecimal("1.5"));
+      BigDecimal low = q1.subtract(span);
+      BigDecimal high = q3.add(span);
+      QQueryFilter outliers = isMemory(table)
+         ? new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR)
+            .withSubFilter(numericRange(table, field, values, null, low, false))
+            .withSubFilter(DrillFilters.and(DrillFilters.condition(field, QCriteriaOperator.IS_NOT_BLANK), DrillFilters.condition(field, QCriteriaOperator.GREATER_THAN, high)))
+         : DrillFilters.outliers(field, low, high);
+      List<BigDecimal> extremes = values.stream().filter(v -> v.compareTo(low) < 0 || v.compareTo(high) > 0).map(v -> new BigDecimal(v.stripTrailingZeros().toPlainString())).distinct()
+         .sorted(Comparator.comparing((BigDecimal v) -> v.subtract(q1.add(q3).divide(BigDecimal.valueOf(2), MATH)).abs()).reversed()).limit(10).toList();
+      List<GroupCount> extremeGroups = new ArrayList<>();
+      for(BigDecimal value : extremes)
+      {
+         QQueryFilter condition = estimating ? DrillFilters.condition(field, QCriteriaOperator.EQUALS, value) : DrillFilters.in(field, equalNumbers(values, value));
+         extremeGroups.add(new GroupCount(value, value.toPlainString(), count(table, DrillFilters.and(filter, condition)), condition, countShare()));
+      }
+      QQueryFilter zeros = estimating ? DrillFilters.condition(field, QCriteriaOperator.EQUALS, BigDecimal.ZERO) : DrillFilters.in(field, equalNumbers(values, BigDecimal.ZERO));
+      QQueryFilter negatives = numericRange(table, field, values, null, BigDecimal.ZERO, false);
+      return (new NumericSummary(metrics, extremeGroups, count(table, DrillFilters.and(filter, outliers)), outliers,
+         List.of(bucket(table, filter, "zeros", zeros), bucket(table, filter, "negatives", negatives))));
+   }
+
+
+
+   /*******************************************************************************
+    ** Portable numeric moments; core-backed subclasses replace supported work.
+    *******************************************************************************/
+   protected Map<String, BigDecimal> numericMetrics(String table, QQueryFilter filter, String field, List<BigDecimal> percentiles, List<BigDecimal> values) throws QException
+   {
+      Map<String, BigDecimal> metrics = new LinkedHashMap<>();
+      if(values.isEmpty())
+      {
+         return (metrics);
+      }
+      AggregateInput input = new AggregateInput(table).withFilter(DrillFilters.copy(filter));
+      for(AggregateOperator op : List.of(AggregateOperator.MIN, AggregateOperator.MAX, AggregateOperator.AVG, AggregateOperator.SUM))
+      {
+         input.withAggregate(new Aggregate(field, op));
+      }
+      List<AggregateResult> results = aggregate(input);
+      AggregateResult result = results.getFirst();
+      metrics.put("min", number(result, field, AggregateOperator.MIN));
+      metrics.put("max", number(result, field, AggregateOperator.MAX));
+      metrics.put("mean", number(result, field, AggregateOperator.AVG));
+      metrics.put("sum", number(result, field, AggregateOperator.SUM));
+      BigDecimal mean = values.stream().reduce(BigDecimal.ZERO, BigDecimal::add).divide(BigDecimal.valueOf(values.size()), MATH);
+      BigDecimal variance = values.stream().map(v -> v.subtract(mean).pow(2)).reduce(BigDecimal.ZERO, BigDecimal::add);
+      metrics.put("stddev", values.size() < 2 ? null : variance.divide(BigDecimal.valueOf(values.size() - 1), MATH).sqrt(MATH));
+      for(BigDecimal p : percentiles)
+      {
+         metrics.put("p" + p.multiply(BigDecimal.valueOf(100)).stripTrailingZeros().toPlainString(), percentile(values, p));
+      }
+      return (metrics);
+   }
+
+
+
+   /*******************************************************************************
+    ** PostgreSQL percentile_cont interpolation at p * (n - 1).
+    *******************************************************************************/
+   public static BigDecimal percentile(List<BigDecimal> sorted, BigDecimal p)
+   {
+      if(sorted.isEmpty())
+      {
+         return (null);
+      }
+      BigDecimal index = p.multiply(BigDecimal.valueOf(sorted.size() - 1));
+      int low = index.intValue();
+      int high = Math.min(low + 1, sorted.size() - 1);
+      return (sorted.get(low).add(sorted.get(high).subtract(sorted.get(low)).multiply(index.subtract(BigDecimal.valueOf(low)))));
+   }
+
+
+
+   /*******************************************************************************
+    ** Predicates share the exact boundary arithmetic used by drills.
+    *******************************************************************************/
+   @Override
+   public List<GroupCount> numericHistogram(String table, QQueryFilter filter, String field, BigDecimal low, BigDecimal high, int bins) throws QException
+   {
+      List<GroupCount> result = new ArrayList<>();
+      if(low == null || high == null)
+      {
+         return (result);
+      }
+      NiceBins nice = NiceBins.covering(low, high);
+      low = nice.low();
+      high = nice.high();
+      bins = nice.count();
+      List<BigDecimal> values = rows(table, filter, Set.of(field), config.getMaxRows()).stream().map(r -> r.getValue(field))
+         .filter(Objects::nonNull).map(v -> new BigDecimal(v.toString())).toList();
+      result.add(bucket(table, filter, AnalysisFormatting.interval(field(table, field), null, low), numericRange(table, field, values, null, low, false)));
+      BigDecimal width = high.subtract(low).divide(BigDecimal.valueOf(bins), MATH);
+      for(int i = 0; i < bins; i++)
+      {
+         BigDecimal start = low.add(width.multiply(BigDecimal.valueOf(i)));
+         BigDecimal end = i == bins - 1 ? high : low.add(width.multiply(BigDecimal.valueOf(i + 1)));
+         result.add(bucket(table, filter, AnalysisFormatting.interval(field(table, field), start, end), numericRange(table, field, values, start, end, i == bins - 1)));
+      }
+      result.add(bucket(table, filter, AnalysisFormatting.interval(field(table, field), high, null), DrillFilters.and(DrillFilters.condition(field, QCriteriaOperator.IS_NOT_BLANK), DrillFilters.condition(field, QCriteriaOperator.GREATER_THAN, high))));
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** A bucket count and its producing condition.
+    *******************************************************************************/
+   private GroupCount bucket(String table, QQueryFilter filter, String label, QQueryFilter condition) throws QException
+   {
+      return (new GroupCount(label, label, count(table, DrillFilters.and(filter, condition)), condition, countShare()));
+   }
+
+
+
+   /*******************************************************************************
+    ** Fill gaps inside the observed range, retaining DST-aware boundaries.
+    *******************************************************************************/
+   @Override
+   public List<GroupCount> dateBuckets(String table, QQueryFilter filter, String field, DateUnit unit, ZoneId zone) throws QException
+   {
+      List<QRecord> records = rows(table, filter, Set.of(field), config.getMaxRows());
+      if(unit == DateUnit.DAY_OF_WEEK || unit == DateUnit.HOUR_OF_DAY)
+      {
+         return (mappedGroups(table, filter, field, records, v -> unit == DateUnit.DAY_OF_WEEK ? day(v, zone).getDayOfWeek().getValue()
+            : ((Instant) v).atZone(zone).getHour(), 24).stream()
+            .map(g -> new GroupCount(g.value(), AnalysisFormatting.dateBucket(g.value(), unit, zone), g.count(), g.condition(), g.share())).toList());
+      }
+      if(unit == DateUnit.HOUR)
+      {
+         List<Instant> instants = records.stream().map(r -> (Instant) r.getValue(field)).filter(Objects::nonNull).sorted().toList();
+         List<GroupCount> hours = new ArrayList<>();
+         if(!instants.isEmpty())
+         {
+            Instant start = instants.getFirst().atZone(zone).truncatedTo(java.time.temporal.ChronoUnit.HOURS).toInstant();
+            while(!start.isAfter(instants.getLast()))
+            {
+               Instant end = start.plus(1, java.time.temporal.ChronoUnit.HOURS);
+               QQueryFilter condition = DrillFilters.and(DrillFilters.condition(field, QCriteriaOperator.GREATER_THAN_OR_EQUALS, start),
+                  DrillFilters.condition(field, QCriteriaOperator.LESS_THAN, end));
+               hours.add(new GroupCount(start, AnalysisFormatting.dateBucket(start, unit, zone), count(table, DrillFilters.and(filter, condition)), condition, countShare()));
+               start = end;
+            }
+         }
+         return (hours);
+      }
+      List<LocalDate> dates = records.stream().map(r -> r.getValue(field)).filter(Objects::nonNull).map(v -> day(v, zone)).sorted().toList();
+      List<GroupCount> result = new ArrayList<>();
+      if(dates.isEmpty())
+      {
+         return (result);
+      }
+      LocalDate start = floor(dates.getFirst(), unit);
+      LocalDate last = floor(dates.getLast(), unit);
+      while(!start.isAfter(last))
+      {
+         LocalDate end = next(start, unit);
+         QQueryFilter condition = DrillFilters.dateRange(field, start, end, field(table, field).getType() == QFieldType.DATE_TIME, zone);
+         result.add(new GroupCount(start, AnalysisFormatting.dateBucket(start, unit, zone), count(table, DrillFilters.and(filter, condition)), condition, countShare()));
+         start = end;
+      }
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** Dates carry no time-zone conversion; instants do.
+    *******************************************************************************/
+   public static LocalDate day(Serializable value, ZoneId zone)
+   {
+      return (ProfileSupport.day(value, zone));
+   }
+
+
+
+   /*******************************************************************************
+    ** ISO weeks begin Monday.
+    *******************************************************************************/
+   protected static LocalDate floor(LocalDate date, DateUnit unit)
+   {
+      return (switch(unit)
+      {
+         case WEEK -> date.with(TemporalAdjusters.previousOrSame(DayOfWeek.MONDAY));
+         case MONTH -> date.withDayOfMonth(1);
+         case QUARTER -> date.withMonth((date.getMonthValue() - 1) / 3 * 3 + 1).withDayOfMonth(1);
+         case YEAR -> date.withDayOfYear(1);
+         default -> date;
+      });
+   }
+
+
+
+   /*******************************************************************************
+    ** Calendar arithmetic handles leap years and daylight savings.
+    *******************************************************************************/
+   protected static LocalDate next(LocalDate date, DateUnit unit)
+   {
+      return (switch(unit)
+      {
+         case WEEK -> date.plusWeeks(1);
+         case MONTH -> date.plusMonths(1);
+         case QUARTER -> date.plusMonths(3);
+         case YEAR -> date.plusYears(1);
+         default -> date.plusDays(1);
+      });
+   }
+
+
+
+   /*******************************************************************************
+    ** Preserve types in minimum and maximum aggregate values.
+    *******************************************************************************/
+   @Override
+   public Map<String, Serializable> extrema(String table, QQueryFilter filter, String field) throws QException
+   {
+      AggregateInput input = new AggregateInput(table).withFilter(DrillFilters.copy(filter))
+         .withAggregate(new Aggregate(field, AggregateOperator.MIN)).withAggregate(new Aggregate(field, AggregateOperator.MAX));
+      Map<String, Serializable> result = new LinkedHashMap<>();
+      result.put("min", null);
+      result.put("max", null);
+      for(AggregateResult row : aggregate(input))
+      {
+         row.getAggregateValues().forEach((key, value) ->
+         {
+            if(key.getOperator() == AggregateOperator.MIN || key.getOperator() == AggregateOperator.MAX)
+            {
+               result.put(key.getOperator().name().toLowerCase(java.util.Locale.ROOT), value);
+            }
+         });
+      }
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** Stream string lengths; bucket members retain exact value-based drills.
+    *******************************************************************************/
+   @Override
+   public LengthSummary lengthSummary(String table, QQueryFilter filter, String field) throws QException
+   {
+      List<QRecord> records = rows(table, filter, Set.of(field), config.getMaxRows());
+      List<Integer> lengths = records.stream().map(r -> r.getValueString(field)).filter(Objects::nonNull).map(String::length).sorted().toList();
+      Map<String, BigDecimal> metrics = new LinkedHashMap<>();
+      if(!lengths.isEmpty())
+      {
+         metrics.put("minLength", BigDecimal.valueOf(lengths.getFirst()));
+         metrics.put("maxLength", BigDecimal.valueOf(lengths.getLast()));
+         metrics.put("meanLength", BigDecimal.valueOf(lengths.stream().mapToLong(Integer::longValue).sum()).divide(BigDecimal.valueOf(lengths.size()), MATH));
+      }
+      int width = lengths.isEmpty() ? 1 : Math.max(1, (int) Math.ceil((lengths.getLast() + 1.0) / 20));
+      return (new LengthSummary(metrics, mappedGroups(table, filter, field, records, v -> (v.toString().length() / width * width) + "–" + (v.toString().length() / width * width + width - 1), 20)));
+   }
+
+
+
+   /*******************************************************************************
+    ** Shapes use a primary-key prefix of at most the requested sample size.
+    *******************************************************************************/
+   @Override
+   public PatternSummary patterns(String table, QQueryFilter filter, String field, int sampleRows) throws QException
+   {
+      List<QRecord> records = rows(table, DrillFilters.and(filter, DrillFilters.nonNull(field, true)), Set.of(field, primaryKey(table)), sampleRows + 1);
+      boolean truncated = records.size() > sampleRows;
+      records = records.subList(0, Math.min(records.size(), sampleRows));
+      QQueryFilter sampled = records.isEmpty() ? DrillFilters.in(primaryKey(table), List.of())
+         : DrillFilters.condition(primaryKey(table), QCriteriaOperator.LESS_THAN_OR_EQUALS, records.getLast().getValue(primaryKey(table)));
+      return (new PatternSummary(mappedGroups(table, estimating ? filter : DrillFilters.and(filter, sampled), field, records, v -> shape(v.toString()), 10), records.size(), truncated));
+   }
+
+
+
+   /*******************************************************************************
+    ** Collapse runs of letters and digits, preserving literal punctuation.
+    *******************************************************************************/
+   public static String shape(String text)
+   {
+      return (text.replaceAll("\\p{L}+", "A").replaceAll("\\p{N}+", "9"));
+   }
+
+
+
+   /*******************************************************************************
+    ** Derived groups do not require unsupported SQL functions.
+    *******************************************************************************/
+   private List<GroupCount> mappedGroups(String table, QQueryFilter filter, String field, List<QRecord> rows, Function<Serializable, Serializable> mapper, int limit) throws QException
+   {
+      Map<Serializable, Set<Serializable>> members = new LinkedHashMap<>();
+      for(QRecord row : rows)
+      {
+         Serializable value = row.getValue(field);
+         if(value != null)
+         {
+            members.computeIfAbsent(mapper.apply(value), ignored -> new LinkedHashSet<>()).add(value);
+         }
+      }
+      List<GroupCount> groups = new ArrayList<>();
+      for(Map.Entry<Serializable, Set<Serializable>> entry : members.entrySet())
+      {
+         QQueryFilter condition = DrillFilters.in(field, new ArrayList<>(entry.getValue()));
+         groups.add(new GroupCount(entry.getKey(), entry.getKey().toString(), count(table, DrillFilters.and(filter, condition)), estimating ? condition : DrillFilters.and(filter, condition), countShare()));
+      }
+      return (groups.stream().sorted(Comparator.comparingLong(GroupCount::count).reversed().thenComparing(GroupCount::label)).limit(limit).toList());
+   }
+
+
+
+   /*******************************************************************************
+    ** Top duplicate groups are sorted before the count threshold is applied.
+    *******************************************************************************/
+   @Override
+   public List<GroupCount> duplicates(String table, QQueryFilter filter, List<String> fields, int limit) throws QException
+   {
+      return (groups(table, filter, fields, limit, 0, true));
+   }
+
+
+
+   /*******************************************************************************
+    ** Metadata lookup follows facade security checks.
+    *******************************************************************************/
+   protected static QFieldMetaData field(String table, String field)
+   {
+      return (QContext.getQInstance().getTable(table).getField(field));
+   }
+
+
+
+   /*******************************************************************************
+    ** Deterministic paging requires an addressable primary key.
+    *******************************************************************************/
+   protected static String primaryKey(String table)
+   {
+      return (QContext.getQInstance().getTable(table).getPrimaryKeyField());
+   }
+
+
+
+   /*******************************************************************************
+    ** COUNT and COUNT_DISTINCT always read as integers: RC.5's RDBMS reader
+    ** otherwise reads them as the field's type (a boolean count fails).
+    *******************************************************************************/
+   protected static Aggregate countOf(String field, AggregateOperator op)
+   {
+      return (new Aggregate(field, op).withFieldType(QFieldType.INTEGER));
+   }
+
+
+
+   /*******************************************************************************
+    ** The value of one aggregate of a result row (0 when absent).
+    *******************************************************************************/
+   protected static BigDecimal number(AggregateResult row, String field, AggregateOperator op)
+   {
+      Serializable value = row.getAggregateValues().entrySet().stream().filter(e -> field.equals(e.getKey().getFieldName()) && op == e.getKey().getOperator())
+         .map(Map.Entry::getValue).filter(Objects::nonNull).findFirst().orElse(0);
+      return (new BigDecimal(value.toString()));
+   }
+
+
+
+   /*******************************************************************************
+    ** RC.5 memory equality is scale-sensitive (BigDecimal.equals), unlike SQL.
+    ** Use strict comparison plus actual boundary spellings to preserve half-open
+    ** membership. SQL backends use ordinary range predicates.
+    *******************************************************************************/
+   protected QQueryFilter numericRange(String table, String field, List<BigDecimal> values, BigDecimal low, BigDecimal high, boolean closed)
+   {
+      if(estimating || !isMemory(table))
+      {
+         return (DrillFilters.range(field, low, high, closed));
+      }
+      QQueryFilter result = DrillFilters.condition(field, QCriteriaOperator.IS_NOT_BLANK);
+      if(low != null)
+      {
+         result.withSubFilter(new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR)
+            .withSubFilter(DrillFilters.condition(field, QCriteriaOperator.GREATER_THAN, low))
+            .withSubFilter(DrillFilters.in(field, equalNumbers(values, low))));
+      }
+      if(high != null)
+      {
+         result.withCriteria(field, QCriteriaOperator.LESS_THAN_OR_EQUALS, high);
+         List<String> boundary = equalNumbers(values, high);
+         if(!closed && !boundary.isEmpty())
+         {
+            result.withCriteria(field, QCriteriaOperator.NOT_IN, boundary);
+         }
+      }
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** Preserve scale through JSON using string operands, accepted by core and SQL.
+    *******************************************************************************/
+   private static List<String> equalNumbers(List<BigDecimal> values, BigDecimal target)
+   {
+      return (values.stream().filter(v -> v.compareTo(target) == 0).map(BigDecimal::toString).distinct().toList());
+   }
+
+
+
+   /*******************************************************************************
+    ** Isolate compatibility fixes to the RC.5 memory implementation.
+    *******************************************************************************/
+   protected static boolean isMemory(String table)
+   {
+      return ("memory".equals(QContext.getQInstance().getBackend(QContext.getQInstance().getTable(table).getBackendName()).getBackendType()));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/engine/TableProfiler.java

@@ -0,0 +1,122 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.engine;
+
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.dataanalysis.result.CandidateKey;
+import com.kingsrook.qbits.dataanalysis.result.ChartKind;
+import com.kingsrook.qbits.dataanalysis.result.FieldSummary;
+import com.kingsrook.qbits.dataanalysis.result.Point;
+import com.kingsrook.qbits.dataanalysis.result.TableProfile;
+import com.kingsrook.qbits.dataanalysis.result.TableProfileRequest;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+
+/*******************************************************************************
+ ** Batched table completeness and candidate-key discovery over the selected scope.
+ *******************************************************************************/
+public class TableProfiler
+{
+   private final AnalysisBackend backend;
+
+   /*******************************************************************************
+    ** Bind the primitive operation port.
+    *******************************************************************************/
+   public TableProfiler(AnalysisBackend backend)
+   {
+      this.backend = backend;
+   }
+
+
+
+   /*******************************************************************************
+    ** Candidate pairs consider the eight most unique readable selected fields.
+    *******************************************************************************/
+   public TableProfile profile(TableProfileRequest request, List<QFieldMetaData> fields, AnalysisBackend.Scope scope) throws QException
+   {
+      String table = request.getTableName();
+      QQueryFilter filter = scope.filter();
+      long rows = backend.count(table, filter);
+      QQueryFilter drillFilter = scope.estimate() ? request.getFilter() : filter;
+      TableProfile result = new TableProfile().withTableName(table).withFilter(DrillFilters.restoreTypes(request.getTableName(), request.getFilter())).withEstimate(scope.estimate())
+         .withSampleRows(scope.estimate() ? scope.rowsScanned() : 0L).withRowsScanned(scope.rowsScanned()).withTruncated(scope.truncated()).withAsOf(Instant.now())
+         .withRowCount(ProfileSupport.count("rows", scope.estimate() ? scope.total() : rows, table, drillFilter, null));
+      Map<String, AnalysisBackend.FieldCounts> counts = backend.fieldCounts(table, filter, fields.stream().map(QFieldMetaData::getName).toList());
+      for(QFieldMetaData field : fields)
+      {
+         String name = field.getName();
+         AnalysisBackend.FieldCounts c = counts.get(name);
+         result.getFields().add(new FieldSummary().withField(name).withLabel(field.getLabel()).withType(field.getType().name())
+            .withCompleteness(AnalysisFormatting.ratio(c.completeness())).withDistinct(c.distinct()).withUniqueness(AnalysisFormatting.ratio(c.uniqueness()))
+            .withConstant(c.constant()).withEmpty(c.blanks() == rows)
+            .withNulls(ProfileSupport.count("nulls", c.nulls(), table, drillFilter, DrillFilters.nulls(name, field.getType().isStringLike())))
+            .withBlanks(ProfileSupport.count("blanks", c.blanks(), table, drillFilter, c.blankFilter())));
+         if(rows > 0 && c.distinct() == rows && c.nulls() == 0)
+         {
+            result.getCandidateKeys().add(key(table, drillFilter, List.of(name), rows));
+         }
+      }
+      List<FieldSummary> ranked = result.getFields().stream().sorted(Comparator.comparing(FieldSummary::getUniqueness).reversed().thenComparing(FieldSummary::getField)).limit(8).toList();
+      for(int i = 0; i < ranked.size(); i++)
+      {
+         for(int j = i + 1; j < ranked.size(); j++)
+         {
+            List<String> pair = List.of(ranked.get(i).getField(), ranked.get(j).getField());
+            if(rows > 0 && pair.stream().allMatch(f -> counts.get(f).nulls() == 0) && backend.duplicates(table, filter, pair, 1).isEmpty())
+            {
+               result.getCandidateKeys().add(key(table, drillFilter, pair, rows));
+            }
+         }
+      }
+      result.withHeatmap(ProfileSupport.chart(ChartKind.HEATMAP, ChartKind.BAR, "field", List.of()));
+      result.getHeatmap().getY().withLabel("Completeness").withValueType(com.kingsrook.qbits.dataanalysis.result.ValueType.PERCENT);
+      result.getHeatmap().getSeries().getFirst().withName("Completeness").withPoints(new ArrayList<>());
+      for(FieldSummary field : result.getFields())
+      {
+         result.getHeatmap().getSeries().getFirst().getPoints().add(new Point().withX(field.getField()).withLabel(field.getLabel()).withY(field.getCompleteness()));
+      }
+      if(scope.estimate())
+      {
+         result.getFields().forEach(f -> ProfileSupport.markEstimates(List.of(f.getNulls(), f.getBlanks())));
+         result.getWarnings().add(scope.warning());
+      }
+      else if(scope.truncated())
+      {
+         result.getWarnings().add("Profiles and candidate keys describe only the first " + rows + " rows by primary key.");
+      }
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** Candidate-key counts drill to the whole assessed population.
+    *******************************************************************************/
+   private static CandidateKey key(String table, QQueryFilter filter, List<String> fields, long rows)
+   {
+      return (new CandidateKey().withFields(fields).withRowCount(rows).withDrill(DrillFilters.drill(table, filter, null)));
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/permissions/DataAnalysisPermissions.java

@@ -27,12 +27,11 @@ import com.kingsrook.qqq.backend.core.context.QContext;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
 import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules;
 import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
-import com.kingsrook.qqq.backend.core.model.session.QSession;
 import com.kingsrook.qqq.backend.core.utils.StringUtils;
 
 
 /*******************************************************************************
- ** Data Analysis permissions and the temporary per-table feature check.
+ ** Data Analysis permissions through the core table feature registry.
  *******************************************************************************/
 public final class DataAnalysisPermissions
 {
@@ -68,9 +67,8 @@ public final class DataAnalysisPermissions
     *******************************************************************************/
    public static boolean canAnalyze(QTableMetaData table)
    {
-      QSession session = QContext.getQSession();
       boolean read = !Boolean.TRUE.equals(QContext.getQInstance().getEnforcePermissionsInCoreActions())
          || PermissionsHelper.hasTablePermission(new QueryInput(table.getName()), table.getName(), TablePermissionSubType.READ);
-      return (read && session != null && session.hasPermission(analyzePermissionName(table)));
+      return (read && PermissionsHelper.hasTableFeaturePermission(QContext.getQInstance(), QContext.getQSession(), table, "analyze"));
    }
 }

src/main/java/com/kingsrook/qbits/dataanalysis/result/AnalysisRequest.java

@@ -0,0 +1,48 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+
+/*******************************************************************************
+ ** Common analysis request contract.
+ *******************************************************************************/
+public interface AnalysisRequest extends Serializable
+{
+
+   /*******************************************************************************
+    ** Request getTableName.
+    *******************************************************************************/
+   String getTableName();
+
+   /*******************************************************************************
+    ** Request getFilter.
+    *******************************************************************************/
+   QQueryFilter getFilter();
+
+   /*******************************************************************************
+    ** Request getExact.
+    *******************************************************************************/
+   Boolean getExact();
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/Axis.java

@@ -0,0 +1,100 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+
+/*******************************************************************************
+ ** Typed Axis contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class Axis implements Serializable
+{
+   private String field;
+   private String label;
+   private ValueType valueType;
+
+
+
+   /*******************************************************************************
+    ** Getter for field.
+    *******************************************************************************/
+   public String getField()
+   {
+      return (field);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for field.
+    *******************************************************************************/
+   public Axis withField(String field)
+   {
+      this.field = field;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for label.
+    *******************************************************************************/
+   public String getLabel()
+   {
+      return (label);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for label.
+    *******************************************************************************/
+   public Axis withLabel(String label)
+   {
+      this.label = label;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for valueType.
+    *******************************************************************************/
+   public ValueType getValueType()
+   {
+      return (valueType);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for valueType.
+    *******************************************************************************/
+   public Axis withValueType(ValueType valueType)
+   {
+      this.valueType = valueType;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/CandidateKey.java

@@ -0,0 +1,101 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+
+/*******************************************************************************
+ ** Typed CandidateKey contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class CandidateKey implements Serializable
+{
+   private List<String> fields;
+   private Long rowCount;
+   private Drill drill;
+
+
+
+   /*******************************************************************************
+    ** Getter for fields.
+    *******************************************************************************/
+   public List<String> getFields()
+   {
+      return (fields);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for fields.
+    *******************************************************************************/
+   public CandidateKey withFields(List<String> fields)
+   {
+      this.fields = fields;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for rowCount.
+    *******************************************************************************/
+   public Long getRowCount()
+   {
+      return (rowCount);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for rowCount.
+    *******************************************************************************/
+   public CandidateKey withRowCount(Long rowCount)
+   {
+      this.rowCount = rowCount;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for drill.
+    *******************************************************************************/
+   public Drill getDrill()
+   {
+      return (drill);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for drill.
+    *******************************************************************************/
+   public CandidateKey withDrill(Drill drill)
+   {
+      this.drill = drill;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/Capabilities.java

@@ -0,0 +1,123 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+
+/*******************************************************************************
+ ** Typed Capabilities contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class Capabilities implements Serializable
+{
+   private String tableName;
+   private List<String> fields;
+   private com.kingsrook.qbits.dataanalysis.engine.EffectiveConfig config;
+   private String backend;
+
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public Capabilities withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for fields.
+    *******************************************************************************/
+   public List<String> getFields()
+   {
+      return (fields);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for fields.
+    *******************************************************************************/
+   public Capabilities withFields(List<String> fields)
+   {
+      this.fields = fields;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for config.
+    *******************************************************************************/
+   public com.kingsrook.qbits.dataanalysis.engine.EffectiveConfig getConfig()
+   {
+      return (config);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for config.
+    *******************************************************************************/
+   public Capabilities withConfig(com.kingsrook.qbits.dataanalysis.engine.EffectiveConfig config)
+   {
+      this.config = config;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for backend.
+    *******************************************************************************/
+   public String getBackend()
+   {
+      return (backend);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for backend.
+    *******************************************************************************/
+   public Capabilities withBackend(String backend)
+   {
+      this.backend = backend;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/Chart.java

@@ -0,0 +1,167 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+
+/*******************************************************************************
+ ** Typed Chart contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class Chart implements Serializable
+{
+   private ChartKind kind;
+   private List<ChartKind> alternatives = List.of();
+   private Axis x;
+   private Axis y;
+   private List<Series> series = List.of();
+   private List<String> annotations = List.of();
+
+
+
+   /*******************************************************************************
+    ** Getter for kind.
+    *******************************************************************************/
+   public ChartKind getKind()
+   {
+      return (kind);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for kind.
+    *******************************************************************************/
+   public Chart withKind(ChartKind kind)
+   {
+      this.kind = kind;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for alternatives.
+    *******************************************************************************/
+   public List<ChartKind> getAlternatives()
+   {
+      return (alternatives);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for alternatives.
+    *******************************************************************************/
+   public Chart withAlternatives(List<ChartKind> alternatives)
+   {
+      this.alternatives = alternatives;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for x.
+    *******************************************************************************/
+   public Axis getX()
+   {
+      return (x);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for x.
+    *******************************************************************************/
+   public Chart withX(Axis x)
+   {
+      this.x = x;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for y.
+    *******************************************************************************/
+   public Axis getY()
+   {
+      return (y);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for y.
+    *******************************************************************************/
+   public Chart withY(Axis y)
+   {
+      this.y = y;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for series.
+    *******************************************************************************/
+   public List<Series> getSeries()
+   {
+      return (series);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for series.
+    *******************************************************************************/
+   public Chart withSeries(List<Series> series)
+   {
+      this.series = series;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for annotations.
+    *******************************************************************************/
+   public List<String> getAnnotations()
+   {
+      return (annotations);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for annotations.
+    *******************************************************************************/
+   public Chart withAnnotations(List<String> annotations)
+   {
+      this.annotations = annotations;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/ChartKind.java

@@ -0,0 +1,30 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+/*******************************************************************************
+ ** Semantic ChartKind values.
+ *******************************************************************************/
+public enum ChartKind
+{
+   HISTOGRAM, BOX, BAR, PARETO, TIME_SERIES, SCATTER, HEATMAP
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/ColumnProfile.java

@@ -0,0 +1,455 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import java.time.Instant;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+
+/*******************************************************************************
+ ** Typed ColumnProfile contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class ColumnProfile implements Serializable
+{
+   private String tableName;
+   private QQueryFilter filter;
+   private Boolean estimate = false;
+   private Long sampleRows = 0L;
+   private Boolean truncated = false;
+   private Long rowsScanned = 0L;
+   private Instant asOf;
+   private String dataVersion;
+   private List<String> warnings = new java.util.ArrayList<>();
+   private String fieldName;
+   private String fieldLabel;
+   private String fieldType;
+   private List<Metric> counts = new java.util.ArrayList<>();
+   private NumericProfile numeric;
+   private DateProfile dates;
+   private TextProfile text;
+   private List<Metric> booleans;
+   private List<ValueCount> topValues = List.of();
+   private Chart chart;
+
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public ColumnProfile withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for filter.
+    *******************************************************************************/
+   public QQueryFilter getFilter()
+   {
+      return (filter);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for filter.
+    *******************************************************************************/
+   public ColumnProfile withFilter(QQueryFilter filter)
+   {
+      this.filter = filter;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for estimate.
+    *******************************************************************************/
+   public Boolean getEstimate()
+   {
+      return (estimate);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for estimate.
+    *******************************************************************************/
+   public ColumnProfile withEstimate(Boolean estimate)
+   {
+      this.estimate = estimate;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for sampleRows.
+    *******************************************************************************/
+   public Long getSampleRows()
+   {
+      return (sampleRows);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for sampleRows.
+    *******************************************************************************/
+   public ColumnProfile withSampleRows(Long sampleRows)
+   {
+      this.sampleRows = sampleRows;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for truncated.
+    *******************************************************************************/
+   public Boolean getTruncated()
+   {
+      return (truncated);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for truncated.
+    *******************************************************************************/
+   public ColumnProfile withTruncated(Boolean truncated)
+   {
+      this.truncated = truncated;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for rowsScanned.
+    *******************************************************************************/
+   public Long getRowsScanned()
+   {
+      return (rowsScanned);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for rowsScanned.
+    *******************************************************************************/
+   public ColumnProfile withRowsScanned(Long rowsScanned)
+   {
+      this.rowsScanned = rowsScanned;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for asOf.
+    *******************************************************************************/
+   public Instant getAsOf()
+   {
+      return (asOf);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for asOf.
+    *******************************************************************************/
+   public ColumnProfile withAsOf(Instant asOf)
+   {
+      this.asOf = asOf;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for dataVersion.
+    *******************************************************************************/
+   public String getDataVersion()
+   {
+      return (dataVersion);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for dataVersion.
+    *******************************************************************************/
+   public ColumnProfile withDataVersion(String dataVersion)
+   {
+      this.dataVersion = dataVersion;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for warnings.
+    *******************************************************************************/
+   public List<String> getWarnings()
+   {
+      return (warnings);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for warnings.
+    *******************************************************************************/
+   public ColumnProfile withWarnings(List<String> warnings)
+   {
+      this.warnings = warnings;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for fieldName.
+    *******************************************************************************/
+   public String getFieldName()
+   {
+      return (fieldName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for fieldName.
+    *******************************************************************************/
+   public ColumnProfile withFieldName(String fieldName)
+   {
+      this.fieldName = fieldName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for fieldLabel.
+    *******************************************************************************/
+   public String getFieldLabel()
+   {
+      return (fieldLabel);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for fieldLabel.
+    *******************************************************************************/
+   public ColumnProfile withFieldLabel(String fieldLabel)
+   {
+      this.fieldLabel = fieldLabel;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for fieldType.
+    *******************************************************************************/
+   public String getFieldType()
+   {
+      return (fieldType);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for fieldType.
+    *******************************************************************************/
+   public ColumnProfile withFieldType(String fieldType)
+   {
+      this.fieldType = fieldType;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for counts.
+    *******************************************************************************/
+   public List<Metric> getCounts()
+   {
+      return (counts);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for counts.
+    *******************************************************************************/
+   public ColumnProfile withCounts(List<Metric> counts)
+   {
+      this.counts = counts;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for numeric.
+    *******************************************************************************/
+   public NumericProfile getNumeric()
+   {
+      return (numeric);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for numeric.
+    *******************************************************************************/
+   public ColumnProfile withNumeric(NumericProfile numeric)
+   {
+      this.numeric = numeric;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for dates.
+    *******************************************************************************/
+   public DateProfile getDates()
+   {
+      return (dates);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for dates.
+    *******************************************************************************/
+   public ColumnProfile withDates(DateProfile dates)
+   {
+      this.dates = dates;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for text.
+    *******************************************************************************/
+   public TextProfile getText()
+   {
+      return (text);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for text.
+    *******************************************************************************/
+   public ColumnProfile withText(TextProfile text)
+   {
+      this.text = text;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for booleans.
+    *******************************************************************************/
+   public List<Metric> getBooleans()
+   {
+      return (booleans);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for booleans.
+    *******************************************************************************/
+   public ColumnProfile withBooleans(List<Metric> booleans)
+   {
+      this.booleans = booleans;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for topValues.
+    *******************************************************************************/
+   public List<ValueCount> getTopValues()
+   {
+      return (topValues);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for topValues.
+    *******************************************************************************/
+   public ColumnProfile withTopValues(List<ValueCount> topValues)
+   {
+      this.topValues = topValues;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for chart.
+    *******************************************************************************/
+   public Chart getChart()
+   {
+      return (chart);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for chart.
+    *******************************************************************************/
+   public ColumnProfile withChart(Chart chart)
+   {
+      this.chart = chart;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/ColumnProfileRequest.java

@@ -0,0 +1,122 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+
+/*******************************************************************************
+ ** Typed ColumnProfileRequest contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class ColumnProfileRequest implements AnalysisRequest
+{
+   private String tableName;
+   private QQueryFilter filter;
+   private Boolean exact = false;
+   private String fieldName;
+
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public ColumnProfileRequest withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for filter.
+    *******************************************************************************/
+   public QQueryFilter getFilter()
+   {
+      return (filter);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for filter.
+    *******************************************************************************/
+   public ColumnProfileRequest withFilter(QQueryFilter filter)
+   {
+      this.filter = filter;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for exact.
+    *******************************************************************************/
+   public Boolean getExact()
+   {
+      return (exact);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for exact.
+    *******************************************************************************/
+   public ColumnProfileRequest withExact(Boolean exact)
+   {
+      this.exact = exact;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for fieldName.
+    *******************************************************************************/
+   public String getFieldName()
+   {
+      return (fieldName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for fieldName.
+    *******************************************************************************/
+   public ColumnProfileRequest withFieldName(String fieldName)
+   {
+      this.fieldName = fieldName;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/DateProfile.java

@@ -0,0 +1,167 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+
+/*******************************************************************************
+ ** Typed DateProfile contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class DateProfile implements Serializable
+{
+   private List<Metric> metrics = new java.util.ArrayList<>();
+   private String unit;
+   private List<ValueCount> buckets = List.of();
+   private List<ValueCount> gaps = List.of();
+   private List<ValueCount> dayOfWeek = List.of();
+   private List<ValueCount> hourOfDay = List.of();
+
+
+
+   /*******************************************************************************
+    ** Getter for metrics.
+    *******************************************************************************/
+   public List<Metric> getMetrics()
+   {
+      return (metrics);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for metrics.
+    *******************************************************************************/
+   public DateProfile withMetrics(List<Metric> metrics)
+   {
+      this.metrics = metrics;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for unit.
+    *******************************************************************************/
+   public String getUnit()
+   {
+      return (unit);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for unit.
+    *******************************************************************************/
+   public DateProfile withUnit(String unit)
+   {
+      this.unit = unit;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for buckets.
+    *******************************************************************************/
+   public List<ValueCount> getBuckets()
+   {
+      return (buckets);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for buckets.
+    *******************************************************************************/
+   public DateProfile withBuckets(List<ValueCount> buckets)
+   {
+      this.buckets = buckets;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for gaps.
+    *******************************************************************************/
+   public List<ValueCount> getGaps()
+   {
+      return (gaps);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for gaps.
+    *******************************************************************************/
+   public DateProfile withGaps(List<ValueCount> gaps)
+   {
+      this.gaps = gaps;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for dayOfWeek.
+    *******************************************************************************/
+   public List<ValueCount> getDayOfWeek()
+   {
+      return (dayOfWeek);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for dayOfWeek.
+    *******************************************************************************/
+   public DateProfile withDayOfWeek(List<ValueCount> dayOfWeek)
+   {
+      this.dayOfWeek = dayOfWeek;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for hourOfDay.
+    *******************************************************************************/
+   public List<ValueCount> getHourOfDay()
+   {
+      return (hourOfDay);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for hourOfDay.
+    *******************************************************************************/
+   public DateProfile withHourOfDay(List<ValueCount> hourOfDay)
+   {
+      this.hourOfDay = hourOfDay;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/DistinctValuesPage.java

@@ -0,0 +1,367 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import java.time.Instant;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+
+/*******************************************************************************
+ ** Typed DistinctValuesPage contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class DistinctValuesPage implements Serializable
+{
+   private String tableName;
+   private QQueryFilter filter;
+   private Boolean estimate = false;
+   private Long sampleRows = 0L;
+   private Boolean truncated = false;
+   private Long rowsScanned = 0L;
+   private Instant asOf;
+   private String dataVersion;
+   private List<String> warnings = new java.util.ArrayList<>();
+   private String fieldName;
+   private Integer page;
+   private Integer pageSize;
+   private Boolean hasMore;
+   private Long totalDistinct;
+   private List<ValueCount> values = List.of();
+
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public DistinctValuesPage withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for filter.
+    *******************************************************************************/
+   public QQueryFilter getFilter()
+   {
+      return (filter);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for filter.
+    *******************************************************************************/
+   public DistinctValuesPage withFilter(QQueryFilter filter)
+   {
+      this.filter = filter;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for estimate.
+    *******************************************************************************/
+   public Boolean getEstimate()
+   {
+      return (estimate);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for estimate.
+    *******************************************************************************/
+   public DistinctValuesPage withEstimate(Boolean estimate)
+   {
+      this.estimate = estimate;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for sampleRows.
+    *******************************************************************************/
+   public Long getSampleRows()
+   {
+      return (sampleRows);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for sampleRows.
+    *******************************************************************************/
+   public DistinctValuesPage withSampleRows(Long sampleRows)
+   {
+      this.sampleRows = sampleRows;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for truncated.
+    *******************************************************************************/
+   public Boolean getTruncated()
+   {
+      return (truncated);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for truncated.
+    *******************************************************************************/
+   public DistinctValuesPage withTruncated(Boolean truncated)
+   {
+      this.truncated = truncated;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for rowsScanned.
+    *******************************************************************************/
+   public Long getRowsScanned()
+   {
+      return (rowsScanned);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for rowsScanned.
+    *******************************************************************************/
+   public DistinctValuesPage withRowsScanned(Long rowsScanned)
+   {
+      this.rowsScanned = rowsScanned;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for asOf.
+    *******************************************************************************/
+   public Instant getAsOf()
+   {
+      return (asOf);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for asOf.
+    *******************************************************************************/
+   public DistinctValuesPage withAsOf(Instant asOf)
+   {
+      this.asOf = asOf;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for dataVersion.
+    *******************************************************************************/
+   public String getDataVersion()
+   {
+      return (dataVersion);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for dataVersion.
+    *******************************************************************************/
+   public DistinctValuesPage withDataVersion(String dataVersion)
+   {
+      this.dataVersion = dataVersion;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for warnings.
+    *******************************************************************************/
+   public List<String> getWarnings()
+   {
+      return (warnings);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for warnings.
+    *******************************************************************************/
+   public DistinctValuesPage withWarnings(List<String> warnings)
+   {
+      this.warnings = warnings;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for fieldName.
+    *******************************************************************************/
+   public String getFieldName()
+   {
+      return (fieldName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for fieldName.
+    *******************************************************************************/
+   public DistinctValuesPage withFieldName(String fieldName)
+   {
+      this.fieldName = fieldName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for page.
+    *******************************************************************************/
+   public Integer getPage()
+   {
+      return (page);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for page.
+    *******************************************************************************/
+   public DistinctValuesPage withPage(Integer page)
+   {
+      this.page = page;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for pageSize.
+    *******************************************************************************/
+   public Integer getPageSize()
+   {
+      return (pageSize);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for pageSize.
+    *******************************************************************************/
+   public DistinctValuesPage withPageSize(Integer pageSize)
+   {
+      this.pageSize = pageSize;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for hasMore.
+    *******************************************************************************/
+   public Boolean getHasMore()
+   {
+      return (hasMore);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for hasMore.
+    *******************************************************************************/
+   public DistinctValuesPage withHasMore(Boolean hasMore)
+   {
+      this.hasMore = hasMore;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for totalDistinct.
+    *******************************************************************************/
+   public Long getTotalDistinct()
+   {
+      return (totalDistinct);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for totalDistinct.
+    *******************************************************************************/
+   public DistinctValuesPage withTotalDistinct(Long totalDistinct)
+   {
+      this.totalDistinct = totalDistinct;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for values.
+    *******************************************************************************/
+   public List<ValueCount> getValues()
+   {
+      return (values);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for values.
+    *******************************************************************************/
+   public DistinctValuesPage withValues(List<ValueCount> values)
+   {
+      this.values = values;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/DistinctValuesRequest.java

@@ -0,0 +1,188 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+
+/*******************************************************************************
+ ** Typed DistinctValuesRequest contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class DistinctValuesRequest implements AnalysisRequest
+{
+   private String tableName;
+   private QQueryFilter filter;
+   private Boolean exact = false;
+   private String fieldName;
+   private Integer page = 0;
+   private Integer pageSize = 100;
+   private String search;
+
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public DistinctValuesRequest withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for filter.
+    *******************************************************************************/
+   public QQueryFilter getFilter()
+   {
+      return (filter);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for filter.
+    *******************************************************************************/
+   public DistinctValuesRequest withFilter(QQueryFilter filter)
+   {
+      this.filter = filter;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for exact.
+    *******************************************************************************/
+   public Boolean getExact()
+   {
+      return (exact);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for exact.
+    *******************************************************************************/
+   public DistinctValuesRequest withExact(Boolean exact)
+   {
+      this.exact = exact;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for fieldName.
+    *******************************************************************************/
+   public String getFieldName()
+   {
+      return (fieldName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for fieldName.
+    *******************************************************************************/
+   public DistinctValuesRequest withFieldName(String fieldName)
+   {
+      this.fieldName = fieldName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for page.
+    *******************************************************************************/
+   public Integer getPage()
+   {
+      return (page);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for page.
+    *******************************************************************************/
+   public DistinctValuesRequest withPage(Integer page)
+   {
+      this.page = page;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for pageSize.
+    *******************************************************************************/
+   public Integer getPageSize()
+   {
+      return (pageSize);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for pageSize.
+    *******************************************************************************/
+   public DistinctValuesRequest withPageSize(Integer pageSize)
+   {
+      this.pageSize = pageSize;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for search.
+    *******************************************************************************/
+   public String getSearch()
+   {
+      return (search);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for search.
+    *******************************************************************************/
+   public DistinctValuesRequest withSearch(String search)
+   {
+      this.search = search;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/Drill.java

@@ -0,0 +1,79 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+
+/*******************************************************************************
+ ** Typed Drill contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class Drill implements Serializable
+{
+   private String tableName;
+   private QQueryFilter filter;
+
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public Drill withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for filter.
+    *******************************************************************************/
+   public QQueryFilter getFilter()
+   {
+      return (com.kingsrook.qbits.dataanalysis.engine.DrillFilters.restoreTypes(tableName, filter));
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for filter.
+    *******************************************************************************/
+   public Drill withFilter(QQueryFilter filter)
+   {
+      this.filter = filter;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/DuplicatesRequest.java

@@ -0,0 +1,141 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+
+/*******************************************************************************
+ ** Typed DuplicatesRequest contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class DuplicatesRequest implements AnalysisRequest
+{
+   private String tableName;
+   private QQueryFilter filter;
+   private Boolean exact = false;
+   private List<String> fields;
+   private Integer limit = 50;
+
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public DuplicatesRequest withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for filter.
+    *******************************************************************************/
+   public QQueryFilter getFilter()
+   {
+      return (filter);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for filter.
+    *******************************************************************************/
+   public DuplicatesRequest withFilter(QQueryFilter filter)
+   {
+      this.filter = filter;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for exact.
+    *******************************************************************************/
+   public Boolean getExact()
+   {
+      return (exact);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for exact.
+    *******************************************************************************/
+   public DuplicatesRequest withExact(Boolean exact)
+   {
+      this.exact = exact;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for fields.
+    *******************************************************************************/
+   public List<String> getFields()
+   {
+      return (fields);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for fields.
+    *******************************************************************************/
+   public DuplicatesRequest withFields(List<String> fields)
+   {
+      this.fields = fields;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Maximum duplicate groups requested.
+    *******************************************************************************/
+   public Integer getLimit()
+   {
+      return (limit);
+   }
+
+   /*******************************************************************************
+    ** Fluent duplicate group limit.
+    *******************************************************************************/
+   public DuplicatesRequest withLimit(Integer limit)
+   {
+      this.limit = limit;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/DuplicatesResult.java

@@ -0,0 +1,279 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import java.time.Instant;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+
+/*******************************************************************************
+ ** Typed DuplicatesResult contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class DuplicatesResult implements Serializable
+{
+   private String tableName;
+   private QQueryFilter filter;
+   private Boolean estimate = false;
+   private Long sampleRows = 0L;
+   private Boolean truncated = false;
+   private Long rowsScanned = 0L;
+   private Instant asOf;
+   private String dataVersion;
+   private List<String> warnings = new java.util.ArrayList<>();
+   private List<String> fields;
+   private List<ValueCount> groups = List.of();
+
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public DuplicatesResult withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for filter.
+    *******************************************************************************/
+   public QQueryFilter getFilter()
+   {
+      return (filter);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for filter.
+    *******************************************************************************/
+   public DuplicatesResult withFilter(QQueryFilter filter)
+   {
+      this.filter = filter;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for estimate.
+    *******************************************************************************/
+   public Boolean getEstimate()
+   {
+      return (estimate);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for estimate.
+    *******************************************************************************/
+   public DuplicatesResult withEstimate(Boolean estimate)
+   {
+      this.estimate = estimate;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for sampleRows.
+    *******************************************************************************/
+   public Long getSampleRows()
+   {
+      return (sampleRows);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for sampleRows.
+    *******************************************************************************/
+   public DuplicatesResult withSampleRows(Long sampleRows)
+   {
+      this.sampleRows = sampleRows;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for truncated.
+    *******************************************************************************/
+   public Boolean getTruncated()
+   {
+      return (truncated);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for truncated.
+    *******************************************************************************/
+   public DuplicatesResult withTruncated(Boolean truncated)
+   {
+      this.truncated = truncated;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for rowsScanned.
+    *******************************************************************************/
+   public Long getRowsScanned()
+   {
+      return (rowsScanned);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for rowsScanned.
+    *******************************************************************************/
+   public DuplicatesResult withRowsScanned(Long rowsScanned)
+   {
+      this.rowsScanned = rowsScanned;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for asOf.
+    *******************************************************************************/
+   public Instant getAsOf()
+   {
+      return (asOf);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for asOf.
+    *******************************************************************************/
+   public DuplicatesResult withAsOf(Instant asOf)
+   {
+      this.asOf = asOf;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for dataVersion.
+    *******************************************************************************/
+   public String getDataVersion()
+   {
+      return (dataVersion);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for dataVersion.
+    *******************************************************************************/
+   public DuplicatesResult withDataVersion(String dataVersion)
+   {
+      this.dataVersion = dataVersion;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for warnings.
+    *******************************************************************************/
+   public List<String> getWarnings()
+   {
+      return (warnings);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for warnings.
+    *******************************************************************************/
+   public DuplicatesResult withWarnings(List<String> warnings)
+   {
+      this.warnings = warnings;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for fields.
+    *******************************************************************************/
+   public List<String> getFields()
+   {
+      return (fields);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for fields.
+    *******************************************************************************/
+   public DuplicatesResult withFields(List<String> fields)
+   {
+      this.fields = fields;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for groups.
+    *******************************************************************************/
+   public List<ValueCount> getGroups()
+   {
+      return (groups);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for groups.
+    *******************************************************************************/
+   public DuplicatesResult withGroups(List<ValueCount> groups)
+   {
+      this.groups = groups;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/FieldSummary.java

@@ -0,0 +1,255 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+
+/*******************************************************************************
+ ** Typed FieldSummary contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class FieldSummary implements Serializable
+{
+   private String field;
+   private String label;
+   private String type;
+   private BigDecimal completeness;
+   private Long distinct;
+   private BigDecimal uniqueness;
+   private Boolean constant;
+   private Boolean empty;
+   private Metric nulls;
+   private Metric blanks;
+
+
+
+   /*******************************************************************************
+    ** Getter for field.
+    *******************************************************************************/
+   public String getField()
+   {
+      return (field);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for field.
+    *******************************************************************************/
+   public FieldSummary withField(String field)
+   {
+      this.field = field;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for label.
+    *******************************************************************************/
+   public String getLabel()
+   {
+      return (label);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for label.
+    *******************************************************************************/
+   public FieldSummary withLabel(String label)
+   {
+      this.label = label;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for type.
+    *******************************************************************************/
+   public String getType()
+   {
+      return (type);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for type.
+    *******************************************************************************/
+   public FieldSummary withType(String type)
+   {
+      this.type = type;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for completeness.
+    *******************************************************************************/
+   public BigDecimal getCompleteness()
+   {
+      return (completeness);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for completeness.
+    *******************************************************************************/
+   public FieldSummary withCompleteness(BigDecimal completeness)
+   {
+      this.completeness = completeness;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for distinct.
+    *******************************************************************************/
+   public Long getDistinct()
+   {
+      return (distinct);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for distinct.
+    *******************************************************************************/
+   public FieldSummary withDistinct(Long distinct)
+   {
+      this.distinct = distinct;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for uniqueness.
+    *******************************************************************************/
+   public BigDecimal getUniqueness()
+   {
+      return (uniqueness);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for uniqueness.
+    *******************************************************************************/
+   public FieldSummary withUniqueness(BigDecimal uniqueness)
+   {
+      this.uniqueness = uniqueness;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for constant.
+    *******************************************************************************/
+   public Boolean getConstant()
+   {
+      return (constant);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for constant.
+    *******************************************************************************/
+   public FieldSummary withConstant(Boolean constant)
+   {
+      this.constant = constant;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for empty.
+    *******************************************************************************/
+   public Boolean getEmpty()
+   {
+      return (empty);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for empty.
+    *******************************************************************************/
+   public FieldSummary withEmpty(Boolean empty)
+   {
+      this.empty = empty;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for nulls.
+    *******************************************************************************/
+   public Metric getNulls()
+   {
+      return (nulls);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for nulls.
+    *******************************************************************************/
+   public FieldSummary withNulls(Metric nulls)
+   {
+      this.nulls = nulls;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for blanks.
+    *******************************************************************************/
+   public Metric getBlanks()
+   {
+      return (blanks);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for blanks.
+    *******************************************************************************/
+   public FieldSummary withBlanks(Metric blanks)
+   {
+      this.blanks = blanks;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/Metric.java

@@ -0,0 +1,228 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+
+/*******************************************************************************
+ ** Typed Metric contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class Metric implements Serializable
+{
+   private Boolean estimate = false;
+   private String key;
+   private String label;
+   private Serializable value;
+   private ValueType valueType;
+   private String formatted;
+   private Drill drill;
+   private Boolean suppressed = false;
+   private String suppressedReason;
+
+
+
+   /*******************************************************************************
+    ** Whether the metric describes a sampled estimate.
+    *******************************************************************************/
+   public Boolean getEstimate()
+   {
+      return (estimate);
+   }
+
+   /*******************************************************************************
+    ** Mark an estimated metric independently of the exact population row total.
+    *******************************************************************************/
+   public Metric withEstimate(Boolean estimate)
+   {
+      this.estimate = estimate;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for key.
+    *******************************************************************************/
+   public String getKey()
+   {
+      return (key);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for key.
+    *******************************************************************************/
+   public Metric withKey(String key)
+   {
+      this.key = key;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for label.
+    *******************************************************************************/
+   public String getLabel()
+   {
+      return (label);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for label.
+    *******************************************************************************/
+   public Metric withLabel(String label)
+   {
+      this.label = label;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for value.
+    *******************************************************************************/
+   public Serializable getValue()
+   {
+      return (value);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for value.
+    *******************************************************************************/
+   public Metric withValue(Serializable value)
+   {
+      this.value = value;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for valueType.
+    *******************************************************************************/
+   public ValueType getValueType()
+   {
+      return (valueType);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for valueType.
+    *******************************************************************************/
+   public Metric withValueType(ValueType valueType)
+   {
+      this.valueType = valueType;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for formatted.
+    *******************************************************************************/
+   public String getFormatted()
+   {
+      return (formatted);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for formatted.
+    *******************************************************************************/
+   public Metric withFormatted(String formatted)
+   {
+      this.formatted = formatted;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for drill.
+    *******************************************************************************/
+   public Drill getDrill()
+   {
+      return (drill);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for drill.
+    *******************************************************************************/
+   public Metric withDrill(Drill drill)
+   {
+      this.drill = drill;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for suppressed.
+    *******************************************************************************/
+   public Boolean getSuppressed()
+   {
+      return (suppressed);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for suppressed.
+    *******************************************************************************/
+   public Metric withSuppressed(Boolean suppressed)
+   {
+      this.suppressed = suppressed;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for suppressedReason.
+    *******************************************************************************/
+   public String getSuppressedReason()
+   {
+      return (suppressedReason);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for suppressedReason.
+    *******************************************************************************/
+   public Metric withSuppressedReason(String suppressedReason)
+   {
+      this.suppressedReason = suppressedReason;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/NumericProfile.java

@@ -0,0 +1,101 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+
+/*******************************************************************************
+ ** Typed NumericProfile contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class NumericProfile implements Serializable
+{
+   private List<Metric> metrics = new java.util.ArrayList<>();
+   private List<ValueCount> histogram = List.of();
+   private List<ValueCount> outliers = List.of();
+
+
+
+   /*******************************************************************************
+    ** Getter for metrics.
+    *******************************************************************************/
+   public List<Metric> getMetrics()
+   {
+      return (metrics);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for metrics.
+    *******************************************************************************/
+   public NumericProfile withMetrics(List<Metric> metrics)
+   {
+      this.metrics = metrics;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for histogram.
+    *******************************************************************************/
+   public List<ValueCount> getHistogram()
+   {
+      return (histogram);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for histogram.
+    *******************************************************************************/
+   public NumericProfile withHistogram(List<ValueCount> histogram)
+   {
+      this.histogram = histogram;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for outliers.
+    *******************************************************************************/
+   public List<ValueCount> getOutliers()
+   {
+      return (outliers);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for outliers.
+    *******************************************************************************/
+   public NumericProfile withOutliers(List<ValueCount> outliers)
+   {
+      this.outliers = outliers;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/PivotCell.java

@@ -0,0 +1,89 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed PivotCell contract.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class PivotCell implements Serializable
+{
+   private Integer rowIndex;
+   private Integer columnIndex;
+   private List<Metric> values = new ArrayList<>();
+
+
+   /*******************************************************************************
+    ** Getter for rowIndex.
+    *******************************************************************************/
+   public Integer getRowIndex()
+   {
+      return (rowIndex);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for rowIndex.
+    *******************************************************************************/
+   public PivotCell withRowIndex(Integer rowIndex)
+   {
+      this.rowIndex = rowIndex;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for columnIndex.
+    *******************************************************************************/
+   public Integer getColumnIndex()
+   {
+      return (columnIndex);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for columnIndex.
+    *******************************************************************************/
+   public PivotCell withColumnIndex(Integer columnIndex)
+   {
+      this.columnIndex = columnIndex;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for values.
+    *******************************************************************************/
+   public List<Metric> getValues()
+   {
+      return (values);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for values.
+    *******************************************************************************/
+   public PivotCell withValues(List<Metric> values)
+   {
+      this.values = values;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/PivotDimension.java

@@ -0,0 +1,88 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.DateBucketUnit;
+
+/*******************************************************************************
+ ** Typed PivotDimension contract.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class PivotDimension implements Serializable
+{
+   private String field;
+   private DateBucketUnit dateBucket;
+   private PivotNumericBins numericBins;
+
+
+   /*******************************************************************************
+    ** Getter for field.
+    *******************************************************************************/
+   public String getField()
+   {
+      return (field);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for field.
+    *******************************************************************************/
+   public PivotDimension withField(String field)
+   {
+      this.field = field;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for dateBucket.
+    *******************************************************************************/
+   public DateBucketUnit getDateBucket()
+   {
+      return (dateBucket);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for dateBucket.
+    *******************************************************************************/
+   public PivotDimension withDateBucket(DateBucketUnit dateBucket)
+   {
+      this.dateBucket = dateBucket;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for numericBins.
+    *******************************************************************************/
+   public PivotNumericBins getNumericBins()
+   {
+      return (numericBins);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for numericBins.
+    *******************************************************************************/
+   public PivotDimension withNumericBins(PivotNumericBins numericBins)
+   {
+      this.numericBins = numericBins;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/PivotHeader.java

@@ -0,0 +1,69 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed PivotHeader contract.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class PivotHeader implements Serializable
+{
+   private Serializable value;
+   private String label;
+
+
+   /*******************************************************************************
+    ** Getter for value.
+    *******************************************************************************/
+   public Serializable getValue()
+   {
+      return (value);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for value.
+    *******************************************************************************/
+   public PivotHeader withValue(Serializable value)
+   {
+      this.value = value;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for label.
+    *******************************************************************************/
+   public String getLabel()
+   {
+      return (label);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for label.
+    *******************************************************************************/
+   public PivotHeader withLabel(String label)
+   {
+      this.label = label;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/PivotMeasure.java

@@ -0,0 +1,95 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed PivotMeasure contract.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class PivotMeasure implements Serializable
+{
+   private Operator operator;
+   private String field;
+   private BigDecimal percentile;
+
+   /*******************************************************************************
+    ** Supported pivot measures. COUNT counts records, regardless of field nulls.
+    *******************************************************************************/
+   public enum Operator
+   {
+      COUNT, SUM, AVG, MIN, MAX, COUNT_DISTINCT, PERCENTILE
+   }
+
+   /*******************************************************************************
+    ** Getter for operator.
+    *******************************************************************************/
+   public Operator getOperator()
+   {
+      return (operator);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for operator.
+    *******************************************************************************/
+   public PivotMeasure withOperator(Operator operator)
+   {
+      this.operator = operator;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for field.
+    *******************************************************************************/
+   public String getField()
+   {
+      return (field);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for field.
+    *******************************************************************************/
+   public PivotMeasure withField(String field)
+   {
+      this.field = field;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for percentile.
+    *******************************************************************************/
+   public BigDecimal getPercentile()
+   {
+      return (percentile);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for percentile.
+    *******************************************************************************/
+   public PivotMeasure withPercentile(BigDecimal percentile)
+   {
+      this.percentile = percentile;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/PivotMeasureInfo.java

@@ -0,0 +1,87 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed PivotMeasureInfo contract.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class PivotMeasureInfo implements Serializable
+{
+   private String key;
+   private String label;
+   private ValueType valueType;
+
+
+   /*******************************************************************************
+    ** Getter for key.
+    *******************************************************************************/
+   public String getKey()
+   {
+      return (key);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for key.
+    *******************************************************************************/
+   public PivotMeasureInfo withKey(String key)
+   {
+      this.key = key;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for label.
+    *******************************************************************************/
+   public String getLabel()
+   {
+      return (label);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for label.
+    *******************************************************************************/
+   public PivotMeasureInfo withLabel(String label)
+   {
+      this.label = label;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for valueType.
+    *******************************************************************************/
+   public ValueType getValueType()
+   {
+      return (valueType);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for valueType.
+    *******************************************************************************/
+   public PivotMeasureInfo withValueType(ValueType valueType)
+   {
+      this.valueType = valueType;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/PivotNumericBins.java

@@ -0,0 +1,88 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed PivotNumericBins contract.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class PivotNumericBins implements Serializable
+{
+   private Integer count = 20;
+   private BigDecimal min;
+   private BigDecimal max;
+
+
+   /*******************************************************************************
+    ** Getter for count.
+    *******************************************************************************/
+   public Integer getCount()
+   {
+      return (count);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for count.
+    *******************************************************************************/
+   public PivotNumericBins withCount(Integer count)
+   {
+      this.count = count;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for min.
+    *******************************************************************************/
+   public BigDecimal getMin()
+   {
+      return (min);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for min.
+    *******************************************************************************/
+   public PivotNumericBins withMin(BigDecimal min)
+   {
+      this.min = min;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for max.
+    *******************************************************************************/
+   public BigDecimal getMax()
+   {
+      return (max);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for max.
+    *******************************************************************************/
+   public PivotNumericBins withMax(BigDecimal max)
+   {
+      this.max = max;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/PivotRequest.java

@@ -0,0 +1,182 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.util.ArrayList;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+/*******************************************************************************
+ ** Typed PivotRequest contract.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class PivotRequest implements AnalysisRequest
+{
+   private String tableName;
+   private QQueryFilter filter;
+   private Boolean exact = true;
+   private List<PivotDimension> rows = new ArrayList<>();
+   private List<PivotDimension> columns = new ArrayList<>();
+   private List<PivotMeasure> values = new ArrayList<>();
+   private Boolean showTotals = true;
+   private Integer limitGroups = 50;
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   @Override
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public PivotRequest withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for filter.
+    *******************************************************************************/
+   @Override
+   public QQueryFilter getFilter()
+   {
+      return (filter);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for filter.
+    *******************************************************************************/
+   public PivotRequest withFilter(QQueryFilter filter)
+   {
+      this.filter = filter;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for exact.
+    *******************************************************************************/
+   @Override
+   public Boolean getExact()
+   {
+      return (exact);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for exact.
+    *******************************************************************************/
+   public PivotRequest withExact(Boolean exact)
+   {
+      this.exact = exact;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for rows.
+    *******************************************************************************/
+   public List<PivotDimension> getRows()
+   {
+      return (rows);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for rows.
+    *******************************************************************************/
+   public PivotRequest withRows(List<PivotDimension> rows)
+   {
+      this.rows = rows;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for columns.
+    *******************************************************************************/
+   public List<PivotDimension> getColumns()
+   {
+      return (columns);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for columns.
+    *******************************************************************************/
+   public PivotRequest withColumns(List<PivotDimension> columns)
+   {
+      this.columns = columns;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for values.
+    *******************************************************************************/
+   public List<PivotMeasure> getValues()
+   {
+      return (values);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for values.
+    *******************************************************************************/
+   public PivotRequest withValues(List<PivotMeasure> values)
+   {
+      this.values = values;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for showTotals.
+    *******************************************************************************/
+   public Boolean getShowTotals()
+   {
+      return (showTotals);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for showTotals.
+    *******************************************************************************/
+   public PivotRequest withShowTotals(Boolean showTotals)
+   {
+      this.showTotals = showTotals;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for limitGroups.
+    *******************************************************************************/
+   public Integer getLimitGroups()
+   {
+      return (limitGroups);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for limitGroups.
+    *******************************************************************************/
+   public PivotRequest withLimitGroups(Integer limitGroups)
+   {
+      this.limitGroups = limitGroups;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/PivotResult.java

@@ -0,0 +1,252 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+import java.io.Serializable;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+/*******************************************************************************
+ ** Typed PivotResult contract.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class PivotResult implements Serializable
+{
+   private List<List<PivotHeader>> rowHeaders = new ArrayList<>();
+   private List<List<PivotHeader>> columnHeaders = new ArrayList<>();
+   private List<PivotMeasureInfo> measures = new ArrayList<>();
+   private List<PivotCell> cells = new ArrayList<>();
+   private List<List<Metric>> rowTotals = new ArrayList<>();
+   private List<List<Metric>> columnTotals = new ArrayList<>();
+   private List<Metric> grandTotals = new ArrayList<>();
+   private Boolean truncatedRows = false;
+   private Boolean truncatedColumns = false;
+   private Boolean estimate = false;
+   private List<String> warnings = new ArrayList<>();
+   private Instant asOf;
+
+
+   /*******************************************************************************
+    ** Getter for rowHeaders.
+    *******************************************************************************/
+   public List<List<PivotHeader>> getRowHeaders()
+   {
+      return (rowHeaders);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for rowHeaders.
+    *******************************************************************************/
+   public PivotResult withRowHeaders(List<List<PivotHeader>> rowHeaders)
+   {
+      this.rowHeaders = rowHeaders;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for columnHeaders.
+    *******************************************************************************/
+   public List<List<PivotHeader>> getColumnHeaders()
+   {
+      return (columnHeaders);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for columnHeaders.
+    *******************************************************************************/
+   public PivotResult withColumnHeaders(List<List<PivotHeader>> columnHeaders)
+   {
+      this.columnHeaders = columnHeaders;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for measures.
+    *******************************************************************************/
+   public List<PivotMeasureInfo> getMeasures()
+   {
+      return (measures);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for measures.
+    *******************************************************************************/
+   public PivotResult withMeasures(List<PivotMeasureInfo> measures)
+   {
+      this.measures = measures;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for cells.
+    *******************************************************************************/
+   public List<PivotCell> getCells()
+   {
+      return (cells);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for cells.
+    *******************************************************************************/
+   public PivotResult withCells(List<PivotCell> cells)
+   {
+      this.cells = cells;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for rowTotals.
+    *******************************************************************************/
+   public List<List<Metric>> getRowTotals()
+   {
+      return (rowTotals);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for rowTotals.
+    *******************************************************************************/
+   public PivotResult withRowTotals(List<List<Metric>> rowTotals)
+   {
+      this.rowTotals = rowTotals;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for columnTotals.
+    *******************************************************************************/
+   public List<List<Metric>> getColumnTotals()
+   {
+      return (columnTotals);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for columnTotals.
+    *******************************************************************************/
+   public PivotResult withColumnTotals(List<List<Metric>> columnTotals)
+   {
+      this.columnTotals = columnTotals;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for grandTotals.
+    *******************************************************************************/
+   public List<Metric> getGrandTotals()
+   {
+      return (grandTotals);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for grandTotals.
+    *******************************************************************************/
+   public PivotResult withGrandTotals(List<Metric> grandTotals)
+   {
+      this.grandTotals = grandTotals;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for truncatedRows.
+    *******************************************************************************/
+   public Boolean getTruncatedRows()
+   {
+      return (truncatedRows);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for truncatedRows.
+    *******************************************************************************/
+   public PivotResult withTruncatedRows(Boolean truncatedRows)
+   {
+      this.truncatedRows = truncatedRows;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for truncatedColumns.
+    *******************************************************************************/
+   public Boolean getTruncatedColumns()
+   {
+      return (truncatedColumns);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for truncatedColumns.
+    *******************************************************************************/
+   public PivotResult withTruncatedColumns(Boolean truncatedColumns)
+   {
+      this.truncatedColumns = truncatedColumns;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for estimate.
+    *******************************************************************************/
+   public Boolean getEstimate()
+   {
+      return (estimate);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for estimate.
+    *******************************************************************************/
+   public PivotResult withEstimate(Boolean estimate)
+   {
+      this.estimate = estimate;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for warnings.
+    *******************************************************************************/
+   public List<String> getWarnings()
+   {
+      return (warnings);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for warnings.
+    *******************************************************************************/
+   public PivotResult withWarnings(List<String> warnings)
+   {
+      this.warnings = warnings;
+      return (this);
+   }
+
+   /*******************************************************************************
+    ** Getter for asOf.
+    *******************************************************************************/
+   public Instant getAsOf()
+   {
+      return (asOf);
+   }
+
+   /*******************************************************************************
+    ** Fluent setter for asOf.
+    *******************************************************************************/
+   public PivotResult withAsOf(Instant asOf)
+   {
+      this.asOf = asOf;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/Point.java

@@ -0,0 +1,123 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+
+/*******************************************************************************
+ ** Typed Point contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class Point implements Serializable
+{
+   private Serializable x;
+   private BigDecimal y;
+   private String label;
+   private Drill drill;
+
+
+
+   /*******************************************************************************
+    ** Getter for x.
+    *******************************************************************************/
+   public Serializable getX()
+   {
+      return (x);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for x.
+    *******************************************************************************/
+   public Point withX(Serializable x)
+   {
+      this.x = x;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for y.
+    *******************************************************************************/
+   public BigDecimal getY()
+   {
+      return (y);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for y.
+    *******************************************************************************/
+   public Point withY(BigDecimal y)
+   {
+      this.y = y;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for label.
+    *******************************************************************************/
+   public String getLabel()
+   {
+      return (label);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for label.
+    *******************************************************************************/
+   public Point withLabel(String label)
+   {
+      this.label = label;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for drill.
+    *******************************************************************************/
+   public Drill getDrill()
+   {
+      return (drill);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for drill.
+    *******************************************************************************/
+   public Point withDrill(Drill drill)
+   {
+      this.drill = drill;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/RunStatus.java

@@ -0,0 +1,189 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import java.time.Instant;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+
+/*******************************************************************************
+ ** Typed RunStatus contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class RunStatus implements Serializable
+{
+   private String runId;
+   private String status;
+   private String error;
+   private ColumnProfile columnProfile;
+   private TableProfile tableProfile;
+   private Instant startedAt;
+   private Instant finishedAt;
+
+
+
+   /*******************************************************************************
+    ** Getter for runId.
+    *******************************************************************************/
+   public String getRunId()
+   {
+      return (runId);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for runId.
+    *******************************************************************************/
+   public RunStatus withRunId(String runId)
+   {
+      this.runId = runId;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for status.
+    *******************************************************************************/
+   public String getStatus()
+   {
+      return (status);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for status.
+    *******************************************************************************/
+   public RunStatus withStatus(String status)
+   {
+      this.status = status;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for error.
+    *******************************************************************************/
+   public String getError()
+   {
+      return (error);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for error.
+    *******************************************************************************/
+   public RunStatus withError(String error)
+   {
+      this.error = error;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for columnProfile.
+    *******************************************************************************/
+   public ColumnProfile getColumnProfile()
+   {
+      return (columnProfile);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for columnProfile.
+    *******************************************************************************/
+   public RunStatus withColumnProfile(ColumnProfile columnProfile)
+   {
+      this.columnProfile = columnProfile;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for tableProfile.
+    *******************************************************************************/
+   public TableProfile getTableProfile()
+   {
+      return (tableProfile);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for tableProfile.
+    *******************************************************************************/
+   public RunStatus withTableProfile(TableProfile tableProfile)
+   {
+      this.tableProfile = tableProfile;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for startedAt.
+    *******************************************************************************/
+   public Instant getStartedAt()
+   {
+      return (startedAt);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for startedAt.
+    *******************************************************************************/
+   public RunStatus withStartedAt(Instant startedAt)
+   {
+      this.startedAt = startedAt;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for finishedAt.
+    *******************************************************************************/
+   public Instant getFinishedAt()
+   {
+      return (finishedAt);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for finishedAt.
+    *******************************************************************************/
+   public RunStatus withFinishedAt(Instant finishedAt)
+   {
+      this.finishedAt = finishedAt;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/Series.java

@@ -0,0 +1,79 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+
+/*******************************************************************************
+ ** Typed Series contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class Series implements Serializable
+{
+   private String name;
+   private List<Point> points = new java.util.ArrayList<>();
+
+
+
+   /*******************************************************************************
+    ** Getter for name.
+    *******************************************************************************/
+   public String getName()
+   {
+      return (name);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for name.
+    *******************************************************************************/
+   public Series withName(String name)
+   {
+      this.name = name;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for points.
+    *******************************************************************************/
+   public List<Point> getPoints()
+   {
+      return (points);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for points.
+    *******************************************************************************/
+   public Series withPoints(List<Point> points)
+   {
+      this.points = points;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/TableProfile.java

@@ -0,0 +1,323 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import java.time.Instant;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+
+/*******************************************************************************
+ ** Typed TableProfile contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class TableProfile implements Serializable
+{
+   private String tableName;
+   private QQueryFilter filter;
+   private Boolean estimate = false;
+   private Long sampleRows = 0L;
+   private Boolean truncated = false;
+   private Long rowsScanned = 0L;
+   private Instant asOf;
+   private String dataVersion;
+   private List<String> warnings = new java.util.ArrayList<>();
+   private Metric rowCount;
+   private List<FieldSummary> fields = new java.util.ArrayList<>();
+   private Chart heatmap;
+   private List<CandidateKey> candidateKeys = new java.util.ArrayList<>();
+
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public TableProfile withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for filter.
+    *******************************************************************************/
+   public QQueryFilter getFilter()
+   {
+      return (filter);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for filter.
+    *******************************************************************************/
+   public TableProfile withFilter(QQueryFilter filter)
+   {
+      this.filter = filter;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for estimate.
+    *******************************************************************************/
+   public Boolean getEstimate()
+   {
+      return (estimate);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for estimate.
+    *******************************************************************************/
+   public TableProfile withEstimate(Boolean estimate)
+   {
+      this.estimate = estimate;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for sampleRows.
+    *******************************************************************************/
+   public Long getSampleRows()
+   {
+      return (sampleRows);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for sampleRows.
+    *******************************************************************************/
+   public TableProfile withSampleRows(Long sampleRows)
+   {
+      this.sampleRows = sampleRows;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for truncated.
+    *******************************************************************************/
+   public Boolean getTruncated()
+   {
+      return (truncated);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for truncated.
+    *******************************************************************************/
+   public TableProfile withTruncated(Boolean truncated)
+   {
+      this.truncated = truncated;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for rowsScanned.
+    *******************************************************************************/
+   public Long getRowsScanned()
+   {
+      return (rowsScanned);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for rowsScanned.
+    *******************************************************************************/
+   public TableProfile withRowsScanned(Long rowsScanned)
+   {
+      this.rowsScanned = rowsScanned;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for asOf.
+    *******************************************************************************/
+   public Instant getAsOf()
+   {
+      return (asOf);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for asOf.
+    *******************************************************************************/
+   public TableProfile withAsOf(Instant asOf)
+   {
+      this.asOf = asOf;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for dataVersion.
+    *******************************************************************************/
+   public String getDataVersion()
+   {
+      return (dataVersion);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for dataVersion.
+    *******************************************************************************/
+   public TableProfile withDataVersion(String dataVersion)
+   {
+      this.dataVersion = dataVersion;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for warnings.
+    *******************************************************************************/
+   public List<String> getWarnings()
+   {
+      return (warnings);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for warnings.
+    *******************************************************************************/
+   public TableProfile withWarnings(List<String> warnings)
+   {
+      this.warnings = warnings;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for rowCount.
+    *******************************************************************************/
+   public Metric getRowCount()
+   {
+      return (rowCount);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for rowCount.
+    *******************************************************************************/
+   public TableProfile withRowCount(Metric rowCount)
+   {
+      this.rowCount = rowCount;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for fields.
+    *******************************************************************************/
+   public List<FieldSummary> getFields()
+   {
+      return (fields);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for fields.
+    *******************************************************************************/
+   public TableProfile withFields(List<FieldSummary> fields)
+   {
+      this.fields = fields;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for heatmap.
+    *******************************************************************************/
+   public Chart getHeatmap()
+   {
+      return (heatmap);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for heatmap.
+    *******************************************************************************/
+   public TableProfile withHeatmap(Chart heatmap)
+   {
+      this.heatmap = heatmap;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for candidateKeys.
+    *******************************************************************************/
+   public List<CandidateKey> getCandidateKeys()
+   {
+      return (candidateKeys);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for candidateKeys.
+    *******************************************************************************/
+   public TableProfile withCandidateKeys(List<CandidateKey> candidateKeys)
+   {
+      this.candidateKeys = candidateKeys;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/TableProfileRequest.java

@@ -0,0 +1,123 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+
+
+/*******************************************************************************
+ ** Typed TableProfileRequest contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class TableProfileRequest implements AnalysisRequest
+{
+   private String tableName;
+   private QQueryFilter filter;
+   private Boolean exact = false;
+   private List<String> fields;
+
+
+
+   /*******************************************************************************
+    ** Getter for tableName.
+    *******************************************************************************/
+   public String getTableName()
+   {
+      return (tableName);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for tableName.
+    *******************************************************************************/
+   public TableProfileRequest withTableName(String tableName)
+   {
+      this.tableName = tableName;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for filter.
+    *******************************************************************************/
+   public QQueryFilter getFilter()
+   {
+      return (filter);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for filter.
+    *******************************************************************************/
+   public TableProfileRequest withFilter(QQueryFilter filter)
+   {
+      this.filter = filter;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for exact.
+    *******************************************************************************/
+   public Boolean getExact()
+   {
+      return (exact);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for exact.
+    *******************************************************************************/
+   public TableProfileRequest withExact(Boolean exact)
+   {
+      this.exact = exact;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for fields.
+    *******************************************************************************/
+   public List<String> getFields()
+   {
+      return (fields);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for fields.
+    *******************************************************************************/
+   public TableProfileRequest withFields(List<String> fields)
+   {
+      this.fields = fields;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/TextProfile.java

@@ -0,0 +1,123 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import java.util.List;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+
+/*******************************************************************************
+ ** Typed TextProfile contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class TextProfile implements Serializable
+{
+   private List<Metric> metrics = new java.util.ArrayList<>();
+   private List<ValueCount> histogram = List.of();
+   private List<ValueCount> patterns = List.of();
+   private Long sampleRows;
+
+
+
+   /*******************************************************************************
+    ** Getter for metrics.
+    *******************************************************************************/
+   public List<Metric> getMetrics()
+   {
+      return (metrics);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for metrics.
+    *******************************************************************************/
+   public TextProfile withMetrics(List<Metric> metrics)
+   {
+      this.metrics = metrics;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for histogram.
+    *******************************************************************************/
+   public List<ValueCount> getHistogram()
+   {
+      return (histogram);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for histogram.
+    *******************************************************************************/
+   public TextProfile withHistogram(List<ValueCount> histogram)
+   {
+      this.histogram = histogram;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for patterns.
+    *******************************************************************************/
+   public List<ValueCount> getPatterns()
+   {
+      return (patterns);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for patterns.
+    *******************************************************************************/
+   public TextProfile withPatterns(List<ValueCount> patterns)
+   {
+      this.patterns = patterns;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for sampleRows.
+    *******************************************************************************/
+   public Long getSampleRows()
+   {
+      return (sampleRows);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for sampleRows.
+    *******************************************************************************/
+   public TextProfile withSampleRows(Long sampleRows)
+   {
+      this.sampleRows = sampleRows;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/ValueCount.java

@@ -0,0 +1,145 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+
+
+/*******************************************************************************
+ ** Typed ValueCount contract; independent of any presentation framework.
+ *******************************************************************************/
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+public class ValueCount implements Serializable
+{
+   private Serializable value;
+   private String label;
+   private Long count;
+   private BigDecimal share;
+   private Drill drill;
+
+
+
+   /*******************************************************************************
+    ** Getter for value.
+    *******************************************************************************/
+   public Serializable getValue()
+   {
+      return (value);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for value.
+    *******************************************************************************/
+   public ValueCount withValue(Serializable value)
+   {
+      this.value = value;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for label.
+    *******************************************************************************/
+   public String getLabel()
+   {
+      return (label);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for label.
+    *******************************************************************************/
+   public ValueCount withLabel(String label)
+   {
+      this.label = label;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for count.
+    *******************************************************************************/
+   public Long getCount()
+   {
+      return (count);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for count.
+    *******************************************************************************/
+   public ValueCount withCount(Long count)
+   {
+      this.count = count;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for share.
+    *******************************************************************************/
+   public BigDecimal getShare()
+   {
+      return (share);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for share.
+    *******************************************************************************/
+   public ValueCount withShare(BigDecimal share)
+   {
+      this.share = share;
+      return (this);
+   }
+
+
+
+   /*******************************************************************************
+    ** Getter for drill.
+    *******************************************************************************/
+   public Drill getDrill()
+   {
+      return (drill);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for drill.
+    *******************************************************************************/
+   public ValueCount withDrill(Drill drill)
+   {
+      this.drill = drill;
+      return (this);
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/result/ValueType.java

@@ -0,0 +1,30 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.result;
+
+
+/*******************************************************************************
+ ** Semantic ValueType values.
+ *******************************************************************************/
+public enum ValueType
+{
+   COUNT, DECIMAL, PERCENT, DATE, DATE_TIME, DURATION, TEXT
+}

src/main/java/com/kingsrook/qbits/dataanalysis/run/AnalysisRunService.java

@@ -0,0 +1,500 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.run;
+
+import java.io.Serializable;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.HexFormat;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.TreeMap;
+import java.util.concurrent.Executor;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.kingsrook.qbits.dataanalysis.DataAnalysisService;
+import com.kingsrook.qbits.dataanalysis.engine.AnalysisBackend;
+import com.kingsrook.qbits.dataanalysis.engine.DrillFilters;
+import com.kingsrook.qbits.dataanalysis.engine.EffectiveConfig;
+import com.kingsrook.qbits.dataanalysis.model.DataAnalysisTables;
+import com.kingsrook.qbits.dataanalysis.result.AnalysisRequest;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfile;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfileRequest;
+import com.kingsrook.qbits.dataanalysis.result.RunStatus;
+import com.kingsrook.qbits.dataanalysis.result.TableProfile;
+import com.kingsrook.qbits.dataanalysis.result.TableProfileRequest;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction;
+import com.kingsrook.qqq.backend.core.context.CapturedContext;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.logging.QLogger;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+import com.kingsrook.qqq.backend.core.utils.ValueUtils;
+
+/*******************************************************************************
+ ** Persistent owner-scoped runs. Results are guarded before being serialized.
+ ** Cache identity includes session policy, effective config and data version.
+ *******************************************************************************/
+public class AnalysisRunService
+{
+   private static final QLogger LOG = QLogger.getLogger(AnalysisRunService.class);
+   private final DataAnalysisService service;
+   private final Executor executor;
+
+   /*******************************************************************************
+    ** Use a host-managed executor without inheriting a caller transaction.
+    *******************************************************************************/
+   public AnalysisRunService(DataAnalysisService service, Executor executor)
+   {
+      this.service = service;
+      this.executor = executor;
+   }
+
+
+
+   /*******************************************************************************
+    ** Estimate is transient; exact results are persisted and reused.
+    *******************************************************************************/
+   public ColumnProfile columnProfile(ColumnProfileRequest request) throws QException
+   {
+      service.validate(request);
+      AnalysisBackend backend = service.backend(request.getTableName());
+      AnalysisBackend.Scope scope = backend.scope(request.getTableName(), request.getFilter(), Boolean.TRUE.equals(request.getExact()));
+      if(scope.estimate())
+      {
+         return (service.compute(request, backend, scope).withDataVersion(DataVersion.of(service.backend(request.getTableName()), request.getTableName(), request.getFilter())));
+      }
+      return (exact(request).getColumnProfile());
+   }
+
+
+
+   /*******************************************************************************
+    ** Table profiles share the same lifecycle and cache isolation.
+    *******************************************************************************/
+   public TableProfile tableProfile(TableProfileRequest request) throws QException
+   {
+      service.validate(request);
+      AnalysisBackend backend = service.backend(request.getTableName());
+      AnalysisBackend.Scope scope = backend.scope(request.getTableName(), request.getFilter(), Boolean.TRUE.equals(request.getExact()));
+      if(scope.estimate())
+      {
+         return (service.compute(request, backend, scope).withDataVersion(DataVersion.of(service.backend(request.getTableName()), request.getTableName(), request.getFilter())));
+      }
+      return (exact(request).getTableProfile());
+   }
+
+
+
+   /*******************************************************************************
+    ** Complete synchronously for already-small populations and explicit exact calls.
+    *******************************************************************************/
+   private RunStatus exact(AnalysisRequest request) throws QException
+   {
+      AnalysisRequest snapshot = snapshot(request);
+      QRecord cached = cached(snapshot);
+      if(cached != null)
+      {
+         return (decode(cached));
+      }
+      QRecord run = insert(snapshot);
+      execute(snapshot, run);
+      RunStatus result = getRun(run.getValueString("id"));
+      if(!"COMPLETE".equals(result.getStatus()))
+      {
+         throw new QException("Analysis failed; inspect the run status and retry.");
+      }
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** Snapshot both request and session before dispatching work. No ambient
+    ** transaction or privileged action stack is copied into the worker.
+    *******************************************************************************/
+   public String startExactRun(AnalysisRequest request) throws QException
+   {
+      service.validate(request);
+      AnalysisRequest snapshot = snapshot(request);
+      service.validate(snapshot);
+      QRecord cached = cached(snapshot);
+      if(cached != null)
+      {
+         return (cached.getValueString("id"));
+      }
+      QRecord run = insert(snapshot);
+      CapturedContext context;
+      try
+      {
+         context = new CapturedContext(QContext.getQInstance(), QContext.getQSession().clone());
+      }
+      catch(CloneNotSupportedException e)
+      {
+         fail(run);
+         throw new QException("Could not capture the analysis session.", e);
+      }
+      try
+      {
+         executor.execute(() -> QContext.withTemporaryContext(context, () -> execute(snapshot, run)));
+      }
+      catch(RuntimeException e)
+      {
+         fail(run);
+         throw new QException("The analysis executor could not accept this run.", e);
+      }
+      return (run.getValueString("id"));
+   }
+
+
+
+   /*******************************************************************************
+    ** Only completed, fresh, owner-and-policy-matching rows qualify as cache hits.
+    *******************************************************************************/
+   private QRecord cached(AnalysisRequest request) throws QException
+   {
+      service.validate(request);
+      EffectiveConfig config = service.getConfigResolver().resolve(request.getTableName());
+      if(config.getCacheTtlMinutes() == 0)
+      {
+         return (null);
+      }
+      QQueryFilter filter = DrillFilters.condition("user_id", QCriteriaOperator.EQUALS, userId())
+         .withCriteria("request_hash", QCriteriaOperator.EQUALS, hash(request))
+         .withCriteria("data_version", QCriteriaOperator.EQUALS, DataVersion.of(service.backend(request.getTableName()), request.getTableName(), request.getFilter()))
+         .withCriteria("status", QCriteriaOperator.EQUALS, "COMPLETE")
+         .withCriteria("finished_at", QCriteriaOperator.GREATER_THAN, Instant.now().minus(config.getCacheTtlMinutes(), ChronoUnit.MINUTES))
+         .withCriteria("finished_at", QCriteriaOperator.LESS_THAN_OR_EQUALS, Instant.now())
+         .withOrderBy(new QFilterOrderBy("id", false)).withLimit(1);
+      List<QRecord> rows = query(filter);
+      return (rows.isEmpty() ? null : rows.getFirst());
+   }
+
+
+
+   /*******************************************************************************
+    ** Run inserts and updates are ordinary user actions under owner locks.
+    *******************************************************************************/
+   private QRecord insert(AnalysisRequest request) throws QException
+   {
+      QRecord run = new QRecord().withValue("table_name", request.getTableName()).withValue("operation", operation(request))
+         .withValue("request_hash", hash(request)).withValue("filter_hash", digest(JsonUtils.toJson(DrillFilters.copy(request.getFilter()))))
+         .withValue("data_version", DataVersion.of(service.backend(request.getTableName()), request.getTableName(), request.getFilter()))
+         .withValue("status", "RUNNING").withValue("started_at", Instant.now()).withValue("user_id", userId());
+      InsertInput input = new InsertInput(DataAnalysisTables.RUN).withRecords(List.of(run));
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      QRecord saved = new InsertAction().execute(input).getRecords().getFirst();
+      check(saved);
+      return (saved);
+   }
+
+
+
+   /*******************************************************************************
+    ** Failure text is intentionally generic; backend errors may contain user data.
+    *******************************************************************************/
+   private void execute(AnalysisRequest request, QRecord run)
+   {
+      try
+      {
+         service.validate(request);
+         AnalysisBackend backend = service.backend(request.getTableName());
+         AnalysisBackend.Scope scope = backend.scope(request.getTableName(), request.getFilter(), true);
+         Serializable result;
+         if(request instanceof ColumnProfileRequest column)
+         {
+            result = service.compute(column, backend, scope).withDataVersion(run.getValueString("data_version"));
+         }
+         else
+         {
+            result = service.compute((TableProfileRequest) request, backend, scope).withDataVersion(run.getValueString("data_version"));
+         }
+         if(!hash(request).equals(run.getValueString("request_hash")))
+         {
+            throw new QException("Analysis policy changed during the run.");
+         }
+         update(new QRecord().withValue("id", run.getValue("id")).withValue("status", "COMPLETE").withValue("finished_at", Instant.now())
+            .withValue("rows_scanned", scope.rowsScanned()).withValue("sampled", false).withValue("result_json", JsonUtils.toJson(result)));
+      }
+      catch(Exception e)
+      {
+         LOG.warn("Analysis execution failed; recording a safe failure status.", e);
+         fail(run);
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Persist safe failure status; persistence failures are logged separately.
+    *******************************************************************************/
+   private void fail(QRecord run)
+   {
+      try
+      {
+         update(new QRecord().withValue("id", run.getValue("id")).withValue("status", "FAILED").withValue("finished_at", Instant.now())
+            .withValue("result_json", null).withValue("error", "Analysis could not be completed. Check permissions and settings, then retry."));
+      }
+      catch(QException e)
+      {
+         LOG.warn("Could not persist analysis failure status.", e);
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Recheck source-table access and policy before releasing historical data.
+    *******************************************************************************/
+   public RunStatus getRun(String id) throws QException
+   {
+      Integer key;
+      try
+      {
+         key = Integer.valueOf(id);
+      }
+      catch(RuntimeException e)
+      {
+         throw new QException("Invalid analysis run id.");
+      }
+      List<QRecord> rows = query(DrillFilters.condition("id", QCriteriaOperator.EQUALS, key).withCriteria("user_id", QCriteriaOperator.EQUALS, userId()).withLimit(1));
+      if(rows.isEmpty())
+      {
+         throw new QPermissionDeniedException("Analysis run is unavailable.");
+      }
+      QRecord row = rows.getFirst();
+      service.capabilities(row.getValueString("table_name"));
+      RunStatus status = decode(row);
+      if("COMPLETE".equals(status.getStatus()))
+      {
+         AnalysisRequest request = status.getColumnProfile() != null
+            ? new ColumnProfileRequest().withTableName(status.getColumnProfile().getTableName()).withFieldName(status.getColumnProfile().getFieldName()).withFilter(status.getColumnProfile().getFilter()).withExact(true)
+            : new TableProfileRequest().withTableName(status.getTableProfile().getTableName()).withFields(status.getTableProfile().getFields().stream().map(f -> f.getField()).toList()).withFilter(status.getTableProfile().getFilter()).withExact(true);
+         service.validate(request);
+         if(!hash(request).equals(row.getValueString("request_hash")))
+         {
+            throw new QPermissionDeniedException("Analysis policy changed; request a new run.");
+         }
+      }
+      return (status);
+   }
+
+
+
+   /*******************************************************************************
+    ** Deserialize typed payloads through core JsonUtils.
+    *******************************************************************************/
+   private RunStatus decode(QRecord row) throws QException
+   {
+      RunStatus status = new RunStatus().withRunId(row.getValueString("id")).withStatus(row.getValueString("status")).withError(row.getValueString("error"))
+         .withStartedAt(row.getValueInstant("started_at")).withFinishedAt(row.getValueInstant("finished_at"));
+      try
+      {
+         if("COMPLETE".equals(status.getStatus()))
+         {
+            if("COLUMN_PROFILE".equals(row.getValueString("operation")))
+            {
+               status.withColumnProfile(JsonUtils.toObject(row.getValueString("result_json"), ColumnProfile.class));
+            }
+            else
+            {
+               status.withTableProfile(JsonUtils.toObject(row.getValueString("result_json"), TableProfile.class));
+            }
+         }
+      }
+      catch(java.io.IOException e)
+      {
+         throw new QException("Stored analysis result could not be read.", e);
+      }
+      return (status);
+   }
+
+
+
+   /*******************************************************************************
+    ** Read only through enforced core actions, including heavy result JSON.
+    *******************************************************************************/
+   private static List<QRecord> query(QQueryFilter filter) throws QException
+   {
+      QueryInput input = new QueryInput(DataAnalysisTables.RUN).withFilter(filter).withShouldFetchHeavyFields(true);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      return (new QueryAction().execute(input).getRecords());
+   }
+
+
+
+   /*******************************************************************************
+    ** Write only supplied run fields and check core record-level failures.
+    *******************************************************************************/
+   private static void update(QRecord record) throws QException
+   {
+      UpdateInput input = new UpdateInput(DataAnalysisTables.RUN).withRecords(List.of(record));
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      check(new UpdateAction().execute(input).getRecords().getFirst());
+   }
+
+
+
+   /*******************************************************************************
+    ** Core can return record-level errors without throwing.
+    *******************************************************************************/
+   private static void check(QRecord record) throws QException
+   {
+      if(record.getErrors() != null && !record.getErrors().isEmpty())
+      {
+         throw new QException("Analysis run could not be stored.");
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** An authenticated identity is mandatory even on unprotected host tables.
+    *******************************************************************************/
+   private static String userId() throws QException
+   {
+      if(QContext.getQSession() == null || QContext.getQSession().getUser() == null || QContext.getQSession().getUser().getIdReference() == null)
+      {
+         throw new QPermissionDeniedException("Sign in to run an analysis.");
+      }
+      return (QContext.getQSession().getUser().getIdReference());
+   }
+
+
+
+   /*******************************************************************************
+    ** Exact requests have canonical selected fields and no pagination metadata.
+    *******************************************************************************/
+   private AnalysisRequest snapshot(AnalysisRequest request) throws QException
+   {
+      if(request instanceof ColumnProfileRequest column)
+      {
+         return (new ColumnProfileRequest().withTableName(column.getTableName()).withFieldName(column.getFieldName()).withFilter(DrillFilters.restoreTypes(column.getTableName(), column.getFilter())).withExact(true));
+      }
+      if(request instanceof TableProfileRequest table)
+      {
+         List<String> fields = service.capabilities(table.getTableName()).getFields().stream()
+            .filter(f -> table.getFields() == null || table.getFields().contains(f)).sorted().toList();
+         return (new TableProfileRequest().withTableName(table.getTableName()).withFields(fields).withFilter(DrillFilters.restoreTypes(table.getTableName(), table.getFilter())).withExact(true));
+      }
+      throw new QException("Exact runs support column and table profiles only.");
+   }
+
+
+
+   /*******************************************************************************
+    ** Stable operation identity.
+    *******************************************************************************/
+   private static String operation(AnalysisRequest request)
+   {
+      return (request instanceof ColumnProfileRequest ? "COLUMN_PROFILE" : "TABLE_PROFILE");
+   }
+
+
+
+   /*******************************************************************************
+    ** Normalize JSON objects and commutative filter lists, then SHA-256. Policy
+    ** values are hashed, never persisted as plaintext in the cache identity.
+    *******************************************************************************/
+   private String hash(AnalysisRequest request) throws QException
+   {
+      Map<String, Object> identity = new LinkedHashMap<>();
+      identity.put("request", snapshot(request));
+      identity.put("operation", operation(request));
+      identity.put("user", userId());
+      identity.put("permissions", QContext.getQSession().getPermissions().stream().sorted().toList());
+      identity.put("keys", QContext.getQSession().getSecurityKeyValues());
+      identity.put("zone", ValueUtils.getSessionOrInstanceZoneId().getId());
+      identity.put("config", service.getConfigResolver().resolve(request.getTableName()));
+      identity.put("fields", service.capabilities(request.getTableName()).getFields().stream().sorted().toList());
+      identity.put("fieldAccess", digest(service.fieldAccessFingerprint(request.getTableName())));
+      identity.put("policy", service.fieldAccessPolicy(request.getTableName()));
+      identity.put("backendVariants", QContext.getQSession().getBackendVariants());
+      try
+      {
+         JsonNode json = new ObjectMapper().readTree(JsonUtils.toJson(identity));
+         return (digest(JsonUtils.toJson(normalize(json, ""))));
+      }
+      catch(java.io.IOException e)
+      {
+         throw new QException("Could not normalize analysis request.", e);
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Preserve ordered parameter arrays, but sort commutative filter clauses.
+    *******************************************************************************/
+   private static Object normalize(JsonNode node, String key)
+   {
+      if(node.isObject())
+      {
+         Map<String, Object> result = new TreeMap<>();
+         node.fields().forEachRemaining(e -> result.put(e.getKey(), normalize(e.getValue(), e.getKey())));
+         return (result);
+      }
+      if(node.isArray())
+      {
+         List<Object> result = new ArrayList<>();
+         node.forEach(value -> result.add(normalize(value, key)));
+         if(List.of("criteria", "subFilters", "analyzableFields", "excludedFields").contains(key))
+         {
+            result.sort(Comparator.comparing(JsonUtils::toJson));
+         }
+         return (result);
+      }
+      return (node);
+   }
+
+
+
+   /*******************************************************************************
+    ** SHA-256 is guaranteed by the Java platform.
+    *******************************************************************************/
+   private static String digest(String value) throws QException
+   {
+      try
+      {
+         return (HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(value.getBytes(StandardCharsets.UTF_8))));
+      }
+      catch(java.security.NoSuchAlgorithmException e)
+      {
+         throw new QException("SHA-256 unavailable.", e);
+      }
+   }
+}

src/main/java/com/kingsrook/qbits/dataanalysis/run/DataVersion.java

@@ -0,0 +1,69 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis.run;
+
+import java.io.Serializable;
+import java.util.Locale;
+import com.kingsrook.qbits.dataanalysis.engine.AnalysisBackend;
+import com.kingsrook.qqq.backend.core.actions.permissions.FieldSecurityLockHelper;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+
+/*******************************************************************************
+ ** Cheap filtered data version; deliberately not a transactional snapshot guarantee.
+ *******************************************************************************/
+public final class DataVersion
+{
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private DataVersion()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Never bypass a lock on a modification field to construct a cache key.
+    *******************************************************************************/
+   public static String of(AnalysisBackend backend, String table, QQueryFilter filter) throws QException
+   {
+      QTableMetaData metadata = QContext.getQInstance().getTable(table);
+      String versionField = metadata.getFields().values().stream().filter(FieldSecurityLockHelper::isFieldAccessible)
+         .filter(f -> isModificationField(f.getName())).map(QFieldMetaData::getName).findFirst().orElse(metadata.getPrimaryKeyField());
+      Serializable maximum = backend.extrema(table, filter, versionField).get("max");
+      return (backend.count(table, filter) + ":" + versionField + ":" + maximum);
+   }
+
+
+
+   /*******************************************************************************
+    ** Conventional host modification timestamps, in camel or snake case.
+    *******************************************************************************/
+   private static boolean isModificationField(String field)
+   {
+      String name = field.replace("_", "").toLowerCase(Locale.ROOT);
+      return (name.equals("modifydate") || name.equals("modifiedat") || name.equals("updatedat") || name.equals("modifieddate"));
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/AnalysisFormattingTest.java

@@ -0,0 +1,158 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.math.BigDecimal;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.ZoneId;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.dataanalysis.engine.AnalysisBackend;
+import com.kingsrook.qbits.dataanalysis.engine.AnalysisFormatting;
+import com.kingsrook.qbits.dataanalysis.engine.MetricLabels;
+import com.kingsrook.qbits.dataanalysis.engine.NiceBins;
+import com.kingsrook.qbits.dataanalysis.engine.ProfileSupport;
+import com.kingsrook.qbits.dataanalysis.result.ValueType;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.DisplayFormat;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/*******************************************************************************
+ ** Public presentation contracts, including precision and calendar edge cases.
+ *******************************************************************************/
+class AnalysisFormattingTest
+{
+   /*******************************************************************************
+    ** Raw ratios remain numeric while display strings are ready for a CLI.
+    *******************************************************************************/
+   @Test
+   void numbersPercentagesAndLengths()
+   {
+      assertThat(ProfileSupport.metric("rows", 12498L, ValueType.COUNT).getFormatted()).isEqualTo("12,498");
+      for(String key : List.of("uniqueness", "completeness", "share"))
+      {
+         var metric = ProfileSupport.metric(key, new BigDecimal("0.987654321"), ValueType.PERCENT);
+         assertThat(metric.getValue()).isEqualTo(new BigDecimal("0.987654"));
+         assertThat(metric.getFormatted()).isEqualTo("98.8%");
+         assertThat(metric.getValueType()).isEqualTo(ValueType.PERCENT);
+      }
+      assertThat(ProfileSupport.metric("share", BigDecimal.ONE, ValueType.PERCENT).getFormatted()).isEqualTo("100%");
+      assertThat(ProfileSupport.metric("share", BigDecimal.ZERO, ValueType.PERCENT).getFormatted()).isEqualTo("0%");
+      assertThat(ProfileSupport.share(1, 3)).isEqualByComparingTo("0.333333");
+      assertThat(ProfileSupport.share(0, 0)).isZero();
+      assertThat(ProfileSupport.metric("meanLength", new BigDecimal("12.345"), ValueType.DECIMAL).getFormatted()).isEqualTo("12.3");
+      assertThat(ProfileSupport.metric("minLength", BigDecimal.TEN, ValueType.DECIMAL).getFormatted()).isEqualTo("10");
+      assertThat(ProfileSupport.metric("max", null, ValueType.DECIMAL).getFormatted()).isNull();
+      assertThatThrownBy(() -> MetricLabels.label("unknown", ValueType.COUNT)).isInstanceOf(NullPointerException.class).hasMessageContaining("Missing metric label");
+   }
+
+
+
+   /*******************************************************************************
+    ** Host currency and custom display formats take precedence over numeric defaults.
+    *******************************************************************************/
+   @Test
+   void fieldFormatsAndRawPrecision()
+   {
+      QFieldMetaData decimal = new QFieldMetaData("amount", QFieldType.DECIMAL);
+      assertThat(AnalysisFormatting.numeric(decimal, "min", new BigDecimal("81753.32"))).isEqualTo("81,753.32");
+      decimal.withDisplayFormat(DisplayFormat.CURRENCY);
+      assertThat(AnalysisFormatting.numeric(decimal, "min", new BigDecimal("81753.32"))).isEqualTo("$81,753.32");
+      var metric = AnalysisFormatting.numericMetric(decimal, "mean", new BigDecimal("125916.45167830173"));
+      assertThat(metric.getValue()).isEqualTo(new BigDecimal("125916.4517"));
+      assertThat(metric.getFormatted()).isEqualTo("$125,916.45");
+      assertThat(AnalysisFormatting.numericMetric(decimal, "max", null).getValue()).isNull();
+      QFieldMetaData integer = new QFieldMetaData("quantity", QFieldType.INTEGER);
+      assertThat(AnalysisFormatting.numeric(integer, "max", new BigDecimal("12498"))).isEqualTo("12,498");
+      assertThat(AnalysisFormatting.numeric(integer, "mean", new BigDecimal("12.345"))).isEqualTo("12.35");
+      assertThat(AnalysisFormatting.numeric(integer, "stddev", new BigDecimal("12.345"))).isEqualTo("12.35");
+      assertThat(AnalysisFormatting.numeric(integer.withDisplayFormat(DisplayFormat.DECIMAL1_COMMAS), "mean", new BigDecimal("12.345"))).isEqualTo("12.3");
+      QFieldMetaData large = new QFieldMetaData("large", QFieldType.LONG).withDisplayFormat(DisplayFormat.COMMAS);
+      assertThat(AnalysisFormatting.numeric(large, "sum", new BigDecimal("9000000000"))).isEqualTo("9,000,000,000");
+   }
+
+
+
+   /*******************************************************************************
+    ** Nice boundaries remain exact at small scales, negative values and constants.
+    *******************************************************************************/
+   @Test
+   void niceEdgesAndLabels()
+   {
+      for(List<String> range : List.of(List.of("25317.13", "65781.79"), List.of("-0.0093", "0.0357"), List.of("42", "42"), List.of("0", "0"), List.of("-9", "905")))
+      {
+         BigDecimal low = new BigDecimal(range.getFirst());
+         BigDecimal high = new BigDecimal(range.getLast());
+         NiceBins bins = NiceBins.covering(low, high);
+         assertThat(bins.count()).isBetween(10, 25);
+         assertThat(bins.low()).isLessThanOrEqualTo(low);
+         assertThat(bins.high()).isGreaterThanOrEqualTo(high);
+         BigDecimal step = bins.high().subtract(bins.low()).divide(BigDecimal.valueOf(bins.count())).stripTrailingZeros();
+         assertThat(step.scaleByPowerOfTen(step.scale() - step.precision() + 1).toPlainString()).isIn("1", "2", "2.5", "5");
+         assertThat(bins.low().remainder(step)).isZero();
+         assertThat(bins.high().remainder(step)).isZero();
+      }
+      QFieldMetaData field = new QFieldMetaData("amount", QFieldType.INTEGER);
+      assertThat(AnalysisFormatting.interval(field, new BigDecimal("60000"), new BigDecimal("65000"))).isEqualTo("60,000 – 65,000");
+      assertThat(AnalysisFormatting.interval(field, null, new BigDecimal("25000"))).isEqualTo("Below 25,000");
+      assertThat(AnalysisFormatting.interval(field, new BigDecimal("65000"), null)).isEqualTo("65,000 and above");
+      assertThat(AnalysisFormatting.interval(field, new BigDecimal("1.25"), new BigDecimal("1.5"))).isEqualTo("1.25 – 1.5");
+      field.withDisplayFormat(DisplayFormat.CURRENCY);
+      assertThat(AnalysisFormatting.interval(field, new BigDecimal("60000"), new BigDecimal("65000"))).isEqualTo("$60,000 – $65,000");
+   }
+
+
+
+   /*******************************************************************************
+    ** Every supported unit has a human label without replacing its ISO coordinate.
+    *******************************************************************************/
+   @Test
+   void dateUnitsAndDurations()
+   {
+      ZoneId zone = ZoneId.of("America/Chicago");
+      LocalDate date = LocalDate.of(2024, 3, 4);
+      Map<AnalysisBackend.DateUnit, String> labels = Map.of(
+         AnalysisBackend.DateUnit.YEAR, "2024", AnalysisBackend.DateUnit.QUARTER, "2024 Q1", AnalysisBackend.DateUnit.MONTH, "Mar 2024",
+         AnalysisBackend.DateUnit.WEEK, "Week of 2024-03-04", AnalysisBackend.DateUnit.DAY, "2024-03-04");
+      labels.forEach((unit, label) -> assertThat(AnalysisFormatting.dateBucket(date, unit, zone)).isEqualTo(label));
+      assertThat(AnalysisFormatting.dateBucket(Instant.parse("2024-03-04T19:00:00Z"), AnalysisBackend.DateUnit.HOUR, zone)).isEqualTo("2024-03-04 13:00");
+      for(int i = 1; i <= 7; i++)
+      {
+         assertThat(AnalysisFormatting.dateBucket(i, AnalysisBackend.DateUnit.DAY_OF_WEEK, zone))
+            .isEqualTo(List.of("Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday").get(i - 1));
+      }
+      for(int i = 0; i < 24; i++)
+      {
+         assertThat(AnalysisFormatting.dateBucket(i, AnalysisBackend.DateUnit.HOUR_OF_DAY, zone)).isEqualTo(String.format(java.util.Locale.US, "%02d:00", i));
+      }
+      assertThat(AnalysisFormatting.duration(date, date.plusYears(48).plusMonths(2))).isEqualTo("48 years 2 months");
+      assertThat(AnalysisFormatting.duration(date, date.plusDays(12))).isEqualTo("12 days");
+      assertThat(AnalysisFormatting.duration(date, date.plusYears(1).plusMonths(1).plusDays(1))).isEqualTo("1 year 1 month 1 day");
+      assertThat(AnalysisFormatting.duration(date, date)).isEqualTo("0 days");
+      assertThat(ProfileSupport.metric("min", date, ValueType.DATE).getLabel()).isEqualTo("Earliest");
+      assertThat(ProfileSupport.metric("max", date, ValueType.DATE).getLabel()).isEqualTo("Latest");
+      assertThat(ProfileSupport.metric("min", date, ValueType.DATE).getFormatted()).isEqualTo("2024-03-04");
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/CoreAnalysisBackendTest.java

@@ -0,0 +1,229 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.util.Set;
+import com.kingsrook.qbits.dataanalysis.engine.CoreAnalysisBackend;
+import com.kingsrook.qbits.dataanalysis.engine.StandInAnalysisBackend;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfileRequest;
+import com.kingsrook.qqq.backend.core.actions.interfaces.AggregateInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateCapability;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.AggregateInput;
+import com.kingsrook.qqq.backend.core.modules.backend.QBackendModuleDispatcher;
+import com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryBackendModule;
+import com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryAggregateAction;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+
+/*******************************************************************************
+ ** Native sample membership and capability-directed fallback behavior.
+ *******************************************************************************/
+class CoreAnalysisBackendTest extends EngineFixture
+{
+   /*******************************************************************************
+    ** Restore the global dispatcher after a capability-specific fixture.
+    *******************************************************************************/
+   @AfterEach
+   void restoreModule()
+   {
+      QBackendModuleDispatcher.registerBackendModule(new MemoryBackendModule());
+   }
+
+   /*******************************************************************************
+    ** Deterministic memory sampling scales every-k-th counts to the population.
+    *******************************************************************************/
+   @Test
+   void sampledPopulation() throws Exception
+   {
+      config.withDefaultSampleThresholdRows(5).withDefaultSampleRows(4);
+      assertThat(service.backend("orders")).isInstanceOf(CoreAnalysisBackend.class);
+      var profile = service.columnProfile(new ColumnProfileRequest().withTableName("orders").withFieldName("amount"));
+      assertThat(profile.getEstimate()).isTrue();
+      assertThat(profile.getSampleRows()).isEqualTo(4);
+      assertThat(profile.getNumeric().getMetrics().stream().filter(m -> m.getKey().equals("sum")).findFirst().orElseThrow().getValue().toString()).isEqualTo("1030");
+      var counts = profile.getCounts().stream().collect(java.util.stream.Collectors.toMap(m -> m.getKey(), m -> m));
+      assertThat(counts.get("rows").getValue()).isEqualTo(12L);
+      assertThat(counts.get("rows").getEstimate()).isFalse();
+      assertThat(counts.get("nonNull").getValue()).isEqualTo(Math.round(4.0 * 12 / 4));
+      assertThat(profile.getTopValues()).allSatisfy(v ->
+      {
+         assertThat(v.getCount()).isEqualTo(Math.round(1.0 * 12 / 4));
+         assertThat(v.getShare()).isEqualByComparingTo("0.25");
+      });
+      assertThat(com.kingsrook.qqq.backend.core.utils.JsonUtils.toJson(profile)).doesNotContain("\"operator\":\"IN\"");
+      new MemoryEngineTest().assertDrills(profile);
+      config.withDefaultMaxRows(0);
+      service.getConfigResolver().invalidate();
+      var empty = service.columnProfile(new ColumnProfileRequest().withTableName("orders").withFieldName("amount"));
+      assertThat(empty.getEstimate()).isTrue();
+      assertThat(empty.getSampleRows()).isEqualTo(4);
+      assertThat(empty.getTruncated()).isFalse();
+   }
+
+   /*******************************************************************************
+    ** Rounding counts must not alter raw shares, and drills retain the user filter.
+    *******************************************************************************/
+   @Test
+   void filteredSampleRatios() throws Exception
+   {
+      config.withDefaultSampleThresholdRows(2).withDefaultSampleRows(4);
+      var filter = com.kingsrook.qbits.dataanalysis.engine.DrillFilters.condition("id",
+         com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator.GREATER_THAN, 1);
+      var profile = service.columnProfile(new ColumnProfileRequest().withTableName("orders").withFieldName("amount").withFilter(filter));
+      // The filtered ids 2..12, sampled every third row, yield 2, 5, 8, 11.
+      var sampledAmounts = java.util.Arrays.asList(0, 20, 40, null);
+      long nonNull = sampledAmounts.stream().filter(java.util.Objects::nonNull).count();
+      var counts = profile.getCounts().stream().collect(java.util.stream.Collectors.toMap(m -> m.getKey(), m -> m));
+      assertThat(profile.getSampleRows()).isEqualTo(sampledAmounts.size());
+      assertThat(counts.get("rows").getValue()).isEqualTo(11L);
+      assertThat(counts.get("nonNull").getValue()).isEqualTo(Math.round(nonNull * 11.0 / sampledAmounts.size()));
+      assertThat(counts.get("nulls").getValue()).isEqualTo(Math.round((sampledAmounts.size() - nonNull) * 11.0 / sampledAmounts.size()));
+      assertThat(profile.getTopValues()).hasSize(4).allSatisfy(v ->
+      {
+         assertThat(v.getCount()).isEqualTo(Math.round(11.0 / sampledAmounts.size()));
+         assertThat(v.getShare()).isEqualByComparingTo("0.25");
+      });
+      var exact = new StandInAnalysisBackend(service.getConfigResolver().resolve("orders"));
+      assertThat(exact.count("orders", counts.get("rows").getDrill().getFilter())).isEqualTo(11);
+      assertThat(exact.count("orders", counts.get("nonNull").getDrill().getFilter())).isEqualTo(10);
+      var twenty = profile.getTopValues().stream().filter(v -> v.getValue() != null && v.getValue().toString().equals("20")).findFirst().orElseThrow();
+      assertThat(exact.count("orders", twenty.getDrill().getFilter())).isEqualTo(2);
+   }
+
+   /*******************************************************************************
+    ** Empty samples keep the population drill; inspecting every row is exact.
+    *******************************************************************************/
+   @Test
+   void samplingBoundaries() throws Exception
+   {
+      config.withDefaultSampleThresholdRows(2).withDefaultSampleRows(0);
+      var empty = service.columnProfile(new ColumnProfileRequest().withTableName("orders").withFieldName("amount"));
+      assertThat(empty.getSampleRows()).isZero();
+      assertThat(empty.getCounts().getFirst().getValue()).isEqualTo(12L);
+      assertThat(empty.getCounts().get(1).getValue()).isEqualTo(0L);
+      config.withDefaultSampleRows(100);
+      service.getConfigResolver().invalidate();
+      var scope = service.backend("orders").scope("orders", null, false);
+      assertThat(scope.samplePercent()).isNull();
+      assertThat(scope.estimate()).isFalse();
+      assertThat(scope.rowsScanned()).isEqualTo(12);
+   }
+
+   /*******************************************************************************
+    ** A non-random estimate has one boundary bind and population-wide drills.
+    *******************************************************************************/
+   @Test
+   void prefixBoundary() throws Exception
+   {
+      capabilities(Set.of());
+      config.withDefaultSampleThresholdRows(2).withDefaultSampleRows(4);
+      var filter = com.kingsrook.qbits.dataanalysis.engine.DrillFilters.condition("id",
+         com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator.GREATER_THAN, 2);
+      var backend = service.backend("orders");
+      var scope = backend.scope("orders", filter, false);
+      assertThat(scope.filter().getSubFilters().get(1).getCriteria()).singleElement().satisfies(c ->
+      {
+         assertThat(c.getFieldName()).isEqualTo("id");
+         assertThat(c.getOperator()).isEqualTo(com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator.LESS_THAN_OR_EQUALS);
+         assertThat(c.getValues()).containsExactly(6);
+      });
+      var profile = service.columnProfile(new ColumnProfileRequest().withTableName("orders").withFieldName("quantity").withFilter(filter));
+      assertThat(profile.getCounts().getFirst().getValue()).isEqualTo(10L);
+      assertThat(profile.getCounts().stream().filter(m -> m.getKey().equals("nonNull")).findFirst().orElseThrow().getValue()).isEqualTo(4L);
+      assertThat(profile.getWarnings()).contains("Estimate from the first 4 rows by id");
+      var drill = profile.getCounts().getFirst().getDrill();
+      assertThat(new StandInAnalysisBackend(service.getConfigResolver().resolve("orders")).count("orders", drill.getFilter())).isEqualTo(10);
+      assertThat(com.kingsrook.qqq.backend.core.utils.JsonUtils.toJson(profile)).doesNotContain("\"operator\":\"IN\"");
+   }
+
+   /*******************************************************************************
+    ** Empty capabilities select the stand-in; partial support uses core plus fallback.
+    *******************************************************************************/
+   @Test
+   void fallbackSelection() throws Exception
+   {
+      capabilities(Set.of());
+      assertThat(service.backend("orders")).isExactlyInstanceOf(StandInAnalysisBackend.class);
+      capabilities(Set.of(AggregateCapability.STDDEV));
+      assertThat(service.backend("orders")).isInstanceOf(CoreAnalysisBackend.class);
+      var profile = service.columnProfile(new ColumnProfileRequest().withTableName("orders").withFieldName("amount"));
+      assertThat(profile.getNumeric().getMetrics().stream().filter(m -> m.getKey().equals("p50")).findFirst().orElseThrow().getValue().toString()).isEqualTo("20.0");
+      new MemoryEngineTest().assertDrills(profile);
+   }
+
+   /*******************************************************************************
+    ** Advertise selected capabilities while retaining the fixture's actual actions.
+    *******************************************************************************/
+   private void capabilities(Set<AggregateCapability> supported)
+   {
+      LimitedMemoryBackend.supported = supported;
+      QBackendModuleDispatcher.registerBackendModule(new LimitedMemoryBackend());
+   }
+
+   /*******************************************************************************
+    ** Public no-argument backend class required by the module dispatcher.
+    *******************************************************************************/
+   public static class LimitedMemoryBackend extends MemoryBackendModule
+   {
+      private static Set<AggregateCapability> supported = Set.of();
+
+      /*******************************************************************************
+       ** Retain real memory execution with a deliberately reduced feature set.
+       *******************************************************************************/
+      @Override
+      public AggregateInterface getAggregateInterface()
+      {
+         return (new MemoryAggregateAction()
+         {
+            @Override
+            public Set<AggregateCapability> getSupportedCapabilities(AggregateInput input)
+            {
+               return (supported);
+            }
+         });
+      }
+   }
+
+   /*******************************************************************************
+    ** Core fallback limits never produce a falsely exact pivot drill.
+    *******************************************************************************/
+   @Test
+   void partialPivotDisablesDrills() throws Exception
+   {
+      capabilities(Set.of());
+      config.withDefaultMaxRows(3);
+      service.getConfigResolver().invalidate();
+      var request = new com.kingsrook.qbits.dataanalysis.result.PivotRequest().withTableName("orders")
+         .withRows(java.util.List.of(new com.kingsrook.qbits.dataanalysis.result.PivotDimension().withField("created")
+            .withDateBucket(com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.DateBucketUnit.DAY)))
+         .withValues(java.util.List.of(new com.kingsrook.qbits.dataanalysis.result.PivotMeasure().withField("amount")
+            .withOperator(com.kingsrook.qbits.dataanalysis.result.PivotMeasure.Operator.PERCENTILE).withPercentile(new java.math.BigDecimal("0.5"))));
+      var result = service.pivot(request);
+      assertThat(result.getEstimate()).isTrue();
+      assertThat(result.getWarnings()).anyMatch(w -> w.startsWith("Partial pivot"));
+      assertThat(result.getCells()).isNotEmpty().allSatisfy(c -> assertThat(c.getValues()).allSatisfy(m ->
+      {
+         assertThat(m.getDrill()).isNull();
+         assertThat(m.getEstimate()).isTrue();
+      }));
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/DataAnalysisApiTest.java

@@ -0,0 +1,323 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.kingsrook.qbits.dataanalysis.api.DataAnalysisApi;
+import com.kingsrook.qqq.backend.core.instances.AbstractQQQApplication;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.authentication.QAuthenticationMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.QAuthenticationType;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.modules.authentication.QAuthenticationModuleCustomizerInterface;
+import com.kingsrook.qqq.middleware.javalin.QApplicationJavalinServer;
+import com.kingsrook.qqq.middleware.javalin.QJavalinImplementation;
+import com.kingsrook.qqq.middleware.javalin.specs.invoke.UiApiInvoker;
+import com.kingsrook.qqq.middleware.javalin.specs.invoke.UiApiRequest;
+import com.kingsrook.qqq.middleware.javalin.specs.v1.MiddlewareVersionV1;
+import com.kingsrook.qqq.middleware.javalin.tools.UiApiContract;
+import com.kingsrook.qqq.openapi.model.HttpMethod;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+
+/*******************************************************************************
+ ** Real HTTP session, schema and drill round-trip acceptance tests.
+ *******************************************************************************/
+class DataAnalysisApiTest extends EngineFixture
+{
+   private QApplicationJavalinServer server;
+   private UiApiInvoker invoker;
+   private String caller = "analysis-user";
+
+   /*******************************************************************************
+    ** Give MOCK sessions only the grants represented by their caller cookie.
+    *******************************************************************************/
+   public static class Sessions implements QAuthenticationModuleCustomizerInterface
+   {
+      /*******************************************************************************
+       ** Build the host's ordinary user permission and record-lock policy.
+       *******************************************************************************/
+      @Override
+      public void customizeSession(QInstance instance, QSession session, Map<String, Object> context)
+      {
+         QSession grants = TestSupport.admin().withPermissions("orders.read", "customer.read").withSecurityKeyValue("orders.all", true);
+         session.setPermissions(grants.getPermissions());
+         session.setSecurityKeyValues(grants.getSecurityKeyValues());
+         if(!"denied".equals(session.getUuid()))
+         {
+            session.withPermission("orders.analyze");
+         }
+         session.withSecurityKeyValue("data_analysis_user", session.getUser().getIdReference());
+      }
+   }
+
+   /*******************************************************************************
+    ** Start on an OS-selected port using the actual spec router and authentication.
+    *******************************************************************************/
+   private void start() throws Exception
+   {
+      instance.withInstanceDefaultAuthentication(new QAuthenticationMetaData().withName("http-test").withType(QAuthenticationType.MOCK)
+         .withCustomizer(new QCodeReference(Sessions.class)));
+      QInstance fixture = instance;
+      server = new QApplicationJavalinServer(new AbstractQQQApplication()
+      {
+         @Override
+         public QInstance defineQInstance()
+         {
+            return (fixture);
+         }
+      }).withPort(0).withServeFrontendNext(false).withServeFrontendMaterialDashboard(false)
+         .withServeLegacyUnversionedMiddlewareAPI(false).withStrictUiApiRoutes(true);
+      server.start();
+      invoker = UiApiInvoker.forServer(server);
+   }
+
+   /*******************************************************************************
+    ** Stop the server before the fixture releases context.
+    *******************************************************************************/
+   @AfterEach
+   void stop()
+   {
+      if(server != null)
+      {
+         server.stop();
+      }
+      QJavalinImplementation.setSessionCookieHttpOnly(false);
+   }
+
+   /*******************************************************************************
+    ** Invoke through loopback, forwarding the actual session cookie.
+    *******************************************************************************/
+   private JsonNode call(HttpMethod method, String path, Object body, int status) throws Exception
+   {
+      var request = new UiApiRequest().withMethod(method).withPath(DataAnalysisApi.PREFIX + path)
+         .withPathParam("table", "orders").withSessionUUID(caller).withUserTimezone("America/Chicago");
+      if(body != null)
+      {
+         request.withJsonBody(body);
+      }
+      var response = invoker.invoke(request);
+      assertThat(response.getStatus()).as(response.getBody()).isEqualTo(status);
+      return (response.getJson());
+   }
+
+   /*******************************************************************************
+    ** All operations, assistant discovery, OpenAPI and count-drill equivalence.
+    *******************************************************************************/
+   @Test
+   void happyPathsAndDrills() throws Exception
+   {
+      start();
+      JsonNode capabilities = call(HttpMethod.GET, "/tables/{table}/capabilities", null, 200);
+      assertThat(capabilities.path("canAnalyze").asBoolean()).isTrue();
+      assertThat(capabilities.path("backendCapabilities").toString()).contains("NUMERIC_BUCKET");
+      assertThat(capabilities.path("fields").toString()).doesNotContain("secret").contains("CATEGORY", "HISTOGRAM");
+      for(String field : List.of("amount", "note", "created", "order_date", "paid", "status"))
+      {
+         checkDrills(call(HttpMethod.POST, "/tables/{table}/column-profile", Map.of("fieldName", field), 200));
+      }
+      checkDrills(call(HttpMethod.POST, "/tables/{table}/column-profile", Map.of("fieldName", "amount", "filter",
+         Map.of("criteria", List.of(Map.of("fieldName", "created", "operator", "EQUALS", "values", List.of("2026-01-01T12:00:00Z"))))), 200));
+      checkDrills(call(HttpMethod.POST, "/tables/{table}/distinct-values", Map.of("fieldName", "status", "pageSize", 1), 200));
+      checkDrills(call(HttpMethod.POST, "/tables/{table}/table-profile", Map.of("fields", List.of("amount", "note")), 200));
+      checkDrills(call(HttpMethod.POST, "/tables/{table}/duplicates", Map.of("fields", List.of("quantity"), "limit", 2), 200));
+      for(String operation : List.of("COLUMN_PROFILE", "TABLE_PROFILE"))
+      {
+         JsonNode started = call(HttpMethod.POST, "/runs", Map.of("operation", operation, "tableName", "orders", "request",
+            operation.equals("COLUMN_PROFILE") ? Map.of("fieldName", "quantity") : Map.of("fields", List.of("paid"))), 200);
+         JsonNode run = null;
+         for(int i = 0; i < 100; i++)
+         {
+            var response = invoker.invoke(new UiApiRequest().withMethod(HttpMethod.GET).withPath(DataAnalysisApi.PREFIX + "/runs/{runId}")
+               .withPathParam("runId", started.path("runId").asText()).withSessionUUID(caller).withUserTimezone("America/Chicago"));
+            assertThat(response.getStatus()).as(response.getBody()).isEqualTo(200);
+            run = response.getJson();
+            if(!run.path("status").asText().equals("RUNNING"))
+            {
+               break;
+            }
+            Thread.sleep(20);
+         }
+         assertThat(run.path("status").asText()).isEqualTo("COMPLETE");
+         var denied = invoker.invoke(new UiApiRequest().withMethod(HttpMethod.GET).withPath(DataAnalysisApi.PREFIX + "/runs/{runId}")
+            .withPathParam("runId", started.path("runId").asText()).withSessionUUID("another-owner"));
+         assertThat(denied.getStatus()).isEqualTo(403);
+         assertThat(run.path(operation.equals("COLUMN_PROFILE") ? "columnProfile" : "tableProfile").isObject()).isTrue();
+      }
+      assertThat(invoker.listOperations().stream().filter(o -> o.pathTemplate().startsWith(DataAnalysisApi.PREFIX)).toList()).hasSize(8);
+      var client = java.net.http.HttpClient.newHttpClient();
+      var response = client.send(java.net.http.HttpRequest.newBuilder(java.net.URI.create("http://127.0.0.1:" + server.getBoundPort() + "/qqq/v1/openapi.json")).build(), java.net.http.HttpResponse.BodyHandlers.ofString());
+      assertThat(response.statusCode()).isEqualTo(200);
+      JsonNode api = new ObjectMapper().readTree(response.body());
+      assertThat(api.path("paths").has("/qqq/v1/qbit/data-analysis/tables/{table}/column-profile")).isTrue();
+      assertThat(api.path("components").path("schemas").has("DataAnalysisMetricV1")).isTrue();
+   }
+
+   /*******************************************************************************
+    ** Estimate payloads preserve exact totals and send drills to all matching rows.
+    *******************************************************************************/
+   @Test
+   void estimateDrills() throws Exception
+   {
+      config.withDefaultSampleThresholdRows(2).withDefaultSampleRows(4);
+      instance.withSupplementalMetaData(new DataAnalysisRuntime(config));
+      start();
+      JsonNode profile = call(HttpMethod.POST, "/tables/{table}/column-profile", Map.of("fieldName", "amount"), 200);
+      assertThat(profile.path("estimate").asBoolean()).isTrue();
+      assertThat(profile.path("sampleRows").asLong()).isEqualTo(4);
+      JsonNode rows = profile.path("counts").get(0);
+      assertThat(rows.path("value").asLong()).isEqualTo(12);
+      assertThat(rows.path("estimate").asBoolean()).isFalse();
+      assertThat(profile.path("counts").get(1).path("formatted").asText()).startsWith("≈ ");
+      assertThat(profile.toString()).doesNotContain("\"operator\":\"IN\"");
+      var response = invoker.invoke(new UiApiRequest().withMethod(HttpMethod.POST).withPath("/table/{tableName}/count")
+         .withPathParam("tableName", "orders").withJsonBody(Map.of("filter", rows.path("drill").path("filter")))
+         .withSessionUUID(caller).withUserTimezone("America/Chicago"));
+      assertThat(response.getStatus()).isEqualTo(200);
+      assertThat(response.getJson().path("count").asLong()).isEqualTo(12);
+      checkDrills(profile);
+      JsonNode table = call(HttpMethod.POST, "/tables/{table}/table-profile", Map.of("fields", List.of("amount", "quantity")), 200);
+      assertThat(table.path("estimate").asBoolean()).isTrue();
+      assertThat(table.path("rowCount").path("value").asLong()).isEqualTo(12);
+      checkDrills(table);
+   }
+
+   /*******************************************************************************
+    ** Recursively post returned count drills to the core count endpoint.
+    *******************************************************************************/
+   private void checkDrills(JsonNode node) throws Exception
+   {
+      if(node.path("estimate").asBoolean(false))
+      {
+         return;
+      }
+      if(node.isObject() && node.hasNonNull("drill"))
+      {
+         JsonNode expected = node.has("count") ? node.get("count") : node.has("y") ? node.get("y") : "COUNT".equals(node.path("valueType").asText()) ? node.get("value") : null;
+         if(expected != null && expected.isNumber())
+         {
+            JsonNode drill = node.get("drill");
+            var response = invoker.invoke(new UiApiRequest().withMethod(HttpMethod.POST).withPath("/table/{tableName}/count")
+               .withPathParam("tableName", drill.path("tableName").asText()).withJsonBody(Map.of("filter", drill.get("filter"))).withSessionUUID(caller).withUserTimezone("America/Chicago"));
+            assertThat(response.getStatus()).as(response.getBody()).isEqualTo(200);
+            assertThat(response.getJson().path("count").asLong()).as(drill.toString()).isEqualTo(expected.asLong());
+         }
+      }
+      if(node.isContainerNode())
+      {
+         for(JsonNode child : node)
+         {
+            checkDrills(child);
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Denials, locked fields, missing tables and malformed request bodies.
+    *******************************************************************************/
+   @Test
+   void errors() throws Exception
+   {
+      start();
+      call(HttpMethod.POST, "/tables/{table}/column-profile", Map.of("fieldName", "secret"), 400);
+      call(HttpMethod.POST, "/tables/{table}/column-profile", Map.of("fieldName", "missing"), 400);
+      call(HttpMethod.POST, "/tables/{table}/column-profile", Map.of(), 400);
+      call(HttpMethod.POST, "/tables/{table}/column-profile", Map.of("fieldName", 1), 400);
+      call(HttpMethod.POST, "/tables/{table}/column-profile", Map.of("fieldName", "amount", "exact", "yes"), 400);
+      call(HttpMethod.POST, "/tables/{table}/distinct-values", Map.of("fieldName", "note", "pageSize", 0), 400);
+      call(HttpMethod.POST, "/tables/{table}/duplicates", Map.of("fields", List.of()), 400);
+      call(HttpMethod.POST, "/tables/{table}/table-profile", Map.of("fields", "amount"), 400);
+      call(HttpMethod.POST, "/runs", Map.of("operation", "PIVOT"), 400);
+      call(HttpMethod.POST, "/runs", com.fasterxml.jackson.databind.node.NullNode.getInstance(), 400);
+      call(HttpMethod.POST, "/tables/{table}/column-profile", Map.of("fieldName", "amount", "filter",
+         Map.of("criteria", List.of(Map.of("fieldName", "secret", "operator", "EQUALS", "values", List.of("hidden"))))), 403);
+      var absent = invoker.invoke(new UiApiRequest().withMethod(HttpMethod.GET).withPath(DataAnalysisApi.PREFIX + "/tables/{table}/capabilities")
+         .withPathParam("table", "missing").withSessionUUID(caller).withUserTimezone("America/Chicago"));
+      assertThat(absent.getStatus()).isEqualTo(404);
+      caller = "denied";
+      assertThat(call(HttpMethod.GET, "/tables/{table}/capabilities", null, 200).path("canAnalyze").asBoolean()).isFalse();
+      call(HttpMethod.POST, "/tables/{table}/column-profile", Map.of("fieldName", "amount"), 403);
+      call(HttpMethod.POST, "/tables/{table}/distinct-values", Map.of("fieldName", "amount"), 403);
+      call(HttpMethod.POST, "/tables/{table}/table-profile", Map.of(), 403);
+      call(HttpMethod.POST, "/tables/{table}/duplicates", Map.of("fields", List.of("amount")), 403);
+      call(HttpMethod.POST, "/runs", Map.of("operation", "COLUMN_PROFILE", "tableName", "orders", "request", Map.of("fieldName", "amount")), 403);
+   }
+
+   /*******************************************************************************
+    ** Generated fragment is committed verbatim and has only the eight operations.
+    *******************************************************************************/
+   @Test
+   void contract() throws Exception
+   {
+      MiddlewareVersionV1 version = new MiddlewareVersionV1();
+      version.setQInstance(instance);
+      String yaml = UiApiContract.generateExtensionYaml(version, DataAnalysisApi.extension());
+      Path path = Path.of("src/main/resources/openapi/qqq-v1/data-analysis.yaml");
+      if(Boolean.getBoolean("openapi.write"))
+      {
+         Files.createDirectories(path.getParent());
+         Files.writeString(path, yaml);
+      }
+      assertThat(Files.exists(path)).as("Regenerate with ./mvnw -o test -Dtest=DataAnalysisApiTest#contract -Dopenapi.write=true -Dqqq.snapshot.version=4.1.0-DATAANALYSIS-SNAPSHOT").isTrue();
+      assertThat(Files.readString(path).replace("\r\n", "\n")).as("OpenAPI changed: regenerate with -Dopenapi.write=true").isEqualTo(yaml.replace("\r\n", "\n"));
+   }
+   @Test
+   void pivotHttp() throws Exception
+   {
+      start();
+      var body = Map.of("rows", List.of(Map.of("field", "status")), "columns", List.of(Map.of("field", "customer")),
+         "values", List.of(Map.of("operator", "COUNT")));
+      JsonNode result = call(HttpMethod.POST, "/tables/{table}/pivot", body, 200);
+      assertThat(result.path("cells").size()).isEqualTo(4);
+      checkDrills(result);
+      checkDrills(call(HttpMethod.POST, "/tables/{table}/pivot", Map.of("rows", List.of(Map.of("field", "paid")),
+         "values", List.of(Map.of("operator", "COUNT")), "limitGroups", 1), 200));
+      for(String field : List.of("note", "amount", "quantity"))
+      {
+         checkDrills(call(HttpMethod.POST, "/tables/{table}/pivot", Map.of("rows", List.of(Map.of("field", field)),
+            "values", List.of(Map.of("operator", "COUNT")), "limitGroups", 1), 200));
+      }
+      for(String unit : List.of("DAY", "HOUR", "DAY_OF_WEEK", "HOUR_OF_DAY"))
+      {
+         checkDrills(call(HttpMethod.POST, "/tables/{table}/pivot", Map.of("rows", List.of(Map.of("field", "created", "dateBucket", unit)),
+            "values", List.of(Map.of("operator", "COUNT"))), 200));
+      }
+      checkDrills(call(HttpMethod.POST, "/tables/{table}/pivot", Map.of("rows", List.of(Map.of("field", "amount", "numericBins", Map.of("count", 10))),
+         "values", List.of(Map.of("operator", "COUNT"))), 200));
+      for(String field : List.of("secret", "missing"))
+      {
+         call(HttpMethod.POST, "/tables/{table}/pivot", Map.of("rows", List.of(Map.of("field", field)), "values", List.of(Map.of("operator", "COUNT"))), 400);
+         call(HttpMethod.POST, "/tables/{table}/pivot", Map.of("rows", List.of(Map.of("field", "status")), "values", List.of(Map.of("operator", "MIN", "field", field))), 400);
+      }
+      call(HttpMethod.POST, "/tables/{table}/pivot", Map.of(), 400);
+      call(HttpMethod.POST, "/tables/{table}/pivot", Map.of("rows", "status", "values", List.of(Map.of("operator", "COUNT"))), 400);
+      call(HttpMethod.POST, "/tables/{table}/pivot", Map.of("rows", List.of(Map.of("field", "status")), "values", List.of(Map.of("operator", "COUNT")), "limitGroups", 1.5), 400);
+      caller = "denied";
+      call(HttpMethod.POST, "/tables/{table}/pivot", body, 403);
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/DataAnalysisHomeTest.java

@@ -33,7 +33,6 @@ import com.kingsrook.qqq.backend.core.model.session.QSession;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
 import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
 
 /*******************************************************************************
@@ -61,9 +60,13 @@ class DataAnalysisHomeTest
       QInstance instance = TestSupport.instance();
       QContext.init(instance, TestSupport.user("alice").withPermissions("data_analysis.saved.read", "data_analysis.watch.read", "data_analysis.run.read"));
       String html = DataAnalysisHome.render(Instant.now());
-      assertThat(html).contains("Mine: 0", "Starred by me: 0", "No saved analyses yet: open any table and choose Analyze on a column header",
-         "No active watches", "No completed or failed runs", "View all");
-      assertThat(new DataAnalysisHome().render(new RenderWidgetInput())).isNotNull();
+      assertThat(html).contains("Mine: 0", "Starred by me: 0", "No saved analyses yet",
+         "No watches yet.", "No analysis runs yet.", "View all", "Open any table and choose Analyze on a column header to explore its data.", "<h3>");
+      var widget = new DataAnalysisHome().render(new RenderWidgetInput()).getWidgetData();
+      assertThat(widget).isInstanceOf(com.kingsrook.qqq.backend.core.model.dashboard.widgets.RawHTML.class);
+      assertThat(((com.kingsrook.qqq.backend.core.model.dashboard.widgets.RawHTML) widget).getType()).isEqualTo("html");
+      assertThat(html).contains("&middot;").doesNotContain("Â", "later", "phase", "<table", "color:", "width:360", "width: 360");
+      assertThat(html.chars().allMatch(c -> c < 128)).isTrue();
       QContext.init(instance, TestSupport.user("alice"));
       html = DataAnalysisHome.render(Instant.now());
       assertThat(html).contains("you need data_analysis.saved.read", "you need data_analysis.watch.read").doesNotContain("Mine: 0", "Complete: 0");
@@ -99,11 +102,39 @@ class DataAnalysisHomeTest
       run("bob", "FAILED", now);
       QContext.init(instance, TestSupport.user("alice").withPermissions("data_analysis.saved.read", "data_analysis.watch.read", "data_analysis.run.read"));
       String html = DataAnalysisHome.render(now);
-      assertThat(html).contains("Mine: 2", "Shared (visible to you): 1", "Starred by me: 1", "Enabled: 2", "Firing: 1", "Complete: 2", "Failed: 1")
-         .doesNotContain("No saved analyses", "No active watches", "No completed or failed runs");
+      assertThat(html).contains("Mine: 2", "Shared (visible to you): 1", "Starred by me: 1", "Enabled: 2", "Firing: 1", "Recent analysis runs", "Complete", "Failed", "Running", "Not finished")
+         .doesNotContain("No saved analyses", "No watches yet", "No analysis runs yet");
       QContext.init(instance, TestSupport.user("bob").withPermissions("data_analysis.saved.read", "data_analysis.run.read"));
       html = DataAnalysisHome.render(now);
-      assertThat(html).contains("Mine: 1", "Shared (visible to you): 1", "Starred by me: 0", "Complete: 0", "Failed: 1", "you need data_analysis.watch.read");
+      assertThat(html).contains("Mine: 1", "Shared (visible to you): 1", "Starred by me: 0", "Failed", "you need data_analysis.watch.read");
+   }
+
+
+
+   /*******************************************************************************
+    ** Latest five remain owner-scoped even with administrator bypass and escape HTML.
+    *******************************************************************************/
+   @Test
+   void recentRunDetailsAndLimit() throws Exception
+   {
+      QInstance instance = TestSupport.instance();
+      instance.getTable(DataAnalysisTables.SAVED).withLabel("Saved <analysis> & review");
+      Instant now = Instant.parse("2026-10-13T23:10:00Z");
+      for(int i = 0; i < 7; i++)
+      {
+         TestSupport.insert(DataAnalysisTables.RUN, new QRecord().withValue("table_name", DataAnalysisTables.SAVED)
+            .withValue("operation", "COLUMN_PROFILE").withValue("user_id", "admin").withValue("status", "COMPLETE")
+            .withValue("started_at", now.minusSeconds(i * 60L)).withValue("finished_at", now.minusSeconds(i * 60L)));
+      }
+      TestSupport.insert(DataAnalysisTables.RUN, new QRecord().withValue("table_name", "private_bob_table")
+         .withValue("operation", "TABLE_PROFILE").withValue("user_id", "bob").withValue("status", "FAILED").withValue("started_at", now));
+      QContext.init(instance, TestSupport.admin().withValue(QSession.VALUE_KEY_USER_TIMEZONE, "America/Chicago"));
+      String html = DataAnalysisHome.render(now);
+      assertThat(html).contains("Saved &lt;analysis&gt; &amp; review", "Column Profile", "2026-10-13 18:10", "2026-10-13 18:06", "<ul", "<dl")
+         .doesNotContain("private_bob_table", "2026-10-13 18:05", "<analysis>");
+      assertThat(html.split("<li>", -1)).hasSize(6);
+      assertThat(html).contains("href=\"" + instance.getTablePath(DataAnalysisTables.RUN) + "/1\"");
+      assertThat(html).contains("href=\"" + instance.getTablePath(DataAnalysisTables.RUN) + "\">View all</a>");
    }
 
 
@@ -113,7 +144,7 @@ class DataAnalysisHomeTest
     *******************************************************************************/
    private static void run(String user, String status, Instant started) throws Exception
    {
-      TestSupport.insert(DataAnalysisTables.RUN, new QRecord().withValue("table_name", "orders").withValue("operation", "profile")
+      TestSupport.insert(DataAnalysisTables.RUN, new QRecord().withValue("table_name", "orders").withValue("operation", "COLUMN_PROFILE")
          .withValue("user_id", user).withValue("status", status).withValue("started_at", started));
    }
 }

src/test/java/com/kingsrook/qbits/dataanalysis/DataAnalysisSecurityTest.java

@@ -91,7 +91,7 @@ class DataAnalysisSecurityTest
       instance.withEnforcePermissionsInCoreActions(false);
       assertThat(DataAnalysisPermissions.canAnalyze(table)).isFalse();
       QContext.init(instance, TestSupport.user("alice").withPermission("sales.orders.analyze"));
-      assertThat(DataAnalysisPermissions.canAnalyze(table)).isTrue();
+      assertThat(DataAnalysisPermissions.canAnalyze(table)).isFalse();
       table.withPermissionRules(null);
       instance.withDefaultPermissionRules(new QPermissionRules().withLevel(PermissionLevel.READ_INSERT_EDIT_DELETE_PERMISSIONS).withPermissionBaseName("defaultBase"));
       assertThat(DataAnalysisPermissions.analyzePermissionName(table)).isEqualTo("defaultBase.analyze");
@@ -101,6 +101,29 @@ class DataAnalysisSecurityTest
 
 
 
+   /*******************************************************************************
+    ** The core permission catalog honors configured inclusion and exclusion.
+    *******************************************************************************/
+   @Test
+   void analyzeCatalog() throws Exception
+   {
+      QInstance instance = new QInstance().withEnforcePermissionsInCoreActions(true);
+      instance.addBackend(new com.kingsrook.qqq.backend.core.model.metadata.QBackendMetaData().withName("memory").withBackendType(com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryBackendModule.class));
+      for(String name : List.of("orders", "excluded", "outside"))
+      {
+         instance.addTable(new QTableMetaData().withName(name).withLabel(name).withPermissionRules(
+            new QPermissionRules().withLevel(PermissionLevel.READ_INSERT_EDIT_DELETE_PERMISSIONS)));
+      }
+      new DataAnalysisQBitProducer().withQBitConfig(new DataAnalysisQBitConfig().withBackendName("memory")
+         .withIncludeTables(java.util.Set.of("orders", "excluded")).withExcludeTables(java.util.Set.of("excluded"))).produce(instance);
+      assertThat(com.kingsrook.qqq.backend.core.actions.permissions.PermissionsHelper.getAllAvailablePermissions(instance)).anySatisfy(permission ->
+      {
+         assertThat(permission.getName()).isEqualTo("orders.analyze");
+         assertThat(permission.getPermissionType()).isEqualTo("Analyze");
+      }).noneMatch(permission -> permission.getName().equals("excluded.analyze") || permission.getName().equals("outside.analyze")
+         || permission.getName().startsWith("data_analysis") && permission.getName().endsWith(".analyze"));
+   }
+
    /*******************************************************************************
     ** Saved, star and run locks hide others even when the shared flag is true.
     *******************************************************************************/

src/test/java/com/kingsrook/qbits/dataanalysis/EngineContractTest.java

@@ -0,0 +1,727 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.kingsrook.qbits.dataanalysis.engine.AnalysisBackend;
+import com.kingsrook.qbits.dataanalysis.engine.ColumnProfiler;
+import com.kingsrook.qbits.dataanalysis.engine.DrillFilters;
+import com.kingsrook.qbits.dataanalysis.engine.StandInAnalysisBackend;
+import com.kingsrook.qbits.dataanalysis.model.DataAnalysisTables;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfile;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfileRequest;
+import com.kingsrook.qbits.dataanalysis.result.DistinctValuesRequest;
+import com.kingsrook.qbits.dataanalysis.result.Drill;
+import com.kingsrook.qbits.dataanalysis.result.DuplicatesRequest;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.RunStatus;
+import com.kingsrook.qbits.dataanalysis.result.TableProfileRequest;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.CountAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.assertj.core.api.Assertions.within;
+
+/*******************************************************************************
+ ** Shared backend acceptance tests, including a generic drill equivalence walker.
+ *******************************************************************************/
+abstract class EngineContractTest extends PivotContractTest
+{
+   /*******************************************************************************
+    ** Every emitted key across all profile kinds has a label, on every backend.
+    *******************************************************************************/
+   @Test
+   void presentationAcrossProfileKinds() throws Exception
+   {
+      java.util.Set<String> keys = new java.util.HashSet<>();
+      for(String field : List.of("amount", "quantity", "note", "paid", "order_date", "created"))
+      {
+         ColumnProfile profile = service.columnProfile(column(field));
+         java.util.List<Metric> metrics = new java.util.ArrayList<>(profile.getCounts());
+         if(profile.getNumeric() != null)
+         {
+            metrics.addAll(profile.getNumeric().getMetrics());
+         }
+         if(profile.getText() != null)
+         {
+            metrics.addAll(profile.getText().getMetrics());
+         }
+         if(profile.getDates() != null)
+         {
+            metrics.addAll(profile.getDates().getMetrics());
+            assertThat(profile.getChart().getX().getLabel()).endsWith(" (day)");
+            assertThat(profile.getChart().getSeries().getFirst().getPoints().getFirst().getX().toString()).isEqualTo("2026-01-01");
+         }
+         if(profile.getBooleans() != null)
+         {
+            metrics.addAll(profile.getBooleans());
+         }
+         for(Metric metric : metrics)
+         {
+            keys.add(metric.getKey());
+            assertThat(metric.getLabel()).isEqualTo(com.kingsrook.qbits.dataanalysis.engine.MetricLabels.label(metric.getKey(), metric.getValueType()));
+            assertThat(metric.getFormatted()).isNotBlank();
+         }
+      }
+      assertThat(keys).containsExactlyInAnyOrder("rows", "nonNull", "nulls", "blanks", "distinct", "uniqueness", "min", "max", "mean", "sum", "stddev",
+         "p1", "p5", "p25", "p50", "p75", "p95", "p99", "zeros", "negatives", "outliers", "minLength", "maxLength", "meanLength", "true", "false", "range");
+      ColumnProfile amount = service.columnProfile(column("amount"));
+      assertThat(metric(amount.getNumeric().getMetrics(), "sum").getFormatted()).isEqualTo("$1,170.00");
+      assertThat(amount.getNumeric().getHistogram()).allSatisfy(v -> assertThat(v.getLabel()).contains("$"));
+      Metric uniqueness = metric(amount.getCounts(), "uniqueness");
+      assertThat(uniqueness.getValueType().name()).isEqualTo("PERCENT");
+      assertThat(uniqueness.getValue().toString()).isEqualTo("0.727273");
+      assertThat(uniqueness.getFormatted()).isEqualTo("72.7%");
+      assertThat(metric(service.columnProfile(column("created")).getDates().getMetrics(), "min").getFormatted()).isEqualTo("2026-01-01 06:00");
+      assertThat(service.columnProfile(column("note")).getWarnings()).isEmpty();
+      var table = service.tableProfile(new TableProfileRequest().withTableName("orders").withFields(List.of("note")));
+      assertThat(table.getRowCount().getLabel()).isEqualTo("Rows");
+      assertThat(table.getFields().getFirst().getNulls().getLabel()).isEqualTo("Nulls");
+      assertThat(table.getFields().getFirst().getBlanks().getLabel()).isEqualTo("Blanks");
+   }
+
+   /*******************************************************************************
+    ** Decimal moments retain ten significant digits; drills retain exact membership.
+    *******************************************************************************/
+   @Test
+   void numericProfile() throws Exception
+   {
+      ColumnProfile result = service.columnProfile(column("amount"));
+      assertMetric(result.getCounts(), "rows", "12");
+      assertMetric(result.getCounts(), "nonNull", "11");
+      assertMetric(result.getCounts(), "nulls", "1");
+      assertMetric(result.getCounts(), "distinct", "8");
+      Map<String, String> expected = Map.ofEntries(Map.entry("min", "-10"), Map.entry("max", "1000"), Map.entry("sum", "1170"),
+         Map.entry("mean", "106.36363636363636"), Map.entry("p1", "-9"), Map.entry("p5", "-5"), Map.entry("p25", "5"),
+         Map.entry("p50", "20"), Map.entry("p75", "35"), Map.entry("p95", "525"), Map.entry("p99", "905"),
+         Map.entry("zeros", "2"), Map.entry("negatives", "1"), Map.entry("outliers", "1"));
+      for(var entry : expected.entrySet())
+      {
+         assertMetric(result.getNumeric().getMetrics(), entry.getKey(), new BigDecimal(entry.getValue()).round(new java.math.MathContext(10)).toPlainString());
+      }
+      double[] values = {-10, 0, 0, 10, 10, 20, 20, 30, 40, 50, 1000};
+      double mean = 1170.0 / 11;
+      double variance = java.util.Arrays.stream(values).map(v -> Math.pow(v - mean, 2)).sum() / 10;
+      assertMetric(result.getNumeric().getMetrics(), "stddev", BigDecimal.valueOf(Math.sqrt(variance)).round(new java.math.MathContext(10)).toPlainString());
+      assertThat(result.getNumeric().getHistogram()).hasSize(22);
+      assertThat(result.getNumeric().getHistogram().stream().mapToLong(v -> v.getCount()).sum()).isEqualTo(11);
+      assertThat(result.getNumeric().getOutliers()).singleElement().satisfies(v -> assertThat(new BigDecimal(v.getValue().toString())).isEqualByComparingTo("1000"));
+      assertThat(result.getChart().getKind().name()).isEqualTo("HISTOGRAM");
+      assertDrills(result);
+      assertDrills(service.columnProfile(column("quantity")));
+   }
+
+   /*******************************************************************************
+    ** Text nulls, whitespace, lengths, shapes, enum labels and FK labels.
+    *******************************************************************************/
+   @Test
+   void textAndLabels() throws Exception
+   {
+      ColumnProfile text = service.columnProfile(column("note"));
+      assertMetric(text.getCounts(), "nulls", "1");
+      assertMetric(text.getCounts(), "blanks", "4");
+      assertMetric(text.getCounts(), "distinct", "10");
+      assertMetric(text.getText().getMetrics(), "minLength", "0");
+      assertMetric(text.getText().getMetrics(), "maxLength", "5");
+      assertMetric(text.getText().getMetrics(), "meanLength", Double.toString(28.0 / 11));
+      assertThat(text.getText().getPatterns()).anySatisfy(v ->
+      {
+         assertThat(v.getLabel()).isEqualTo("A-9");
+         assertThat(v.getCount()).isEqualTo(3);
+      });
+      assertDrills(text);
+      ColumnProfile customer = service.columnProfile(column("customer"));
+      assertThat(customer.getTopValues()).extracting(v -> v.getLabel()).containsExactly("Alice Co", "Bob Co");
+      assertThat(customer.getChart().getKind().name()).isEqualTo("BAR");
+      assertDrills(customer);
+      ColumnProfile status = service.columnProfile(column("status"));
+      assertThat(status.getTopValues()).extracting(v -> v.getLabel()).containsExactlyInAnyOrder("New order", "Paid order");
+      assertDrills(status);
+   }
+
+   /*******************************************************************************
+    ** Date gaps, timezone buckets, moving average and boolean counts.
+    *******************************************************************************/
+   @Test
+   void datesAndBooleans() throws Exception
+   {
+      ColumnProfile date = service.columnProfile(column("order_date"));
+      assertThat(date.getDates().getUnit()).isEqualTo("DAY");
+      assertThat(date.getDates().getBuckets()).extracting(v -> v.getCount()).containsExactly(4L, 0L, 8L);
+      assertThat(date.getDates().getGaps()).hasSize(1);
+      assertThat(date.getChart().getSeries()).hasSize(2);
+      assertMetric(date.getDates().getMetrics(), "range", "2");
+      assertDrills(date);
+      ColumnProfile instant = service.columnProfile(column("created"));
+      assertThat(instant.getDates().getHourOfDay()).extracting(v -> v.getValue().toString()).containsExactlyInAnyOrder("6", "12");
+      assertDrills(instant);
+      ColumnProfile bool = service.columnProfile(column("paid"));
+      assertMetric(bool.getBooleans(), "true", "6");
+      assertMetric(bool.getBooleans(), "false", "5");
+      assertMetric(bool.getBooleans(), "nulls", "1");
+      assertDrills(bool);
+   }
+
+   /*******************************************************************************
+    ** Completeness, field and pair keys and duplicate tuples.
+    *******************************************************************************/
+   @Test
+   void tableAndDuplicates() throws Exception
+   {
+      var table = service.tableProfile(new TableProfileRequest().withTableName("orders"));
+      assertThat(table.getFields()).noneMatch(f -> f.getField().equals("secret"));
+      assertThat(table.getFields()).anySatisfy(f ->
+      {
+         assertThat(f.getField()).isEqualTo("note");
+         assertThat(f.getCompleteness().doubleValue()).isEqualTo(0.666667);
+      });
+      assertThat(table.getCandidateKeys()).anyMatch(k -> k.getFields().equals(List.of("id")));
+      var pairs = service.tableProfile(new TableProfileRequest().withTableName("orders").withFields(List.of("status", "quantity")));
+      assertThat(pairs.getCandidateKeys()).anyMatch(k -> Set.copyOf(k.getFields()).equals(Set.of("status", "quantity")));
+      assertDrills(table);
+      assertDrills(pairs);
+      var duplicates = service.duplicates(new DuplicatesRequest().withTableName("orders").withFields(List.of("amount")));
+      assertThat(duplicates.getGroups()).extracting(v -> v.getCount()).containsExactly(2L, 2L, 2L);
+      assertDrills(duplicates);
+      assertDrills(service.duplicates(new DuplicatesRequest().withTableName("orders").withFields(List.of("status", "customer"))));
+   }
+
+   /*******************************************************************************
+    ** Paging and search retain exact memberships and enforce page size.
+    *******************************************************************************/
+   @Test
+   void distinctPages() throws Exception
+   {
+      var first = service.distinctValues(new DistinctValuesRequest().withTableName("orders").withFieldName("note").withPageSize(2));
+      var second = service.distinctValues(new DistinctValuesRequest().withTableName("orders").withFieldName("note").withPageSize(2).withPage(1));
+      assertThat(first.getHasMore()).isTrue();
+      assertThat(first.getValues()).hasSize(2);
+      assertThat(second.getValues()).hasSize(2);
+      assertThat(first.getValues().getFirst().getValue()).isNotEqualTo(second.getValues().getFirst().getValue());
+      assertDrills(first);
+      assertDrills(second);
+      var search = service.distinctValues(new DistinctValuesRequest().withTableName("orders").withFieldName("note").withSearch("AA"));
+      assertThat(search.getValues()).hasSize(1);
+      assertDrills(search);
+      assertThatThrownBy(() -> service.distinctValues(new DistinctValuesRequest().withTableName("orders").withFieldName("note").withPageSize(501))).isInstanceOf(QException.class);
+   }
+
+   /*******************************************************************************
+    ** Missing READ/analyze, locked fields and exclusions fail before computation.
+    *******************************************************************************/
+   @Test
+   void permissionChecks() throws Exception
+   {
+      assertThat(service.capabilities("orders").getFields()).doesNotContain("secret");
+      assertThatThrownBy(() -> service.columnProfile(column("secret"))).isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
+      QContext.init(instance, TestSupport.user("alice").withPermission("orders.analyze"));
+      assertThatThrownBy(() -> service.columnProfile(column("amount"))).isInstanceOf(QPermissionDeniedException.class);
+      QContext.init(instance, TestSupport.user("alice").withPermission("orders.read"));
+      assertThatThrownBy(() -> service.columnProfile(column("amount"))).isInstanceOf(QPermissionDeniedException.class);
+      QContext.init(instance, session());
+      config.withTableDefaults(Map.of("orders", new TableAnalysisDefaults().withExcludedFields(Set.of("amount"))));
+      service.getConfigResolver().invalidate();
+      assertThat(service.capabilities("orders").getFields()).doesNotContain("amount");
+      assertThatThrownBy(() -> service.columnProfile(column("amount"))).isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
+      assertThatThrownBy(() -> service.capabilities("missing")).isInstanceOf(QPermissionDeniedException.class);
+   }
+
+   /*******************************************************************************
+    ** Record locks constrain every backend primitive and every returned drill.
+    *******************************************************************************/
+   @Test
+   void recordLocks() throws Exception
+   {
+      QSession alice = TestSupport.user("alice").withPermissions("orders.read", "orders.analyze", "customer.read",
+         "data_analysis.run.read", "data_analysis.run.insert", "data_analysis.run.edit").withSecurityKeyValue("customer_scope", 1);
+      QContext.init(instance, alice);
+      var result = service.columnProfile(column("amount"));
+      assertMetric(result.getCounts(), "rows", "8");
+      assertMetric(result.getNumeric().getMetrics(), "sum", "120");
+      assertDrills(result);
+      assertDrills(service.tableProfile(new TableProfileRequest().withTableName("orders")));
+      assertDrills(service.distinctValues(new DistinctValuesRequest().withTableName("orders").withFieldName("note")));
+      assertDrills(service.duplicates(new DuplicatesRequest().withTableName("orders").withFields(List.of("quantity"))));
+      QContext.getQSession().withSecurityKeyValue("customer_scope", 2);
+      assertMetric(service.columnProfile(column("amount")).getCounts(), "rows", "12");
+   }
+   /*******************************************************************************
+    ** Guarded cache JSON contains no unmerged rare top values or extreme listings.
+    *******************************************************************************/
+   @Test
+   void privacyGuard() throws Exception
+   {
+      config.withDefaultMinGroupSize(3);
+      service.getConfigResolver().invalidate();
+      ColumnProfile note = service.columnProfile(column("note"));
+      assertThat(note.getTopValues()).singleElement().satisfies(v ->
+      {
+         assertThat(v.getLabel()).startsWith("Other (");
+         assertThat(v.getCount()).isEqualTo(12);
+         assertThat(v.getDrill()).isNull();
+         assertThat(v.getValue()).isNull();
+      });
+      ColumnProfile amount = service.columnProfile(column("amount"));
+      assertThat(amount.getNumeric().getOutliers()).isEmpty();
+      assertThat(metric(amount.getNumeric().getMetrics(), "outliers").getDrill()).isNull();
+      var tiny = service.columnProfile(column("amount").withFilter(DrillFilters.condition("id", QCriteriaOperator.EQUALS, 1)));
+      for(String key : List.of("min", "max", "mean", "stddev", "p1", "p50", "p99"))
+      {
+         assertThat(metric(tiny.getNumeric().getMetrics(), key).getSuppressed()).isTrue();
+         assertThat(metric(tiny.getNumeric().getMetrics(), key).getValue()).isNull();
+         assertThat(metric(tiny.getNumeric().getMetrics(), key).getSuppressedReason()).isEqualTo("Hidden: fewer than 3 records");
+      }
+      var page = service.distinctValues(new DistinctValuesRequest().withTableName("orders").withFieldName("note").withPageSize(1));
+      assertThat(page.getValues()).hasSize(1);
+      assertThat(page.getValues().getFirst().getCount()).isEqualTo(12);
+      assertThat(page.getHasMore()).isFalse();
+      for(QRecord run : runs())
+      {
+         JsonNode json = new ObjectMapper().readTree(run.getValueString("result_json"));
+         for(JsonNode group : json.path("topValues"))
+         {
+            if(group.path("count").asLong() < 3)
+            {
+               assertThat(group.path("drill").isMissingNode() || group.path("drill").isNull()).isTrue();
+               assertThat(group.path("value").isMissingNode() || group.path("value").isNull()).isTrue();
+            }
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Real asynchronous context propagation, completion, cache hit and invalidation.
+    *******************************************************************************/
+   @Test
+   void estimatesRunsAndCache() throws Exception
+   {
+      config.withDefaultSampleThresholdRows(5).withDefaultSampleRows(4);
+      service = newService(config, java.util.concurrent.ForkJoinPool.commonPool());
+      ColumnProfile estimate = service.columnProfile(column("amount"));
+      assertThat(estimate.getEstimate()).isTrue();
+      assertMetric(estimate.getCounts(), "rows", "12");
+      assertThat(metric(estimate.getCounts(), "rows").getEstimate()).isFalse();
+      assertThat(metric(estimate.getCounts(), "nonNull").getEstimate()).isTrue();
+      assertThat(metric(estimate.getCounts(), "nonNull").getFormatted()).startsWith("≈ ");
+      assertDrills(estimate);
+      assertThat(count(metric(estimate.getCounts(), "rows").getDrill())).isEqualTo(12);
+      if(service.backend("orders") instanceof com.kingsrook.qbits.dataanalysis.engine.CoreAnalysisBackend)
+      {
+         assertThat(estimate.getWarnings()).anyMatch(w -> w.contains("random sample") && w.contains("scaled to the full 12 rows"));
+      }
+      else
+      {
+         assertThat(estimate.getSampleRows()).isEqualTo(4);
+         assertMetric(estimate.getCounts(), "nonNull", "4");
+         assertMetric(estimate.getNumeric().getMetrics(), "sum", "10");
+         assertThat(estimate.getWarnings()).contains("Estimate from the first 4 rows by id");
+      }
+      String id = service.startExactRun(column("amount"));
+      RunStatus run = awaitRun(id);
+      assertThat(run.getStatus()).isEqualTo("COMPLETE");
+      assertMetric(run.getColumnProfile().getCounts(), "rows", "12");
+      int before = runs().size();
+      assertThat(service.startExactRun(column("amount"))).isEqualTo(id);
+      assertMetric(service.columnProfile(column("amount").withExact(true)).getCounts(), "rows", "12");
+      assertThat(runs()).hasSize(before);
+      TestSupport.insert("orders", new QRecord().withValue("id", 13).withValue("customer", 1).withValue("amount", BigDecimal.ONE));
+      String next = service.startExactRun(column("amount"));
+      assertThat(next).isNotEqualTo(id);
+      assertThat(awaitRun(next).getStatus()).isEqualTo("COMPLETE");
+      assertMetric(service.getRun(next).getColumnProfile().getCounts(), "rows", "13");
+      assertThat(service.tableProfile(new TableProfileRequest().withTableName("orders")).getEstimate()).isTrue();
+      String table = service.startExactRun(new TableProfileRequest().withTableName("orders").withFields(List.of("id", "amount")));
+      assertThat(awaitRun(table).getTableProfile().getRowCount().getValue().toString()).isEqualTo("13");
+   }
+
+   /*******************************************************************************
+    ** Partial results retain exact prefix drills; empty populations are valid.
+    *******************************************************************************/
+   @Test
+   void truncatedAndEmpty() throws Exception
+   {
+      config.withDefaultMaxRows(3);
+      service.getConfigResolver().invalidate();
+      ColumnProfile partial = service.columnProfile(column("amount").withExact(true));
+      assertThat(partial.getTruncated()).isTrue();
+      assertThat(partial.getRowsScanned()).isEqualTo(3);
+      assertMetric(partial.getCounts(), "rows", "3");
+      assertDrills(partial);
+      var emptyFilter = DrillFilters.condition("id", QCriteriaOperator.EQUALS, -1);
+      var empty = service.columnProfile(column("amount").withFilter(emptyFilter));
+      assertMetric(empty.getCounts(), "rows", "0");
+      assertThat(empty.getNumeric().getHistogram()).isEmpty();
+      assertDrills(empty);
+      assertDrills(service.columnProfile(column("created").withFilter(emptyFilter)));
+      assertDrills(service.columnProfile(column("note").withFilter(emptyFilter)));
+   }
+
+   /*******************************************************************************
+    ** Drill composition never modifies the request's nested OR filter.
+    *******************************************************************************/
+   @Test
+   void originalFilterUnchanged() throws Exception
+   {
+      QQueryFilter filter = DrillFilters.condition("id", QCriteriaOperator.EQUALS, 1).withBooleanOperator(QQueryFilter.BooleanOperator.OR)
+         .withCriteria("id", QCriteriaOperator.EQUALS, 12);
+      String original = JsonUtils.toJson(filter);
+      ColumnProfile result = service.columnProfile(column("amount").withFilter(filter));
+      assertMetric(result.getCounts(), "rows", "2");
+      assertDrills(result);
+      assertThat(JsonUtils.toJson(filter)).isEqualTo(original);
+   }
+
+   /*******************************************************************************
+    ** Config rows override defaults and restore the session after privileged reads.
+    *******************************************************************************/
+   @Test
+   void configResolution() throws Exception
+   {
+      config.withDefaultMaxRows(500).withTableDefaults(Map.of("orders", new TableAnalysisDefaults().withMaxRows(100).withSampleRows(8).withMinGroupSize(2)));
+      service.getConfigResolver().invalidate();
+      assertThat(service.capabilities("orders").getConfig().getMaxRows()).isEqualTo(100);
+      TestSupport.insert(DataAnalysisTables.TABLE_CONFIG, new QRecord().withValue("table_name", "orders").withValue("max_rows", 50)
+         .withValue("min_group_size", 3).withValue("analyzable_fields", "amount, note").withValue("excluded_fields", "note").withValue("cache_ttl_minutes", 2));
+      assertThat(service.capabilities("orders").getConfig().getMaxRows()).isEqualTo(100);
+      service.getConfigResolver().invalidate();
+      QSession current = QContext.getQSession();
+      var capabilities = service.capabilities("orders");
+      assertThat(capabilities.getConfig().getMaxRows()).isEqualTo(50);
+      assertThat(capabilities.getConfig().getSampleRows()).isEqualTo(8);
+      assertThat(capabilities.getConfig().getMinGroupSize()).isEqualTo(3);
+      assertThat(capabilities.getConfig().getCacheTtlMinutes()).isEqualTo(2);
+      assertThat(capabilities.getFields()).containsExactly("amount");
+      assertThat(QContext.getQSession()).isSameAs(current);
+      config.withExcludeTables(Set.of("orders"));
+      service.getConfigResolver().invalidate();
+      assertThatThrownBy(() -> service.capabilities("orders")).isInstanceOf(QPermissionDeniedException.class);
+   }
+
+   /*******************************************************************************
+    ** Changed privacy policy and another user cannot retrieve older cached data.
+    *******************************************************************************/
+   @Test
+   void cachePolicyRechecked() throws Exception
+   {
+      String id = service.startExactRun(column("amount"));
+      config.withDefaultMinGroupSize(3);
+      service.getConfigResolver().invalidate();
+      assertThatThrownBy(() -> service.getRun(id)).isInstanceOf(QPermissionDeniedException.class);
+      assertThat(service.startExactRun(column("amount"))).isNotEqualTo(id);
+      QContext.init(instance, TestSupport.user("bob").withPermissions("data_analysis.run.read", "orders.read", "orders.analyze"));
+      assertThatThrownBy(() -> service.getRun(id)).isInstanceOf(QPermissionDeniedException.class);
+   }
+
+   /*******************************************************************************
+    ** Calendar boundaries, weekly/monthly/yearly drills and interpolation.
+    *******************************************************************************/
+   @Test
+   void shapeAndDateRules() throws Exception
+   {
+      assertThat(StandInAnalysisBackend.shape("AAA-999 QQ_88!!")).isEqualTo("A-9 A_9!!");
+      LocalDate first = LocalDate.of(2024, 1, 1);
+      assertThat(ColumnProfiler.autoBucket(first, first.plusDays(92))).isEqualTo(AnalysisBackend.DateUnit.DAY);
+      assertThat(ColumnProfiler.autoBucket(first, first.plusDays(93))).isEqualTo(AnalysisBackend.DateUnit.WEEK);
+      assertThat(ColumnProfiler.autoBucket(first, first.plusYears(2))).isEqualTo(AnalysisBackend.DateUnit.WEEK);
+      assertThat(ColumnProfiler.autoBucket(first, first.plusYears(2).plusDays(1))).isEqualTo(AnalysisBackend.DateUnit.MONTH);
+      assertThat(ColumnProfiler.autoBucket(first, first.plusYears(10))).isEqualTo(AnalysisBackend.DateUnit.MONTH);
+      assertThat(ColumnProfiler.autoBucket(first, first.plusYears(10).plusDays(1))).isEqualTo(AnalysisBackend.DateUnit.YEAR);
+      for(AnalysisBackend.DateUnit unit : List.of(AnalysisBackend.DateUnit.WEEK, AnalysisBackend.DateUnit.MONTH, AnalysisBackend.DateUnit.QUARTER, AnalysisBackend.DateUnit.YEAR))
+      {
+         var buckets = service.backend("orders").dateBuckets("orders", null, "order_date", unit, java.time.ZoneId.of("America/Chicago"));
+         assertThat(buckets.stream().mapToLong(AnalysisBackend.GroupCount::count).sum()).isEqualTo(12);
+         for(var bucket : buckets)
+         {
+            assertThat(count(new Drill().withTableName("orders").withFilter(bucket.condition()))).isEqualTo(bucket.count());
+         }
+      }
+      assertThat(StandInAnalysisBackend.percentile(List.of(BigDecimal.ZERO, BigDecimal.TEN), new BigDecimal("0.25"))).isEqualByComparingTo("2.5");
+   }
+
+   /*******************************************************************************
+    ** Common request builder.
+    *******************************************************************************/
+   protected static ColumnProfileRequest column(String field)
+   {
+      return (new ColumnProfileRequest().withTableName("orders").withFieldName(field));
+   }
+
+   /*******************************************************************************
+    ** Select metrics by their stable semantic keys.
+    *******************************************************************************/
+   protected static Metric metric(List<Metric> metrics, String key)
+   {
+      return (metrics.stream().filter(m -> m.getKey().equals(key)).findFirst().orElseThrow());
+   }
+
+   /*******************************************************************************
+    ** Scalar reference tolerance.
+    *******************************************************************************/
+   protected static void assertMetric(List<Metric> metrics, String key, String expected)
+   {
+      assertThat(new BigDecimal(metric(metrics, key).getValue().toString()).doubleValue()).as(key).isCloseTo(Double.parseDouble(expected), within(1e-9));
+   }
+
+   /*******************************************************************************
+    ** Walk actual serialized payloads so cached drills receive the same assertions.
+    *******************************************************************************/
+   protected void assertDrills(Object result) throws Exception
+   {
+      walk(new ObjectMapper().readTree(JsonUtils.toJson(result)));
+   }
+
+   /*******************************************************************************
+    ** Collect count metrics, group counts, chart points and candidate-key counts.
+    *******************************************************************************/
+   private void walk(JsonNode node) throws Exception
+   {
+      if(node.path("estimate").asBoolean(false))
+      {
+         return;
+      }
+      if(node.isObject())
+      {
+         if(node.hasNonNull("drill"))
+         {
+            JsonNode number = node.has("count") ? node.get("count") : node.has("rowCount") ? node.get("rowCount") : node.has("y") ? node.get("y") : node.get("value");
+            assertThat(number).as(node.toString()).isNotNull();
+            Drill drill = JsonUtils.toObject(node.get("drill").toString(), Drill.class);
+            assertThat(count(drill)).as(node.toString()).isEqualTo(number.asLong());
+         }
+         var fields = node.fields();
+         while(fields.hasNext())
+         {
+            var field = fields.next();
+            if(!field.getKey().equals("drill") && !field.getKey().equals("filter"))
+            {
+               walk(field.getValue());
+            }
+         }
+      }
+      else if(node.isArray())
+      {
+         for(JsonNode child : node)
+         {
+            walk(child);
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Use core count under the current user's locks.
+    *******************************************************************************/
+   private static long count(Drill drill) throws Exception
+   {
+      CountInput input = new CountInput(drill.getTableName()).withFilter(drill.getFilter());
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      return (new CountAction().execute(input).getCount());
+   }
+
+   /*******************************************************************************
+    ** Inspect persistent cache rows through enforced actions.
+    *******************************************************************************/
+   protected List<QRecord> runs() throws Exception
+   {
+      QueryInput input = new QueryInput(DataAnalysisTables.RUN).withShouldFetchHeavyFields(true);
+      input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      return (new QueryAction().execute(input).getRecords());
+   }
+
+   /*******************************************************************************
+    ** Wait for actual asynchronous completion with a fixed deadline.
+    *******************************************************************************/
+   protected RunStatus awaitRun(String id) throws Exception
+   {
+      long deadline = System.nanoTime() + 20_000_000_000L;
+      RunStatus run;
+      do
+      {
+         run = service.getRun(id);
+         if(!"RUNNING".equals(run.getStatus()))
+         {
+            return (run);
+         }
+         Thread.sleep(10);
+      }
+      while(System.nanoTime() < deadline);
+      throw new AssertionError("Run did not finish: " + id);
+   }
+
+
+   /*******************************************************************************
+    ** Related labels obey READ, field locks and record locks without bypasses.
+    *******************************************************************************/
+   @Test
+   void relatedLabelSecurity() throws Exception
+   {
+      String original = service.startExactRun(column("customer"));
+      QContext.getQSession().getPermissions().remove("customer.read");
+      assertThat(service.columnProfile(column("customer")).getTopValues()).extracting(v -> v.getLabel()).containsExactly("1", "2");
+      QContext.getQSession().withPermission("customer.read");
+      instance.getTable("customer").getField("name").withFieldSecurityLock(new com.kingsrook.qqq.backend.core.model.metadata.security.FieldSecurityLock()
+         .withSecurityKeyType("secret_access").withDefaultBehavior(com.kingsrook.qqq.backend.core.model.metadata.security.FieldSecurityLock.Behavior.DENY));
+      assertThatThrownBy(() -> service.getRun(original)).isInstanceOf(QPermissionDeniedException.class);
+      assertThat(service.columnProfile(column("customer")).getTopValues()).extracting(v -> v.getLabel()).containsExactly("1", "2");
+      instance.getTable("customer").getField("name").withFieldSecurityLock(null);
+      instance.getTable("customer").withRecordSecurityLock(new com.kingsrook.qqq.backend.core.model.metadata.security.RecordSecurityLock()
+         .withSecurityKeyType("customer_scope").withFieldName("id"));
+      QContext.getQSession().getSecurityKeyValues().remove("orders.all");
+      QContext.getQSession().withSecurityKeyValue("customer_scope", 1);
+      assertThat(service.columnProfile(column("customer")).getTopValues()).extracting(v -> v.getLabel()).containsExactly("Alice Co");
+   }
+
+   /*******************************************************************************
+    ** Zero/constant populations, zero limits, rejected executors and disabled cache.
+    *******************************************************************************/
+   @Test
+   void boundaryAndFailurePaths() throws Exception
+   {
+      assertThat(DataAnalysisRuntime.service()).isNotNull();
+      var constant = service.columnProfile(column("amount").withFilter(DrillFilters.condition("id", QCriteriaOperator.EQUALS, 2)));
+      assertThat(constant.getNumeric().getHistogram().stream().mapToLong(v -> v.getCount()).sum()).isEqualTo(1);
+      assertDrills(constant);
+      config.withDefaultMaxRows(0).withDefaultCacheTtlMinutes(0);
+      service.getConfigResolver().invalidate();
+      assertMetric(service.columnProfile(column("amount")).getCounts(), "rows", "0");
+      int previous = runs().size();
+      service.columnProfile(column("amount"));
+      assertThat(runs()).hasSize(previous + 1);
+      service = newService(config, task ->
+      {
+         throw new java.util.concurrent.RejectedExecutionException("test");
+      });
+      assertThatThrownBy(() -> service.startExactRun(column("amount"))).isInstanceOf(QException.class);
+      assertThat(runs()).anyMatch(r -> "FAILED".equals(r.getValueString("status")));
+      assertThatThrownBy(() -> service.getRun("bad")).isInstanceOf(QException.class);
+      assertThatThrownBy(() -> service.duplicates(new DuplicatesRequest().withTableName("orders"))).isInstanceOf(QException.class);
+      assertThatThrownBy(() -> service.columnProfile(null)).isInstanceOf(QException.class);
+      assertThatThrownBy(() -> service.startExactRun(new DistinctValuesRequest().withTableName("orders").withFieldName("note"))).isInstanceOf(QException.class);
+   }
+
+   /*******************************************************************************
+    ** Decimal scales, integral boundaries and final-bin closure must be portable.
+    *******************************************************************************/
+   @Test
+   void scaledDecimalsAndIntegerBins() throws Exception
+   {
+      TestSupport.insert("orders", new QRecord().withValue("id", 13).withValue("customer", 1).withValue("amount", new BigDecimal("0.00")));
+      TestSupport.insert("orders", new QRecord().withValue("id", 14).withValue("customer", 1).withValue("amount", new BigDecimal("10.000")));
+      var result = service.columnProfile(column("amount"));
+      assertMetric(result.getCounts(), "distinct", "8");
+      assertMetric(result.getNumeric().getMetrics(), "zeros", "3");
+      assertThat(result.getNumeric().getHistogram().stream().mapToLong(v -> v.getCount()).sum()).isEqualTo(13);
+      assertDrills(result);
+      var quantity = service.columnProfile(column("quantity"));
+      assertMetric(quantity.getNumeric().getMetrics(), "mean", "3.5");
+      assertThat(quantity.getNumeric().getHistogram().stream().mapToLong(v -> v.getCount()).sum()).isEqualTo(12);
+      assertDrills(quantity);
+      var filtered = column("amount").withFilter(DrillFilters.condition("amount", QCriteriaOperator.EQUALS, new BigDecimal("0.00")));
+      var selected = service.columnProfile(filtered);
+      assertThat(((Number) metric(selected.getCounts(), "rows").getValue()).longValue()).isEqualTo(count(new Drill().withTableName("orders").withFilter(filtered.getFilter())));
+      assertDrills(selected);
+      assertDrills(service.columnProfile(filtered));
+   }
+
+
+   /*******************************************************************************
+    ** Expired cache rows miss; reordered AND criteria share normalized identity.
+    *******************************************************************************/
+   @Test
+   void cacheExpiryAndNormalizedFilters() throws Exception
+   {
+      QQueryFilter a = DrillFilters.condition("id", QCriteriaOperator.GREATER_THAN, 1).withCriteria("id", QCriteriaOperator.LESS_THAN, 8);
+      QQueryFilter b = DrillFilters.condition("id", QCriteriaOperator.LESS_THAN, 8).withCriteria("id", QCriteriaOperator.GREATER_THAN, 1);
+      String id = service.startExactRun(column("amount").withFilter(a));
+      assertThat(service.startExactRun(column("amount").withFilter(b))).isEqualTo(id);
+      var update = new com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput(DataAnalysisTables.RUN)
+         .withRecords(List.of(new QRecord().withValue("id", Integer.valueOf(id)).withValue("finished_at", java.time.Instant.now().minusSeconds(7200))));
+      update.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+      new com.kingsrook.qqq.backend.core.actions.tables.UpdateAction().execute(update);
+      assertThat(service.startExactRun(column("amount").withFilter(a))).isNotEqualTo(id);
+      var backend = service.backend("customer");
+      assertThat(com.kingsrook.qbits.dataanalysis.run.DataVersion.of(backend, "customer", null)).isEqualTo("2:id:2");
+   }
+
+   /*******************************************************************************
+    ** Local midnight date drills span 23 hours across daylight-saving transitions.
+    *******************************************************************************/
+   @Test
+   void daylightSavingAndSearch() throws Exception
+   {
+      TestSupport.insert("orders", new QRecord().withValue("id", 13).withValue("customer", 1).withValue("created", java.time.Instant.parse("2026-03-08T06:00:00Z")));
+      TestSupport.insert("orders", new QRecord().withValue("id", 14).withValue("customer", 1).withValue("created", java.time.Instant.parse("2026-03-09T04:59:59Z")));
+      TestSupport.insert("orders", new QRecord().withValue("id", 15).withValue("customer", 1).withValue("created", java.time.Instant.parse("2026-03-09T05:00:00Z")));
+      var drill = new Drill().withTableName("orders").withFilter(DrillFilters.dateRange("created", LocalDate.of(2026, 3, 8), LocalDate.of(2026, 3, 9), true, java.time.ZoneId.of("America/Chicago")));
+      assertThat(count(drill)).isEqualTo(2);
+      assertDrills(service.columnProfile(column("created").withFilter(DrillFilters.condition("id", QCriteriaOperator.GREATER_THAN_OR_EQUALS, 13))));
+      var values = service.distinctValues(new DistinctValuesRequest().withTableName("orders").withFieldName("amount").withSearch("1000"));
+      assertThat(values.getValues()).hasSize(1);
+      assertThat(values.getTotalDistinct()).isEqualTo(1);
+      assertDrills(values);
+   }
+
+   /*******************************************************************************
+    ** Computation failures persist a safe FAILED row, with no partial result JSON.
+    *******************************************************************************/
+   @Test
+   void executionFailureAndGuardedBooleans() throws Exception
+   {
+      List<Runnable> jobs = new java.util.ArrayList<>();
+      service = newService(config, jobs::add);
+      String id = service.startExactRun(column("amount"));
+      var table = instance.getTables().remove("orders");
+      jobs.getFirst().run();
+      instance.addTable(table);
+      assertThat(service.getRun(id).getStatus()).isEqualTo("FAILED");
+      assertThat(service.getRun(id).getError()).contains("could not be completed");
+      assertThat(runs().getFirst().getValue("result_json")).isNull();
+      config.withDefaultMinGroupSize(3);
+      service = newService(config, Runnable::run);
+      var paid = service.columnProfile(column("paid"));
+      assertThat(paid.getBooleans()).anySatisfy(m ->
+      {
+         assertThat(m.getKey()).isEqualTo("other");
+         assertThat(m.getDrill()).isNull();
+      });
+      assertDrills(paid);
+      assertThat(service.columnProfile(column("created")).getDates().getGaps()).isEmpty();
+      assertThat(service.duplicates(new DuplicatesRequest().withTableName("orders").withFields(List.of("quantity"))).getGroups())
+         .allMatch(v -> v.getDrill() == null);
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/EngineFixture.java

@@ -0,0 +1,154 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.math.BigDecimal;
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.util.List;
+import com.kingsrook.qbits.dataanalysis.model.DataAnalysisTables;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.instances.QInstanceEnricher;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.DisplayFormat;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValue;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValueSource;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValueSourceType;
+import com.kingsrook.qqq.backend.core.model.metadata.security.FieldSecurityLock;
+import com.kingsrook.qqq.backend.core.model.metadata.security.QSecurityKeyType;
+import com.kingsrook.qqq.backend.core.model.metadata.security.RecordSecurityLock;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.module.rdbms.model.metadata.RDBMSBackendMetaData;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+
+/*******************************************************************************
+ ** Identical fixture built through core actions on all three supported test backends.
+ *******************************************************************************/
+abstract class EngineFixture
+{
+   protected DataAnalysisService service;
+   protected DataAnalysisQBitConfig config;
+   protected QInstance instance;
+   protected Connection connection;
+
+   /*******************************************************************************
+    ** Null selects memory; subclasses supply real database metadata.
+    *******************************************************************************/
+   protected RDBMSBackendMetaData database()
+   {
+      return (null);
+   }
+
+   /*******************************************************************************
+    ** Build metadata and insert rows without direct memory-store injection.
+    *******************************************************************************/
+   @BeforeEach
+   void setup() throws Exception
+   {
+      instance = TestSupport.instance();
+      RDBMSBackendMetaData database = database();
+      String backend = database == null ? "memory" : "database_" + java.util.UUID.randomUUID();
+      if(database != null)
+      {
+         instance.addBackend(database.withName(backend));
+         connection = DriverManager.getConnection(database.getJdbcUrl(), database.getUsername(), database.getPassword());
+         try(var statement = connection.createStatement())
+         {
+            statement.execute("DROP TABLE IF EXISTS orders");
+            statement.execute("DROP TABLE IF EXISTS customer");
+            statement.execute("CREATE TABLE customer (id INTEGER PRIMARY KEY, name VARCHAR(100))");
+            statement.execute("CREATE TABLE orders (id INTEGER PRIMARY KEY, customer INTEGER, status VARCHAR(20), amount DECIMAL(20,4), quantity INTEGER, order_date DATE, created TIMESTAMP, note VARCHAR(100), paid BOOLEAN, modify_date TIMESTAMP, secret VARCHAR(100))");
+         }
+      }
+      instance.addSecurityKeyType(new QSecurityKeyType().withName("customer_scope").withAllAccessKeyName("orders.all"));
+      instance.addSecurityKeyType(new QSecurityKeyType().withName("secret_access"));
+      instance.addTable(new QTableMetaData().withName("customer").withBackendName(backend).withPrimaryKeyField("id")
+         .withPermissionRules(DataAnalysisTables.permissionRules("customer")).withRecordLabelFormatAndFields("%s", "name")
+         .withField(new QFieldMetaData("id", QFieldType.INTEGER)).withField(new QFieldMetaData("name", QFieldType.STRING)));
+      instance.addPossibleValueSource(QPossibleValueSource.newForTable("customer"));
+      instance.addPossibleValueSource(new QPossibleValueSource().withName("statusValues").withType(QPossibleValueSourceType.ENUM)
+         .withEnumValues(List.of(new QPossibleValue<>("NEW", "New order"), new QPossibleValue<>("PAID", "Paid order"))));
+      instance.addTable(new QTableMetaData().withName("orders").withBackendName(backend).withPrimaryKeyField("id")
+         .withPermissionRules(DataAnalysisTables.permissionRules("orders"))
+         .withField(new QFieldMetaData("id", QFieldType.INTEGER)).withField(new QFieldMetaData("customer", QFieldType.INTEGER).withPossibleValueSourceName("customer"))
+         .withField(new QFieldMetaData("status", QFieldType.STRING).withPossibleValueSourceName("statusValues"))
+         .withField(new QFieldMetaData("amount", QFieldType.DECIMAL).withDisplayFormat(DisplayFormat.CURRENCY)).withField(new QFieldMetaData("quantity", QFieldType.INTEGER))
+         .withField(new QFieldMetaData("order_date", QFieldType.DATE)).withField(new QFieldMetaData("created", QFieldType.DATE_TIME))
+         .withField(new QFieldMetaData("note", QFieldType.STRING)).withField(new QFieldMetaData("paid", QFieldType.BOOLEAN))
+         .withField(new QFieldMetaData("modifyDate", QFieldType.DATE_TIME).withBackendName("modify_date"))
+         .withField(new QFieldMetaData("secret", QFieldType.STRING).withFieldSecurityLock(new FieldSecurityLock().withSecurityKeyType("secret_access")
+            .withDefaultBehavior(FieldSecurityLock.Behavior.DENY).withOverrideValues(List.of(true))))
+         .withRecordSecurityLock(new RecordSecurityLock().withFieldName("customer").withSecurityKeyType("customer_scope").withNullValueBehavior(RecordSecurityLock.NullValueBehavior.DENY)));
+      new QInstanceEnricher(instance).enrich();
+      QContext.init(instance, session());
+      TestSupport.insert("customer", new QRecord().withValue("id", 1).withValue("name", "Alice Co"));
+      TestSupport.insert("customer", new QRecord().withValue("id", 2).withValue("name", "Bob Co"));
+      Integer[] amounts = {-10, 0, 10, 10, 20, 20, 30, 40, 50, 1000, null, 0};
+      String[] notes = {null, "", " ", "AA-11", "BB-22", "CC-33", "x", "yy", "z", "", "AB12", "CD34"};
+      for(int i = 0; i < amounts.length; i++)
+      {
+         TestSupport.insert("orders", new QRecord().withValue("id", i + 1).withValue("customer", i < 8 ? 1 : 2)
+            .withValue("status", i % 2 == 0 ? "NEW" : "PAID").withValue("amount", amounts[i] == null ? null : BigDecimal.valueOf(amounts[i]))
+            .withValue("quantity", i / 2 + 1).withValue("order_date", LocalDate.of(2026, 1, i < 4 ? 1 : 3))
+            .withValue("created", Instant.parse(i < 4 ? "2026-01-01T12:00:00Z" : "2026-01-03T18:00:00Z"))
+            .withValue("note", notes[i]).withValue("paid", i == 11 ? null : i % 2 == 0).withValue("modifyDate", Instant.parse("2026-10-13T12:00:00Z")));
+      }
+      config = new DataAnalysisQBitConfig().withBackendName("memory");
+      service = newService(config, Runnable::run);
+   }
+
+   /*******************************************************************************
+    ** Allow the identical contract to exercise both primitive implementations.
+    *******************************************************************************/
+   protected DataAnalysisService newService(DataAnalysisQBitConfig configuration, java.util.concurrent.Executor executor)
+   {
+      return (new DataAnalysisService(configuration, executor));
+   }
+
+   /*******************************************************************************
+    ** Fixture privileges include an explicit record-lock key.
+    *******************************************************************************/
+   protected QSession session()
+   {
+      return (TestSupport.admin().withPermissions("orders.read", "orders.insert", "orders.edit", "orders.analyze", "customer.read", "customer.insert")
+         .withSecurityKeyValue("orders.all", true).withValue(QSession.VALUE_KEY_USER_TIMEZONE, "America/Chicago"));
+   }
+
+   /*******************************************************************************
+    ** Clear context and close SQL connections.
+    *******************************************************************************/
+   @AfterEach
+   void cleanup() throws Exception
+   {
+      QContext.clear();
+      if(connection != null)
+      {
+         connection.close();
+      }
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/FieldAnalysisAccessTest.java

@@ -0,0 +1,244 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.util.List;
+import java.util.concurrent.atomic.AtomicReference;
+import com.kingsrook.qbits.dataanalysis.engine.CoreTierFieldAccessResolver;
+import com.kingsrook.qbits.dataanalysis.engine.DrillFilters;
+import com.kingsrook.qbits.dataanalysis.engine.FieldAnalysisAccess;
+import com.kingsrook.qbits.dataanalysis.engine.FieldAnalysisAccessResolver;
+import com.kingsrook.qbits.dataanalysis.engine.FieldSecurityLockFieldAccessResolver;
+import com.kingsrook.qbits.dataanalysis.result.DistinctValuesRequest;
+import com.kingsrook.qbits.dataanalysis.result.ValueCount;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfile;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfileRequest;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.PivotCell;
+import com.kingsrook.qbits.dataanalysis.result.PivotDimension;
+import com.kingsrook.qbits.dataanalysis.result.PivotMeasure;
+import com.kingsrook.qbits.dataanalysis.result.PivotRequest;
+import com.kingsrook.qbits.dataanalysis.result.PivotResult;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.assertj.core.api.Assertions.within;
+
+/*******************************************************************************
+ ** Exercise reflection without shadowing a future real core package on test classpaths.
+ *******************************************************************************/
+class FieldAnalysisAccessTest extends EngineFixture
+{
+   /*******************************************************************************
+    ** Test helper for field-access behavior.
+    *******************************************************************************/
+   public static class TierApi
+   {
+      static String tier = "FULL";
+      static boolean fail;
+      /*******************************************************************************
+       ** Verify or support the pivot and field-access contract.
+       *******************************************************************************/
+      public static String getTier(QTableMetaData table, String field)
+      {
+         if(fail)
+         {
+            throw new IllegalStateException("unavailable");
+         }
+         return (tier);
+      }
+      /*******************************************************************************
+       ** Verify or support the pivot and field-access contract.
+       *******************************************************************************/
+      public static String getAccessFingerprint()
+      {
+         if(fail)
+         {
+            throw new IllegalStateException("unavailable");
+         }
+         return ("policy-v1");
+      }
+   }
+
+   /*******************************************************************************
+    ** Test helper for field-access behavior.
+    *******************************************************************************/
+   public static class TierOnlyApi
+   {
+      /*******************************************************************************
+       ** Verify or support the pivot and field-access contract.
+       *******************************************************************************/
+      public static String getTier(QTableMetaData table, String field)
+      {
+         return ("FULL");
+      }
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void legacyFallbackAndReflectiveTierMapping() throws Exception
+   {
+      var table = instance.getTable("orders");
+      var fallback = new FieldSecurityLockFieldAccessResolver();
+      assertThat(fallback.resolve(table, table.getField("amount"))).isEqualTo(FieldAnalysisAccess.FULL);
+      assertThat(fallback.resolve(table, table.getField("secret"))).isEqualTo(FieldAnalysisAccess.NONE);
+      // The snapshot has no tier package. Test the actual default selection.
+      assertThat(CoreTierFieldAccessResolver.defaultResolver()).isInstanceOf(FieldSecurityLockFieldAccessResolver.class);
+      var resolver = new CoreTierFieldAccessResolver(TierApi.class);
+      try
+      {
+         for(String tier : List.of("FULL", "REVEALABLE", "MASKED", "HIDDEN", "UNKNOWN"))
+         {
+            TierApi.tier = tier;
+            assertThat(resolver.resolve(table, table.getField("amount"))).isEqualTo(tier.equals("FULL") ? FieldAnalysisAccess.FULL : tier.equals("REVEALABLE") ? FieldAnalysisAccess.EXACT_MATCH_ONLY : FieldAnalysisAccess.NONE);
+         }
+         assertThat(resolver.getAccessFingerprint()).isEqualTo("policy-v1");
+         TierApi.fail = true;
+         assertThat(resolver.resolve(table, table.getField("amount"))).isEqualTo(FieldAnalysisAccess.NONE);
+         assertThatThrownBy(resolver::getAccessFingerprint).isInstanceOf(IllegalStateException.class);
+         assertThat(new CoreTierFieldAccessResolver(TierOnlyApi.class).getAccessFingerprint()).isEmpty();
+      }
+      finally
+      {
+         TierApi.fail = false;
+         TierApi.tier = "FULL";
+      }
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void customPolicyAndUserFilterPassThrough() throws Exception
+   {
+      config.withFieldAnalysisAccessResolver(() -> (table, field) -> field.getName().equals("note") ? FieldAnalysisAccess.NONE
+         : field.getName().equals("paid") ? FieldAnalysisAccess.EXACT_MATCH_ONLY : new FieldSecurityLockFieldAccessResolver().resolve(table, field));
+      service = new DataAnalysisService(config, Runnable::run);
+      assertThat(service.capabilities("orders").getFields()).doesNotContain("note", "paid", "secret");
+      for(String field : List.of("note", "paid"))
+      {
+         assertThatThrownBy(() -> service.columnProfile(new ColumnProfileRequest().withTableName("orders").withFieldName(field)))
+            .isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
+         assertThatThrownBy(() -> service.pivot(new PivotRequest().withTableName("orders").withRows(List.of(new PivotDimension().withField(field)))
+            .withValues(List.of(new PivotMeasure().withOperator(PivotMeasure.Operator.COUNT)))))
+            .isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
+         assertThatThrownBy(() -> service.pivot(new PivotRequest().withTableName("orders").withRows(List.of(new PivotDimension().withField("status")))
+            .withValues(List.of(new PivotMeasure().withOperator(PivotMeasure.Operator.MIN).withField(field)))))
+            .isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
+      }
+      var request = new PivotRequest().withTableName("orders").withRows(List.of(new PivotDimension().withField("status")))
+         .withValues(List.of(new PivotMeasure().withOperator(PivotMeasure.Operator.COUNT)));
+      assertThat(JsonUtils.toJson(service.pivot(request))).doesNotContain("\"fieldName\":\"note\"", "\"fieldName\":\"paid\"");
+      var ownFilter = DrillFilters.condition("paid", QCriteriaOperator.EQUALS, true);
+      String before = JsonUtils.toJson(ownFilter);
+      PivotResult result = service.pivot(request.withFilter(ownFilter));
+      assertThat(JsonUtils.toJson(ownFilter)).isEqualTo(before);
+      assertThat(((Number)result.getGrandTotals().getFirst().getValue()).intValue()).isEqualTo(6);
+      for(PivotCell cell : result.getCells())
+      {
+         var drill = cell.getValues().getFirst().getDrill().getFilter();
+         assertThat(JsonUtils.toJson(drill.getSubFilters().getFirst())).isEqualTo(before);
+         assertThat(JsonUtils.toJson(drill.getSubFilters().get(1))).doesNotContain("paid", "note");
+      }
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void cacheMissesOnFieldTierAndCoreFingerprintChanges() throws Exception
+   {
+      AtomicReference<FieldAnalysisAccess> tier = new AtomicReference<>(FieldAnalysisAccess.FULL);
+      AtomicReference<String> fingerprint = new AtomicReference<>("first");
+      config.withFieldAnalysisAccessResolver(() -> new FieldAnalysisAccessResolver()
+      {
+         /*******************************************************************************
+          ** Verify or support the pivot and field-access contract.
+          *******************************************************************************/
+         @Override
+         public FieldAnalysisAccess resolve(QTableMetaData table, QFieldMetaData field)
+         {
+            return (field.getName().equals("quantity") ? tier.get() : new FieldSecurityLockFieldAccessResolver().resolve(table, field));
+         }
+         /*******************************************************************************
+          ** Verify or support the pivot and field-access contract.
+          *******************************************************************************/
+         @Override
+         public String getAccessFingerprint()
+         {
+            return (fingerprint.get());
+         }
+      });
+      service = new DataAnalysisService(config, Runnable::run);
+      ColumnProfileRequest request = new ColumnProfileRequest().withTableName("orders").withFieldName("amount").withExact(true);
+      String first = service.startExactRun(request);
+      assertThat(service.startExactRun(request)).isEqualTo(first);
+      tier.set(FieldAnalysisAccess.EXACT_MATCH_ONLY);
+      String second = service.startExactRun(request);
+      assertThat(second).isNotEqualTo(first);
+      assertThatThrownBy(() -> service.getRun(first)).isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException.class);
+      fingerprint.set("second");
+      assertThat(service.startExactRun(request)).isNotEqualTo(second);
+   }
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void generatedRepresentativeDrillsCannotUseRestrictedPrimaryKey() throws Exception
+   {
+      config.withFieldAnalysisAccessResolver(() -> (table, field) -> field.getName().equals("id") ? FieldAnalysisAccess.NONE
+         : new FieldSecurityLockFieldAccessResolver().resolve(table, field));
+      service = new DataAnalysisService(config, Runnable::run);
+      ColumnProfile profile = service.columnProfile(new ColumnProfileRequest().withTableName("orders").withFieldName("status").withExact(true));
+      Metric distinct = profile.getCounts().stream().filter(m -> m.getKey().equals("distinct")).findFirst().orElseThrow();
+      assertThat(distinct.getDrill()).isNull();
+      assertThat(profile.getCounts().getFirst().getDrill()).isNotNull();
+      var ownFilter = DrillFilters.condition("id", QCriteriaOperator.EQUALS, 1);
+      profile = service.columnProfile(new ColumnProfileRequest().withTableName("orders").withFieldName("status").withFilter(ownFilter).withExact(true));
+      assertThat(profile.getCounts().getFirst().getDrill()).isNotNull();
+      assertThat(JsonUtils.toJson(profile.getCounts().getFirst().getDrill())).contains("id");
+   }
+   /*******************************************************************************
+    ** Related label tiers must neither leak labels nor reuse a stale cache entry.
+    *******************************************************************************/
+   @Test
+   void relatedLabelTierChangesInvalidateCache() throws Exception
+   {
+      AtomicReference<FieldAnalysisAccess> tier = new AtomicReference<>(FieldAnalysisAccess.FULL);
+      config.withFieldAnalysisAccessResolver(() -> (table, field) -> table.getName().equals("customer") && field.getName().equals("name")
+         ? tier.get() : new FieldSecurityLockFieldAccessResolver().resolve(table, field));
+      service = new DataAnalysisService(config, Runnable::run);
+      ColumnProfileRequest request = new ColumnProfileRequest().withTableName("orders").withFieldName("customer").withExact(true);
+      String first = service.startExactRun(request);
+      assertThat(service.columnProfile(request).getTopValues()).extracting(ValueCount::getLabel).contains("Alice Co");
+      tier.set(FieldAnalysisAccess.NONE);
+      assertThat(service.startExactRun(request)).isNotEqualTo(first);
+      assertThat(service.columnProfile(request).getTopValues()).extracting(ValueCount::getLabel).containsExactly("1", "2");
+      assertThat(service.distinctValues(new DistinctValuesRequest().withTableName("orders").withFieldName("customer")).getValues()).extracting(ValueCount::getLabel).containsExactly("1", "2");
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/H2CompatibilityEngineTest.java

@@ -0,0 +1,39 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import com.kingsrook.qqq.backend.module.rdbms.model.metadata.RDBMSBackendMetaData;
+
+/*******************************************************************************
+ ** Verify native bucket SQL in H2's ordinal-grouping compatibility mode.
+ *******************************************************************************/
+class H2CompatibilityEngineTest extends H2EngineTest
+{
+   /*******************************************************************************
+    ** H2 supports core's GROUP BY positions in PostgreSQL compatibility mode.
+    *******************************************************************************/
+   @Override
+   protected RDBMSBackendMetaData database()
+   {
+      RDBMSBackendMetaData database = super.database();
+      return (database.withJdbcUrl(database.getJdbcUrl() + ";MODE=PostgreSQL"));
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/H2EngineTest.java

@@ -0,0 +1,40 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.util.UUID;
+import com.kingsrook.qqq.backend.module.rdbms.model.metadata.RDBMSBackendMetaData;
+
+/*******************************************************************************
+ ** H2 executes the identical fixture through the RDBMS module.
+ *******************************************************************************/
+class H2EngineTest extends EngineContractTest
+{
+   /*******************************************************************************
+    ** An isolated database for each test.
+    *******************************************************************************/
+   @Override
+   protected RDBMSBackendMetaData database()
+   {
+      return (new RDBMSBackendMetaData().withVendor("h2").withUsername("sa").withPassword("")
+         .withJdbcUrl("jdbc:h2:mem:analysis_" + UUID.randomUUID() + ";DB_CLOSE_DELAY=-1;DATABASE_TO_UPPER=FALSE"));
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/H2SamplingTest.java

@@ -0,0 +1,82 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.util.List;
+import com.kingsrook.qbits.dataanalysis.engine.DrillFilters;
+import com.kingsrook.qbits.dataanalysis.engine.StandInAnalysisBackend;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfileRequest;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.module.rdbms.model.metadata.RDBMSBackendMetaData;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.within;
+
+/*******************************************************************************
+ ** RAND samples fluctuate around population counts without changing drill scope.
+ *******************************************************************************/
+class H2SamplingTest extends EngineFixture
+{
+   /*******************************************************************************
+    ** Ordinal grouping is supported by H2's PostgreSQL compatibility mode.
+    *******************************************************************************/
+   @Override
+   protected RDBMSBackendMetaData database()
+   {
+      return (new RDBMSBackendMetaData().withVendor("h2").withUsername("sa").withPassword("")
+         .withJdbcUrl("jdbc:h2:mem:sampling_" + java.util.UUID.randomUUID() + ";DB_CLOSE_DELAY=-1;DATABASE_TO_UPPER=FALSE;MODE=PostgreSQL"));
+   }
+
+   /*******************************************************************************
+    ** A large sample gives stable tolerances and includes filtered-out records.
+    *******************************************************************************/
+   @Test
+   void randomCountsAndHistograms() throws Exception
+   {
+      try(var statement = connection.createStatement())
+      {
+         statement.execute("INSERT INTO orders (id, customer, amount) SELECT x, 1, CASE WHEN MOD(x, 4) = 0 THEN NULL ELSE MOD(x, 10) END FROM SYSTEM_RANGE(1001, 11000) AS source(x)");
+      }
+      config.withDefaultSampleThresholdRows(100).withDefaultSampleRows(2000);
+      service.getConfigResolver().invalidate();
+      var filter = DrillFilters.condition("id", QCriteriaOperator.GREATER_THAN, 1000);
+      var profile = service.columnProfile(new ColumnProfileRequest().withTableName("orders").withFieldName("amount").withFilter(filter));
+      assertThat(profile.getEstimate()).isTrue();
+      var metrics = profile.getCounts().stream().collect(java.util.stream.Collectors.toMap(m -> m.getKey(), m -> m));
+      assertThat(metrics.get("rows").getValue()).isEqualTo(10000L);
+      assertThat(metrics.get("rows").getEstimate()).isFalse();
+      assertThat(((Number) metrics.get("nulls").getValue()).longValue()).isCloseTo(2500L, within(500L));
+      assertThat(((Number) metrics.get("nonNull").getValue()).longValue()).isCloseTo(7500L, within(500L));
+      assertThat(metrics.get("nonNull").getFormatted()).startsWith("≈ ");
+      assertThat(profile.getNumeric().getHistogram().stream().mapToLong(v -> v.getCount()).sum()).isCloseTo(7500L, within(700L));
+      var exact = new StandInAnalysisBackend(service.getConfigResolver().resolve("orders"));
+      assertThat(exact.count("orders", metrics.get("rows").getDrill().getFilter())).isEqualTo(10000);
+      for(var value : profile.getTopValues())
+      {
+         long population = exact.count("orders", value.getDrill().getFilter());
+         assertThat(value.getCount()).isCloseTo(population, within(500L));
+      }
+      assertThat(com.kingsrook.qqq.backend.core.utils.JsonUtils.toJson(profile)).doesNotContain("\"operator\":\"IN\"");
+      var table = service.tableProfile(new com.kingsrook.qbits.dataanalysis.result.TableProfileRequest().withTableName("orders").withFilter(filter).withFields(List.of("amount")));
+      assertThat(table.getRowCount().getValue()).isEqualTo(10000L);
+      assertThat(table.getEstimate()).isTrue();
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/H2StreamedEngineTest.java

@@ -0,0 +1,48 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.util.concurrent.Executor;
+import com.kingsrook.qbits.dataanalysis.engine.AnalysisBackend;
+import com.kingsrook.qbits.dataanalysis.engine.StandInAnalysisBackend;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+
+/*******************************************************************************
+ ** Run every engine contract assertion with the portable streamed implementation.
+ *******************************************************************************/
+class H2StreamedEngineTest extends H2EngineTest
+{
+   /*******************************************************************************
+    ** Change only the backend under test, preserving the entire shared contract.
+    *******************************************************************************/
+   @Override
+   protected DataAnalysisService newService(DataAnalysisQBitConfig configuration, Executor executor)
+   {
+      return (new DataAnalysisService(configuration, executor)
+      {
+         @Override
+         public AnalysisBackend backend(String table) throws QException
+         {
+            return (new StandInAnalysisBackend(getConfigResolver().resolve(table)));
+         }
+      });
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/MemoryEngineTest.java

@@ -0,0 +1,28 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+/*******************************************************************************
+ ** Memory reference implementation of the shared engine contract.
+ *******************************************************************************/
+class MemoryEngineTest extends EngineContractTest
+{
+}

src/test/java/com/kingsrook/qbits/dataanalysis/OptionalMiddlewareTest.java

@@ -0,0 +1,77 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.nio.file.Path;
+import java.util.Arrays;
+import java.util.concurrent.TimeUnit;
+import java.util.stream.Collectors;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+
+/*******************************************************************************
+ ** A separate JVM proves the optional middleware is not needed by the engine.
+ *******************************************************************************/
+class OptionalMiddlewareTest
+{
+   /*******************************************************************************
+    ** Remove Javalin and middleware artifacts from the actual test classpath.
+    *******************************************************************************/
+   @Test
+   void engineWithoutMiddleware() throws Exception
+   {
+      String classpath = Arrays.stream(System.getProperty("surefire.test.class.path", System.getProperty("java.class.path")).split(java.io.File.pathSeparator))
+         .filter(entry -> !entry.contains("qqq-middleware-javalin") && !Path.of(entry).getFileName().toString().startsWith("javalin-"))
+         .collect(Collectors.joining(java.io.File.pathSeparator));
+      Path log = Path.of("target", "core-only-smoke.log");
+      Process process = new ProcessBuilder(Path.of(System.getProperty("java.home"), "bin", "java").toString(), "-cp", classpath, CoreOnlySmoke.class.getName())
+         .redirectErrorStream(true).redirectOutput(log.toFile()).start();
+      try
+      {
+         assertThat(process.waitFor(30, TimeUnit.SECONDS)).as("Core-only JVM timed out").isTrue();
+         assertThat(process.exitValue()).as(java.nio.file.Files.readString(log)).isZero();
+      }
+      finally
+      {
+         if(process.isAlive())
+         {
+            process.destroyForcibly();
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Entry point in the classpath with middleware removed.
+    *******************************************************************************/
+   public static class CoreOnlySmoke
+   {
+      /*******************************************************************************
+       ** Metadata and runtime must initialize without loading any API classes.
+       *******************************************************************************/
+      public static void main(String[] args) throws Exception
+      {
+         var instance = TestSupport.instance();
+         assertThat(instance.getSupplementalMetaData("dataAnalysisRuntime")).isNotNull();
+         assertThat(instance.getSupplementalMetaData("middlewareSpecExtensions")).isNull();
+         assertThat(instance.getTable("data_analysis_run")).isNotNull();
+      }
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/PivotContractTest.java

@@ -0,0 +1,350 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.math.BigDecimal;
+import java.util.List;
+import java.util.ArrayList;
+import com.kingsrook.qbits.dataanalysis.result.Drill;
+import com.kingsrook.qbits.dataanalysis.result.Metric;
+import com.kingsrook.qbits.dataanalysis.result.PivotCell;
+import com.kingsrook.qbits.dataanalysis.result.PivotDimension;
+import com.kingsrook.qbits.dataanalysis.result.PivotHeader;
+import com.kingsrook.qbits.dataanalysis.result.PivotMeasure;
+import com.kingsrook.qbits.dataanalysis.result.PivotNumericBins;
+import com.kingsrook.qbits.dataanalysis.result.PivotRequest;
+import com.kingsrook.qbits.dataanalysis.result.PivotResult;
+import com.kingsrook.qbits.dataanalysis.result.ValueType;
+import com.kingsrook.qbits.dataanalysis.engine.DrillFilters;
+import com.kingsrook.qqq.backend.core.actions.permissions.PermissionEnforcement;
+import com.kingsrook.qqq.backend.core.actions.tables.CountAction;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.aggregate.DateBucketUnit;
+import com.kingsrook.qqq.backend.core.model.metadata.joins.QJoinMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.joins.JoinOn;
+import com.kingsrook.qqq.backend.core.model.metadata.joins.JoinType;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.ExposedJoin;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.assertj.core.api.Assertions.within;
+
+/*******************************************************************************
+ ** Pivot contract inherited by every existing backend test configuration.
+ *******************************************************************************/
+abstract class PivotContractTest extends EngineFixture
+{
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   protected PivotDimension dimension(String field)
+   {
+      return (new PivotDimension().withField(field));
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   protected PivotMeasure measure(PivotMeasure.Operator operator, String field)
+   {
+      return (new PivotMeasure().withOperator(operator).withField(field));
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   protected PivotRequest pivot(List<String> rows, List<String> columns)
+   {
+      return (new PivotRequest().withTableName("orders").withRows(rows.stream().map(this::dimension).toList())
+         .withColumns(columns.stream().map(this::dimension).toList()).withValues(List.of(measure(PivotMeasure.Operator.COUNT, null))));
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   private void equalNumber(Metric metric, String value)
+   {
+      assertThat(new BigDecimal(metric.getValue().toString())).isEqualByComparingTo(value);
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   protected void countDrills(PivotResult result) throws Exception
+   {
+      List<List<Metric>> groups = new ArrayList<>(result.getRowTotals());
+      groups.addAll(result.getColumnTotals());
+      groups.add(result.getGrandTotals());
+      result.getCells().forEach(c -> groups.add(c.getValues()));
+      for(List<Metric> metrics : groups)
+      {
+         for(Metric metric : metrics)
+         {
+            if(metric.getKey().equals("value0") && !metric.getSuppressed())
+            {
+               assertThat(metric.getDrill()).isNotNull();
+               Drill drill = JsonUtils.toObject(JsonUtils.toJson(metric.getDrill()), Drill.class);
+               CountInput input = new CountInput(drill.getTableName()).withFilter(drill.getFilter());
+               input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+               assertThat(new CountAction().execute(input).getCount()).as(JsonUtils.toJson(drill)).isEqualTo(((Number) metric.getValue()).intValue());
+               QueryInput query = new QueryInput(drill.getTableName()).withFilter(drill.getFilter());
+               query.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+               assertThat(new QueryAction().execute(query).getRecords()).as(JsonUtils.toJson(drill)).hasSize(((Number) metric.getValue()).intValue());
+            }
+         }
+      }
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void pivotShapesAndTotals() throws Exception
+   {
+      for(PivotRequest request : List.of(pivot(List.of("status"), List.of("customer")), pivot(List.of("status", "paid"), List.of("customer")),
+         pivot(List.of("status"), List.of("customer", "paid"))))
+      {
+         PivotResult result = service.pivot(request);
+         equalNumber(result.getGrandTotals().getFirst(), "12");
+         assertThat(result.getCells().stream().mapToLong(c -> ((Number)c.getValues().getFirst().getValue()).longValue()).sum()).isEqualTo(12);
+         countDrills(result);
+      }
+      PivotResult result = service.pivot(pivot(List.of("status"), List.of("customer")));
+      assertThat(result.getCells()).hasSize(4);
+      assertThat(result.getCells()).allSatisfy(c -> assertThat(((Number)c.getValues().getFirst().getValue()).longValue()).isIn(2L, 4L));
+      assertThat(result.getRowTotals()).allSatisfy(m -> equalNumber(m.getFirst(), "6"));
+      result = service.pivot(pivot(List.of("status"), List.of()).withShowTotals(false));
+      assertThat(result.getGrandTotals()).isEmpty();
+      assertThat(result.getRowTotals()).isEmpty();
+      assertThat(result.getColumnHeaders()).containsExactly(List.of());
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void pivotOtherAndNonAdditiveMeasures() throws Exception
+   {
+      PivotRequest request = pivot(List.of("quantity"), List.of("status")).withLimitGroups(1).withValues(List.of(
+         measure(PivotMeasure.Operator.COUNT, null), measure(PivotMeasure.Operator.SUM, "amount"), measure(PivotMeasure.Operator.AVG, "amount"),
+         measure(PivotMeasure.Operator.COUNT_DISTINCT, "amount"), measure(PivotMeasure.Operator.PERCENTILE, "amount").withPercentile(new BigDecimal("0.5"))));
+      PivotResult result = service.pivot(request);
+      assertThat(result.getTruncatedRows()).isTrue();
+      assertThat(result.getTruncatedColumns()).isTrue();
+      assertThat(result.getRowHeaders().stream().flatMap(List::stream).map(PivotHeader::getLabel)).anyMatch(l -> l.equals("Other (5 groups)"));
+      equalNumber(result.getGrandTotals().get(1), "1170");
+      equalNumber(result.getGrandTotals().get(3), "8");
+      equalNumber(result.getGrandTotals().get(4), "20");
+      countDrills(result);
+      for(PivotCell cell : result.getCells())
+      {
+         var input = new com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput("orders").withFilter(cell.getValues().getFirst().getDrill().getFilter());
+         input.setPermissionEnforcement(PermissionEnforcement.ENFORCE);
+         var numbers = new com.kingsrook.qqq.backend.core.actions.tables.QueryAction().execute(input).getRecords().stream().map(r -> r.getValueBigDecimal("amount"))
+            .filter(java.util.Objects::nonNull).sorted().toList();
+         BigDecimal sum = numbers.stream().reduce(BigDecimal.ZERO, BigDecimal::add);
+         equalNumber(cell.getValues().get(1), sum.toString());
+         assertThat(new BigDecimal(cell.getValues().get(2).getValue().toString()).doubleValue()).isCloseTo(sum.doubleValue() / numbers.size(), within(0.000000001));
+         equalNumber(cell.getValues().get(3), Long.toString(numbers.stream().map(BigDecimal::stripTrailingZeros).distinct().count()));
+         BigDecimal median = numbers.size() % 2 == 1 ? numbers.get(numbers.size() / 2) : numbers.get(numbers.size() / 2 - 1).add(numbers.get(numbers.size() / 2)).divide(BigDecimal.valueOf(2));
+         equalNumber(cell.getValues().get(4), median.toString());
+      }
+      for(String field : List.of("paid", "note", "amount"))
+      {
+         countDrills(service.pivot(pivot(List.of(field), List.of()).withLimitGroups(1)));
+      }
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void pivotBuckets() throws Exception
+   {
+      for(DateBucketUnit unit : DateBucketUnit.values())
+      {
+         PivotRequest request = pivot(List.of("created"), List.of("status")).withRows(List.of(dimension("created").withDateBucket(unit)));
+         PivotResult result = service.pivot(request);
+         equalNumber(result.getGrandTotals().getFirst(), "12");
+         countDrills(result);
+      }
+      PivotResult dates = service.pivot(pivot(List.of("order_date"), List.of("status")).withRows(List.of(dimension("order_date").withDateBucket(DateBucketUnit.DAY))));
+      assertThat(dates.getCells()).hasSize(4);
+      countDrills(dates);
+      for(PivotNumericBins bins : List.of(new PivotNumericBins().withCount(4).withMin(BigDecimal.ZERO).withMax(BigDecimal.valueOf(40)), new PivotNumericBins().withCount(10)))
+      {
+         countDrills(service.pivot(pivot(List.of("amount"), List.of("status")).withRows(List.of(dimension("amount").withNumericBins(bins)))));
+      }
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void pivotPrivacyAndUserFilter() throws Exception
+   {
+      config.withDefaultMinGroupSize(3);
+      service.getConfigResolver().invalidate();
+      PivotResult result = service.pivot(pivot(List.of("status"), List.of("customer")).withValues(List.of(measure(PivotMeasure.Operator.COUNT, null), measure(PivotMeasure.Operator.SUM, "amount"))));
+      assertThat(result.getCells().stream().filter(c -> c.getValues().getFirst().getSuppressed())).hasSize(2);
+      result.getCells().stream().filter(c -> c.getValues().getFirst().getSuppressed()).forEach(c -> assertThat(c.getValues()).allSatisfy(m ->
+      {
+         assertThat(m.getValue()).isNull();
+         assertThat(m.getDrill()).isNull();
+      }));
+      assertThat(service.pivot(pivot(List.of("quantity"), List.of())).getRowHeaders()).isEmpty();
+      config.withDefaultMinGroupSize(0);
+      service.getConfigResolver().invalidate();
+      var filter = DrillFilters.condition("customer", QCriteriaOperator.EQUALS, 1);
+      String before = JsonUtils.toJson(filter);
+      result = service.pivot(pivot(List.of("status"), List.of()).withFilter(filter));
+      equalNumber(result.getGrandTotals().getFirst(), "8");
+      assertThat(JsonUtils.toJson(filter)).isEqualTo(before);
+      countDrills(result);
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void pivotJoinedDimensionAndPermissions() throws Exception
+   {
+      instance.addJoin(new QJoinMetaData().withName("ordersCustomer").withLeftTable("orders").withRightTable("customer")
+         .withType(JoinType.MANY_TO_ONE).withJoinOn(new JoinOn("customer", "id")));
+      instance.getTable("orders").withExposedJoin(new ExposedJoin().withJoinTable("customer").withJoinPath(List.of("ordersCustomer")));
+      PivotResult result = service.pivot(pivot(List.of("customer.name"), List.of("status")));
+      assertThat(result.getRowHeaders().stream().flatMap(List::stream).map(PivotHeader::getValue)).containsExactlyInAnyOrder("Alice Co", "Bob Co");
+      equalNumber(result.getGrandTotals().getFirst(), "12");
+      assertThat(result.getWarnings()).isEmpty();
+      assertThat(result.getCells()).allSatisfy(c -> assertThat(JsonUtils.toJson(c.getValues().getFirst().getDrill())).contains("customer.name"));
+      countDrills(result);
+      countDrills(service.pivot(pivot(List.of("customer.name"), List.of("status")).withLimitGroups(1)
+         .withFilter(DrillFilters.condition("paid", QCriteriaOperator.EQUALS, true))));
+      instance.getJoins().put("ordersCustomer", instance.getJoin("ordersCustomer").flip());
+      countDrills(service.pivot(pivot(List.of("customer.name"), List.of("status"))));
+      QContext.getQSession().getPermissions().remove("customer.read");
+      assertThatThrownBy(() -> service.pivot(pivot(List.of("customer.name"), List.of()))).isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
+   }
+
+   /*******************************************************************************
+    ** Reversing a many-to-one join multiplies records and disables every drill.
+    *******************************************************************************/
+   @Test
+   void pivotToManyDimension() throws Exception
+   {
+      instance.addJoin(new QJoinMetaData().withName("ordersCustomer").withLeftTable("orders").withRightTable("customer")
+         .withType(JoinType.MANY_TO_ONE).withJoinOn(new JoinOn("customer", "id")));
+      instance.getTable("customer").withExposedJoin(new ExposedJoin().withJoinTable("orders").withJoinPath(List.of("ordersCustomer")));
+      QContext.getQSession().getPermissions().add("customer.analyze");
+      for(int direction = 0; direction < 2; direction++)
+      {
+         PivotResult result = service.pivot(pivot(List.of("orders.status"), List.of()).withTableName("customer"));
+         equalNumber(result.getGrandTotals().getFirst(), "12");
+         assertThat(result.getWarnings()).containsExactly("Counts include one row per related " + instance.getTable("orders").getLabel()
+            + "; drill-through is not available for this dimension.");
+         assertThat(result.getCells()).allSatisfy(c -> assertThat(c.getValues()).allSatisfy(m -> assertThat(m.getDrill()).isNull()));
+         assertThat(result.getRowTotals()).allSatisfy(metrics -> assertThat(metrics).allSatisfy(m -> assertThat(m.getDrill()).isNull()));
+         assertThat(result.getColumnTotals()).allSatisfy(metrics -> assertThat(metrics).allSatisfy(m -> assertThat(m.getDrill()).isNull()));
+         assertThat(result.getGrandTotals()).allSatisfy(m -> assertThat(m.getDrill()).isNull());
+         instance.getJoins().put("ordersCustomer", instance.getJoin("ordersCustomer").flip());
+      }
+   }
+
+   /*******************************************************************************
+    ** Every hop must be to-one, including hops preceding a one-to-one target.
+    *******************************************************************************/
+   @Test
+   void pivotMultiHopDimension() throws Exception
+   {
+      instance.addTable(new com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData().withName("region").withLabel("Region")
+         .withBackendName(instance.getTable("customer").getBackendName()).withPrimaryKeyField("id")
+         .withField(new com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData("id", com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType.INTEGER))
+         .withField(new com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData("name", com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType.STRING)));
+      if(connection != null)
+      {
+         try(var statement = connection.createStatement())
+         {
+            statement.execute("DROP TABLE IF EXISTS region");
+            statement.execute("CREATE TABLE region (id INTEGER PRIMARY KEY, name VARCHAR(100))");
+         }
+      }
+      new com.kingsrook.qqq.backend.core.instances.QInstanceEnricher(instance).enrich();
+      TestSupport.insert("region", new com.kingsrook.qqq.backend.core.model.data.QRecord().withValue("id", 1).withValue("name", "East"));
+      TestSupport.insert("region", new com.kingsrook.qqq.backend.core.model.data.QRecord().withValue("id", 2).withValue("name", "West"));
+      instance.addJoin(new QJoinMetaData().withName("ordersCustomer").withLeftTable("orders").withRightTable("customer")
+         .withType(JoinType.MANY_TO_ONE).withJoinOn(new JoinOn("customer", "id")));
+      instance.addJoin(new QJoinMetaData().withName("customerRegion").withLeftTable("region").withRightTable("customer")
+         .withType(JoinType.ONE_TO_ONE).withJoinOn(new JoinOn("id", "id")));
+      instance.getTable("orders").withExposedJoin(new ExposedJoin().withJoinTable("region").withJoinPath(List.of("ordersCustomer", "customerRegion")));
+      PivotResult result = service.pivot(pivot(List.of("region.name"), List.of("status")));
+      assertThat(result.getWarnings()).containsExactly("Drill-through is not available for fields reached through more than one join (Region).");
+      assertThat(result.getCells()).allSatisfy(c -> assertThat(c.getValues().getFirst().getDrill()).isNull());
+      instance.getJoin("ordersCustomer").withType(JoinType.MANY_TO_MANY);
+      result = service.pivot(pivot(List.of("region.name"), List.of("status")));
+      assertThat(result.getWarnings()).containsExactly("Counts include one row per related Region; drill-through is not available for this dimension.");
+      assertThat(result.getCells()).allSatisfy(c -> assertThat(c.getValues().getFirst().getDrill()).isNull());
+   }
+
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void pivotValidation() throws Exception
+   {
+      for(String field : List.of("secret", "missing", "missing.field"))
+      {
+         assertThatThrownBy(() -> service.pivot(pivot(List.of(field), List.of()))).isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
+         assertThatThrownBy(() -> service.pivot(pivot(List.of("status"), List.of()).withValues(List.of(measure(PivotMeasure.Operator.MIN, field)))))
+            .isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
+      }
+      for(PivotRequest bad : List.of(pivot(List.of(), List.of()), pivot(List.of("status"), List.of()).withLimitGroups(201),
+         pivot(List.of("status"), List.of("status")), pivot(List.of("status"), List.of()).withRows(List.of(dimension("status").withDateBucket(DateBucketUnit.YEAR))),
+         pivot(List.of("status"), List.of()).withValues(List.of(measure(PivotMeasure.Operator.PERCENTILE, "amount").withPercentile(BigDecimal.TEN)))))
+      {
+         assertThatThrownBy(() -> service.pivot(bad)).isInstanceOf(com.kingsrook.qqq.backend.core.exceptions.QBadRequestException.class);
+      }
+   }
+   /*******************************************************************************
+    ** Verify or support the pivot and field-access contract.
+    *******************************************************************************/
+   @Test
+   void pivotTypedExtremesAndEmptyScope() throws Exception
+   {
+      PivotResult result = service.pivot(pivot(List.of("status"), List.of()).withValues(List.of(measure(PivotMeasure.Operator.COUNT, "amount"),
+         measure(PivotMeasure.Operator.MIN, "order_date"), measure(PivotMeasure.Operator.MAX, "created"), measure(PivotMeasure.Operator.MIN, "amount"),
+         measure(PivotMeasure.Operator.MAX, "amount"))));
+      equalNumber(result.getGrandTotals().getFirst(), "12");
+      equalNumber(result.getGrandTotals().get(3), "-10");
+      equalNumber(result.getGrandTotals().get(4), "1000");
+      assertThat(result.getGrandTotals().get(1).getValueType()).isEqualTo(ValueType.DATE);
+      assertThat(result.getGrandTotals().get(2).getValueType()).isEqualTo(ValueType.DATE_TIME);
+      countDrills(result);
+      result = service.pivot(pivot(List.of("status"), List.of()).withFilter(DrillFilters.condition("id", QCriteriaOperator.EQUALS, -1)));
+      assertThat(result.getCells()).isEmpty();
+      equalNumber(result.getGrandTotals().getFirst(), "0");
+      countDrills(result);
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/PostgresEngineTest.java

@@ -0,0 +1,96 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import com.kingsrook.qqq.backend.module.postgres.model.metadata.PostgreSQLBackendMetaData;
+import com.kingsrook.qqq.backend.module.rdbms.model.metadata.RDBMSBackendMetaData;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Assumptions;
+import org.testcontainers.DockerClientFactory;
+import org.testcontainers.postgresql.PostgreSQLContainer;
+
+/*******************************************************************************
+ ** Actual PostgreSQL tests; skip cleanly if Docker is unavailable.
+ *******************************************************************************/
+class PostgresEngineTest extends EngineContractTest
+{
+   private static PostgreSQLContainer postgres;
+
+   /*******************************************************************************
+    ** Never substitute another database for the PostgreSQL contract.
+    *******************************************************************************/
+   @BeforeAll
+   static void start()
+   {
+      if(DockerClientFactory.instance().isDockerAvailable())
+      {
+         postgres = new PostgreSQLContainer("postgres:17-alpine");
+         postgres.start();
+      }
+   }
+
+   /*******************************************************************************
+    ** Release the test container.
+    *******************************************************************************/
+   @AfterAll
+   static void stop()
+   {
+      if(postgres != null)
+      {
+         postgres.stop();
+      }
+   }
+
+   /*******************************************************************************
+    ** Large populations never become one bind per sampled primary key.
+    *******************************************************************************/
+   @org.junit.jupiter.api.Test
+   void largeEstimate() throws Exception
+   {
+      try(var statement = connection.createStatement())
+      {
+         statement.execute("TRUNCATE TABLE orders");
+         statement.execute("INSERT INTO orders (id, customer, paid) SELECT id, 1, id % 2 = 0 FROM generate_series(1, 50000) AS id");
+      }
+      config.withDefaultSampleThresholdRows(100).withDefaultSampleRows(1000);
+      service.getConfigResolver().invalidate();
+      var profile = service.columnProfile(new com.kingsrook.qbits.dataanalysis.result.ColumnProfileRequest().withTableName("orders").withFieldName("paid"));
+      org.assertj.core.api.Assertions.assertThat(profile.getEstimate()).isTrue();
+      assertMetric(profile.getCounts(), "rows", "50000");
+      org.assertj.core.api.Assertions.assertThat(com.kingsrook.qqq.backend.core.utils.JsonUtils.toJson(profile)).doesNotContain("\"operator\":\"IN\"");
+      // Also exceed the old parameter ceiling with the requested sample itself.
+      config.withDefaultSampleRows(40000);
+      service.getConfigResolver().invalidate();
+      assertMetric(service.columnProfile(new com.kingsrook.qbits.dataanalysis.result.ColumnProfileRequest().withTableName("orders").withFieldName("paid")).getCounts(), "rows", "50000");
+   }
+
+   /*******************************************************************************
+    ** Credentials belong only to the ephemeral test container.
+    *******************************************************************************/
+   @Override
+   protected RDBMSBackendMetaData database()
+   {
+      Assumptions.assumeTrue(postgres != null, "Docker unavailable; PostgreSQL contract skipped");
+      return (new PostgreSQLBackendMetaData().withJdbcUrl(postgres.getJdbcUrl())
+         .withUsername(postgres.getUsername()).withPassword(postgres.getPassword()));
+   }
+}

src/test/java/com/kingsrook/qbits/dataanalysis/PresentationSamplingTest.java

@@ -0,0 +1,115 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.dataanalysis;
+
+import java.time.Instant;
+import java.time.ZoneId;
+import java.util.ArrayList;
+import java.util.List;
+import com.kingsrook.qbits.dataanalysis.engine.AnalysisBackend;
+import com.kingsrook.qbits.dataanalysis.engine.DrillFilters;
+import com.kingsrook.qbits.dataanalysis.result.ColumnProfileRequest;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+
+/*******************************************************************************
+ ** Real rows prove warning boundaries and date coordinates without Docker.
+ *******************************************************************************/
+class PresentationSamplingTest extends EngineFixture
+{
+   /*******************************************************************************
+    ** Null prefixes do not consume the budget; warn only after 10,000 values.
+    *******************************************************************************/
+   @Test
+   void patternWarningOnlyWhenTruncated() throws Exception
+   {
+      List<QRecord> records = new ArrayList<>();
+      for(int i = 100; i <= 10101; i++)
+      {
+         records.add(new QRecord().withValue("id", i).withValue("customer", 1).withValue("note", i == 100 ? null : "AA-11"));
+      }
+      assertThat(new InsertAction().execute(new InsertInput("orders").withRecords(records)).getRecords()).allSatisfy(r -> assertThat(r.getErrors()).isNullOrEmpty());
+      var filter = DrillFilters.condition("id", QCriteriaOperator.GREATER_THAN_OR_EQUALS, 100);
+      var request = new ColumnProfileRequest().withTableName("orders").withFieldName("note").withFilter(filter).withExact(true);
+      var truncated = service.columnProfile(request);
+      assertThat(truncated.getText().getSampleRows()).isEqualTo(10000);
+      assertThat(truncated.getWarnings()).containsExactly("Patterns are based on the first 10,000 values.");
+      request.withFilter(DrillFilters.and(filter, DrillFilters.condition("id", QCriteriaOperator.LESS_THAN_OR_EQUALS, 10100)));
+      var all = service.columnProfile(request);
+      assertThat(all.getText().getSampleRows()).isEqualTo(10000);
+      assertThat(all.getWarnings()).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** Empty samples are not empty populations; full scans are not estimates.
+    *******************************************************************************/
+   @Test
+   void warningsDescribeObservedScope() throws Exception
+   {
+      config.withDefaultSampleThresholdRows(1).withDefaultSampleRows(100);
+      var request = new ColumnProfileRequest().withTableName("orders").withFieldName("note");
+      var complete = service.columnProfile(request);
+      assertThat(complete.getEstimate()).isFalse();
+      assertThat(complete.getWarnings()).isEmpty();
+      config.withDefaultSampleRows(0);
+      service.getConfigResolver().invalidate();
+      var emptySample = service.columnProfile(request);
+      assertThat(emptySample.getWarnings()).contains("No sample rows were observed; run exact for exact numbers.")
+         .doesNotContain("No readable records match this analysis scope.", "All values in this analysis scope are null.");
+      var empty = service.columnProfile(request.withExact(true).withFilter(DrillFilters.condition("id", QCriteriaOperator.EQUALS, -1)));
+      assertThat(empty.getWarnings()).containsExactly("No readable records match this analysis scope.");
+      var nulls = service.columnProfile(request.withFilter(DrillFilters.condition("id", QCriteriaOperator.EQUALS, 1)));
+      assertThat(nulls.getWarnings()).containsExactly("All values in this analysis scope are null.");
+   }
+
+
+
+   /*******************************************************************************
+    ** Hour buckets cross DST in real elapsed hours and preserve ISO instants.
+    *******************************************************************************/
+   @Test
+   void hourlyBucketCoordinatesAndLabels() throws Exception
+   {
+      var backend = service.backend("orders");
+      ZoneId zone = ZoneId.of("America/Chicago");
+      var buckets = backend.dateBuckets("orders", null, "created", AnalysisBackend.DateUnit.HOUR, zone);
+      assertThat(buckets.getFirst().value()).isEqualTo(Instant.parse("2026-01-01T12:00:00Z"));
+      assertThat(buckets.getFirst().label()).isEqualTo("2026-01-01 06:00");
+      assertThat(buckets.stream().mapToLong(AnalysisBackend.GroupCount::count).sum()).isEqualTo(12);
+      for(var bucket : buckets)
+      {
+         assertThat(backend.count("orders", bucket.condition())).isEqualTo(bucket.count());
+      }
+      TestSupport.insert("orders", new QRecord().withValue("id", 20).withValue("customer", 1).withValue("created", Instant.parse("2026-11-01T06:30:00Z")));
+      TestSupport.insert("orders", new QRecord().withValue("id", 21).withValue("customer", 1).withValue("created", Instant.parse("2026-11-01T07:30:00Z")));
+      var filter = DrillFilters.condition("id", QCriteriaOperator.GREATER_THAN_OR_EQUALS, 20);
+      var dst = backend.dateBuckets("orders", filter, "created", AnalysisBackend.DateUnit.HOUR, zone);
+      assertThat(dst).hasSize(2).allSatisfy(b -> assertThat(b.label()).isEqualTo("2026-11-01 01:00"));
+      assertThat(dst).extracting(AnalysisBackend.GroupCount::value).doesNotHaveDuplicates();
+      assertThat(dst).allSatisfy(b -> assertThat(b.count()).isEqualTo(1));
+   }
+}